my nixos setup https://git.hwebs.info/nixos-config/atom?h=main 2026-08-05T00:09:56Z 2026-08-05T00:09:56Z Henry J. Webster hwebs@hwebs.info 2026-08-04T23:49:58Z urn:sha1:1f63d22ea3689cc567402dd6bf18838c9adea773 Also remove claude-code from human user packages to fully remove agent harnesses from the human account's path. Assisted-by: pi:laguna-xs-2.1 2026-08-04T22:14:09Z Henry J. Webster hwebs@hwebs.info 2026-08-04T22:10:10Z urn:sha1:a4c50351f5d55438a102d48c63dcbb62f9ef5e8d Serve Ollama on kusanagi's Wi-Fi LAN while removing the blanket tailscale0 firewall trust so tailnet traffic follows explicit host firewall rules instead of inheriting every listening service. Add shared LAN networking for both hosts: allow ping, publish and resolve .local names with Avahi, and scope mDNS to each machine's declared Wi-Fi interface. Assisted-by: OpenAI:gpt-5 2026-08-04T03:12:32Z Henry J. Webster hwebs@hwebs.info 2026-08-04T03:00:49Z urn:sha1:3df910d75fa98a7d0291e6b8c6889905c6088f64 Move the yokai agent-sandbox account (user, ikai group, /srv/git drop dir, scoped sudo de-escalation, and the local-clones workflow docs) out of machines/enzo into a shared profiles/sandbox.nix that both machines import. The only per-machine value is the human owner allowed to drop into the sandbox, exposed as a `sandbox.owner` string option so the profile stays username-agnostic (enzo: hwebs, kusanagi: henz). kusanagi gains the sandbox it didn't have before; enzo's inline block collapses to one setting. Assisted-by: claude-code:claude-opus-4-8 2026-08-04T00:44:07Z Henry J. Webster hwebs@hwebs.info 2026-08-04T00:44:07Z urn:sha1:e9b9671d238bb3de779c0dbf4a518b41280be778 Add a bare `yokai` user (primary group `ikai`) for running coding agents under a separate UID, isolated from hwebs's files and secrets. yokai has no privileged group memberships and its own $HOME. - systemd.tmpfiles creates /srv/git (2770 root:ikai) as a drop dir for the agent's local clones, outside ~ so /home/hwebs stays a sealed 700. - security.sudo lets hwebs drop to yokai without a password (de-escalation only, scoped to runAs=yokai; root stays gated). - hwebs joins the ikai group. Extensive comments document the local-clones model: yokai owns its clone, hwebs never runs git inside it, and commits are exchanged by fetching (or via bundles) and landed on main with squash/rebase/interactive + signing. Assisted-by: claude-code:claude-opus-4-8 2026-08-03T22:32:56Z Henry J. Webster hwebs@hwebs.info 2026-08-03T22:32:56Z urn:sha1:66be8debbf34b82a735b17c09ff400d30d8a48f1 The new yambar niri-workspaces.sh script runs `niri msg --json` piped to jq, and the workspace on-clicks run `niri msg action focus-workspace`. yambar spawns these via execvp with no shell, so both binaries must be on the service PATH alongside the existing libnotify/wireplumber. Assisted-by: Claude Code:claude-opus-4-8 2026-08-03T18:01:21Z Henry J. Webster hwebs@hwebs.info 2026-08-03T17:59:24Z urn:sha1:9ca21e94b8ade285e749d54441c7d9115da5b522 - replace x-clip with wl-clipboard for wayland machines - add TODOs I noticed while editing Assisted-by: Claude Code:claude-opus-4-8 2026-08-03T18:01:21Z Henry J. Webster hwebs@hwebs.info 2026-08-01T15:27:09Z urn:sha1:cf5470e00e559b91c9905eff22c4def6ba52baa0 Assisted-by: Claude:Opus-4.8 2026-08-03T18:01:21Z Henry J. Webster hwebs@hwebs.info 2026-07-31T21:31:18Z urn:sha1:720e66715a22cf5c278dfaf03da0cb927c8a2c7a yambar runs on-click commands via execvp with no shell, so the binaries must be on the systemd service PATH. Since the bar moved from a niri spawn (full login PATH) to a user service (minimal PATH), every on-click failed with ENOENT. Add libnotify (notify-send) and wireplumber (wpctl). Assisted-by: Claude Code:claude-opus-4-8 2026-08-01T14:57:40Z Henry J. Webster hwebs@hwebs.info 2026-08-01T14:57:40Z urn:sha1:726ef32d2631f15f991591ef6879925e08f442f6 kusanagi set XCURSOR_THEME=Bibata-Modern-Classic but never declared the theme in Nix — it only resolved while bibata-cursors lingered in an old nix-env profile. Once that was gone the theme fell off the icon path and the pointer/hand cursor disappeared. Standardize both hosts on Adwaita (matching the shared niri config.kdl): move XCURSOR_THEME/XCURSOR_SIZE and the adwaita-icon-theme package into the shared profiles/desktop.nix so the theme is always on the icon path. Drop the inert HYPRCURSOR_* vars (hyprcursor is unused under niri). Assisted-by: Claude:claude-opus-4-8 2026-07-31T14:51:20Z Henry J. Webster hwebs@hwebs.info 2026-07-31T14:51:20Z urn:sha1:9cba5e7886b326bfec049c4ca5024274e4b8e201 Move the niri bar (yambar on enzo, waybar on kusanagi) and swaybg wallpaper out of the shared stowed niri config and into per-machine systemd user services bound to graphical-session.target, mirroring the existing xdg-user-dirs-update unit. This makes the bar host-correct (kusanagi previously spawned yambar, which isn't installed there) and keeps host-specific paths out of the shared config. Also switch the greetd session to a small wrapper script that shows a fortune greeting in tuigreet. Assisted-by: Claude:claude-opus-4-8