fix: update compose submodule — remove stale COPY for deleted script

fix: update compose submodule — use native s6 multi-profile supervision
Updates the compose submodule to commit 3f82c9d on branch fix/hermes-entrypoint-simple, which drops all custom entrypoint scripts and uses the image's native s6-overlay profile supervision. The five profiles (ashley, claire, finn, matt, paul) auto-start on boot via the s6 reconciler reading their gateway_state.json.
2026-07-07 22:29:51 -04:00 · 2026-07-07 22:26:18 -04:00 · 2026-07-08 02:09:38 +00:00 · 2026-07-07 22:08:46 -04:00 · 2026-07-08 02:06:42 +00:00 · 2026-07-07 20:53:28 -04:00
17 changed files with 504 additions and 444 deletions
--- a/assets/compose
+++ b/assets/compose
--- a/assets/ollama/Dockerfile
+++ b/assets/ollama/Dockerfile
@@ -1,106 +0,0 @@
-# ollama-gfx906/Dockerfile
-#
-# Custom ollama image with ROCm 6.1 + gfx906 (MI50) support.
-# The official ollama/rocm image ships ROCm 7.2 which dropped gfx906.
-# This uses v0.23.2's native CMake build system with AMDGPU_TARGETS including gfx906.
-#
-# Build: docker build -t ollama/ollama:rocm-gfx906 ai/ollama
-
-FROM rocm/dev-ubuntu-22.04:6.1.2-complete AS builder
-
-# Build dependencies (CMake, Ninja, Go)
-ARG CMAKEVERSION=3.31.2
-ARG NINJAVERSION=1.12.1
-ARG GOLANG_VERSION=1.22.0
-
-RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
-    curl git ccache build-essential pkg-config unzip \
-    && rm -rf /var/lib/apt/lists/*
-
-# Install CMake from official binaries
-RUN curl -fsSL https://github.com/Kitware/CMake/releases/download/v${CMAKEVERSION}/cmake-${CMAKEVERSION}-linux-x86_64.tar.gz \
-    | tar xz -C /usr/local --strip-components 1
-
-# Install Ninja
-RUN curl -fsSL -o /tmp/ninja.zip \
-    https://github.com/ninja-build/ninja/releases/download/v${NINJAVERSION}/ninja-linux.zip \
-    && unzip /tmp/ninja.zip -d /usr/local/bin && rm /tmp/ninja.zip
-
-# Install Go
-RUN curl -fsSL https://go.dev/dl/go${GOLANG_VERSION}.linux-amd64.tar.gz \
-    | tar xz -C /usr/local
-ENV PATH=/usr/local/go/bin:$PATH
-
-ARG OLLAMA_VERSION=v0.23.2
-RUN git clone --depth 1 --branch ${OLLAMA_VERSION} https://github.com/ollama/ollama.git /build
-WORKDIR /build
-
-# ROCm paths
-ENV HIP_PATH=/opt/rocm
-ENV ROCM_PATH=/opt/rocm
-ENV CMAKE_GENERATOR=Ninja
-ENV LDFLAGS=-s
-
-# Step 1: Build CPU backends with GCC (no ROCm preset)
-# Pre-set CMAKE_HIP_COMPILER="" to prevent check_language(HIP) from
-# finding a HIP compiler (it searches /opt/rocm even without PATH).
-# Remove /opt/rocm from PATH to prevent find_program from finding hipcc.
-RUN mkdir -p build-cpu && \
-    PATH=/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
-    cmake -B build-cpu -DCMAKE_BUILD_TYPE=Release \
-      -DCMAKE_HIP_COMPILER="" \
-      -DCMAKE_INSTALL_PREFIX=/build/dist && \
-    cmake --build build-cpu --target ggml-cpu -- -l $(nproc) && \
-    cmake --install build-cpu --component CPU --strip && \
-    echo "=== CPU install ===" && \
-    (find /build/dist/lib/ollama -type f -o -type l 2>&1 | head -20 || echo "empty")
-
-# Step 2: Build HIP backend with ROCm preset + gfx906 target only
-# The ROCm 6 preset enables HIP language detection (enable_language(HIP))
-# which ensures GPU kernels are properly compiled for gfx906.
-# OLLAMA_RUNNER_DIR=rocm from the preset, so HIP goes to lib/ollama/rocm/
-# Need CMAKE_PREFIX_PATH so find_package(hip) finds hip-config.cmake
-# at /opt/rocm/lib/cmake/hip/hip-config.cmake.
-RUN mkdir -p build-hip && \
-    cmake -B build-hip \
-      --preset 'ROCm 6' \
-      -DAMDGPU_TARGETS="gfx906:xnack-" \
-      -DCMAKE_BUILD_TYPE=Release \
-      -DCMAKE_PREFIX_PATH="/opt/rocm" && \
-    cmake --build build-hip --target ggml-hip -- -l $(nproc) && \
-    cmake --install build-hip --component HIP --strip && \
-    echo "=== HIP install ===" && \
-    find /build/dist/lib/ollama -type f -o -type l | head -20
-
-# Step 3: Build Go binary (GCC for CGo linking)
-ENV CGO_ENABLED=1
-RUN go build -trimpath -ldflags="-X=github.com/ollama/ollama/version.Version=${OLLAMA_VERSION}" -o /build/dist/ollama .
-
-# ---------- Runtime image ----------
-FROM ubuntu:24.04
-
-RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
-    ca-certificates curl libstdc++6 libgomp1 libvulkan1 libopenblas0 \
-    && rm -rf /var/lib/apt/lists/*
-
-# Copy ROCm 6.1 runtime libraries
-# These are needed at runtime by ggml-hip via LD_LIBRARY_PATH
-COPY --from=builder /opt/rocm/lib/ /opt/rocm/lib/
-COPY --from=builder /opt/rocm/share/ /opt/rocm/share/
-
-# Copy ollama binary + all backends (CPU + HIP)
-# CPU install:  /build/dist/lib/ollama/libggml-*.so
-# HIP install:  /build/dist/lib/ollama/rocm/libggml-hip.so
-COPY --from=builder /build/dist/ollama /usr/bin/ollama
-COPY --from=builder /build/dist/lib/ollama/ /usr/lib/ollama/
-
-RUN ldconfig
-
-ENV LD_LIBRARY_PATH=/opt/rocm/lib:/usr/lib/ollama/rocm:/usr/lib/ollama
-ENV HSA_OVERRIDE_GFX_VERSION=9.0.6
-ENV HCC_AMDGPU_TARGET=gfx906
-ENV HSA_ENABLE_SDMA=0
-
-EXPOSE 11434
-ENTRYPOINT ["/bin/ollama"]
-CMD ["serve"]
--- a/flake.lock
+++ b/flake.lock
@@ -23,6 +23,38 @@
        "type": "github"
      }
    },
+    "argononed": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1729566243,
+        "narHash": "sha256-DPNI0Dpk5aym3Baf5UbEe5GENDrSmmXVdriRSWE+rgk=",
+        "owner": "nvmd",
+        "repo": "argononed",
+        "rev": "16dbee54d49b66d5654d228d1061246b440ef7cf",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvmd",
+        "repo": "argononed",
+        "type": "github"
+      }
+    },
+    "argononed_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1729566243,
+        "narHash": "sha256-DPNI0Dpk5aym3Baf5UbEe5GENDrSmmXVdriRSWE+rgk=",
+        "owner": "nvmd",
+        "repo": "argononed",
+        "rev": "16dbee54d49b66d5654d228d1061246b440ef7cf",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvmd",
+        "repo": "argononed",
+        "type": "github"
+      }
+    },
    "flake-compat": {
      "flake": false,
      "locked": {
@@ -37,6 +69,54 @@
        "url": "https://git.lix.systems/lix-project/flake-compat/archive/main.tar.gz"
      }
    },
+    "flake-compat_2": {
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_3": {
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@@ -144,6 +224,150 @@
        "type": "github"
      }
    },
+    "nixmate": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs_2",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1771085058,
+        "narHash": "sha256-w9qE5zZ8mEHPbR84OuJoFWFvmMuKpvq/ANwyDUEvbPo=",
+        "owner": "daskladas",
+        "repo": "nixmate",
+        "rev": "9030841d4c3ec72359643d7af68bfdac428f1636",
+        "type": "github"
+      },
+      "original": {
+        "owner": "daskladas",
+        "repo": "nixmate",
+        "type": "github"
+      }
+    },
+    "nixos-images": {
+      "inputs": {
+        "nixos-stable": [
+          "nixos-raspberrypi",
+          "nixpkgs"
+        ],
+        "nixos-unstable": [
+          "nixos-raspberrypi",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1747747741,
+        "narHash": "sha256-LUOH27unNWbGTvZFitHonraNx0JF/55h30r9WxqrznM=",
+        "owner": "nvmd",
+        "repo": "nixos-images",
+        "rev": "cbbd6db325775096680b65e2a32fb6187c09bbb4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvmd",
+        "ref": "sdimage-installer",
+        "repo": "nixos-images",
+        "type": "github"
+      }
+    },
+    "nixos-images_2": {
+      "inputs": {
+        "nixos-stable": [
+          "nixos-uconsole",
+          "nixos-raspberrypi",
+          "nixpkgs"
+        ],
+        "nixos-unstable": [
+          "nixos-uconsole",
+          "nixos-raspberrypi",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1747747741,
+        "narHash": "sha256-LUOH27unNWbGTvZFitHonraNx0JF/55h30r9WxqrznM=",
+        "owner": "nvmd",
+        "repo": "nixos-images",
+        "rev": "cbbd6db325775096680b65e2a32fb6187c09bbb4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvmd",
+        "ref": "sdimage-installer",
+        "repo": "nixos-images",
+        "type": "github"
+      }
+    },
+    "nixos-raspberrypi": {
+      "inputs": {
+        "argononed": "argononed",
+        "flake-compat": "flake-compat_2",
+        "nixos-images": "nixos-images",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779023229,
+        "narHash": "sha256-MInilg7B/06c34SwOuGSBho4l0H1EZcmvxTkSWCs5pE=",
+        "owner": "nvmd",
+        "repo": "nixos-raspberrypi",
+        "rev": "06c6e3513e1ee64b651913193fc6ac38aa4963f5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvmd",
+        "ref": "v1.20260517.0",
+        "repo": "nixos-raspberrypi",
+        "type": "github"
+      }
+    },
+    "nixos-raspberrypi_2": {
+      "inputs": {
+        "argononed": "argononed_2",
+        "flake-compat": "flake-compat_3",
+        "nixos-images": "nixos-images_2",
+        "nixpkgs": [
+          "nixos-uconsole",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779023229,
+        "narHash": "sha256-MInilg7B/06c34SwOuGSBho4l0H1EZcmvxTkSWCs5pE=",
+        "owner": "nvmd",
+        "repo": "nixos-raspberrypi",
+        "rev": "06c6e3513e1ee64b651913193fc6ac38aa4963f5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nvmd",
+        "ref": "v1.20260517.0",
+        "repo": "nixos-raspberrypi",
+        "type": "github"
+      }
+    },
+    "nixos-uconsole": {
+      "inputs": {
+        "nixos-raspberrypi": "nixos-raspberrypi_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1780333979,
+        "narHash": "sha256-yjp/gWRqWCxalYLe2+27gbxhttL+46Ozm7qvccpFbv4=",
+        "owner": "nixos-uconsole",
+        "repo": "nixos-uconsole",
+        "rev": "1e6a8dc51c7b26e15850688a0b01121c3fea4b30",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos-uconsole",
+        "repo": "nixos-uconsole",
+        "type": "github"
+      }
+    },
    "nixpkgs": {
      "locked": {
        "lastModified": 1705033721,
@@ -177,6 +401,22 @@
      }
    },
    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1770562336,
+        "narHash": "sha256-ub1gpAONMFsT/GU2hV6ZWJjur8rJ6kKxdm9IlCT0j84=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "d6c71932130818840fc8fe9509cf50be8c64634f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
      "locked": {
        "lastModified": 1774386573,
        "narHash": "sha256-4hAV26quOxdC6iyG7kYaZcM3VOskcPUrdCQd/nx8obc=",
@@ -212,7 +452,31 @@
      "inputs": {
        "agenix": "agenix",
        "lix": "lix",
-        "nixpkgs": "nixpkgs_2"
+        "nixmate": "nixmate",
+        "nixos-raspberrypi": "nixos-raspberrypi",
+        "nixos-uconsole": "nixos-uconsole",
+        "nixpkgs": "nixpkgs_3"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixmate",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1770606655,
+        "narHash": "sha256-rpJf+kxvLWv32ivcgu8d+JeJooog3boJCT8J3joJvvM=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "11a396520bf911e4ed01e78e11633d3fc63b350e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
      }
    },
    "systems": {
@@ -229,6 +493,21 @@
        "repo": "default",
        "type": "github"
      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@@ -2,34 +2,29 @@
  description = "Gortium infra flake";

  inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs?ref=25.11";
+    nixmate.url = "github:daskladas/nixmate";
+    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
    agenix = {
      url = "github:ryantm/agenix";
      inputs.darwin.follows = "";
      inputs.nixpkgs.follows = "nixpkgs";
    };
-    disko = {
-      url = "github:nix-community/disko";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
    lix = {
      url = "git+https://git.lix.systems/lix-project/lix?ref=main";
      inputs.nixpkgs.follows = "nixpkgs";
    };
-    nixpkgs-uconsole = {
-      url = "github:nixos/nixpkgs/54170c54449ea4d6725efd30d719c5e505f1c10e";
-    };
    nixos-uconsole = {
-      url = "github:nixos-uconsole/nixos-uconsole/v1.1.0";
-      inputs.nixpkgs.follows = "nixpkgs-uconsole";
+      url = "github:nixos-uconsole/nixos-uconsole";
+      inputs.nixpkgs.follows = "nixpkgs";
    };
    nixos-raspberrypi = {
-      url = "github:nvmd/nixos-raspberrypi/v1.20260317.0";
-      inputs.nixpkgs.follows = "nixos-uconsole/nixpkgs";
+      url = "github:nvmd/nixos-raspberrypi/v1.20260517.0";
+      inputs.nixpkgs.follows = "nixpkgs";
    };
+    self.submodules = true;
  };

-  outputs = { self, nixpkgs, agenix, disko, lix, nixos-uconsole, nixos-raspberrypi, ... }@inputs:
+  outputs = { self, nixmate, nixpkgs, agenix, lix, nixos-uconsole, nixos-raspberrypi, ... }@inputs:
    let
      system = "x86_64-linux";
      keys = import ./lib/keys.nix;
@@ -40,7 +35,11 @@
          "/etc/ssh/ssh_host_ed25519_key"
          "/root/.age/bootstrap.key" ];
      };
-      overlays = [ agenix.overlays.default (import ./overlays/reticulum.nix) ];
+      overlays = [
+        agenix.overlays.default
+        (import ./overlays/reticulum.nix)
+        (import ./overlays/nixmate.nix inputs)
+      ];
      pkgs = import nixpkgs {
        inherit system overlays;
        config.allowUnfree = true;
@@ -95,21 +94,19 @@
            ];
          };

-          uConsole = nixos-uconsole.lib.mkUConsoleSystem {
-            variant = "cm5";
+          uConsole = nixos-raspberrypi.lib.nixosSystem {
            specialArgs = { inherit self keys paths inputs nixos-raspberrypi; };
            modules = [
              {
                nixpkgs.overlays = overlays;
                nixpkgs.config.allowUnfree = true;
-                nixpkgs.config.permittedInsecurePackages = [
-                  "openclaw-2026.3.12"
-                ];
+                nixpkgs.hostPlatform = "aarch64-linux";
+                nix.package = lix.packages."aarch64-linux".default;
              }
-              disko.nixosModules.disko
+              nixos-raspberrypi.nixosModules.raspberry-pi-5.base
+              nixos-uconsole.nixosModules.uconsole-cm5
              ./hosts/uConsole/configuration.nix
              ./hosts/uConsole/hardware-configuration.nix
-              ./hosts/uConsole/disko-config.nix
            ];
          };
        };
--- a/hosts/lazyworkhorse/configuration.nix
+++ b/hosts/lazyworkhorse/configuration.nix
@@ -144,12 +144,14 @@
  # You can use https://Search.nixos.org/ to find more packages (and options).
  environment.systemPackages = with pkgs; [
    neovim
+    tmux
    docker-compose
    wget
    age
    agenix
    git
    nh
+    nixmate
    lm_sensors
    rocmPackages.rocminfo
    rocmPackages.rocm-smi
@@ -256,12 +258,6 @@
    # };
  };

-  services.opencode = {
-    enable = true;
-    port = 4099;
-    ollamaUrl = "http://127.0.0.1:11434/v1"; 
-  };
-  
  # Private host ssh key managed by agenix
  age = {
    identityPaths = paths.identities;
@@ -311,16 +307,6 @@
    };
  };

-  # OpenClaw Node service (host-side execution for Docker gateway)
-  services.openclaw-node = {
-    enable = true;
-    user = "ai-worker";
-    gatewayHost = "127.0.0.1";
-    gatewayPort = 18789;
-    gatewayTokenFile = "/run/secrets/openclaw_gateway_token";
-    displayName = "lazyworkhorse-host";
-  };
-
  # Public host ssh key (kept in sync with the private one)
  environment.etc."ssh/ssh_host_ed25519_key.pub".text =
    "${keys.hosts.lazyworkhorse.main}";
--- a/hosts/uConsole/configuration.nix
+++ b/hosts/uConsole/configuration.nix
@@ -1,19 +1,5 @@
 { config, lib, pkgs, paths, self, keys, ... }:

-let
-  # Backlight fallback for CM5 display quirk
-  # The kernel driver usually handles this, but some boots need a kick
-  backlightFixScript = pkgs.writeShellScript "backlight-fix" ''
-    # Try sysfs backlight control
-    for bl in /sys/class/backlight/*/brightness; do
-      if [ -f "$bl" ]; then
-        max=$(cat "$(dirname "$bl")/max_brightness" 2>/dev/null || echo 100)
-        echo "$max" > "$bl" 2>/dev/null || true
-      fi
-    done
-  '';
-in
-
 {
  # Basic Host Info
  networking.hostName = "uConsole";
@@ -21,37 +7,19 @@ in
  i18n.defaultLocale = "en_CA.UTF-8";

  # System State
-  system.stateVersion = "25.11";
+  system.stateVersion = "25.05";

  # Boot & Hardware (migrated to kernel bootloader per nixos-raspberrypi deprecation notice)
  boot.loader.raspberry-pi.bootloader = "kernel";
  # kernel managed by nixos-raspberrypi module — don't override, patches are version-specific
  # boot.kernelPackages = pkgs.linuxPackages_latest;

-  # Kernel parameters matching nixos-uconsole CM5 module
-  # console=tty1 is critical — without it, console output goes to ttyAMA0 not fb0
-  boot.kernelParams = [
-    "8250.nr_uarts=1"
-    "console=tty1"
-  ];
-
-  # Enable Mesa GPU drivers — REQUIRED for VC4 display pipeline to initialize
-  hardware.graphics.enable = true;
-
-  # Console font sized for the 5" 720x1280 display (from nixos-uconsole base module)
-  console = {
-    earlySetup = true;
-    font = "ter-v24n";
-    packages = with pkgs; [ terminus_font ];
-  };
-
  # Networking
  networking.networkmanager.enable = true;
  services.openssh = {
    enable = true;
-    # TODO: lock down after first deployment
-    settings.PermitRootLogin = lib.mkForce "yes";
-    settings.PasswordAuthentication = lib.mkForce true;
+    settings.PermitRootLogin = lib.mkForce "prohibit-password";
+    settings.PasswordAuthentication = lib.mkForce false;
  };

  # User
@@ -88,7 +56,6 @@ in
    htop
    tmux
    neovim
-    libgpiod                    # GPIO control (for internal USB hub, AIO modules)

    # ===== HAM Radio =====
    js8call
@@ -108,8 +75,7 @@ in
    soapysdr-with-plugins      # SoapySDR + hardware support plugins

    # ===== Mesh / LoRa =====
-    # meshtastic not available in nixpkgs 25.11 stable; install manually:
-    # nix shell nixpkgs#meshtastic -c meshtastic
+    meshtastic                 # Python CLI for Meshtastic devices
    reticulumStack             # Reticulum Network Stack (rnsd, rnsh, rncp, rnx, rnpath, etc.)
    lxmf                       # LXMF messaging protocol
    nomadnet                   # Nomad Network client
@@ -173,33 +139,22 @@ in
  };

  # ============================================================
-  # Kernel modules for SDR, radio, and WiFi
+  # Kernel modules for SDR and radio
  # ============================================================
  boot.kernelModules = [
-    "mt7921u"         # MediaTek MT7921 USB WiFi (uConsole AC1200)
    "88x2bu"          # Realtek 8812/8821BU USB WiFi (common adapter)
    "rtl8xxxu"        # RTL8188/8192/8723 USB WiFi
    "rtl2832_sdr"     # RTL-SDR kernel module
    "dvb_usb_rtl28xxu" # RTL-SDR DVB-T
-    # Display drivers — loaded AFTER RP1 PCIe southbridge init (~12s)
-    # NOTHING in initrd — ALL RP1 hardware is behind PCIe
-    "panel_cwu50"     # uConsole DSI panel driver
-    "vc4"             # VideoCore 4 KMS GPU driver
-    "rp1_dsi"         # RP1 DSI bridge driver
  ];

  boot.blacklistedKernelModules = [ ];

-  # Rien dans initrd pour le display — tout RP1 est derrière PCIe
-  boot.initrd.kernelModules = lib.mkForce [ ];
-
  # ============================================================
  # Extra udev rules for SDR and HAM radio devices
  # ============================================================
  services.udev.packages = with pkgs; [ rtl-sdr ];

-
-
  # ============================================================
  # Enable IPv6 for Reticulum mesh
  # ============================================================
@@ -213,74 +168,4 @@ in
  # Reticulum uses its own encryption and doesn't need open ports
  # for basic mesh operations (peer-to-peer discovery).
  # For TCP interfaces, open additional ports as needed.
-
-  # ============================================================
-  # Hyprland Wayland compositor (manual start)
-  # No SDDM — boot to console, user starts Hyprland with command
-  # Display modules (vc4/panel_cwu50) load late after RP1 PCIe init
-  # ============================================================
-  programs.hyprland = {
-    enable = true;
-    xwayland.enable = true;
-  };
-  # SDDM disabled — was blocking boot when display isn't ready
-  # services.displayManager.sddm = {
-  #   enable = true;
-  #   wayland.enable = true;
-  # };
-
-  # ============================================================
-  # CM5 Config.txt Fix: use [pi5] section (not [cm5])
-  # Rex's images use [pi5], the CM5 firmware may not detect [cm5]
-  # ============================================================
-  # Merge nixos-uconsole GPIO config with our [pi5] overrides
-  # GPIO 10/11 are from nixos-uconsole configtxt.nix (audio amplifier)
-  # [pi5] section fixes the CM5 detection issue — firmware matches [pi5] not [cm5]
-  hardware.raspberry-pi.extra-config = ''
-    [all]
-    gpio=10=ip,np
-    gpio=11=op,dh
-
-    [pi5]
-    dtparam=pciex1=off
-    dtoverlay=clockworkpi-uconsole-cm5
-    dtoverlay=dwc2,dr_mode=host
-    dtoverlay=vc4-kms-v3d-pi5,cma-384
-    dtparam=nohdmi1=off
-  '';
-
-  # ============================================================
-  # CM5 Display Backlight Fix
-  # The kernel driver initializes backlight, but some boots fail.
-  # This service kicks it after boot as a reliable fallback.
-  # ============================================================
-  systemd.services.cm5-backlight-fix = {
-    description = "CM5 Display Backlight Fix";
-    after = [ "multi-user.target" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = "${backlightFixScript}";
-    };
-  };
-
-  # ============================================================
-  # Internal USB Hub Enable (GPIO 23) — DISABLED
-  # This service freeze the CM5 because gpioset 0 23=1 writes
-  # to the wrong GPIO chip (BCM2712 native, not RP1).
-  # Enable manually after boot once the correct chip is confirmed:
-  #   gpioset 0 23=1   # on chip 0 (BCM2712, CORE_VOLT or critical)
-  #   gpioset 512 23=1 # on chip 512 (RP1, likely correct)
-  # ============================================================
-  # systemd.services.enable-gpio23-usb-hub = {
-  #   description = "Enable Internal USB Hub (GPIO 23)";
-  #   before = [ "network.target" ];
-  #   wantedBy = [ "multi-user.target" ];
-  #   serviceConfig = {
-  #     Type = "oneshot";
-  #     RemainAfterExit = true;
-  #     ExecStart = "${pkgs.libgpiod}/bin/gpioset 0 23=1";
-  #     ExecStop = "${pkgs.libgpiod}/bin/gpioset 0 23=0";
-  #   };
-  # };
 }
--- a/hosts/uConsole/disko-config.nix
+++ b/hosts/uConsole/disko-config.nix
@@ -1,46 +0,0 @@
-{ lib, ... }:
-{
-  disko.devices.disk.main = {
-    type = "disk";
-    device = "/dev/mmcblk0";
-    content = {
-      type = "gpt";
-      partitions = {
-        boot = {
-          name = "FIRMWARE";
-          size = "1G";
-          type = "EF00";
-          content = {
-            type = "filesystem";
-            format = "vfat";
-            mountpoint = "/boot/firmware";
-            mountOptions = [
-              "fmask=0022"
-              "dmask=0022"
-            ];
-          };
-        };
-        root = {
-          name = "NIXOS_UCM5";
-          size = "30G";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/";
-            mountOptions = [ "noatime" ];
-          };
-        };
-        home = {
-          name = "NIXOS_HOME";
-          size = "100%";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/home";
-            mountOptions = [ "noatime" ];
-          };
-        };
-      };
-    };
-  };
-}
--- a/hosts/uConsole/hardware-configuration.nix
+++ b/hosts/uConsole/hardware-configuration.nix
@@ -9,28 +9,15 @@
  boot.initrd.kernelModules = [ ];
  boot.extraModulePackages = [ ];

-  # Filesystems for NixOS install.
-  # mkForce overrides disko's auto-generated paths so we can use
-  # filesystem labels (by-label) which work with loop device installs.
-  # Disko will set its own paths when nixos-anywhere is used.
-  fileSystems."/" = lib.mkForce {
+  # uConsole CM5 uses NVMe or eMMC for boot storage
+  # The uconsole-cm5 module sets up /boot/firmware and default /
+  # Override device label here if using different storage
+  fileSystems."/" = lib.mkDefault {
    device = "/dev/disk/by-label/NIXOS_UCM5";
    fsType = "ext4";
    options = [ "noatime" ];
  };

-  fileSystems."/boot/firmware" = lib.mkForce {
-    device = "/dev/disk/by-label/FIRMWARE";
-    fsType = "vfat";
-    options = [ "fmask=0022" "dmask=0022" ];
-  };
-
-  fileSystems."/home" = lib.mkForce {
-    device = "/dev/disk/by-label/NIXOS_HOME";
-    fsType = "ext4";
-    options = [ "noatime" ];
-  };
-
  swapDevices = [ ];

  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
--- a/overlays/nixmate.nix
+++ b/overlays/nixmate.nix
@@ -0,0 +1,6 @@
+# ./overlays/nixmate.nix
+inputs: # We pass inputs here so the overlay can see the nixmate flake
+
+final: prev: {
+  nixmate = inputs.nixmate.packages.${prev.system}.default;
+}
--- a/overlays/reticulum.nix
+++ b/overlays/reticulum.nix
@@ -1,92 +1,81 @@
 final: prev: let
  python3 = final.python3;
  pyPkgs = python3.pkgs;
-in
-  {
-    reticulumStack = python3.pkgs.buildPythonApplication rec {
-      pname = "reticulum";
-      version = "1.2.9";
-      format = "setuptools";
-      src = pyPkgs.fetchPypi {
-        pname = "rns";
-        inherit version;
-        sha256 = "554814231c237b9caacf8df669312e57dd7d3f84b6d4810125087d1a79a75d75";
-      };
-      patchPhase = ''
-        # Fix license_files syntax: ("LICENSE") is a string not tuple
-        # Newer setuptools iterates over it char by char, fails on 'S'
-        substituteInPlace setup.py \
-          --replace-fail 'license_files = ("LICENSE")' 'license_files = ("LICENSE",)'
-      '';
-      propagatedBuildInputs = with pyPkgs; [ cryptography pyserial ];
-      doCheck = false;
-      pythonImportsCheck = [ "RNS" ];
-      meta = with final.lib; {
-        description = "Self-configuring, encrypted and resilient mesh networking stack";
-        homepage = "https://reticulum.network/";
-        license = licenses.mit;
-        platforms = platforms.linux;
-      };
+in {
+  reticulumStack = python3.pkgs.buildPythonApplication rec {
+    pname = "reticulum";
+    version = "1.2.9";
+    format = "setuptools";
+    src = pyPkgs.fetchPypi {
+      pname = "rns";
+      inherit version;
+      sha256 = "554814231c237b9caacf8df669312e57dd7d3f84b6d4810125087d1a79a75d75";
    };
+    propagatedBuildInputs = with pyPkgs; [ cryptography pyserial ];
+    doCheck = false;
+    pythonImportsCheck = [ "RNS" ];
+    meta = with final.lib; {
+      description = "Self-configuring, encrypted and resilient mesh networking stack";
+      homepage = "https://reticulum.network/";
+      license = licenses.mit;
+      platforms = platforms.linux;
+    };
+  };

-    lxmf = python3.pkgs.buildPythonApplication rec {
-      pname = "lxmf";
-      version = "0.9.8";
-      format = "setuptools";
-      src = pyPkgs.fetchPypi {
-        inherit pname version;
-        sha256 = "30f39f3a975a049c12ee2cfceb3261d24cb5adec881c6821f7354464b3f3650c";
-      };
-      propagatedBuildInputs = [ final.reticulumStack ];
-      doCheck = false;
-      pythonImportsCheck = [ "LXMF" ];
-      meta = with final.lib; {
-        description = "Lightweight Extensible Message Format for Reticulum";
-        homepage = "https://github.com/markqvist/lxmf";
-        license = licenses.mit;
-        platforms = platforms.linux;
-      };
+  lxmf = python3.pkgs.buildPythonApplication rec {
+    pname = "lxmf";
+    version = "0.9.8";
+    format = "setuptools";
+    src = pyPkgs.fetchPypi {
+      inherit pname version;
+      sha256 = "30f39f3a975a049c12ee2cfceb3261d24cb5adec881c6821f7354464b3f3650c";
    };
+    propagatedBuildInputs = [ final.reticulumStack ];
+    doCheck = false;
+    pythonImportsCheck = [ "LXMF" ];
+    meta = with final.lib; {
+      description = "Lightweight Extensible Message Format for Reticulum";
+      homepage = "https://github.com/markqvist/lxmf";
+      license = licenses.mit;
+      platforms = platforms.linux;
+    };
+  };

-    nomadnet = python3.pkgs.buildPythonApplication rec {
-      pname = "nomadnet";
-      version = "1.1.1";
-      format = "setuptools";
-      src = pyPkgs.fetchPypi {
-        inherit pname version;
-        sha256 = "fa13b64a10e75b705a58024815ab72451700aa726af96d415ba99dec28dfc40a";
-      };
-      propagatedBuildInputs = with pyPkgs; [ final.reticulumStack final.lxmf urwid qrcode ];
-      doCheck = false;
-      pythonImportsCheck = [ "nomadnet" ];
-      meta = with final.lib; {
-        description = "Nomad Network — resilient mesh communications platform";
-        homepage = "https://github.com/markqvist/NomadNet";
-        license = licenses.mit;
-        platforms = platforms.linux;
-      };
+  nomadnet = python3.pkgs.buildPythonApplication rec {
+    pname = "nomadnet";
+    version = "1.1.1";
+    format = "setuptools";
+    src = pyPkgs.fetchPypi {
+      inherit pname version;
+      sha256 = "fa13b64a10e75b705a58024815ab72451700aa726af96d415ba99dec28dfc40a";
    };
+    propagatedBuildInputs = with pyPkgs; [ final.reticulumStack final.lxmf urwid qrcode ];
+    doCheck = false;
+    pythonImportsCheck = [ "nomadnet" ];
+    meta = with final.lib; {
+      description = "Nomad Network — resilient mesh communications platform";
+      homepage = "https://github.com/markqvist/NomadNet";
+      license = licenses.mit;
+      platforms = platforms.linux;
+    };
+  };

-    rnsh = python3.pkgs.buildPythonApplication rec {
-      pname = "rnsh";
-      version = "0.1.7";
-      format = "setuptools";
-      src = pyPkgs.fetchPypi {
-        inherit pname version;
-        sha256 = "9cb72f25abb1c6d300f8014b264184ff78f592fe88e36094938012990b797c93";
-      };
-      propagatedBuildInputs = [ final.reticulumStack ];
-      doCheck = false;
-      pythonImportsCheck = [ "rnsh" ];
-      meta = with final.lib; {
-        description = "Remote shell over Reticulum";
-        homepage = "https://github.com/acehoss/rnsh";
-        license = licenses.mit;
-        platforms = platforms.linux;
-      };
+  rnsh = python3.pkgs.buildPythonApplication rec {
+    pname = "rnsh";
+    version = "0.1.7";
+    format = "setuptools";
+    src = pyPkgs.fetchPypi {
+      inherit pname version;
+      sha256 = "9cb72f25abb1c6d300f8014b264184ff78f592fe88e36094938012990b797c93";
    };
-  }
-  # meshtastic may not exist in all nixpkgs versions (e.g. not in 25.11)
-  // prev.lib.optionalAttrs (prev ? meshtastic) {
-    inherit (prev) meshtastic;
-  }
+    propagatedBuildInputs = [ final.reticulumStack ];
+    doCheck = false;
+    pythonImportsCheck = [ "rnsh" ];
+    meta = with final.lib; {
+      description = "Remote shell over Reticulum";
+      homepage = "https://github.com/acehoss/rnsh";
+      license = licenses.mit;
+      platforms = platforms.linux;
+    };
+  };
+}
--- a/secrets/ai.age
+++ b/secrets/ai.age
@@ -0,0 +1,19 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSA2QUFR
+RmlnY2pYUFBHZGN3dzNpNVc0UW14V2NaVWZHWDJmcU1iWStsSHpJCnRYQUtEalNt
+SzFYWUF6VWRyYWF5VCtsSGduRU96MHA0WlI0b0lpUGFram8KLT4gM0stZ3JlYXNl
+IC5DPExhJQpCMlZRR0E1NGdsYlhNRXZUTVJqTTNHZUZQVUJoYkhheWd3TktvVEFp
+WnFqbS9xWUxJSmI0U0hqQkdzQU1EVy9BCkhWc3A0Mk45YVBxcnJFWU5qa01LRTVw
+WlNoWm40cjgyb1RXS3hGdlpRSEs5V0x0cHNvcVBOek0KLS0tIFhiOFExNnRSbEgz
+M3FmS1owQUdHSXpiWVhLQ0R6emtuK2hZSkkrSTFtTTAKi2hXxTslGLlneDJlvHUm
+OFsvgsHmiADRaiwDC/iCfWyEFzHyupXKX79B6rjt4Up2yUWHLHy4pyCvJiezAh1J
+uxvtVmUYrqYOUoUHCEMLjjVydh5tt+22yXezV0ecU2ePiAgb0gv9EwH8t+70An6Z
+fgvtZZqJ1hK6dTyTf4oROUjPD8RgfjDnRTTvTM1COMvwgpK+cboYAvJ4BhUsn70V
+B3Gveg7++1U2ECF8YHKZGfSuWn0ajT5RzdgRXTveGAINiW4G98oyXnOVhRHmXo9i
+8T/41afy4xhUbNCRsaAApFjS6y8xrpGtrOcpw0u3y3T/bjYHq8VDi4ttYWIF8hJD
+HPo44+SDj0g9lr/UPQDWXaiZjdD6xdioUqnHnaAdyOPPf5D6C5I7WIQPPIjnJ1yc
+PmQkIV4rtb+e7cWrGbnd9stCBZ2F+HcORfjgnJzKI5asy9rmdWPIIHkcZoPFZ/K8
+2ZWXUVgAZvwzcFxSjh5uXKvkOgYixdVLRfa88+KM++vwz0y3O5naq3d1SaLxV4dk
+mRifLNhF9y2MKjX0bZ86Wm74NlhGGQSnUuUHpPLSA6McVOfleN/yJ9gMsosxUc9U
+xIsKHYn8gN0lPVtyTSBTomK6kxoKJXxia50x/XAhJwI9X3ydLg==
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/cloudstorage.age
+++ b/secrets/cloudstorage.age
@@ -0,0 +1,10 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBaT3h1
+K28zWlE3N3BMdHRFaldkZ0F2YVZjT3kxK2dpV1RxZUVOSElsbkdJCnF2M1ZkUWky
+cGtPaXdzMmU1cllsWWtQK3R4Z0xhUExxSW9xUVh3eUo5RjQKLT4geHEtZ3JlYXNl
+IEQ5JWBWM0QKS1N5WlpnbEtLTFNxQVFvbkVEa1BOTDhQRDV0SDhsdWFEdE5xMDRa
+b3loMDZEeGZTZ1NzaFM5UlZYT0NjMHVvWAordjh4cFhnb2pOc3JPZlFLbFU0eC9O
+WWFFVlUKLS0tIEJnMm9LM09KQ3VXNXpNNU1kS3V5VDNOTGozdDdGdWQxcFc3Mk5j
+R0p0WVkKIX6p7MGDZOxS5qVgYs5K5sKC31IPIEMaWAqA5Gygegj5rVnKtN/jn7+9
+L5CBbzaSXzNwRce0WPVi0mQp56lL12mRlXXamOx/E9Q+r2rznFYdQA==
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/containers.env.age
+++ b/secrets/containers.env.age
@@ -1,36 +1,43 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBWNEpt
-cGFNeVBBaDRqb3pLSEZGQW0wb3VmVnBoZCswUFkzbnBLUnJ0QTNrClRqVkk4RUVO
-d29KYjd5YUcwankvaTFmVHUxQVpDT2ZYWHRaY3JXTUtQMU0KLT4gKXBtQ3UsXi1n
-cmVhc2UgNnwxYCBXVyA/KCQmIHt9NAo3OTZVUHR2UXkvaEFwY0ZBdEJsaFpsbHJ0
-cklKcDVHcEdWMEdPSkpnN0FiRU43RW5hUWFMdjR3WFRRSFBLSGlmClM3cTNJWlNM
-TExkdHdXUHJISkNIaE1TTUxUc1NUWkV1a09HeFU3bVZwQXMKLS0tIGhOcXFTUElS
-azJJNnEreUhMWTJBaVZGSTJPRUFqQkVYS01KRENUVVpZSDgK8+8onFejroBo7MeO
-dW+so4lOsq4zJKn3f0cxmCFg1f0X8zt6h4Uc3A5Cvr1uU+6yw1FWmJ7xa3jJz3lO
-EEaKQJXYC+xIIKGcA7qILa0SFp4a/4OuYjcg27HrlPhg7u5wDhQrd0LdVEe1Xngp
-ZivX7P7HwIna3X8C+TL+K2v/AG2N/z86cdKfRvxyMKNbHhYw+CfHEnWgh8tJ++4h
-G9evNniuNqte6cQaRe7jODfPNW4FuY/Sb7barlJ/M9iAQdYAdyLAzU1LABeHeUfD
-wtHjxy9DUZ55Vg8bB8M2JJU9MkoRT4ewiVd9LeC1GWeVmKsm93wsmrov714i7U2j
-wHtDkjqEF2MmzuQc18sjNaAHiwz8j6o5xU2L/Q4+Q707yISWG7RGZYh389Cr1rnw
-siUq/Vunqw2wk13+J/4vu9nqt5mMktBaCtp+QiWIurjwB5LUAyChrSm+dg5lb0Mt
-UhSc0lq1+E3vxAXM2Hmk+vP86VD+6WJvAU82VFApF1s6zG2FU1/AcOVVf54nan/q
-f+rgSFfASHQCYSblUJHyEtwLNsWEmTGmOEn1buUKD/H0zatPQnc0rYpjlx2V0Sjd
-6yB5+wPrZ0AkN1pjcsPKOv8Kaog2DzqIjib+SaSTaRxWHQEb9uzvaReAcYI5HOpE
-gkC040HN33BItATbo4+hz70Im8Ni/VXD+g6yzM6Hj1hJL+PinTKeg5keQRFIZjMx
-grzievB2wVBBgLgN3qMdTFmpplaL7iL702JjXZUTTK9Izp+9wiCsV1fTa53FWDht
-ylFL5SWElqXjK+QBXxAe+Jk6VQov5HI21YDXL67S554ABeRok23wxrQ31TCI4xq9
-PQV7VtNRjyVud7S29m3OwpWOsgTZhn+JclHj2v4bNJzJkJnZRTmcvGPktzRI5+R4
-e5vxVhGnJDzI71txaHl8+xS1lu9VzCQUrxX6TXyTRV4KjIOz0g06JOBgmBRBvJca
-7MZbC65xpisl/gyLRbgkVga3t94dPV+dpZsn8eq6427IyRbKslJefatggR9//c6I
-5N5fl0fR3gJQMB+HRbipBH2YsdbdWJyb4Nn6STZxIfrqoG/xC6C1raF0xK7hUx6i
-4DUDSPohM8fOIswQPfE+FH3eygfzu/Ln5+ghsgHTEhgFvmgMvyxaAt6kHIzIUhMX
-M3dASr4VPDpIXuXsRWwYLEifhzxsuvwVxfwtsnCaR6XKijsYECWGDdYOWHdleeqx
-wDPhxEesfFVhKxhrKY9Ir8k9/FFBKQU/3GjW4+SMAg5Al1YEzxshP9vKuVcsei7W
-JDwAwotNXaCm6NBckiyZJE53ou6+gckPY7V9cOfnuH74Z9ywkFzB3HW3ZlonaGyM
-oGmLGcccavFtyhg5s/As4i6X8ARIpDiwe59Pn3GNXMctySqIrrr2ogUoXgrfFCie
-6GOTdeMW7GeOSdJUxCofghlspS/nq01Og77VI/beWYrIwLubSka6Zaltww9zgObk
-/FGEMgFkEpq7iyCvYSPA8F46pJKvnMP3S84AWCPmcTcHeg4lwGPvs6btexXBGdoz
-nkCyq7wdH5Nngm7jUbl88LtaLZPAQkuqXphBVTnrF9Ofbnb4iRZ2Op4xpx9rGyvx
-mO6UEhL6V1i2YZFNkNMg/W8aoMiUgBdqbkxaxblT9L0aNdlFU9+LbWYolURVEadd
-Qjv0Z1gMA+tsuBbVszwsMfneZ5+B9Q==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBVYWFV
+U1dWcVVoZVJ2a1Bmd00zbnRvYnNTb0RvUlhJSVZheVlZcGlKRFgwCmVNTVNzVk8z
+ZSszVUN2enhIV09UMkpGNG9vZlhTTVZrd1U1QnB6OVpnOU0KLT4gSCgtZ3JlYXNl
+IFtVXTlQIGl6YXRHCjdqNS9oa3p5dGZseWV5NDNadjN2VDVheCtkRm1jRWpuY0Y3
+Sk1aWHhyQQotLS0gaFo5TjM1bFdKOEJVenZHK3RXOHExeXV0dFIrTUNMc0pnTXBM
+YWIrNHdHNAqkUzENsQawFRPRh6K13pJN9pkDGpvpx07kTPkUWbocUQoJMxeXdAlh
+Syw6Ca2X2Xb2QGnO6EIoMsfs6Tg78cEiDH4DEcdcNdHoSZlaNGLrUHnvE/Ygc/G0
+vz0D3uxTTvRBFYPNSONt+uN9j2p3JEZK5Hllt1GRmo6c8xnktDQpkwYLgegPYYxW
+5Ge/ywwPlKp1WzqVVBQv2FH1/qm0QcBUhtjrkTTPFOjk3vlrXqbSM7n4cMZJYWRi
+kMK51q2H49anwT8gkaeJ7hwlJpmzNIocDpD5sxxXj1NGc+uogEfaZrP7IRsACSTa
+ggub/LYjPyajj4CLjt+6O3KNepNsOTEiGH11TZ6cyjipDerIcZx1rO/6cnOPpN40
+TZQc1IW+oGrbJk7WNNX4gjX2t0+ElVeDVQ2wEe862Yh4OxyMVUkCyh9DGFu5RxL4
+veKJfvs6VSjS4GtaOOXAxYra5GXGaNAx9w53MRSWXd7T9eh4VnYr0pvdRPMYyQAe
+H/aNl9lqtQt1r4DtfF/RMOuqIiKFlnnhKlVfp5uCAn5Bgn4nCBMvQrAlghXWzI+N
+rou2kBuzI3yKDO+8VJlacEVXM9vwv/O15XYpY/Mn1TYzbsOQi7FgnFatAWr6Uinh
+gmay4WDxikIlKdhV1CqOJek5AAC1ptVCDgDcOpERDdZ+whBHUDTJ4NjMEPPcmlyw
+9sejEf7mjuqKY5VGAVy2CRqV0wIMJ3nIo8Um2NNQE2BKCVyucmxhPVA6NieRgG8F
+NvqIE3Iji1xFiUC+twjOkTcVAl7hKk2yLjZxF6KqoP7rWr787qr3qNA3cXhxgSUN
+ZX9kzepy7pTyHADqK4j1Hum8o6/OjKaGQy/HIiywMjfk7zl3+Cs0PhjKG9HBReIQ
+MqbJqa2fyAqOuHk/44Lpja1CI7LGWxOrctTixG3+Gy3JmTrZh8pDqzzNmPrByrHO
+nN3HzUZ/4sw5ONUz/GQ89WcSjez1TNr+lwRsYMf8tUCRHgdxUT9HRXUeOd8eD4d
+CDyoAYpab01ZFkHzRhBOWJlqjqhDNIDEzMjImU4ieBsgCh9ZyIZF2HetLov6xESo
+FYCDb7UqIXsw7n04wSTbwcYV2iPQ0EowPrADcSvqq+9YVr8Tsw6pmTaxC18Wi+zY
+7R9ALANy9qgxLnBAAXIbp2iyJayFQDNONkOlp4NV2RiVN/UrHcZNsZsSfM0DFzqh
+spuqt3czmAdvUzWpnghjMRUC49kkW2XNJxS9dREHmEPVZnzQo457CCCFsAqmrRB6
+c/wvyKD86Z89l/tkrLVz+sLQJMYfc5zED+EjyZyghHprkqZ6iDjFaEQUO8Fk2FwX
+wCDqJhJGXs3MT7tJnfIrwy4AvJv9FgUnMYYpQiyv+ToDqgAWGVDfxGieQo6r59El
+ZpTx+qt3jT+jI5Z6v4OVRODU2FFlee+YcF3ooF3yiwNdvuRhIgOVCNXkD/9QBOyq
+MiOcCcGNxWx3COGIdshg/HVjGfxm+zZUYW0ktn3/YNkUHPIPxIWPNRdlQ9xbu3kD
+vd1Ivx8wsUfo7soMffjdYKoAbAWS/3Ce/Sgpk15uo7CzGoO7Egzj+cb4GtvgojDD
+BwG3CSzUJcXV2zbRwxfHRanko0RN/Qpskc/P1DiSMduxP8nZT+/r2HCykX+CRkM7
+PtnG0moKD3i5u3X/jQAAPA1X9BPbbwgTE/nmHpgMxG1BD5GlLmeY1hkBRwEUlnSr
+UsN8FaWGBKyPMtMhK8EcjzmH259NJYguDgpBgMiIpO3sXst4yK5RuxR22+S8AI6X
+VucMZWa+BzyHc3Oej/T5UrCIZ/tDzktD0Xp76EZxPD7ADw2z0+7TQ5YSYFal3+X1
+fcdKTphts2YRvtXLQuv+8SCIcf8VKMVjIkRCtE5ez1Isk+ZHEtprKsp9ZFsj9cFV
+R6c2d1YqoW7IGWfcZL4snG09DaifPtwiwJBdYxRfGXgOq1fxtszzAxdlIoT3HRVo
+pBHZp+7zcAXFyjgPDGOP5fcfGbMD41Vr9W9DVzioBIZDDQLRs4M6DZDgqgWv32tO
+P7s2TivIEoAnirtic+tQZe5lXwndPUou0qYTO28diLSCTj29S+Vw9/ftah7qOqy6
+iDdf2rhbMNSRoywZOwQer6aLHePkSq7yDRRnQburIaUyy4FWjSYumx3O/2++JrkW
+uFhLRIOu4M3gkgyqb4xOscxl/aEGZADR8tLIeqn/Bnt/Bub8vTph1H/ZCYEvjZA5
+afmShsiIKw==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/homeautomation.age
+++ b/secrets/homeautomation.age
@@ -0,0 +1,19 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBOSk9J
+RDF0bk4zNmdWRXhFTU1xUlVKeDJkTU51UDRiNjcvWlVKT3cxNzBvCk00ZEtMdlI2
+L2xiS3BnT1g0aEd3VmgydCtSVERrTjNraHNmSHZicENLODAKLT4gI0crX0A0Zmst
+Z3JlYXNlIE8wNCBfPz5uSy4KSGxzcnJlM1FRamI0VWlZbTJvRnRuanlwSjN0eisy
+bnlHSDZZbHpIbGNZUngvS1Fqb2dzd1p6UjZKZGowOUhONgoKLS0tIE1NMUV3QlpV
+dEFXMUVOTFBGSlpVSjFzRlpjVTk2dkx1VURUaFl3R014a2cKTnWIRQg4txvZZ4A5
+XdwnXZqmYzOX7l2UrjmP/TJA++EURZzYtTS+q3FV9QTIj+7k0DOLf9nKq7XHlGM8
+Ptkaf/s1Ly7ke+v9l9C2uf9oNI6b+m3d7QqZC5WWvRXWvl9ImaJ3xVi9AM5f5NWH
+Likn6GZDir4ihAec8pAi3H2SCCjkhqF/TlLe99tp+7AAUiOjNuNlej1OUOmJNxEr
+GnHePwZZqa6/F9YnYQ0tKKRsZH5whxUPYUwhHSuWa/NidBK7lqKqdaPBevfdqWLg
+59gkaL9BeGG5FUXg1cPEWAvOQ5Ajae/kVH6aRi5LXJPZfA/DetWgm9mmxJ2qPpFD
+/n/JCsQUOnpk66j38bWMW5uok51s61oG1OZWGpPYstoLtivKOlVpG7xgioGqIIuc
+c2ZsKK/iCauwX3sGQtpX9DbILrtOnzxU2B/dclcXe2EDfSJH0u2RrefxcqPG87pI
+BAosRdq7GUUISSCTccaswwG555a7/Z5gzXOwXeQYNlK1HRnkF9oBsKTUoAI2b+VO
+Hdv1uw9u5JLcZt+5qSB6AxJuk8yDF0KXIqkaCiwl2fV3bBkehPru7oCJFTtVMFVZ
+u0A0h+n8KJCvyRKe/Tl+lT+JHM6Mk7SkFrmsaepZPnAtfLht+bP6b0oHrUsVx/iI
+r7o=
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/network.age
+++ b/secrets/network.age
@@ -0,0 +1,12 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBVMEhO
+RWdybFg4VWJaMjRWYm1ac2pzZ3R5aFZEM1o4dUtFZ0M4QnVKRzIwCnNGRFRjb01X
+QU5mQTRSb21MV3lMMERIMGI1RHFQVFFZNlVlMnk4aTdna1kKLT4gM24xLWdyZWFz
+ZSA/bVhubQplcXNVN3kxOEpqY2hUbkV3MG5PNVJtRGhORVVLdFVCRnFFVjRneEFI
+VWFyZTRNS280RXlnckJpdFR4V1NBSTUzCjlxZkZ3UllpZXUwczR0T3JGRzUzMEhV
+U1hobC84eWtEWWZOYyt6M2c3OUZIUTlKTm41dVp5UEZVSmVwWHBmR00KCi0tLSBF
+ZnJ5QzN2VXpsY3JQQ3lmbklxcldydm1MSlFlejJ2S3hVVUtka0hTM044CvqhtnFn
+pZsgP6w5uKh9CtVQpcyST8hA9P24e1opfu1JN3m/8g9XiJrMT5qVYtUXkV+pr4s6
+pVGsp9KScaS0T8TpLxvZoUAAdvVtdHh6GSbbszR6gZbStbWXmb6THYKHOghpK9HD
+cDEoRmzcmFdwi3m26Xppmi2R6NmeKI4S6pbY95bfh2E6jn+7
+-----END AGE ENCRYPTED FILE-----
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -11,4 +11,8 @@ in
  "lazyworkhorse_host_ssh_key.age".publicKeys = authorizedKeys;
  "n8n_ssh_key.age".publicKeys = authorizedKeys;
  "openclaw_gateway_token.age".publicKeys = authorizedKeys;
+  "ai.age".publicKeys = authorizedKeys;
+  "cloudstorege.age".publicKeys = authorizedKeys;
+  "homeautomation.age".age".publicKeys = authorizedKeys;
+  "network.age".age".publicKeys = authorizedKeys;
 }
--- a/secrets/tak.age
+++ b/secrets/tak.age
@@ -0,0 +1,12 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBsYXVu
+Sk5CSjNsbHBRZkNXUGZVeGNva3FKMUdHV0RiQzJLNHVvSHZzd0dRClNnbzZvUFFR
+Ty96OXZ4R2lCMHpnclpVaEZ1TEYvb0tTSVRwdWV1amdIL0UKLT4gYTtvOmAtZ3Jl
+YXNlICk5WkE7USUgSyRLCjBmTWRTdEJJV2lNbVRlL3VidmZza1NTTWhIcG1vVFY5
+OUUxcG4ycTMraUUKLS0tIEVlaUdlcUFPMkZSMUpJVEFzTksrVC9lZGlMNEJ1SFBv
+SFNtc0wwQ05nQ0EKYlRGYGeKlfW0lTPdpCtcTfh2NWUuyZnDFe6VAWLYL3PW42od
+a+bhlgxTi9KF5FLjVA3IIdQSsKiMya+PI0VfOLWkA24ZN+4uilsQkicxnnRR1z8o
+hv9G8N3eYqBsLylg8rW2Xkn4RzT/S5TyJZPFG4HsUYWtHS+iomg4HbQrgIrpIde9
+Th3V8WQB1HfKs9ilg8Q/DvDckFjevWYz2OXMYx4ZHWS53huQfE/oWPZfQid6Dd06
+NXcvCHPVDUszhWvcoOsSpK6vaOnuY1B32/qExw==
+-----END AGE ENCRYPTED FILE-----
Author	SHA1	Message	Date
gortium	84cab6fd7a	fix: update compose submodule — remove stale COPY for deleted script	2026-07-07 22:29:51 -04:00
gortium	db01cf54d6	fix: update compose submodule — use native s6 multi-profile supervision Updates the compose submodule to commit 3f82c9d on branch fix/hermes-entrypoint-simple, which drops all custom entrypoint scripts and uses the image's native s6-overlay profile supervision. The five profiles (ashley, claire, finn, matt, paul) auto-start on boot via the s6 reconciler reading their gateway_state.json.	2026-07-07 22:26:18 -04:00
Thierry Pouplier	0399a23147	Merge pull request 'fix: update compose submodule for s6-overlay entrypoint crash fix' (#78 ) from fix/hermes-s6-overlay-entrypoint-crash into master Reviewed-on: #78	2026-07-08 02:09:38 +00:00
gortium	c59a65478e	fix: update compose submodule for s6-overlay entrypoint crash fix Updates the compose submodule to commit f4dd57f on branch fix/hermes-s6-overlay-entrypoint-crash, which: - Removes the broken entrypoint override (bash->tini->entrypoint.sh) - Bakes start-hermes.sh into the image as the new CMD - Uses the image default ENTRYPOINT (s6-overlay /init) Fixes the SIGTERM restart loop on the Hermes container. See compose PR #56 for details.	2026-07-07 22:08:46 -04:00
Thierry Pouplier	e061ed28ad	Merge pull request 'fix/hermes-submodule-update' (#79 ) from fix/hermes-submodule-update into master Reviewed-on: #79	2026-07-08 02:06:42 +00:00
Robert	add14ab914	Merge branch 'fix/hermes-submodule-update' of ssh://code.lazyworkhorse.net:2222/gortium/infra into fix/hermes-submodule-update	2026-07-07 20:53:28 -04:00
Hermes	256fa2fde9	chore: update compose submodule (openconcho ReactNode fix)	2026-07-07 20:52:41 -04:00
Hermes	d8919970b6	chore: update compose submodule (openconcho TS fix)	2026-07-07 20:50:05 -04:00
Robert	2deebc102b	Merge branch 'fix/hermes-submodule-update' of ssh://code.lazyworkhorse.net:2222/gortium/infra into fix/hermes-submodule-update	2026-07-07 20:47:16 -04:00
Hermes	898bd2097c	chore: update compose submodule - openconcho to upstream v0.16.0	2026-07-07 20:43:09 -04:00
Robert	d72b799027	Merge branch 'fix/hermes-submodule-update' of ssh://code.lazyworkhorse.net:2222/gortium/infra into fix/hermes-submodule-update	2026-07-07 20:15:36 -04:00
Hermes	c1414603cd	fix: update compose submodule to fix openconcho SHA (force-pushed commit)	2026-07-07 20:10:36 -04:00
Hermes	c8abad243e	fix(compose): update submodule to fix/hermes-gosu-honcho-ssh	2026-07-07 19:49:47 -04:00
Thierry Pouplier	60a90d5f98	Merge pull request 'fix: update compose submodule pin to include USER hermes fix' (#77 ) from local_changes into master Reviewed-on: #77	2026-07-07 19:41:59 +00:00
Hermes	2338eaf74c	fix: update compose submodule to include USER hermes fix The compose submodule now points to commit 54e0661 which adds the missing USER hermes at the end of the Hermes Dockerfile. This ensures all container processes run as uid 10000 instead of root, fixing the privilege leak where background subprocesses escaped the gosu drop and created root-owned files in ExoKortex that broke Syncthing sync.	2026-07-07 14:59:26 -04:00
Robert	df91a909b6	More local changes, mostly compose update and nixmate	2026-07-07 14:15:26 -04:00
Robert	2e236581f0	update lock	2026-06-15 13:20:15 -04:00
Robert	65587809aa	Added opencode api key	2026-06-15 13:17:49 -04:00
Robert	2b1df578ac	Deleted wrongly created file...	2026-06-15 13:16:58 -04:00
Robert	1c806e6390	Updated the compose pin	2026-06-15 13:15:12 -04:00
Robert	78ab440727	Split container secret in preparation to switching seperated env	2026-06-15 13:12:39 -04:00
Robert	ab7da92626	Added tmux, removed opencode, openclaw node	2026-06-11 15:27:08 -04:00
Robert	e3f7d18d8e	Added paperclip and honcho secrets	2026-06-11 15:02:16 -04:00
Thierry Pouplier	5aca97e057	Merge pull request 'feat: add uConsole CM5 host with Reticulum mesh network support' (#61 ) from feat/uconsole-cm5-v3 into master Reviewed-on: #61	2026-06-06 13:19:19 +00:00