fix(wol): generalize 'wol-*' scripts

home/hosts/andromache/default.nix

@@ -19,10 +19,7 @@
   xdg.userDirs.createDirectories = false;
   xdg.userDirs.download = "${config.home.homeDirectory}/dl";
 
-  modules."3d" = {
-    printing.enable = true;
-    modeling.enable = true;
-  };
+  modules."3d".printing.enable = true;
   ai-tools = {
     claude-code.enable = true;
     codex.enable = true;

home/modules/3d/default.nix

@@ -6,7 +6,18 @@
       enable = lib.mkEnableOption "3D printing tools";
     };
     modeling = {
-      enable = lib.mkEnableOption "3D modeling tools";
+      blender = {
+        enable = lib.mkOption {
+          default = false;
+          type = lib.types.bool;
+        };
+      };
+      openscad = {
+        enable = lib.mkOption {
+          default = false;
+          type = lib.types.bool;
+        };
+      };
     };
   };
 

home/modules/3d/modeling.nix

@@ -6,11 +6,15 @@
 }:
 
 {
-  config = lib.mkIf config.modules."3d".modeling.enable {
-    home.packages = with pkgs; [
-      blender
-      openscad-lsp
-      openscad-unstable
-    ];
+  config = {
+    home.packages =
+      with pkgs;
+      lib.optionals config.modules."3d".modeling.blender.enable [
+        blender
+      ]
+      ++ lib.optionals config.modules."3d".modeling.openscad.enable [
+        openscad-lsp
+        openscad-unstable
+      ];
   };
 }

home/modules/ai-tools/claude-code.nix

@@ -6,52 +6,33 @@
 }:
 let
   cfg = config.ai-tools.claude-code;
-  rtk-version = "0.18.1";
 in
 {
   config = lib.mkIf cfg.enable {
     programs.claude-code.enable = true;
 
     home.packages = with pkgs; [
-      (stdenv.mkDerivation {
-        name = "ccline";
-        src = fetchurl {
-          url = "https://github.com/Haleclipse/CCometixLine/releases/download/v1.0.8/ccline-linux-x64.tar.gz";
-          hash = "sha256-Joe3Dd6uSMGi66QT6xr2oY/Tz8rA5RuKa6ckBVJIzI0=";
+      (rustPlatform.buildRustPackage (finalAttrs: {
+        pname = "ccometixline";
+        version = "2.0.1";
+        src = fetchFromGitHub {
+          owner = "Haleclipse";
+          repo = "CCometixLine";
+          tag = "v${finalAttrs.version}";
+          hash = "sha256-tzEo+8M86C6EdN31rDVqt8+SCYqeEXRCVFsbtbW41XY=";
         };
-        unpackPhase = "tar xzf $src";
-        installPhase = ''
-          mkdir -p $out/bin
-          cp ccline $out/bin/
-          chmod +x $out/bin/ccline
-        '';
+        cargoHash = "sha256-dTsuyklpaiYqp5Rq1Q7YUBrmQUH42ve2UY+MwUqF7Ek=";
+        checkFlags = [ "--skip=git::tests::detects_repositories_without_spawning_git" ];
+        postInstall = "mv $out/bin/ccometixline $out/bin/ccline";
         meta = {
-          description = "CCometixLine Linux x64 CLI (Claude Code statusline)";
+          description = "CCometixLine (ccline) - Claude Code statusline tool";
           homepage = "https://github.com/Haleclipse/CCometixLine";
           license = lib.licenses.mit;
-          platforms = [ "x86_64-linux" ];
+          mainProgram = "ccline";
+          platforms = lib.platforms.unix;
         };
-      })
-      (stdenv.mkDerivation {
-        name = "rtk-${rtk-version}";
-        version = rtk-version;
-        src = fetchurl {
-          url = "https://github.com/rtk-ai/rtk/releases/download/v${rtk-version}/rtk-x86_64-unknown-linux-gnu.tar.gz";
-          hash = "sha256-XoTia5K8b00OzcKYCufwx8ApkAS31DxUCpGSU0jFs2Q=";
-        };
-        unpackPhase = "tar xzf $src";
-        installPhase = ''
-          mkdir -p $out/bin
-          cp rtk $out/bin/
-          chmod +x $out/bin/rtk
-        '';
-        meta = {
-          description = "RTK - AI coding tool enhancer";
-          homepage = "https://www.rtk-ai.app";
-          license = lib.licenses.mit;
-          platforms = [ "x86_64-linux" ];
-        };
-      })
+      }))
+      rtk
       mcp-nixos
     ];
   };

home/modules/browser/firefox-base.nix

@@ -53,6 +53,10 @@ in
   };
   policies = {
     DefaultDownloadDirectory = "\${home}/dl";
+    "3rdparty".Extensions."keepassxc-browser@keepassxc.org".settings = {
+      defaultGroup = "browser";
+      defaultPasskeyGroup = "browser";
+    };
     ExtensionSettings = {
       "jid1-ZAdIEUB7XOzOJw@jetpack" = {
         default_area = "navbar";

hosts/andromache/default.nix

@@ -8,7 +8,6 @@
 
 let
   meta = import ./meta.nix;
-  wolInterfaces = import ./wol-interfaces.nix;
 in
 {
   imports = [
@@ -88,10 +87,7 @@ in
   };
   tailscale.enable = true;
   taskwarrior.enable = true;
-  wol = {
-    enable = true;
-    interfaces.eno1 = { inherit (wolInterfaces.eno1) macAddress; };
-  };
+  wol.interfaces.eno1.macAddress = "02:68:b3:29:da:98";
   zfs.enable = true;
 
   disko.devices = {

hosts/andromache/wol-interfaces.nix

@@ -1,3 +0,0 @@
-{
-  eno1.macAddress = "02:68:b3:29:da:98";
-}

hosts/astyanax/default.nix

@@ -71,6 +71,7 @@ in
     };
   };
   taskwarrior.enable = true;
+  wol.wakes = [ "andromache" ];
   zfs.enable = true;
 
   secrets.nixSigningKey.enable = true;
@@ -82,16 +83,6 @@ in
 
   hardware.cpu.intel.updateMicrocode = true;
 
-  environment.systemPackages = [
-    (pkgs.writeShellApplication {
-      name = "wol-andromache";
-      runtimeInputs = [ pkgs.wakeonlan ];
-      text = ''
-        wakeonlan ${(import ../andromache/wol-interfaces.nix).eno1.macAddress}
-      '';
-    })
-  ];
-
   networking = {
     hostId = "5f0bde3c";
     useDHCP = false;

hosts/eetion-02/default.nix

@@ -16,6 +16,7 @@ in
 
   ssh.enable = true;
   tailscale.enable = true;
+  wol.wakes = [ "andromache" ];
 
   boot = {
     kernelParams = [

modules/backups/default.nix

@@ -21,6 +21,11 @@ in
       type = lib.types.listOf lib.types.str;
       default = [ "/home" ];
     };
+
+    inhibitsSleep = lib.mkOption {
+      type = lib.types.bool;
+      default = config.host.role != "laptop";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -53,6 +58,7 @@ in
         Persistent = true;
       };
       initialize = true;
+      inherit (cfg) inhibitsSleep;
       extraBackupArgs = [ "--one-file-system" ];
       pruneOpts = [
         "--keep-daily 7"
@@ -62,5 +68,11 @@ in
       ];
       environmentFile = config.sops.templates."restic/b2-env-${host}".path;
     };
+
+    systemd.services.restic-backups-home = {
+      unitConfig = {
+        RequiresMountsFor = cfg.paths;
+      };
+    };
   };
 }

modules/ssh/hardened-openssh.nix

@@ -17,18 +17,32 @@ in
   config = {
     networking.firewall.allowedTCPPorts = lib.mkIf config.ssh.enable [ 22 ];
 
-    services.openssh.settings = optionalAttrs cfg.harden {
-      PermitRootLogin = "no";
-      PasswordAuthentication = false;
-      AuthenticationMethods = "publickey";
-      KbdInteractiveAuthentication = false;
-      ChallengeResponseAuthentication = false;
-      X11Forwarding = false;
-      AllowAgentForwarding = false;
-      AllowTcpForwarding = false;
-      PermitTunnel = false;
-      MaxAuthTries = 3;
-      LoginGraceTime = "1m";
+    services.openssh = {
+      settings = optionalAttrs cfg.harden {
+        PermitRootLogin = "no";
+        PasswordAuthentication = false;
+        AuthenticationMethods = "publickey";
+        KbdInteractiveAuthentication = false;
+        ChallengeResponseAuthentication = false;
+        X11Forwarding = false;
+        AllowAgentForwarding = false;
+        AllowTcpForwarding = false;
+        PermitTunnel = false;
+        MaxAuthTries = 3;
+        LoginGraceTime = "1m";
+        ClientAliveInterval = 300;
+        ClientAliveCountMax = 2;
+        TCPKeepAlive = false;
+        MaxSessions = 4;
+        LogLevel = "VERBOSE";
+        AllowUsers = [ config.host.username ];
+      };
+      hostKeys = mkIf cfg.harden [
+        {
+          type = "ed25519";
+          path = "/etc/ssh/ssh_host_ed25519_key";
+        }
+      ];
     };
   };
 }

modules/wol/default.nix

@@ -1,33 +1,57 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  outputs,
+  paths,
+  myUtils,
+  pkgs,
+  ...
+}:
 
 let
-  inherit (lib) mkEnableOption mkOption types;
+  hosts = myUtils.dirNames paths.hosts;
+  interfaces = host: outputs.nixosConfigurations.${host}.config.wol.interfaces;
 in
 {
   options.wol = {
-    enable = mkEnableOption "Wake-on-LAN configuration";
+    wakes = lib.mkOption {
+      type = lib.types.listOf (lib.types.enum hosts);
+    };
 
-    interfaces = mkOption {
-      type = types.attrsOf (
-        types.submodule {
+    interfaces = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule {
           options = {
-            macAddress = mkOption {
-              type = types.str;
-              example = "02:68:b3:29:da:98";
-            };
+            macAddress = lib.mkOption { type = lib.types.str; };
           };
         }
       );
-      default = { };
     };
   };
 
-  config = lib.mkIf config.wol.enable {
+  config = {
+    assertions = map (host: {
+      assertion = interfaces host != { };
+      message = "cannot set up wake-on-lan for '${host}' as it declares no 'wol.interfaces'.";
+    }) config.wol.wakes;
+
     networking.interfaces = lib.mapAttrs (_: iface: {
       wakeOnLan.enable = true;
       inherit (iface) macAddress;
     }) config.wol.interfaces;
 
-    # networking.firewall.allowedUDPPorts = [ 9 ];
+    environment.systemPackages = map (
+      host:
+      let
+        macAddresses = lib.mapAttrsToList (_: interface: interface.macAddress) (interfaces host);
+      in
+      pkgs.writeShellApplication {
+        name = "wol-${host}";
+        runtimeInputs = [ pkgs.wakeonlan ];
+        text = ''
+          wakeonlan ${lib.escapeShellArgs macAddresses}
+        '';
+      }
+    ) config.wol.wakes;
   };
 }