feat: enable uconsole-cm5-aio-v2 module on uConsole

flake.nix

@@ -8,46 +8,240 @@
       inputs.darwin.follows = "";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    agenix-rekey = {
+      url = "github:oddlama/agenix-rekey";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     lix = {
       url = "git+https://git.lix.systems/lix-project/lix?ref=main";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    nixpkgs-uconsole.url = "github:NixOS/nixpkgs/nixos-25.11";
     nixos-uconsole = {
-      url = "github:nixos-uconsole/nixos-uconsole";
+      url = "github:gortium/nixos-uconsole/pr/dcs-panel-detection";
-      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs.follows = "nixpkgs-uconsole";
+      inputs.nixos-raspberrypi.follows = "nixos-raspberrypi";
     };
     nixos-raspberrypi = {
-      url = "github:nvmd/nixos-raspberrypi/v1.20260517.0";
+      url = "github:gortium/nixos-raspberrypi/cm5-cross-v1";
-      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs.follows = "nixpkgs-uconsole";
-    };
-    home-manager = {
-      url = "github:nix-community/home-manager/release-25.11";
-      inputs.nixpkgs.follows = "nixpkgs";
     };
     self.submodules = true;
+    home-manager = {
+      url = "github:nix-community/home-manager/release-25.11";
+      inputs.nixpkgs.follows = "nixpkgs-uconsole";
+    };
   };
 
-  outputs = { self, nixpkgs, agenix, lix, nixos-uconsole, nixos-raspberrypi, home-manager, ... }@inputs:
+  outputs = { self, nixpkgs, agenix, agenix-rekey, lix
+            , nixpkgs-uconsole, nixos-uconsole, nixos-raspberrypi
+            , home-manager
+            , ... }@inputs:
     let
       system = "x86_64-linux";
       keys = import ./lib/keys.nix;
-      paths = import ./lib/paths.nix;
+      paths = {
-      overlays = [
+        flake = "/home/gortium/infra";
-        agenix.overlays.default
+        identities = [
-        (import ./overlays/reticulum.nix) ];
+          "/home/gortium/.ssh/gortium_ssh_key"
+          "/etc/ssh/ssh_host_ed25519_key"
+          "/root/.age/bootstrap.key" ];
+      };
+      overlays = [ agenix.overlays.default (import ./overlays/reticulum.nix) ];
       pkgs = import nixpkgs {
         inherit system overlays;
         config.allowUnfree = true;
-        config.permittedInsecurePackages = [
+        config.permittedInsecurePackages = [ "openclaw-2026.3.12" ];
-          "openclaw-2026.3.12"
-        ];
       };
-
       devShell = import ./shells/nix_dev.nix {
         inherit pkgs system agenix;
       };
-    in
+
+       ##############################################################################
+      # CROSS-COMPILE WORKAROUNDS — packages that fail aarch64 cross-compile
+      #
+      # These packages need NATIVE COMPILATION on the uConsole itself (aarch64).
+      # They cannot cross-compile from x86_64 for various reasons listed below.
+      # We work around them in the overlay until we set up distributed builds
+      # with the uConsole as a native aarch64 builder.
+      #
+      # ==== Cross-compile failures ====
+      #
+      # libcamera / libcamera-rpi / libpisp:
+      #   meta.platforms excludes aarch64. pipewire hard-depends on them in nixos-25.11.
+      #   Fix: empty meta.platforms + strip from pipewire buildInputs.
+      #
+      # gjs:
+      #   Need native display (GTK3/4 tests) for cross-compile configure.
+      #   Fix: meson -Dskip_gtk_tests=true.
+      #
+      # hyprland:
+      #   Qt6Quick missing from aarch64 qtdeclarative, breaks hyprland-qt-support.
+      #   Fix: wrapRuntimeDeps=false (Qt UI components disabled, WM still works).
+      #
+      # boost.mpi:
+      #   Boost.Build has no b2 architecture alternatives for ARM.
+      #   Fix: useMpi=false.
+      #
+      # perl-ldap (perlPackages.perlldap):
+      #   Module::Install requires Perl dynamic loading (Fcntl) which is
+      #   unavailable in cross-compiled Perl.
+      #   Fix: stripped from john.s propagatedBuildInputs.
+      #
+      # john (John the Ripper):
+      #   Indirectly affected — depends on perl-ldap for perl utility scripts.
+      #   Fix: perl-ldap stripped from propagatedBuildInputs (john still works,
+      #   just loses sha-dump.pl etc. LDAP support).
+      #
+      # gss (GNU Generic Security Service):
+      #   autogen.sh fails cross-compile. Pulled by mailutils → emacs-pgtk.
+      #   Fix: emacs withMailutils=false.
+      #
+      # emacs-pgtk:
+      #   Indirectly affected — depends on mailutils which depends on gss.
+      #   Fix: withMailutils=false (no mail/IMAP within emacs).
+      #
+      # qtquick3d (Qt6):
+      #   Qt::Quick not available in aarch64 cross-compile qtdeclarative.
+      #   cmake skips build, ninja has no install target.
+      #   Fix: removed js8call, switched wireshark → wireshark-cli.
+      #
+      # js8call:
+      #   REMOVED from system packages. Depends on Qt6 multimedia → qtquick3d.
+      #
+      # wireshark-qt:
+      #   SWITCHED to wireshark-cli. Same Qt6 multimedia → qtquick3d chain.
+      #
+# neovim:
+#   `libnlua0.so` built for aarch64, luajit (x86_64) tries to load it
+#   during codegen (preload_nlua.lua). No clean override option.
+#   Fix: remove from system packages + install via native build
+#   once uConsole is set up as remote builder.
+#
+# clamav:
+#   cmake try_run() + Rust proc-macro can't find native linker in
+#   cross-compile (cc crate uses cross CC, no cc in PATH for build
+#   scripts). Chain: clamav → system-path → etc → dbus → polkit.
+#   Fix: remove from system packages; clamscan available from server.
+
+#
+# ==== Remote builder setup (bidirectional) — TODO ====
+# To eliminate cross-compile exceptions, set up distributed builds:
+# 1. Create a dedicated `builder` user on both hosts (no shell, home=/var/empty)
+# 2. Add the same SSH key to both hosts (symmetric)
+# 3. On lazyworkhorse — `nix.buildMachines` pointing to uConsole for aarch64-linux
+# 4. On uConsole — `nix.buildMachines` pointing to lazyworkhorse for x86_64-linux
+# 5. Remove the uconsoleCrossOverlay workarounds above
+# 6. Nix auto-dispatches derivations by `system` — no per-package exceptions needed
+# Example buildMachines config:
+# Server dispatches aarch64 builds to uConsole (4 cores, less power):
+#   nix.buildMachines = [{
+#     hostName = "uConsole.local";
+#     systems = ["aarch64-linux"];
+#     maxJobs = 4;
+#     sshUser = "builder";
+#     sshKey = "/etc/ssh/builder_key";
+#   }];
+# uConsole dispatches x86_64 builds to server (36 cores, 256GB RAM):
+#   nix.buildMachines = [{
+#     hostName = "lazyworkhorse.net";
+#     port = 2424;
+#     systems = ["x86_64-linux"];
+#     maxJobs = 36;
+#     sshUser = "builder";
+#     sshKey = "/etc/ssh/builder_key";
+#   }];
+
+      # ==== How to build natively on uConsole ====
+      # To native-compile these on the uConsole:
+      # 1. Add uConsole as a remote builder (nix.buildMachines)
+      # 2. Set nix.extra-platforms = [ "aarch64-linux" ] on server
+      # 3. Remove the overlay workarounds below
+      # 4. Packages will auto-dispatch to uConsole for native builds
+      ##############################################################################
+      uconsoleCrossOverlay = final: prev: {
+        libcamera = prev.libcamera.overrideAttrs (_: { meta.platforms = []; });
+        libcamera-rpi = prev.libcamera-rpi.overrideAttrs (_: { meta.platforms = []; });
+        libpisp = prev.libpisp.overrideAttrs (_: { meta.platforms = []; });
+        pipewire = prev.pipewire.overrideAttrs (old: {
+          buildInputs = builtins.filter
+            (x: !(x?pname && x.pname == "libcamera"))
+            (old.buildInputs or []);
+          mesonFlags = builtins.filter
+            (flag: !(builtins.isString flag && builtins.match ".*libcamera.*" flag != null))
+            (old.mesonFlags or []) ++ [ "-Dlibcamera=disabled" ];
+        });
+        gjs = prev.gjs.overrideAttrs (old: {
+          mesonFlags = (old.mesonFlags or []) ++ [ "-Dskip_gtk_tests=true" ];
+        });
+        hyprland = prev.hyprland.override { wrapRuntimeDeps = false; };
+        boost = prev.boost.override { useMpi = false; };
+        # perl-ldap cannot cross-compile (Module::Install needs dynamic loading)
+        xdg-desktop-portal-hyprland = prev.xdg-desktop-portal-hyprland.overrideAttrs (old: {
+          preConfigure = (old.preConfigure or "") + ''
+            cmakeFlags="$cmakeFlags -Dhyprwayland-scanner_DIR=${prev.buildPackages.hyprwayland-scanner}/lib/cmake/hyprwayland-scanner" 2>/dev/null || true
+            export PKG_CONFIG_PATH="${prev.buildPackages.hyprwayland-scanner}/lib/pkgconfig:$PKG_CONFIG_PATH"
+          '';
+        });
+        emacs-pgtk = prev.emacs-pgtk.override { withMailutils = false; };
+        # perl-ldap fails cross-compile (Module::Install needs dynamic loading)
+        # Strip it from john deps -- the perl scripts that need it are not critical
+        john = prev.john.overrideAttrs (old: {
+          propagatedBuildInputs = builtins.filter
+            (x: x?pname && x.pname != "perl-ldap")
+            (old.propagatedBuildInputs or []);
+        });
+        # clamav: removed from system packages (see note above).
+      };
+
+      uconsoleRpiPipewireOverlay = final: prev: {
+        pipewire = prev.pipewire.overrideAttrs (old: {
+          buildInputs = builtins.filter
+            (x: !(x?pname && x.pname == "libcamera"))
+            (old.buildInputs or []);
+          mesonFlags = builtins.filter
+            (flag: !(builtins.isString flag && builtins.match ".*libcamera.*" flag != null))
+            (old.mesonFlags or []) ++ [ "-Dlibcamera=disabled" ];
+        });
+      };
+
+      uconsoleBaseModules = [
         {
+          nixpkgs.buildPlatform = "x86_64-linux";
+          nixpkgs.hostPlatform = "aarch64-linux";
+          nixpkgs.config.allowUnfree = true;
+          boot.loader.raspberry-pi.bootloader = "kernel";
+          nixpkgs.overlays = [ uconsoleCrossOverlay (import ./overlays/reticulum.nix) ];
+        }
+        nixos-raspberrypi.nixosModules.nixpkgs-rpi
+        ({ config, lib, pkgs, ... }: {
+          nixpkgs.overlays = [ uconsoleRpiPipewireOverlay ];
+        })
+        nixos-raspberrypi.nixosModules.raspberry-pi-5.base
+        nixos-raspberrypi.lib.inject-overlays
+        nixos-raspberrypi.lib.inject-overlays-global
+        nixos-uconsole.nixosModules.uconsole-cm5
+        ./modules/nixos/hardware/uconsole-cm5-aio-v2.nix
+        ({ config, lib, pkgs, inputs, ... }: let
+          lixCross = import inputs.nixpkgs-uconsole {
+            localSystem = { system = "x86_64-linux"; };
+            crossSystem = { system = "aarch64-linux"; };
+            overlays = [ inputs.lix.overlays.default ];
+          };
+        in { nix.package = lixCross.lix; })
+        inputs.home-manager.nixosModules.home-manager
+        agenix.nixosModules.default
+        agenix-rekey.nixosModules.default
+        ./hosts/uconsole-cm5/configuration.nix
+        ./hosts/uconsole-cm5/hardware-configuration.nix
+        ./modules/nixos/services/remote-builder.nix
+        ./modules/nixos/services/wireguard-client.nix
+        ./modules/nixos/services/clamav.nix
+        ./modules/nixos/security/ai-worker-restricted.nix
+        ./users/gortium/gortium.nix
+        ./users/ai-worker/ai-worker.nix
+      ];
+    in {
       nixosConfigurations = {
         lazyworkhorse = nixpkgs.lib.nixosSystem {
           specialArgs = { inherit system self keys paths inputs; };
@@ -56,23 +250,22 @@
               nixpkgs.overlays = overlays;
               nixpkgs.config.allowUnfree = true;
               nixpkgs.config.rocmSupport = true;
-                nixpkgs.config.permittedInsecurePackages = [
+              nixpkgs.config.permittedInsecurePackages = [ "openclaw-2026.3.12" ];
-                  "openclaw-2026.3.12"
-                ];
               nix.package = lix.packages.${system}.default;
             }
+            inputs.home-manager.nixosModules.home-manager
             agenix.nixosModules.default
             ./hosts/lazyworkhorse/configuration.nix
             ./hosts/lazyworkhorse/hardware-configuration.nix
             ./modules/nixos/filesystem/hoardingcow-mount.nix
             ./modules/nixos/services/docker_manager.nix
-              ./modules/nixos/services/open_code_server.nix
-              ./modules/nixos/services/ollama_init_custom_models.nix
-              ./modules/nixos/services/openclaw_node.nix
             ./modules/nixos/filesystem/poup-16t-disk.nix
+            ./modules/nixos/services/ollama_init_custom_models.nix
+            ./modules/nixos/services/open_code_server.nix
+            ./modules/nixos/services/clamav.nix
             ./modules/nixos/security/ai-worker-restricted.nix
-              ./users/gortium.nix
+            ./users/gortium/gortium.nix
-              ./users/ai-worker.nix
+            ./users/ai-worker/ai-worker.nix
           ];
         };
 
@@ -87,27 +280,42 @@
             }
             ./hosts/cyt-pi/configuration.nix
             ./hosts/cyt-pi/hardware-configuration.nix
+            ./modules/nixos/services/remote-builder.nix
+        ./modules/nixos/services/wireguard-client.nix
+            ./users/gortium/gortium.nix
           ];
         };
 
-          uConsole = nixos-raspberrypi.lib.nixosSystem {
+        uconsole-cm5 = nixpkgs-uconsole.lib.nixosSystem {
-            specialArgs = { inherit self keys paths inputs nixos-raspberrypi; };
+          system = "aarch64-linux";
-            modules = [
+          specialArgs = {
-              {
+            inherit self keys paths inputs;
-                nixpkgs.overlays = overlays;
+            nixos-raspberrypi = nixos-raspberrypi;
-                nixpkgs.config.allowUnfree = true;
+            isCM4 = false;
-                nixpkgs.hostPlatform = "aarch64-linux";
+          };
-                nix.package = lix.packages."aarch64-linux".default;
+          modules = uconsoleBaseModules;
-              }
-              nixos-raspberrypi.nixosModules.raspberry-pi-5.base
-              nixos-uconsole.nixosModules.uconsole-cm5
-              agenix.nixosModules.default
-              ./modules/nixos/hardware/uconsole-cm5-aio-v2.nix
-              ./hosts/uConsole/configuration.nix
-              ./hosts/uConsole/hardware-configuration.nix
-            ];
         };
       };
+
+      agenix-rekey = agenix-rekey.configure {
+        userFlake = self;
+        nixosConfigurations = self.nixosConfigurations;
+      };
+
       devShells.${system}.default = devShell;
+
+      packages.${system} = {
+        uconsole-cm5-image = (nixos-raspberrypi.lib.nixosSystem {
+          system = "aarch64-linux";
+          specialArgs = {
+            inherit self keys inputs;
+            nixos-raspberrypi = nixos-raspberrypi;
+            isCM4 = false;
+          };
+          modules = uconsoleBaseModules ++ [
+            nixos-raspberrypi.nixosModules.sd-image
+          ];
+        }).config.system.build.sdImage;
+      };
     };
 }

hosts/lazyworkhorse/configuration.nix

@@ -569,19 +569,3 @@
 
 }
 
-  # Remote builder — uConsole for aarch64-linux native builds
-  nix.distributedBuilds = true;
-  nix.buildMachines = [{
-    hostName = "192.168.1.120";
-    systems = ["aarch64-linux"];
-    maxJobs = 4;
-    supportedFeatures = ["big-parallel" "nixos-test" "benchmark" "gccarch-armv8-a"];
-    sshUser = "builder";
-    sshKey = "/home/ai-worker/id_deploy";
-  }];
-  nix.extraOptions = '
-    builders-use-substitutes = true
-    fallback = true
-  ';
-
-

hosts/uconsole-cm5/configuration.nix

@@ -1,11 +1,11 @@
 { config, lib, pkgs, keys, ... }:
+
 {
   networking.hostName = "uConsole";
   time.timeZone = "America/Montreal";
   i18n.defaultLocale = "en_CA.UTF-8";
   system.stateVersion = "25.11";
-  # Boot & Hardware
+
-  boot.loader.raspberry-pi.bootloader = "kernel";
   # SSH — root access avec clés gortium + ai-worker
   services.openssh = {
     enable = true;
@@ -14,32 +14,41 @@
       PasswordAuthentication = lib.mkForce false;
     };
   };
+
   users.users.root.openssh.authorizedKeys.keys = with keys; [
     users.gortium.main
     users.ai-worker.main
   ];
+
+  # AI worker user (Hermes SSH access)
+  users.users.ai-worker = {
+    isNormalUser = false;
+    shell = pkgs.bash;
+    openssh.authorizedKeys.keys = with keys; [
+      users.ai-worker.main
+    ];
+  };
+
   # Age secret for gortium password (file created by user)
   age.secrets.gortium_password = {
-    file = ../../secrets/gortium_password.age;
+    file = ../secrets/gortium_password.age;
   };
-  # WiFi via NetworkManager
+
+  # Password file for gortium (merges with users/gortium/default.nix)
+
+  # WiFi via NetworkManager + secret agenix
   networking.networkmanager.enable = true;
+
   # Firmware
   hardware.enableRedistributableFirmware = true;
-  # RealtimeKit for PipeWire audio
+
-  security.rtkit.enable = true;
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    alsa.support32Bit = true;
-    pulse.enable = true;
-  };
   # Hyprland Wayland compositor (manual start — no SDDM)
   programs.hyprland = {
     enable = true;
     xwayland.enable = true;
   };
-  # HackerGadgets AIO v2 board
+
+  # HackerGadgets AIO v2 board — GPIO rail control, aiov2_ctl CLI
   hardware.uconsole-cm5-aio-v2 = {
     enable = true;
     bootRails = {
@@ -50,165 +59,4 @@
     };
     enableGPS = false;
   };
-  # User
-  users.users.gortium = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" "networkmanager" "video" "dialout" "kismet" ];
-    hashedPasswordFile = config.age.secrets.gortium_password.path;
-    openssh.authorizedKeys.keys = [
-      keys.users.gortium.main
-      keys.users.gortium.gitea
-    ];
-  };
-  security.sudo.extraRules = [
-    {
-      users = [ "gortium" ];
-      commands = [{
-        command = "ALL";
-        options = [ "NOPASSWD" ];
-      }];
-    }
-  ];
-  # ============================================================
-  # Package groups
-  # ============================================================
-  # ============================================================
-  # CROSS-COMPILE REMOVALS — packages removed for aarch64 bootstrap
-  # ============================================================
-  # These packages fail to cross-compile for aarch64.
-  # Install them natively AFTER the first successful switch.
-  #
-  # Removed:                              Reason:
-#   inspectrum — Qt5 cross-compile cascade fails (qtsvg mismatched qtbase deps)
-  #   hashcat   — Makefile calls gcc directly (cross-compiler not used)
-  #   neovim    — Same as hashcat: Makefile calls gcc directly (cross-compiler not used)
-  #   clamav    — cmake try_run + Rust proc-macro linker for aarch64
-  #   sdrpp     — glfw/wxPython cross-compile fails
-  #   gqrx      — Qt5 cross-compile cascade fails
-  #   emacs-pgtk → emacs-nox — GTK3 + mailutils → gss → shishi chain
-  #   viking    — GTK3 GPS map editor
-  #   foxtrotgps — GTK2 GPS app
-  #   js8call   — QtQuick3D dep
-  #   wsjtx     — qtbase/Qt5 linker fails (collect2: ld returned 1)
-  #   fldigi    — same: qtbase/Qt5 linker fails
-#   gpsbabel  — qmake can't find cross-compiler g++
-#   john      — configure script needs python (not in PATH during cross-compile)
-#   trustedqsl — needs wxWidgets (unavailable in cross-compile)
-#   chirp — depends on wxPython (fails cross-compile: GTK3 + wx build)
-  # ============================================================
-  environment.systemPackages = with pkgs; [
-    # ===== Base =====
-    # emacs-pgtk — removed for bootstrap (GTK3 cross-compile fails)
-    # emacs-nox — removed for bootstrap (depends on mailutils -> gss -> shishi, cross-compile fails)
-    git
-    ripgrep
-    fd
-    htop
-    tmux
-    # ===== HAM Radio =====
-    wsjtx # removed for bootstrap - now native
-    fldigi # removed for bootstrap - now native
-    pat                        # Winlink client
-    direwolf                   # AX.25 packet modem
-    chirp # Radio programming tool - now native
-    hamlib                     # Ham radio control libraries
-    trustedqsl # Logbook of the World (LoTW) - now native
-    # ===== SDR / RF =====
-    sdrpp # removed for bootstrap - now native
-    gqrx # removed for bootstrap - now native
-    rtl-sdr                    # RTL-SDR drivers & utilities
-    inspectrum # removed for bootstrap - now native
-    soapysdr-with-plugins      # SoapySDR + hardware support plugins
-    # ===== Mesh / LoRa =====
-    reticulumStack             # Reticulum Network Stack
-    lxmf                       # LXMF messaging protocol
-    nomadnet                   # Nomad Network client
-    # ===== Security =====
-    nmap
-    aircrack-ng
-    kismet                     # Wi-Fi monitor / IDS
-    bettercap                  # MITM/network attack framework
-    wireshark-cli                  # Packet analyzer
-    john # John the Ripper - now native
-    sqlmap                     # SQL injection tool
-    # ===== GPS / Maps =====
-    foxtrotgps # removed for bootstrap - now native
-    viking # removed for bootstrap - now native
-    gpsbabel # GPS data conversion - now native
-  ];
-  # ============================================================
-  # Reticulum Service (rnsd)
-  # ============================================================
-  systemd.services.rnsd = {
-    description = "Reticulum Network Stack Daemon";
-    wants = [ "network-online.target" ];
-    after = [ "network-online.target" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      User = "gortium";
-      Group = "gortium";
-      ExecStart = "${pkgs.reticulumStack}/bin/rnsd";
-      Restart = "always";
-      RestartSec = "10s";
-      LimitNOFILE = 65536;
-    };
-  };
-  # ============================================================
-  # Kismet Service (Wi-Fi monitoring / mesh node)
-  # ============================================================
-  systemd.services.kismet = {
-    description = "Kismet Wi-Fi Monitor & IDS";
-    wants = [ "network-online.target" ];
-    after = [ "network-online.target" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      User = "gortium";
-      Group = "kismet";
-      ExecStart = "${pkgs.kismet}/bin/kismet -c wlan0 --log-prefix=/home/gortium/kismet_logs --no-nc-ui";
-      Restart = "always";
-      RestartSec = "10s";
-    };
-  };
-  # ============================================================
-  # Kernel modules for SDR and radio
-  # ============================================================
-  boot.kernelModules = [
-    "88x2bu"          # Realtek 8812/8821BU USB WiFi
-    "rtl8xxxu"        # RTL8188/8192/8723 USB WiFi
-    "rtl2832_sdr"     # RTL-SDR kernel module
-    "dvb_usb_rtl28xxu" # RTL-SDR DVB-T
-  ];
-  # ============================================================
-  # Extra udev rules for SDR and HAM radio devices
-  # ============================================================
-  services.udev.packages = with pkgs; [ rtl-sdr ];
-  # ============================================================
-  # Enable IPv6 for Reticulum mesh
-  # ============================================================
-  networking.enableIPv6 = true;
-  # ============================================================
-  # Firewall
-  # ============================================================
-  networking.firewall.allowedTCPPorts = [ 22 ];
-  networking.firewall.allowedUDPPorts = [ ];
-  # ============================================================
-  # agenix-rekey — automatic secret re-encryption at deploy time
-  # ============================================================
-  age.rekey = {
-    # Master identities for encrypting secrets (on Thierry's laptop)
-    masterIdentities = [
-      "/home/gortium/.ssh/gortium_ssh_key"
-    ];
-    # uConsole SSH host pubkey — for automatic rekey at build time
-    # Once uConsole is deployed, replace with actual pubkey from:
-    #   ssh-keyscan uConsole.local | ssh-to-age
-    hostPubkey = "age1qyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqs3290gq"; # dummy — replace after bootstrap
-  };
-
-  # Pipewire overlay: drop libcamera (fixes aarch64 cross-compile — rpi-pisp blocks)
-  nixpkgs.overlays = [
-    (final: prev: {
-      pipewire = prev.pipewire.override { libcamera = null; };
-    })
-  ];
 }

modules/nixos/hardware/uconsole-cm5-aio-v2.nix

@@ -47,7 +47,6 @@ let
     };
 
     dontUnpack = true;
-    buildInputs = [ pkgs.python3 ];
 
     installPhase = ''
       mkdir -p $out/bin $out/share/aiov2_ctl/img

users/gortium/gortium.nix

@@ -1,7 +1,5 @@
 { pkgs, inputs, config, keys, ... }: {
-  home-manager.extraSpecialArgs = {
+  home-manager.extraSpecialArgs = { inherit (config.networking) hostName; dotfiles = inputs.dotfiles.outPath # flake input (not submodule); };
-    inherit (config.networking) hostName;
-  };
   home-manager.users.gortium = import ./home.nix;
   users.users.gortium = {
     isNormalUser = true;

users/gortium/home.nix

@@ -2,7 +2,6 @@
 
 let
   isUconsole = hostName == "uConsole";
-  dotfiles = ../../assets/dotfiles;
 in {
   home.username = "gortium";
   home.homeDirectory = "/home/gortium";
@@ -34,9 +33,6 @@ in {
     ".config/wofi/config".source = "${dotfiles}/wofi/.config/wofi/config";
 
     # yazi
-
-    # wallpapers
-    ".config/wallpapers".source = "${dotfiles}/wallpapers/.config/wallpapers";
     ".config/yazi/yazi.toml".source = "${dotfiles}/yazi/.config/yazi/yazi.toml";
 
     # hyprland — common config
@@ -47,45 +43,22 @@ in {
     ".config/hypr/mocha.conf".source = "${dotfiles}/hypr/.config/hypr/mocha.conf";
 
     # hyprland — host-specific monitor config
-    ".config/hypr/hosts/monitors.conf".source =
+    ".config/hypr/host/monitors.conf".source =
       if isUconsole
       then "${dotfiles}/hypr/.config/hypr/hosts/uconsole.conf"
       else "${dotfiles}/hypr/.config/hypr/hosts/laptop.conf";
   };
 
-  programs.bash.enable = true;
-  programs.zsh = {
-    enable = true;
-    initExtra = builtins.readFile "${dotfiles}/zsh/.zshrc";
-  };
-
   home.packages = with pkgs; [
     git zsh tmux starship
     neovim kitty
     btop yazi ripgrep fd fzf
-    htop unzip wget jq
+  ] ++ lib.optionals (!isUconsole) [
-    hyprland hyprlock hypridle hyprpaper
+    waybar wofi swww hyprshot
-    waybar wofi dunst
+  ] ++ lib.optionals isUconsole [
-    libnotify mako
+    brightnessctl
-    swaynotificationcenter
-    swww
-    emacs
-    udiskie
-    hyprshade
-    networkmanagerapplet
-    pavucontrol
   ];
 
-  xdg.userDirs = {
+  programs.zsh.enable = true;
-    enable = true;
+  programs.starship.enable = true;
-    createDirectories = true;
-    desktop = "$HOME/desktop";
-    documents = "$HOME/documents";
-    download = "$HOME/downloads";
-    music = "$HOME/music";
-    pictures = "$HOME/pictures";
-    publicShare = "$HOME/public";
-    templates = "$HOME/templates";
-    videos = "$HOME/videos";
-  };
 }