feat(ntfy): wire Home Assistant rest_command publisher

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -0,0 +1,92 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Commands
+
+```bash
+# Apply configuration (switch/boot/test)
+sudo nixos-rebuild switch --flake '.#jupiter'
+sudo nixos-rebuild switch --flake '.#mibook'
+
+# Build without switching (CI-style check)
+nix build '.#nixosConfigurations.jupiter.config.system.build.toplevel'
+
+# Update all flake inputs
+nix flake update
+
+# Format Nix files
+nixfmt-rfc-style <file>   # or: find . -name '*.nix' | xargs nixfmt-rfc-style
+```
+
+## Architecture
+
+This is a flake-parts NixOS configuration for two machines:
+
+- **jupiter** — home server running media/automation services
+- **mibook** — laptop running KDE desktop + development tools
+
+### Module Loading Chain
+
+```
+flake.nix
+└── machines/configuration.nix        # flake-parts module; defines nixosConfigurations
+    ├── machines/core/                 # base modules applied to every machine
+    │   ├── core.nix                   # system packages, locale, timezone
+    │   ├── network.nix
+    │   ├── nix.nix
+    │   └── users.nix
+    ├── modules/                       # custom NixOS option modules (my.profiles.*, my.hardware.*, my.services.*)
+    │   ├── environments/              # per-service/app profiles
+    │   ├── hardware/                  # hardware profiles (nvidia, bluetooth, sound, wifi)
+    │   └── services/                  # infrastructure services (vpn, webserver)
+    └── machines/<name>/
+        ├── configuration.nix          # machine-specific NixOS settings
+        ├── environments.nix           # enables profiles via my.profiles.* / my.hardware.* options
+        ├── disks.nix
+        └── hardware-configuration.nix
+```
+
+### Profile / Module Pattern
+
+Every module under `modules/` follows the same structure:
+
+```nix
+{ config, lib, pkgs, ... }:
+let cfg = config.my.profiles.<name>; in
+{
+  options.my.profiles.<name>.enable = lib.mkEnableOption "...";
+  config = lib.mkIf cfg.enable { ... };
+}
+```
+
+Namespaces in use:
+- `my.profiles.*` — application/service profiles
+- `my.hardware.*` — hardware profiles
+- `my.services.*` — infrastructure services
+
+Profiles are enabled per-machine in `machines/<name>/environments.nix`.
+
+### Unstable Packages
+
+`pkgs.unstable` is available everywhere via an overlay defined in `machines/configuration.nix`. Use it when a package isn't in the pinned stable channel (`nixpkgs/nixos-25.11`).
+
+### Homepage Dashboard Integration
+
+Modules that expose a web UI can self-register with the homepage dashboard by adding to `my.homepage.services`:
+
+```nix
+my.homepage.services = [{
+  group = "Services";
+  name = "My Service";
+  description = "...";
+  href = "http://${hostName}:PORT";
+  icon = "si-iconname";  # optional
+}];
+```
+
+### Adding a New Service Module
+
+1. Create `modules/environments/<name>/default.nix` following the profile pattern above.
+2. Add `./environments/<name>` to `modules/environments/default.nix` (or the relevant `default.nix`).
+3. Enable it in the target machine's `machines/<name>/environments.nix`.

docs/superpowers/plans/2026-07-05-ntfy-module.md

@@ -0,0 +1,269 @@
+# ntfy Notification Module Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add a `my.profiles.ntfy` NixOS module that runs an auth-required self-hosted ntfy server on jupiter, exposes a homepage tile, and wires a Home Assistant `rest_command` for publishing notifications.
+
+**Architecture:** A single profile module under `modules/environments/ntfy/`, following the repo's `my.profiles.<name>` pattern. It configures `services.ntfy-sh` with `auth-default-access = deny-all`, opens the firewall, registers a homepage tile, and — when the home-assistant profile is enabled — merges a `rest_command.ntfy_send` into `services.home-assistant.config`. No secrets touch the Nix store; credentials are provisioned manually by the operator, and the only secret lives in HA's `secrets.yaml`.
+
+**Tech Stack:** Nix (flake-parts NixOS config), nixpkgs `services.ntfy-sh`, `services.home-assistant`, nixfmt-rfc-style.
+
+## Global Constraints
+
+- Follow the profile pattern exactly: `let cfg = config.my.profiles.<name>; in { options.my.profiles.<name>.enable = lib.mkEnableOption "..."; config = lib.mkIf cfg.enable { ... }; }`.
+- Namespace is `my.profiles.ntfy`.
+- Homepage self-registration uses `my.homepage.services` (list of `{ group; name; description; href; icon; }`).
+- `hostName` is bound from `config.networking.hostName`, matching sibling modules.
+- All `.nix` files must be formatted with `nixfmt-rfc-style`.
+- No secret values may appear in any `.nix` file (nothing enters the Nix store). The only secret is `ntfy_password` in `/var/lib/hass/secrets.yaml`, provisioned by hand.
+- Evaluation check used throughout (runs on darwin without a Linux builder):
+  `nix eval '.#nixosConfigurations.jupiter.config.system.build.toplevel.drvPath'`
+- Do NOT run `nixos-rebuild` or SSH to jupiter; deploy + provisioning are operator steps the user runs on the host.
+
+---
+
+### Task 1: Create the ntfy server module (server + homepage tile)
+
+**Files:**
+- Create: `modules/environments/ntfy/default.nix`
+- Modify: `modules/environments/default.nix` (add `./ntfy` to `imports`)
+- Modify: `machines/jupiter/environments.nix` (enable the profile)
+
+**Interfaces:**
+- Consumes: `config.networking.hostName`; `services.ntfy-sh` (nixpkgs); `my.homepage.services` (repo homepage module).
+- Produces: option `my.profiles.ntfy.enable` (bool), `my.profiles.ntfy.port` (port, default 2586), `my.profiles.ntfy.topic` (str, default "ha"), `my.profiles.ntfy.haIntegration.enable` (bool, default true). Later tasks rely on `cfg.port`, `cfg.topic`, and `cfg.haIntegration.enable`.
+
+- [ ] **Step 1: Create the module file**
+
+Create `modules/environments/ntfy/default.nix`:
+
+```nix
+# self-hosted push notification server (ntfy)
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.profiles.ntfy;
+  hostName = config.networking.hostName;
+in
+{
+  options.my.profiles.ntfy = with lib; {
+    enable = mkEnableOption "ntfy notification server";
+
+    port = mkOption {
+      type = types.port;
+      default = 2586;
+      description = "HTTP port ntfy listens on.";
+    };
+
+    topic = mkOption {
+      type = types.str;
+      default = "ha";
+      description = "Topic Home Assistant publishes notifications to.";
+    };
+
+    haIntegration.enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Wire a Home Assistant rest_command that publishes to ntfy.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.ntfy-sh = {
+      enable = true;
+      settings = {
+        base-url = "http://${hostName}:${toString cfg.port}";
+        listen-http = ":${toString cfg.port}";
+        auth-file = "/var/lib/ntfy-sh/user.db";
+        auth-default-access = "deny-all";
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ cfg.port ];
+
+    my.homepage.services = [
+      {
+        group = "Services";
+        name = "ntfy";
+        description = "Push notifications";
+        href = "http://${hostName}:${toString cfg.port}";
+        icon = "ntfy.svg";
+      }
+    ];
+  };
+}
+```
+
+- [ ] **Step 2: Register the module in the environments import list**
+
+In `modules/environments/default.nix`, add `./ntfy` to the `imports` list (place it near the other service modules, e.g. after `./home-assistant`):
+
+```nix
+    ./home-assistant
+    ./ntfy
+```
+
+- [ ] **Step 3: Enable the profile on jupiter**
+
+In `machines/jupiter/environments.nix`, inside the `my.profiles = { ... }` block, add:
+
+```nix
+    ntfy.enable = true;
+```
+
+- [ ] **Step 4: Format the new file**
+
+Run: `nixfmt-rfc-style modules/environments/ntfy/default.nix`
+Expected: exits 0, no diff on re-run.
+
+- [ ] **Step 5: Evaluate the configuration**
+
+Run: `nix eval '.#nixosConfigurations.jupiter.config.system.build.toplevel.drvPath'`
+Expected: prints a `/nix/store/...-nixos-system-jupiter-*.drv` path with no evaluation errors. (This forces full module-system evaluation, catching option/type mistakes, without building a Linux derivation.)
+
+- [ ] **Step 6: Confirm the ntfy settings evaluate as expected**
+
+Run: `nix eval --json '.#nixosConfigurations.jupiter.config.services.ntfy-sh.settings'`
+Expected JSON includes `"auth-default-access":"deny-all"`, `"listen-http":":2586"`, and `"base-url":"http://jupiter:2586"`.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add modules/environments/ntfy/default.nix modules/environments/default.nix machines/jupiter/environments.nix
+git commit -m "feat(ntfy): add self-hosted notification server module
+
+Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>"
+```
+
+---
+
+### Task 2: Wire the Home Assistant rest_command
+
+**Files:**
+- Modify: `modules/environments/ntfy/default.nix` (add HA integration block)
+
+**Interfaces:**
+- Consumes: `cfg.port`, `cfg.topic`, `cfg.haIntegration.enable` (Task 1); `config.my.profiles.home-assistant.enable`; `services.home-assistant.config` (nixpkgs / repo home-assistant module).
+- Produces: `services.home-assistant.config.rest_command.ntfy_send`, callable from HA automations as `service: rest_command.ntfy_send`.
+
+- [ ] **Step 1: Add the HA integration block to the module**
+
+The module currently has a single `config = lib.mkIf cfg.enable { ... };`. Change it to merge two conditional configs with `lib.mkMerge` so the HA wiring is gated independently. Replace the `config = lib.mkIf cfg.enable { ... };` assignment with:
+
+```nix
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      services.ntfy-sh = {
+        enable = true;
+        settings = {
+          base-url = "http://${hostName}:${toString cfg.port}";
+          listen-http = ":${toString cfg.port}";
+          auth-file = "/var/lib/ntfy-sh/user.db";
+          auth-default-access = "deny-all";
+        };
+      };
+
+      networking.firewall.allowedTCPPorts = [ cfg.port ];
+
+      my.homepage.services = [
+        {
+          group = "Services";
+          name = "ntfy";
+          description = "Push notifications";
+          href = "http://${hostName}:${toString cfg.port}";
+          icon = "ntfy.svg";
+        }
+      ];
+    })
+
+    (lib.mkIf (cfg.enable && cfg.haIntegration.enable && config.my.profiles.home-assistant.enable) {
+      services.home-assistant.config.rest_command.ntfy_send = {
+        url = "http://${hostName}:${toString cfg.port}/${cfg.topic}";
+        method = "POST";
+        payload = "{{ message }}";
+        content_type = "text/plain";
+        username = "homeassistant";
+        password = "!secret ntfy_password";
+        headers = {
+          Title = "{{ title | default('Home Assistant') }}";
+          Priority = "{{ priority | default('default') }}";
+        };
+      };
+    })
+  ];
+```
+
+(The first `mkIf cfg.enable` block is identical to Task 1's config body — it is repeated here because the whole `config` assignment is being replaced with the `mkMerge` form.)
+
+- [ ] **Step 2: Format the file**
+
+Run: `nixfmt-rfc-style modules/environments/ntfy/default.nix`
+Expected: exits 0, no diff on re-run.
+
+- [ ] **Step 3: Evaluate the configuration**
+
+Run: `nix eval '.#nixosConfigurations.jupiter.config.system.build.toplevel.drvPath'`
+Expected: prints a `.drv` path, no evaluation errors (confirms the `rest_command` merges cleanly into the HA config the home-assistant module already defines).
+
+- [ ] **Step 4: Confirm the rest_command evaluated into HA config**
+
+Run: `nix eval --json '.#nixosConfigurations.jupiter.config.services.home-assistant.config.rest_command.ntfy_send'`
+Expected JSON includes `"url":"http://jupiter:2586/ha"`, `"username":"homeassistant"`, and `"password":"!secret ntfy_password"`.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add modules/environments/ntfy/default.nix
+git commit -m "feat(ntfy): wire Home Assistant rest_command publisher
+
+Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>"
+```
+
+---
+
+## Operator steps (run by the user on jupiter — not part of the agent's task loop)
+
+These require the host and manual credentials, so they are performed by the user after the branch is merged/deployed:
+
+1. Deploy: `sudo nixos-rebuild switch --flake '.#jupiter'`
+2. Create ntfy users:
+   ```bash
+   ntfy user add homeassistant            # set a password
+   ntfy access homeassistant ha write-only
+   ntfy user add --role=admin admin
+   ```
+3. Add the publisher password to Home Assistant secrets:
+   ```yaml
+   # /var/lib/hass/secrets.yaml
+   ntfy_password: <the homeassistant user's password>
+   ```
+4. Restart Home Assistant, then test from an automation / Developer Tools:
+   ```yaml
+   service: rest_command.ntfy_send
+   data:
+     message: "ntfy test"
+     title: "Home Assistant"
+     priority: high
+   ```
+5. Subscribe from the ntfy app as `admin` to receive the message.
+
+---
+
+## Self-Review
+
+**Spec coverage:**
+- Module structure + options → Task 1. ✔
+- Server config (deny-all, port, firewall) → Task 1 (steps 1, 6). ✔
+- Homepage tile → Task 1. ✔
+- Registration in `default.nix` + enable on jupiter → Task 1 (steps 2–3). ✔
+- HA `rest_command` wiring, gated on HA profile, `!secret` password → Task 2. ✔
+- Manual provisioning runbook → Operator steps section. ✔
+- Verification (eval/build + nixfmt) → per-task steps. ✔
+- Out-of-scope items (no seeding, no sops, no reverse proxy) → honored; no tasks added for them. ✔
+
+**Placeholder scan:** No TBD/TODO/"handle edge cases". The one "similar to Task 1" note is accompanied by the full repeated code, per the no-placeholders rule. ✔
+
+**Type consistency:** `cfg.port`/`cfg.topic`/`cfg.haIntegration.enable` defined in Task 1 and used identically in Task 2. `rest_command.ntfy_send` name consistent across Task 2 and operator steps. Homepage tile shape matches sibling modules. ✔

docs/superpowers/specs/2026-07-05-ntfy-module-design.md

@@ -0,0 +1,176 @@
+# ntfy self-hosted notification module — design
+
+Date: 2026-07-05
+Target machine: jupiter
+
+## Purpose
+
+Add a NixOS profile module that runs and configures a self-hosted
+[ntfy](https://ntfy.sh) notification server on jupiter, with authentication
+required, a homepage dashboard tile, and out-of-the-box plumbing so Home
+Assistant automations can publish push notifications.
+
+## Scope decisions (from brainstorming)
+
+- **Service:** ntfy (self-hosted server), not Apprise/Gotify/HA-only.
+- **Access control:** authentication required (`auth-default-access = deny-all`).
+- **Home Assistant:** the module wires an HA `rest_command` so automations can
+  send notifications out of the box.
+- **Credentials:** fully manual. The module runs the server and wires the HA
+  plumbing, but does **not** seed users or store any secret. The operator
+  provisions ntfy users/passwords by hand, and the only secret lives in Home
+  Assistant's `secrets.yaml` — never in the world-readable Nix store.
+
+## Module structure
+
+New module at `modules/environments/ntfy/default.nix` following the repo's
+standard profile pattern (`my.profiles.<name>` with `options` +
+`config = lib.mkIf cfg.enable { ... }`).
+
+Registration:
+1. Add `./ntfy` to the `imports` list in `modules/environments/default.nix`.
+2. Enable via `my.profiles.ntfy.enable = true;` in
+   `machines/jupiter/environments.nix`.
+
+### Options
+
+```nix
+options.my.profiles.ntfy = with lib; {
+  enable = mkEnableOption "ntfy notification server";
+
+  port = mkOption {
+    type = types.port;
+    default = 2586;
+    description = "HTTP port ntfy listens on.";
+  };
+
+  topic = mkOption {
+    type = types.str;
+    default = "ha";
+    description = "Topic Home Assistant publishes notifications to.";
+  };
+
+  haIntegration.enable = mkOption {
+    type = types.bool;
+    default = true;
+    description = "Wire a Home Assistant rest_command that publishes to ntfy.";
+  };
+};
+```
+
+## Server configuration
+
+```nix
+config = lib.mkIf cfg.enable {
+  services.ntfy-sh = {
+    enable = true;
+    settings = {
+      base-url            = "http://${hostName}:${toString cfg.port}";
+      listen-http         = ":${toString cfg.port}";
+      auth-file           = "/var/lib/ntfy-sh/user.db";
+      auth-default-access = "deny-all";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ cfg.port ];
+
+  my.homepage.services = [
+    {
+      group = "Services";
+      name = "ntfy";
+      description = "Push notifications";
+      href = "http://${hostName}:${toString cfg.port}";
+      icon = "ntfy.svg";
+    }
+  ];
+};
+```
+
+`hostName` is bound from `config.networking.hostName`, matching the pattern in
+the home-assistant and paperless modules.
+
+## Home Assistant wiring
+
+Applied only when ntfy, the HA integration flag, and the home-assistant profile
+are all enabled:
+
+```nix
+lib.mkIf (cfg.enable && cfg.haIntegration.enable
+          && config.my.profiles.home-assistant.enable) {
+  services.home-assistant.config.rest_command.ntfy_send = {
+    url = "http://${hostName}:${toString cfg.port}/${cfg.topic}";
+    method = "POST";
+    payload = "{{ message }}";
+    content_type = "text/plain";
+    username = "homeassistant";
+    password = "!secret ntfy_password";
+    headers = {
+      Title = "{{ title | default('Home Assistant') }}";
+      Priority = "{{ priority | default('default') }}";
+    };
+  };
+};
+```
+
+Notes:
+- `services.home-assistant.config` is an attrset that NixOS merges, so adding
+  `rest_command.ntfy_send` from this module composes with the config the
+  home-assistant module already defines.
+- `password = "!secret ntfy_password"` is a whole-value `!secret` reference. The
+  upstream home-assistant module unquotes such values when rendering the config
+  (the same mechanism the repo already relies on for `!include`), so the secret
+  resolves from `/var/lib/hass/secrets.yaml` at runtime and never enters the
+  Nix store. See `reference_nixos_ha_yaml_includes`.
+- `rest_command` is chosen over the `notify` REST platform because ntfy's
+  per-topic URL path plus header-based metadata map cleanly onto rest_command,
+  whereas the notify platform's fixed JSON payload fights ntfy's format.
+
+## Manual provisioning (operator runbook)
+
+Because credentials are fully manual, after the first `nixos-rebuild switch`
+run these once on jupiter:
+
+```bash
+# Dedicated publisher for Home Assistant, scoped to the ha topic
+ntfy user add homeassistant            # prompts for a password
+ntfy access homeassistant ha write-only
+
+# Admin account for the app / web UI
+ntfy user add --role=admin admin
+```
+
+Then add the homeassistant password to Home Assistant's secrets:
+
+```yaml
+# /var/lib/hass/secrets.yaml
+ntfy_password: <the homeassistant user's password>
+```
+
+Restart Home Assistant. Automations can then publish with:
+
+```yaml
+service: rest_command.ntfy_send
+data:
+  message: "Garage door left open"
+  title: "Alert"
+  priority: high
+```
+
+Subscribers (phone/desktop ntfy app) log in as `admin` (or another user granted
+read access) to receive messages.
+
+## Testing / verification
+
+- Build check: `nix build '.#nixosConfigurations.jupiter.config.system.build.toplevel'`
+  must succeed with the module enabled.
+- `nixfmt-rfc-style` clean on the new file.
+- Post-deploy manual verification (documented, not automated): create the users
+  above, publish a test message from HA, confirm it reaches a subscribed client.
+
+## Out of scope
+
+- No automated user/token seeding (explicitly deferred to manual provisioning).
+- No sops-nix setup (repo has dangling `config.sops.secrets` references, but
+  wiring up sops is a separate change and not required here).
+- No reverse-proxy / TLS termination (`behind-proxy` left default; LAN-only via
+  firewall).

flake.lock

@@ -21,11 +21,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1777988971,
+        "lastModified": 1778716662,
-        "narHash": "sha256-qIoWPDs+0/8JecyYgE3gpKQxW/4bLW/gp45vow9ioCQ=",
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "0678d8986be1661af6bb555f3489f2fdfc31f6ff",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
         "type": "github"
       },
       "original": {
@@ -42,11 +42,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775087534,
+        "lastModified": 1778716662,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
         "type": "github"
       },
       "original": {
@@ -69,11 +69,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776796298,
+        "lastModified": 1781733627,
-        "narHash": "sha256-PcRvlWayisPSjd0UcRQbhG8Oqw78AcPE6x872cPRHN8=",
+        "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "3cfd774b0a530725a077e17354fbdb87ea1c4aad",
+        "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39",
         "type": "github"
       },
       "original": {
@@ -92,11 +92,11 @@
         "nixpkgs-regression": "nixpkgs-regression"
       },
       "locked": {
-        "lastModified": 1778249748,
+        "lastModified": 1782337899,
-        "narHash": "sha256-D+3kaW4NUUaiFTsEpmregtGZVniljBThg/O0JIjRL8k=",
+        "narHash": "sha256-Imevyelg3r2N5iDonnGdOKGRiB56m3HgVFAljTB3CLU=",
         "owner": "NixOS",
         "repo": "nix",
-        "rev": "616df97974fd29b79f83502f63854d6d471ee055",
+        "rev": "3887a906b178836818a62e8eba666ad652e8a388",
         "type": "github"
       },
       "original": {
@@ -142,12 +142,15 @@
       }
     },
     "nixos-hardware": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
       "locked": {
-        "lastModified": 1778143761,
+        "lastModified": 1782379505,
-        "narHash": "sha256-lkesY6x2X2qxlqLM7CT2iM/0rP2JB7fruPN3h8POXmI=",
+        "narHash": "sha256-zPvPiU+a7pqtH47xrtZLNRABJKpOjfZQclDbcvNtH+I=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "3bcaa367d4c550d687a17ac792fd5cda214ee871",
+        "rev": "603d3afd1b6145bd66e97ae38a34d91c95df70cf",
         "type": "github"
       },
       "original": {
@@ -158,15 +161,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771903837,
+        "lastModified": 1780902259,
-        "narHash": "sha256-jEA8WggGKtMFeNeCKq3NK8cLEjJmG6/RLUElYYbBZ0E=",
+        "narHash": "sha256-YMnBf9lk/LYgvqfmSSJuOGigtRs5Lsy26pJHVlR9yMY=",
-        "rev": "e764fc9a405871f1f6ca3d1394fb422e0a0c3951",
+        "rev": "bd0ff2d3eac24699c3664d5966b9ef36f388e2ca",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/25.11/nixos-25.11.6495.e764fc9a4058/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.1550.bd0ff2d3eac2/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://channels.nixos.org/nixos-25.11/nixexprs.tar.xz"
+        "url": "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz"
       }
     },
     "nixpkgs-23-11": {
@@ -218,12 +221,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1777954456,
+        "lastModified": 1782467914,
-        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
+        "narHash": "sha256-inDx/w70OSJoJPqtKh0BrzAsbZZhpya7YgS43jHnhwg=",
-        "owner": "NixOS",
+        "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
-        "repo": "nixpkgs",
+        "type": "tarball",
-        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1022855.e73de5be04e0/nixexprs.tar.xz"
-        "type": "github"
       },
       "original": {
         "id": "nixpkgs",
@@ -233,16 +235,28 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1778003029,
+        "lastModified": 1767892417,
-        "narHash": "sha256-q/nkKLDtHIyLjZpKhWk3cSK5IYsFqtMd6UtXF3ddjgA=",
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
-        "owner": "NixOS",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
-        "repo": "nixpkgs",
+        "type": "tarball",
-        "rev": "0c88e1f2bdb93d5999019e99cb0e61e1fe2af4c5",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
-        "type": "github"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1782375420,
+        "narHash": "sha256-f+/IH5ng5P91VHrhcNxqpW2RYDySD68V1fcX00COQy4=",
+        "rev": "4062d36ebeae843c750011eef6b61ec9a9dbc9a9",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.3250.4062d36ebeae/nixexprs.tar.xz"
       },
       "original": {
         "id": "nixpkgs",
-        "ref": "nixos-25.11",
+        "ref": "nixos-26.05",
         "type": "indirect"
       }
     },
@@ -252,7 +266,7 @@
         "nix": "nix",
         "nixos-generators": "nixos-generators",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
         "nixpkgs-unstable": "nixpkgs-unstable"
       }
     }

flake.nix

@@ -3,7 +3,7 @@
 
   inputs = {
     nix.url = "github:NixOS/nix";
-    nixpkgs.url = "nixpkgs/nixos-25.11";
+    nixpkgs.url = "nixpkgs/nixos-26.05";
     nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
     flake-parts.url = "github:hercules-ci/flake-parts";
     nixos-hardware.url = "github:NixOS/nixos-hardware";
@@ -11,7 +11,6 @@
       url = "github:nix-community/nixos-generators";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    # hyprland.url = "github:hyprwm/Hyprland";
 
   };
 

machines/jupiter/configuration.nix

@@ -10,7 +10,7 @@
     ./disks.nix
     ./hardware-configuration.nix
     ./environments.nix
-#    ./network.nix
+    ./network.nix
   ];
 
   networking.hostName = "jupiter";

machines/jupiter/environments.nix

@@ -23,6 +23,7 @@ in
     jellyseerr.enable = true;
     development.enable = true;
     home-assistant.enable = true;
+    ntfy.enable = true;
 
     homepage.enable = true;
     paperless = {

machines/mibook/configuration.nix

@@ -36,7 +36,7 @@
 
 
   hardware.nvidia.prime = {
-    sync.enable = true;
+    sync.enable = false;
 
     nvidiaBusId = "PCI:01:00:0";
     intelBusId = "PCI:00:2:0";

machines/mibook/environments.nix

@@ -19,7 +19,7 @@ in
   my.hardware = {
     bluetooth.enable = true;
     sound.enable = false;
-    nvidia.enable = true;
+    nvidia.enable = false;
   };
   my.services = {
     vpn.enable = true;

modules/environments/audiobookshelf/default.nix

@@ -8,6 +8,7 @@
 let
   cfg = config.my.profiles.audiobookshelf;
   hostName = config.networking.hostName;
+  domain = config.networking.domain;
 in
 {
   options.my.profiles.audiobookshelf = with lib; {
@@ -32,7 +33,7 @@ in
         group = "Media";
         name = "Audiobookshelf";
         description = "Audiobooks and podcasts";
-        href = "http://${hostName}:63834";
+        href = "http://${domain}:63834";
         icon = "audiobookshelf.png";
       }
     ];

modules/environments/default.nix

@@ -7,6 +7,7 @@
     ./claude-code
     ./development
     ./home-assistant
+    ./ntfy
     ./hyprland
     ./zsh
     ./paperless

modules/environments/home-assistant/default.nix

@@ -11,11 +11,6 @@ let
   hostName = config.networking.hostName;
 in
 {
-  imports = [
-    # services.openthread-border-router isn't in nixos-25.11; pull from
-    # nixpkgs-unstable. Package comes from the existing unstable overlay.
-    "${self.inputs.nixpkgs-unstable}/nixos/modules/services/home-automation/openthread-border-router.nix"
-  ];
 
   options.my.profiles.home-assistant = with lib; {
     enable = mkEnableOption "Home Automation";
@@ -34,6 +29,8 @@ in
         "otbr"
         "thread"
         "xiaomi_miio"
+        "apple_tv" # Apple TV (pyatv); pair via UI PIN flow
+        "tuya" # Tuya/SmartLife cloud; Unistyle WLAN irrigation computer
       ];
     };
     services.home-assistant.config = {
@@ -43,7 +40,7 @@ in
         internal_url = "http://${hostName}:8123";
         external_url = "http://jupiter.solar.internal:8123";
       };
-      mobile_app = {};
+      mobile_app = { };
       automation = "!include automations.yaml";
       script = "!include scripts.yaml";
       scene = "!include scenes.yaml";

modules/environments/homepage/default.nix

@@ -7,7 +7,7 @@
 let
   cfg = config.my.profiles.homepage;
   dashboardPort = 8082;
-  dashboardHost = config.networking.hostName;
+  dashboardHost = config.networking.domain;
   dashboardUrl = "http://${dashboardHost}:${toString dashboardPort}";
   manualServices = import ./manual-services.nix;
   manualWidgets = import ./manual-widgets.nix;

modules/environments/ntfy/default.nix

@@ -0,0 +1,74 @@
+# self-hosted push notification server (ntfy)
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.profiles.ntfy;
+  hostName = config.networking.hostName;
+in
+{
+  options.my.profiles.ntfy = with lib; {
+    enable = mkEnableOption "ntfy notification server";
+
+    port = mkOption {
+      type = types.port;
+      default = 2586;
+      description = "HTTP port ntfy listens on.";
+    };
+
+    topic = mkOption {
+      type = types.str;
+      default = "ha";
+      description = "Topic Home Assistant publishes notifications to.";
+    };
+
+    haIntegration.enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Wire a Home Assistant rest_command that publishes to ntfy.";
+    };
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      services.ntfy-sh = {
+        enable = true;
+        settings = {
+          base-url = "http://${hostName}:${toString cfg.port}";
+          listen-http = ":${toString cfg.port}";
+          auth-file = "/var/lib/ntfy-sh/user.db";
+          auth-default-access = "deny-all";
+        };
+      };
+
+      networking.firewall.allowedTCPPorts = [ cfg.port ];
+
+      my.homepage.services = [
+        {
+          group = "Services";
+          name = "ntfy";
+          description = "Push notifications";
+          href = "http://${hostName}:${toString cfg.port}";
+          icon = "ntfy.svg";
+        }
+      ];
+    })
+
+    (lib.mkIf (cfg.enable && cfg.haIntegration.enable && config.my.profiles.home-assistant.enable) {
+      services.home-assistant.config.rest_command.ntfy_send = {
+        url = "http://${hostName}:${toString cfg.port}/${cfg.topic}";
+        method = "POST";
+        payload = "{{ message }}";
+        content_type = "text/plain";
+        username = "homeassistant";
+        password = "!secret ntfy_password";
+        headers = {
+          Title = "{{ title | default('Home Assistant') }}";
+          Priority = "{{ priority | default('default') }}";
+        };
+      };
+    })
+  ];
+}