feat(ntfy): wire Home Assistant rest_command publisher

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/superpowers/plans/2026-07-05-ntfy-module.md

@@ -0,0 +1,269 @@
+# ntfy Notification Module Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add a `my.profiles.ntfy` NixOS module that runs an auth-required self-hosted ntfy server on jupiter, exposes a homepage tile, and wires a Home Assistant `rest_command` for publishing notifications.
+
+**Architecture:** A single profile module under `modules/environments/ntfy/`, following the repo's `my.profiles.<name>` pattern. It configures `services.ntfy-sh` with `auth-default-access = deny-all`, opens the firewall, registers a homepage tile, and — when the home-assistant profile is enabled — merges a `rest_command.ntfy_send` into `services.home-assistant.config`. No secrets touch the Nix store; credentials are provisioned manually by the operator, and the only secret lives in HA's `secrets.yaml`.
+
+**Tech Stack:** Nix (flake-parts NixOS config), nixpkgs `services.ntfy-sh`, `services.home-assistant`, nixfmt-rfc-style.
+
+## Global Constraints
+
+- Follow the profile pattern exactly: `let cfg = config.my.profiles.<name>; in { options.my.profiles.<name>.enable = lib.mkEnableOption "..."; config = lib.mkIf cfg.enable { ... }; }`.
+- Namespace is `my.profiles.ntfy`.
+- Homepage self-registration uses `my.homepage.services` (list of `{ group; name; description; href; icon; }`).
+- `hostName` is bound from `config.networking.hostName`, matching sibling modules.
+- All `.nix` files must be formatted with `nixfmt-rfc-style`.
+- No secret values may appear in any `.nix` file (nothing enters the Nix store). The only secret is `ntfy_password` in `/var/lib/hass/secrets.yaml`, provisioned by hand.
+- Evaluation check used throughout (runs on darwin without a Linux builder):
+  `nix eval '.#nixosConfigurations.jupiter.config.system.build.toplevel.drvPath'`
+- Do NOT run `nixos-rebuild` or SSH to jupiter; deploy + provisioning are operator steps the user runs on the host.
+
+---
+
+### Task 1: Create the ntfy server module (server + homepage tile)
+
+**Files:**
+- Create: `modules/environments/ntfy/default.nix`
+- Modify: `modules/environments/default.nix` (add `./ntfy` to `imports`)
+- Modify: `machines/jupiter/environments.nix` (enable the profile)
+
+**Interfaces:**
+- Consumes: `config.networking.hostName`; `services.ntfy-sh` (nixpkgs); `my.homepage.services` (repo homepage module).
+- Produces: option `my.profiles.ntfy.enable` (bool), `my.profiles.ntfy.port` (port, default 2586), `my.profiles.ntfy.topic` (str, default "ha"), `my.profiles.ntfy.haIntegration.enable` (bool, default true). Later tasks rely on `cfg.port`, `cfg.topic`, and `cfg.haIntegration.enable`.
+
+- [ ] **Step 1: Create the module file**
+
+Create `modules/environments/ntfy/default.nix`:
+
+```nix
+# self-hosted push notification server (ntfy)
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.profiles.ntfy;
+  hostName = config.networking.hostName;
+in
+{
+  options.my.profiles.ntfy = with lib; {
+    enable = mkEnableOption "ntfy notification server";
+
+    port = mkOption {
+      type = types.port;
+      default = 2586;
+      description = "HTTP port ntfy listens on.";
+    };
+
+    topic = mkOption {
+      type = types.str;
+      default = "ha";
+      description = "Topic Home Assistant publishes notifications to.";
+    };
+
+    haIntegration.enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Wire a Home Assistant rest_command that publishes to ntfy.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.ntfy-sh = {
+      enable = true;
+      settings = {
+        base-url = "http://${hostName}:${toString cfg.port}";
+        listen-http = ":${toString cfg.port}";
+        auth-file = "/var/lib/ntfy-sh/user.db";
+        auth-default-access = "deny-all";
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ cfg.port ];
+
+    my.homepage.services = [
+      {
+        group = "Services";
+        name = "ntfy";
+        description = "Push notifications";
+        href = "http://${hostName}:${toString cfg.port}";
+        icon = "ntfy.svg";
+      }
+    ];
+  };
+}
+```
+
+- [ ] **Step 2: Register the module in the environments import list**
+
+In `modules/environments/default.nix`, add `./ntfy` to the `imports` list (place it near the other service modules, e.g. after `./home-assistant`):
+
+```nix
+    ./home-assistant
+    ./ntfy
+```
+
+- [ ] **Step 3: Enable the profile on jupiter**
+
+In `machines/jupiter/environments.nix`, inside the `my.profiles = { ... }` block, add:
+
+```nix
+    ntfy.enable = true;
+```
+
+- [ ] **Step 4: Format the new file**
+
+Run: `nixfmt-rfc-style modules/environments/ntfy/default.nix`
+Expected: exits 0, no diff on re-run.
+
+- [ ] **Step 5: Evaluate the configuration**
+
+Run: `nix eval '.#nixosConfigurations.jupiter.config.system.build.toplevel.drvPath'`
+Expected: prints a `/nix/store/...-nixos-system-jupiter-*.drv` path with no evaluation errors. (This forces full module-system evaluation, catching option/type mistakes, without building a Linux derivation.)
+
+- [ ] **Step 6: Confirm the ntfy settings evaluate as expected**
+
+Run: `nix eval --json '.#nixosConfigurations.jupiter.config.services.ntfy-sh.settings'`
+Expected JSON includes `"auth-default-access":"deny-all"`, `"listen-http":":2586"`, and `"base-url":"http://jupiter:2586"`.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add modules/environments/ntfy/default.nix modules/environments/default.nix machines/jupiter/environments.nix
+git commit -m "feat(ntfy): add self-hosted notification server module
+
+Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>"
+```
+
+---
+
+### Task 2: Wire the Home Assistant rest_command
+
+**Files:**
+- Modify: `modules/environments/ntfy/default.nix` (add HA integration block)
+
+**Interfaces:**
+- Consumes: `cfg.port`, `cfg.topic`, `cfg.haIntegration.enable` (Task 1); `config.my.profiles.home-assistant.enable`; `services.home-assistant.config` (nixpkgs / repo home-assistant module).
+- Produces: `services.home-assistant.config.rest_command.ntfy_send`, callable from HA automations as `service: rest_command.ntfy_send`.
+
+- [ ] **Step 1: Add the HA integration block to the module**
+
+The module currently has a single `config = lib.mkIf cfg.enable { ... };`. Change it to merge two conditional configs with `lib.mkMerge` so the HA wiring is gated independently. Replace the `config = lib.mkIf cfg.enable { ... };` assignment with:
+
+```nix
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      services.ntfy-sh = {
+        enable = true;
+        settings = {
+          base-url = "http://${hostName}:${toString cfg.port}";
+          listen-http = ":${toString cfg.port}";
+          auth-file = "/var/lib/ntfy-sh/user.db";
+          auth-default-access = "deny-all";
+        };
+      };
+
+      networking.firewall.allowedTCPPorts = [ cfg.port ];
+
+      my.homepage.services = [
+        {
+          group = "Services";
+          name = "ntfy";
+          description = "Push notifications";
+          href = "http://${hostName}:${toString cfg.port}";
+          icon = "ntfy.svg";
+        }
+      ];
+    })
+
+    (lib.mkIf (cfg.enable && cfg.haIntegration.enable && config.my.profiles.home-assistant.enable) {
+      services.home-assistant.config.rest_command.ntfy_send = {
+        url = "http://${hostName}:${toString cfg.port}/${cfg.topic}";
+        method = "POST";
+        payload = "{{ message }}";
+        content_type = "text/plain";
+        username = "homeassistant";
+        password = "!secret ntfy_password";
+        headers = {
+          Title = "{{ title | default('Home Assistant') }}";
+          Priority = "{{ priority | default('default') }}";
+        };
+      };
+    })
+  ];
+```
+
+(The first `mkIf cfg.enable` block is identical to Task 1's config body — it is repeated here because the whole `config` assignment is being replaced with the `mkMerge` form.)
+
+- [ ] **Step 2: Format the file**
+
+Run: `nixfmt-rfc-style modules/environments/ntfy/default.nix`
+Expected: exits 0, no diff on re-run.
+
+- [ ] **Step 3: Evaluate the configuration**
+
+Run: `nix eval '.#nixosConfigurations.jupiter.config.system.build.toplevel.drvPath'`
+Expected: prints a `.drv` path, no evaluation errors (confirms the `rest_command` merges cleanly into the HA config the home-assistant module already defines).
+
+- [ ] **Step 4: Confirm the rest_command evaluated into HA config**
+
+Run: `nix eval --json '.#nixosConfigurations.jupiter.config.services.home-assistant.config.rest_command.ntfy_send'`
+Expected JSON includes `"url":"http://jupiter:2586/ha"`, `"username":"homeassistant"`, and `"password":"!secret ntfy_password"`.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add modules/environments/ntfy/default.nix
+git commit -m "feat(ntfy): wire Home Assistant rest_command publisher
+
+Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>"
+```
+
+---
+
+## Operator steps (run by the user on jupiter — not part of the agent's task loop)
+
+These require the host and manual credentials, so they are performed by the user after the branch is merged/deployed:
+
+1. Deploy: `sudo nixos-rebuild switch --flake '.#jupiter'`
+2. Create ntfy users:
+   ```bash
+   ntfy user add homeassistant            # set a password
+   ntfy access homeassistant ha write-only
+   ntfy user add --role=admin admin
+   ```
+3. Add the publisher password to Home Assistant secrets:
+   ```yaml
+   # /var/lib/hass/secrets.yaml
+   ntfy_password: <the homeassistant user's password>
+   ```
+4. Restart Home Assistant, then test from an automation / Developer Tools:
+   ```yaml
+   service: rest_command.ntfy_send
+   data:
+     message: "ntfy test"
+     title: "Home Assistant"
+     priority: high
+   ```
+5. Subscribe from the ntfy app as `admin` to receive the message.
+
+---
+
+## Self-Review
+
+**Spec coverage:**
+- Module structure + options → Task 1. ✔
+- Server config (deny-all, port, firewall) → Task 1 (steps 1, 6). ✔
+- Homepage tile → Task 1. ✔
+- Registration in `default.nix` + enable on jupiter → Task 1 (steps 2–3). ✔
+- HA `rest_command` wiring, gated on HA profile, `!secret` password → Task 2. ✔
+- Manual provisioning runbook → Operator steps section. ✔
+- Verification (eval/build + nixfmt) → per-task steps. ✔
+- Out-of-scope items (no seeding, no sops, no reverse proxy) → honored; no tasks added for them. ✔
+
+**Placeholder scan:** No TBD/TODO/"handle edge cases". The one "similar to Task 1" note is accompanied by the full repeated code, per the no-placeholders rule. ✔
+
+**Type consistency:** `cfg.port`/`cfg.topic`/`cfg.haIntegration.enable` defined in Task 1 and used identically in Task 2. `rest_command.ntfy_send` name consistent across Task 2 and operator steps. Homepage tile shape matches sibling modules. ✔

docs/superpowers/plans/2026-07-24-dank-material-shell.md

@@ -1,289 +0,0 @@
-# DankMaterialShell (niri) Profile Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Add a `my.profiles.dank` NixOS profile that runs DankMaterialShell (DMS) on the niri Wayland compositor as a login session parallel to KDE on mibook, backed by a new opt-in `my.profiles.home-manager` module.
-
-**Architecture:** Three flake inputs (`home-manager`, `niri` = niri-flake, `dank` = DankMaterialShell) are added to `flake.nix`. A `my.profiles.home-manager` module unconditionally imports the home-manager NixOS module and, when enabled, sets global HM settings. A `my.profiles.dank` module enables `my.profiles.home-manager` as a dependency, turns on niri (system session) + the DMS nixosModule (daemons/packages), and configures `home-manager.users.finn` with the DMS + niri-flake HM modules for keybinds/spawn. mibook enables `dank`.
-
-**Tech Stack:** Nix flakes, flake-parts, NixOS modules, home-manager (as NixOS module), niri-flake, DankMaterialShell flake, quickshell (from `pkgs.unstable`).
-
-## Global Constraints
-
-- Do **not** modify `machines/configuration.nix`. `inputs` and `self` are already threaded into every module via `_module.args`; consume them as module arguments.
-- **Top-level `imports` must reference flake modules via `self.inputs.*`, not `inputs.*`.** `self` is a specialArg (available during `imports` resolution); `inputs` comes from `_module.args` (config-derived) and using it in an `imports` list causes infinite recursion. Inside the `config` body (including nested `home-manager.users.<name>.imports`), either `inputs` or `self.inputs` is fine.
-- Base channel is pinned `nixpkgs/nixos-26.05`; `pkgs.unstable` overlay is available everywhere. quickshell must come from `pkgs.unstable.quickshell` (needs ≥ 0.3.0).
-- home-manager scoped to user `finn` only; `home.stateVersion = "26.05"`.
-- Follow the existing profile pattern exactly: `let cfg = config.my.profiles.<name>; in { options.my.profiles.<name>.enable = lib.mkEnableOption "..."; config = lib.mkIf cfg.enable { ... }; }`.
-- Format every new/edited `.nix` file with `nixfmt-rfc-style` before committing.
-- Commit messages end with the repo's trailer lines (Co-Authored-By + Claude-Session) as seen in recent history.
-- KDE (`my.profiles.kde-desktop`) stays enabled on mibook; do not remove it.
-
----
-
-### Task 1: Add flake inputs
-
-**Files:**
-- Modify: `flake.nix:4-15` (the `inputs = { ... }` block)
-
-**Interfaces:**
-- Produces: flake inputs `inputs.home-manager`, `inputs.niri`, `inputs.dank`, reachable from any NixOS module (via the existing `_module.args.inputs = self.inputs`). Later tasks consume `inputs.home-manager.nixosModules.home-manager`, `inputs.niri.homeModules.niri`, `inputs.dank.nixosModules.dank-material-shell`, `inputs.dank.homeModules.dank-material-shell`, `inputs.dank.homeModules.niri`.
-
-- [ ] **Step 1: Add the three inputs**
-
-In `flake.nix`, inside the `inputs = { ... }` block, after the `nixos-generators` entry and before the closing `};`, add:
-
-```nix
-    home-manager = {
-      url = "github:nix-community/home-manager/release-26.05";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    niri.url = "github:sodiboo/niri-flake";
-    dank.url = "github:AvengeMedia/DankMaterialShell";
-```
-
-- [ ] **Step 2: Resolve the lock file**
-
-Run: `nix flake lock`
-Expected: completes without error; `flake.lock` gains `home-manager`, `niri`, `niri-flake`-transitive, and `dank` (DankMaterialShell) nodes. If it reports a bad URL, re-check the `github:owner/repo` strings.
-
-- [ ] **Step 3: Verify inputs expose the expected outputs**
-
-Run: `nix eval --raw '.#nixosConfigurations.mibook.pkgs.system'` first to confirm the flake still evaluates (expected: `x86_64-linux`).
-Then run: `nix flake show 'github:AvengeMedia/DankMaterialShell' --allow-import-from-derivation 2>/dev/null | grep -E 'dank-material-shell|nixosModules|homeModules'`
-Expected: output lists `nixosModules.dank-material-shell` and `homeModules.dank-material-shell` and `homeModules.niri`. If the niri output name differs (e.g. `dankMaterialShell.niri`), note the actual name — Task 3 Step 1 must use whatever this shows.
-
-- [ ] **Step 4: Format and commit**
-
-```bash
-nixfmt-rfc-style flake.nix
-git add flake.nix flake.lock
-git commit -m "chore: add home-manager, niri-flake, and DankMaterialShell flake inputs
-
-Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
-Claude-Session: https://claude.ai/code/session_018Sv2QAunLcLo3tS1YsfLgN"
-```
-
----
-
-### Task 2: `my.profiles.home-manager` module
-
-**Files:**
-- Create: `modules/environments/home-manager/default.nix`
-- Modify: `modules/environments/default.nix` (add `./home-manager` to `imports`)
-
-**Interfaces:**
-- Consumes: `inputs.home-manager.nixosModules.home-manager` (Task 1).
-- Produces: option `my.profiles.home-manager.enable`. When enabled, sets `home-manager.useGlobalPkgs = true`, `home-manager.useUserPackages = true`, `home-manager.extraSpecialArgs = { inherit inputs self; }`. Also makes the `home-manager.users.<name>` option available (from the unconditional import) so Task 3 can populate `home-manager.users.finn`.
-
-- [ ] **Step 1: Create the module**
-
-Create `modules/environments/home-manager/default.nix`:
-
-```nix
-{
-  config,
-  lib,
-  inputs,
-  self,
-  ...
-}:
-let
-  cfg = config.my.profiles.home-manager;
-in
-{
-  imports = [ self.inputs.home-manager.nixosModules.home-manager ];
-
-  options.my.profiles.home-manager.enable =
-    lib.mkEnableOption "home-manager integration";
-
-  config = lib.mkIf cfg.enable {
-    home-manager.useGlobalPkgs = true;
-    home-manager.useUserPackages = true;
-    home-manager.extraSpecialArgs = { inherit inputs self; };
-  };
-}
-```
-
-- [ ] **Step 2: Register the module**
-
-In `modules/environments/default.nix`, add `./home-manager` to the `imports` list (place it after `./hyprland`):
-
-```nix
-    ./hyprland
-    ./home-manager
-```
-
-- [ ] **Step 3: Verify it evaluates disabled (no behavior change)**
-
-Run: `nix build '.#nixosConfigurations.mibook.config.system.build.toplevel' --dry-run`
-Expected: evaluates and shows a build plan with no errors. Because `my.profiles.home-manager.enable` defaults to false, importing the HM module must not change the build outcome.
-
-- [ ] **Step 4: Verify the option exists and defaults false**
-
-Run: `nix eval '.#nixosConfigurations.mibook.config.my.profiles.home-manager.enable'`
-Expected: `false`
-
-- [ ] **Step 5: Format and commit**
-
-```bash
-nixfmt-rfc-style modules/environments/home-manager/default.nix modules/environments/default.nix
-git add modules/environments/home-manager/default.nix modules/environments/default.nix
-git commit -m "feat(home-manager): add opt-in my.profiles.home-manager module
-
-Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
-Claude-Session: https://claude.ai/code/session_018Sv2QAunLcLo3tS1YsfLgN"
-```
-
----
-
-### Task 3: `my.profiles.dank` module
-
-**Files:**
-- Create: `modules/environments/dank/default.nix`
-- Modify: `modules/environments/default.nix` (add `./dank` to `imports`)
-
-**Interfaces:**
-- Consumes: `my.profiles.home-manager.enable` (Task 2); `inputs.dank.nixosModules.dank-material-shell`, `inputs.dank.homeModules.dank-material-shell`, `inputs.dank.homeModules.niri`, `inputs.niri.homeModules.niri` (Task 1); `pkgs.unstable.quickshell`.
-- Produces: option `my.profiles.dank.enable`.
-
-- [ ] **Step 1: Create the module**
-
-Create `modules/environments/dank/default.nix`. Use the exact `homeModules`/`nixosModules` output names confirmed in Task 1 Step 3 — the block below assumes `dank-material-shell` and `niri`:
-
-```nix
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  self,
-  ...
-}:
-let
-  cfg = config.my.profiles.dank;
-in
-{
-  imports = [ self.inputs.dank.nixosModules.dank-material-shell ];
-
-  options.my.profiles.dank.enable = lib.mkEnableOption "DankMaterialShell on niri";
-
-  config = lib.mkIf cfg.enable {
-    # Dependency: declarative user config comes from home-manager.
-    my.profiles.home-manager.enable = true;
-
-    # System side: niri Wayland session + DMS daemons/packages.
-    programs.niri.enable = true;
-
-    programs.dank-material-shell = {
-      enable = true;
-      systemd.enable = true;
-      quickshell.package = pkgs.unstable.quickshell;
-    };
-
-    # Home side: DMS shell + niri spawn for finn (keybinds come via includes).
-    home-manager.users.finn = {
-      imports = [
-        inputs.niri.homeModules.niri
-        inputs.dank.homeModules.dank-material-shell
-        inputs.dank.homeModules.niri
-      ];
-
-      programs.dank-material-shell = {
-        enable = true;
-        systemd.enable = true;
-        quickshell.package = pkgs.unstable.quickshell;
-        # niri.enableKeybinds intentionally omitted: DMS's niri `includes.enable`
-        # (default true) already brings in the generated binds.kdl plus theming;
-        # setting enableKeybinds too triggers an upstream "not recommended" warning.
-        niri.enableSpawn = true;
-      };
-
-      home.stateVersion = "26.05";
-    };
-  };
-}
-```
-
-- [ ] **Step 2: Register the module**
-
-In `modules/environments/default.nix`, add `./dank` to the `imports` list (after `./home-manager`):
-
-```nix
-    ./home-manager
-    ./dank
-```
-
-- [ ] **Step 3: Verify it evaluates disabled**
-
-Run: `nix eval '.#nixosConfigurations.mibook.config.my.profiles.dank.enable'`
-Expected: `false`
-Run: `nix build '.#nixosConfigurations.mibook.config.system.build.toplevel' --dry-run`
-Expected: evaluates without error (dank disabled → no behavior change yet).
-
-- [ ] **Step 4: Format and commit**
-
-```bash
-nixfmt-rfc-style modules/environments/dank/default.nix modules/environments/default.nix
-git add modules/environments/dank/default.nix modules/environments/default.nix
-git commit -m "feat(dank): add DankMaterialShell (niri) profile
-
-Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
-Claude-Session: https://claude.ai/code/session_018Sv2QAunLcLo3tS1YsfLgN"
-```
-
----
-
-### Task 4: Enable on mibook and build the full toplevel
-
-**Files:**
-- Modify: `machines/mibook/environments.nix:7-17` (the `my.profiles = { ... }` block)
-
-**Interfaces:**
-- Consumes: `my.profiles.dank.enable` (Task 3).
-
-- [ ] **Step 1: Enable the profile**
-
-In `machines/mibook/environments.nix`, inside the `my.profiles = { ... }` block, add:
-
-```nix
-    dank.enable = true;
-```
-
-- [ ] **Step 2: Build the full toplevel (the real test)**
-
-Run: `nix build '.#nixosConfigurations.mibook.config.system.build.toplevel'`
-Expected: builds successfully. This exercises the DMS package, quickshell from unstable, niri, and the home-manager generation for finn.
-
-If it fails on a **quickshell/Qt6 version mismatch** (see spec risks): drop `quickshell.package = pkgs.unstable.quickshell;` from **both** the system and HM `programs.dank-material-shell` blocks in `modules/environments/dank/default.nix` and rebuild, letting DMS's module pick its own default quickshell. If it fails on an **unknown HM option** (e.g. `niri.enableKeybinds`), run `nix eval '.#nixosConfigurations.mibook.config.home-manager.users.finn.programs.dank-material-shell' --apply builtins.attrNames 2>&1 | head` to list the real option names and adjust. Re-run the build until it passes.
-
-- [ ] **Step 3: Run flake check**
-
-Run: `nix flake check`
-Expected: passes (all nixosConfigurations evaluate). If `nix flake check` is slow or pulls DMS's own checks, `nix build '.#nixosConfigurations.mibook.config.system.build.toplevel'` from Step 2 passing is the authoritative gate.
-
-- [ ] **Step 4: Format and commit**
-
-```bash
-nixfmt-rfc-style machines/mibook/environments.nix
-git add machines/mibook/environments.nix modules/environments/dank/default.nix
-git commit -m "feat(mibook): enable DankMaterialShell (niri) session
-
-Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
-Claude-Session: https://claude.ai/code/session_018Sv2QAunLcLo3tS1YsfLgN"
-```
-
-- [ ] **Step 5: Manual acceptance (human, on hardware)**
-
-Run: `sudo nixos-rebuild test --flake '.#mibook'`
-Then log out, pick the **niri** session at SDDM, log in as finn.
-Expected: DMS bar/shell appears; `Mod+Space` opens the launcher; `Mod+V` opens the clipboard; the KDE session is still selectable and works. Note this step cannot be automated — it requires the physical machine.
-
----
-
-## Notes for the implementer
-
-- **Order matters:** Task 1 must land first (inputs must resolve before any module can import them). Tasks 2→3→4 are strictly sequential.
-- **Output-name drift is the top risk.** The DMS flake has renamed outputs over time (there are deprecated aliases like `dankMaterialShell.niri`). Task 1 Step 3 pins down the real names against the locked revision; use those, not the names in this plan, if they differ.
-- **No unit-test framework here.** Nix evaluation + a successful `toplevel` build *is* the test. Do not fabricate a test harness.
-- Do not touch `machines/configuration.nix`, `machines/jupiter/*`, or the KDE profile.

docs/superpowers/specs/2026-07-05-ntfy-module-design.md

@@ -0,0 +1,176 @@
+# ntfy self-hosted notification module — design
+
+Date: 2026-07-05
+Target machine: jupiter
+
+## Purpose
+
+Add a NixOS profile module that runs and configures a self-hosted
+[ntfy](https://ntfy.sh) notification server on jupiter, with authentication
+required, a homepage dashboard tile, and out-of-the-box plumbing so Home
+Assistant automations can publish push notifications.
+
+## Scope decisions (from brainstorming)
+
+- **Service:** ntfy (self-hosted server), not Apprise/Gotify/HA-only.
+- **Access control:** authentication required (`auth-default-access = deny-all`).
+- **Home Assistant:** the module wires an HA `rest_command` so automations can
+  send notifications out of the box.
+- **Credentials:** fully manual. The module runs the server and wires the HA
+  plumbing, but does **not** seed users or store any secret. The operator
+  provisions ntfy users/passwords by hand, and the only secret lives in Home
+  Assistant's `secrets.yaml` — never in the world-readable Nix store.
+
+## Module structure
+
+New module at `modules/environments/ntfy/default.nix` following the repo's
+standard profile pattern (`my.profiles.<name>` with `options` +
+`config = lib.mkIf cfg.enable { ... }`).
+
+Registration:
+1. Add `./ntfy` to the `imports` list in `modules/environments/default.nix`.
+2. Enable via `my.profiles.ntfy.enable = true;` in
+   `machines/jupiter/environments.nix`.
+
+### Options
+
+```nix
+options.my.profiles.ntfy = with lib; {
+  enable = mkEnableOption "ntfy notification server";
+
+  port = mkOption {
+    type = types.port;
+    default = 2586;
+    description = "HTTP port ntfy listens on.";
+  };
+
+  topic = mkOption {
+    type = types.str;
+    default = "ha";
+    description = "Topic Home Assistant publishes notifications to.";
+  };
+
+  haIntegration.enable = mkOption {
+    type = types.bool;
+    default = true;
+    description = "Wire a Home Assistant rest_command that publishes to ntfy.";
+  };
+};
+```
+
+## Server configuration
+
+```nix
+config = lib.mkIf cfg.enable {
+  services.ntfy-sh = {
+    enable = true;
+    settings = {
+      base-url            = "http://${hostName}:${toString cfg.port}";
+      listen-http         = ":${toString cfg.port}";
+      auth-file           = "/var/lib/ntfy-sh/user.db";
+      auth-default-access = "deny-all";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ cfg.port ];
+
+  my.homepage.services = [
+    {
+      group = "Services";
+      name = "ntfy";
+      description = "Push notifications";
+      href = "http://${hostName}:${toString cfg.port}";
+      icon = "ntfy.svg";
+    }
+  ];
+};
+```
+
+`hostName` is bound from `config.networking.hostName`, matching the pattern in
+the home-assistant and paperless modules.
+
+## Home Assistant wiring
+
+Applied only when ntfy, the HA integration flag, and the home-assistant profile
+are all enabled:
+
+```nix
+lib.mkIf (cfg.enable && cfg.haIntegration.enable
+          && config.my.profiles.home-assistant.enable) {
+  services.home-assistant.config.rest_command.ntfy_send = {
+    url = "http://${hostName}:${toString cfg.port}/${cfg.topic}";
+    method = "POST";
+    payload = "{{ message }}";
+    content_type = "text/plain";
+    username = "homeassistant";
+    password = "!secret ntfy_password";
+    headers = {
+      Title = "{{ title | default('Home Assistant') }}";
+      Priority = "{{ priority | default('default') }}";
+    };
+  };
+};
+```
+
+Notes:
+- `services.home-assistant.config` is an attrset that NixOS merges, so adding
+  `rest_command.ntfy_send` from this module composes with the config the
+  home-assistant module already defines.
+- `password = "!secret ntfy_password"` is a whole-value `!secret` reference. The
+  upstream home-assistant module unquotes such values when rendering the config
+  (the same mechanism the repo already relies on for `!include`), so the secret
+  resolves from `/var/lib/hass/secrets.yaml` at runtime and never enters the
+  Nix store. See `reference_nixos_ha_yaml_includes`.
+- `rest_command` is chosen over the `notify` REST platform because ntfy's
+  per-topic URL path plus header-based metadata map cleanly onto rest_command,
+  whereas the notify platform's fixed JSON payload fights ntfy's format.
+
+## Manual provisioning (operator runbook)
+
+Because credentials are fully manual, after the first `nixos-rebuild switch`
+run these once on jupiter:
+
+```bash
+# Dedicated publisher for Home Assistant, scoped to the ha topic
+ntfy user add homeassistant            # prompts for a password
+ntfy access homeassistant ha write-only
+
+# Admin account for the app / web UI
+ntfy user add --role=admin admin
+```
+
+Then add the homeassistant password to Home Assistant's secrets:
+
+```yaml
+# /var/lib/hass/secrets.yaml
+ntfy_password: <the homeassistant user's password>
+```
+
+Restart Home Assistant. Automations can then publish with:
+
+```yaml
+service: rest_command.ntfy_send
+data:
+  message: "Garage door left open"
+  title: "Alert"
+  priority: high
+```
+
+Subscribers (phone/desktop ntfy app) log in as `admin` (or another user granted
+read access) to receive messages.
+
+## Testing / verification
+
+- Build check: `nix build '.#nixosConfigurations.jupiter.config.system.build.toplevel'`
+  must succeed with the module enabled.
+- `nixfmt-rfc-style` clean on the new file.
+- Post-deploy manual verification (documented, not automated): create the users
+  above, publish a test message from HA, confirm it reaches a subscribed client.
+
+## Out of scope
+
+- No automated user/token seeding (explicitly deferred to manual provisioning).
+- No sops-nix setup (repo has dangling `config.sops.secrets` references, but
+  wiring up sops is a separate change and not required here).
+- No reverse-proxy / TLS termination (`behind-proxy` left default; LAN-only via
+  firewall).

docs/superpowers/specs/2026-07-24-dank-material-shell-design.md

@@ -1,234 +0,0 @@
-# DankMaterialShell (niri) Profile — Design
-
-**Date:** 2026-07-24
-**Branch:** `feat/dank-material-shell`
-**Status:** Approved (brainstorming)
-
-## Summary
-
-Add a `my.profiles.dank` NixOS profile that provides a complete
-[DankMaterialShell](https://danklinux.com) (DMS) desktop running on the
-**niri** Wayland compositor, selectable at the SDDM login screen **alongside**
-the existing KDE session on **mibook** (user `finn`).
-
-DMS's keybind, spawn, and declarative-settings integration is delivered only
-through home-manager modules, so this work also introduces home-manager into the
-flake — as its own opt-in profile (`my.profiles.home-manager`) that the `dank`
-profile enables as a dependency. Everything stays declarative inside the flake;
-there is no separate home-manager entrypoint.
-
-## Background / Research
-
-DMS is a Quickshell-based Wayland desktop **shell** (bar, launcher, control
-center, lock screen, notifications) — not a compositor. Its repository
-(`github:AvengeMedia/DankMaterialShell`) ships a flake with:
-
-- `nixosModules.dank-material-shell` — system side: installs the `dms-shell`
-  package + `quickshell`, a `dms` systemd **user** service, `dgop` (system
-  monitoring), matugen (dynamic theming), and enables polkit /
-  power-profiles-daemon / accounts-daemon / geoclue2. Configured via
-  `programs.dank-material-shell.*`.
-- `homeModules.dank-material-shell` — home side: declarative
-  `~/.config/DankMaterialShell/settings.json`, the `dms` user service, plugin
-  management, and the `programs.quickshell` HM program.
-- `homeModules.niri` — niri-specific integration: generates niri keybinds wired
-  to `dms ipc` (launcher, clipboard, notifications, media/brightness keys, power
-  menu, lock) and `spawn-at-startup` for `dms run`.
-
-`homeModules.niri` builds on **niri-flake**'s home-manager API
-(`programs.niri.settings`, `config.lib.niri.actions`); DMS does **not** bundle
-niri-flake, so it must be added as its own input. quickshell ≥ 0.3.0 is
-recommended and is available in nixos-unstable → use `pkgs.unstable.quickshell`.
-
-### Key repo facts
-
-- This repo is flake-parts based, pins `nixpkgs/nixos-26.05`, and exposes
-  `pkgs.unstable` via an overlay in `machines/configuration.nix`.
-- `inputs` and `self` are already threaded into every NixOS module via
-  `_module.args` (set in `machines/configuration.nix`), so `modules/` files may
-  take `inputs` / `self` as arguments and `imports = [ inputs.<x>... ]`.
-- The repo currently uses **no home-manager**; compositor profiles (e.g.
-  `hyprland`) install packages via `users.users.finn.packages`.
-- mibook currently runs the KDE desktop (`my.profiles.kde-desktop`).
-
-## Scope
-
-- **In:** mibook only; niri+DMS as a session parallel to KDE; home-manager
-  scoped to user `finn`; a reusable `my.profiles.home-manager` module.
-- **Out:** enabling on jupiter (headless server); Dank Greeter as the login
-  manager (SDDM stays); declarative DMS `settings.json` content (DMS is
-  configured through its own GUI at runtime; the HM `settings` option remains
-  available for later use but is left empty); any change to `configuration.nix`.
-
-## Design
-
-### 1. New flake inputs (`flake.nix`)
-
-```nix
-home-manager = {
-  url = "github:nix-community/home-manager";
-  inputs.nixpkgs.follows = "nixpkgs";
-};
-niri.url = "github:sodiboo/niri-flake";
-dank.url = "github:AvengeMedia/DankMaterialShell";
-```
-
-Notes:
-- `dank` tracks nixos-unstable internally (its own `nixpkgs`), which is expected
-  for the DMS package build.
-- `niri-flake` provides both the compositor session (nixosModule) and the HM
-  `programs.niri.settings` API that DMS's niri module extends.
-- `home-manager` follows the repo `nixpkgs` (nixos-26.05).
-
-`machines/configuration.nix` is **not** modified — the existing
-`_module.args.inputs = self.inputs` line already makes these inputs reachable
-from any module.
-
-### 2. Home-manager profile (`modules/environments/home-manager/default.nix`)
-
-A new opt-in `my.profiles.home-manager` profile. Because module `imports` cannot
-be gated on an option value, the home-manager NixOS module is imported
-unconditionally (harmless — it only adds options and does nothing until
-`home-manager.users.*` is populated); only the global settings are guarded by
-`mkIf cfg.enable`:
-
-```nix
-{ config, lib, inputs, self, ... }:
-let
-  cfg = config.my.profiles.home-manager;
-in
-{
-  imports = [ inputs.home-manager.nixosModules.home-manager ];
-
-  options.my.profiles.home-manager.enable =
-    lib.mkEnableOption "home-manager integration";
-
-  config = lib.mkIf cfg.enable {
-    home-manager.useGlobalPkgs = true;      # HM shares the system pkgs (+ unstable overlay)
-    home-manager.useUserPackages = true;
-    home-manager.extraSpecialArgs = { inherit inputs self; };
-  };
-}
-```
-
-Registered by adding `./environments/home-manager` to
-`modules/environments/default.nix`.
-
-> Placement note: the profile lives under `modules/environments/` (where
-> `my.profiles.*` modules live) to match the namespace, even though its function
-> is infrastructural.
-
-### 3. Dank profile (`modules/environments/dank/default.nix`)
-
-Standard profile pattern; enables the home-manager profile as a dependency and
-splits configuration between the system module (session + daemons) and the
-home-manager module (keybinds / spawn / settings):
-
-```nix
-{ config, lib, pkgs, inputs, ... }:
-let
-  cfg = config.my.profiles.dank;
-in
-{
-  imports = [ inputs.dank.nixosModules.dank-material-shell ];
-
-  options.my.profiles.dank.enable = lib.mkEnableOption "DankMaterialShell on niri";
-
-  config = lib.mkIf cfg.enable {
-    # dependency: pull in home-manager integration
-    my.profiles.home-manager.enable = true;
-
-    # --- system side: niri session + DMS daemons/packages ---
-    programs.niri.enable = true;                     # niri-flake nixosModule → Wayland session in SDDM
-
-    programs.dank-material-shell = {
-      enable = true;
-      systemd.enable = true;
-      quickshell.package = pkgs.unstable.quickshell;  # >= 0.3.0 from unstable
-      # enableSystemMonitoring / enableVPN / enableDynamicTheming / enableAudioWavelength
-      # / enableCalendarEvents all default true — left on.
-    };
-
-    # --- home side: DMS + niri keybinds for finn ---
-    home-manager.users.finn = {
-      imports = [
-        inputs.niri.homeModules.niri
-        inputs.dank.homeModules.dank-material-shell
-        inputs.dank.homeModules.niri
-      ];
-
-      programs.dank-material-shell = {
-        enable = true;
-        systemd.enable = true;
-        quickshell.package = pkgs.unstable.quickshell;
-        niri.enableKeybinds = true;    # Mod+Space launcher, Mod+V clipboard, media/brightness, power, lock…
-        niri.enableSpawn = true;       # spawn `dms run` at niri startup
-      };
-
-      home.stateVersion = "26.05";     # match nixpkgs release; required by HM
-    };
-  };
-}
-```
-
-Registered by adding `./environments/dank` to
-`modules/environments/default.nix`.
-
-Open validation point (resolve during implementation, not a blocker):
-- Confirm the exact HM output name for the niri integration
-  (`homeModules.niri` vs `homeModules.dankMaterialShell.niri`) and that
-  `programs.niri.enable` is the correct niri-flake nixosModule option; adjust to
-  match the pinned input revisions.
-- Confirm whether `programs.dank-material-shell.quickshell.package` needs to be
-  set on both the system and HM sides or only one; set consistently.
-
-### 4. Enable on mibook (`machines/mibook/environments.nix`)
-
-Add to the `my.profiles` block:
-
-```nix
-dank.enable = true;
-```
-
-KDE (`kde-desktop.enable = true`) stays; both sessions are offered by SDDM.
-
-### 5. Documentation
-
-No homepage dashboard entry (DMS is not a web service). CLAUDE.md is left
-unchanged unless, after implementation, the home-manager pattern warrants a short
-note — decided at the end, not up front (YAGNI).
-
-## Data / control flow
-
-1. `nixos-rebuild` builds the mibook toplevel; niri-flake registers a `niri`
-   Wayland session, DMS nixosModule installs packages + the `dms` user service
-   template, home-manager renders finn's niri config (with DMS keybinds) and DMS
-   config.
-2. At login, SDDM lists **KDE** and **niri**. Selecting niri starts the
-   compositor; `spawn-at-startup` launches `dms run`, bringing up the DMS shell.
-3. Keybinds invoke `dms ipc …` (launcher, clipboard, notifications, media,
-   brightness, power, lock). DMS is further configured via its own GUI, persisted
-   under `~/.config/DankMaterialShell/`.
-
-## Risks / open questions
-
-- **unstable/stable skew:** the repo pins nixos-26.05 while `dank` and
-  `niri-flake` track nixos-unstable, and quickshell comes from `pkgs.unstable`.
-  Qt6/quickshell version mismatch between the DMS package and the stable base is
-  the most likely failure. Mitigation: validate with a full toplevel build and,
-  if it fails, align quickshell/qt sourcing (e.g. take the DMS package's own
-  quickshell) before switching.
-- **HM output/option names** may differ from the researched revision — pin the
-  inputs first, then read the resolved module options and adjust (see §3 open
-  validation point).
-- **First HM activation** for finn: ensure `home.stateVersion` is set so the
-  build doesn't error.
-
-## Verification
-
-1. `nix flake check` succeeds.
-2. `nix build '.#nixosConfigurations.mibook.config.system.build.toplevel'`
-   succeeds.
-3. `sudo nixos-rebuild test --flake '.#mibook'`, then log into the **niri**
-   session: DMS bar appears, `Mod+Space` opens the launcher, KDE session still
-   works.

flake.lock

@@ -1,41 +1,5 @@
 {
   "nodes": {
-    "dank": {
-      "inputs": {
-        "dank-qml-common": "dank-qml-common",
-        "flake-compat": "flake-compat",
-        "nixpkgs": "nixpkgs"
-      },
-      "locked": {
-        "lastModified": 1784830217,
-        "narHash": "sha256-6MvMw45RSORjINmFd3Lfz9VX9sH8+xTb5WNZiWIKbDw=",
-        "owner": "AvengeMedia",
-        "repo": "DankMaterialShell",
-        "rev": "8af71036cca800064f3fb22dd201109ade6c5ee9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "AvengeMedia",
-        "repo": "DankMaterialShell",
-        "type": "github"
-      }
-    },
-    "dank-qml-common": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1784647395,
-        "narHash": "sha256-kcLSJC8XBzmWoSBc90Zn81qrNsqWMkwQ1m/zZixOw30=",
-        "owner": "AvengeMedia",
-        "repo": "dank-qml-common",
-        "rev": "1919595f0dde4f5bf5ac0baa1902ff6d070971d5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "AvengeMedia",
-        "repo": "dank-qml-common",
-        "type": "github"
-      }
-    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -52,32 +16,16 @@
         "type": "github"
       }
     },
-    "flake-compat_2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1767039857,
-        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
-        "owner": "NixOS",
-        "repo": "flake-compat",
-        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1778716662,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
         "type": "github"
       },
       "original": {
@@ -94,11 +42,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1778716662,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
         "type": "github"
       },
       "original": {
@@ -112,17 +60,20 @@
         "flake-compat": [
           "nix"
         ],
+        "gitignore": [
+          "nix"
+        ],
         "nixpkgs": [
           "nix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1783008725,
+        "lastModified": 1781733627,
-        "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=",
+        "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe",
+        "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39",
         "type": "github"
       },
       "original": {
@@ -131,98 +82,21 @@
         "type": "github"
       }
     },
-    "home-manager": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1784350909,
-        "narHash": "sha256-ZWyzLbS1yKUTeFJLmdVuWNnHttL333/ldJbEE+KzCrM=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "4ce190229c73d44536caa7072f6308fb2d8feeb3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "release-26.05",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
-    "niri": {
-      "inputs": {
-        "niri-stable": "niri-stable",
-        "niri-unstable": "niri-unstable",
-        "nixpkgs": "nixpkgs_2",
-        "nixpkgs-stable": "nixpkgs-stable",
-        "xwayland-satellite-stable": "xwayland-satellite-stable",
-        "xwayland-satellite-unstable": "xwayland-satellite-unstable"
-      },
-      "locked": {
-        "lastModified": 1784874881,
-        "narHash": "sha256-u4jhSIf/Un0qZB+Cn3hTTaHSI20XeAxYbA5o4faqdJs=",
-        "owner": "sodiboo",
-        "repo": "niri-flake",
-        "rev": "ef7a2a3d719af46b906c22a3ebfb7d65627b2cd2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "sodiboo",
-        "repo": "niri-flake",
-        "type": "github"
-      }
-    },
-    "niri-stable": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1756556321,
-        "narHash": "sha256-RLD89dfjN0RVO86C/Mot0T7aduCygPGaYbog566F0Qo=",
-        "owner": "YaLTeR",
-        "repo": "niri",
-        "rev": "01be0e65f4eb91a9cd624ac0b76aaeab765c7294",
-        "type": "github"
-      },
-      "original": {
-        "owner": "YaLTeR",
-        "ref": "v25.08",
-        "repo": "niri",
-        "type": "github"
-      }
-    },
-    "niri-unstable": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1784570726,
-        "narHash": "sha256-9EMn69JBcFWFgUM7f0VBAX+jBby5b9H3M59U75+5yI4=",
-        "owner": "YaLTeR",
-        "repo": "niri",
-        "rev": "7f26c3ee804fb6ed458ef7fb0e3c794f14e0b3bc",
-        "type": "github"
-      },
-      "original": {
-        "owner": "YaLTeR",
-        "repo": "niri",
-        "type": "github"
-      }
-    },
     "nix": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat",
         "flake-parts": "flake-parts_2",
         "git-hooks-nix": "git-hooks-nix",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs",
         "nixpkgs-23-11": "nixpkgs-23-11",
         "nixpkgs-regression": "nixpkgs-regression"
       },
       "locked": {
-        "lastModified": 1784762557,
+        "lastModified": 1782337899,
-        "narHash": "sha256-R/r6jRnANV50c8F5Fz5+1Q1moab0IGWRk+cg5ME2nMY=",
+        "narHash": "sha256-Imevyelg3r2N5iDonnGdOKGRiB56m3HgVFAljTB3CLU=",
         "owner": "NixOS",
         "repo": "nix",
-        "rev": "d10c84cd0cc0efdcb29cf2611caf5fbcd10fa071",
+        "rev": "3887a906b178836818a62e8eba666ad652e8a388",
         "type": "github"
       },
       "original": {
@@ -269,14 +143,14 @@
     },
     "nixos-hardware": {
       "inputs": {
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1784723954,
+        "lastModified": 1782379505,
-        "narHash": "sha256-1CfD8ZUjCkTgjsneLZ/lxCHhgDfqxxE7/GX0MmsgiqA=",
+        "narHash": "sha256-zPvPiU+a7pqtH47xrtZLNRABJKpOjfZQclDbcvNtH+I=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "a017f5b72210026af5b3ac5949f08d94380a6fbd",
+        "rev": "603d3afd1b6145bd66e97ae38a34d91c95df70cf",
         "type": "github"
       },
       "original": {
@@ -287,18 +161,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1783224372,
+        "lastModified": 1780902259,
-        "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
+        "narHash": "sha256-YMnBf9lk/LYgvqfmSSJuOGigtRs5Lsy26pJHVlR9yMY=",
-        "owner": "nixos",
+        "rev": "bd0ff2d3eac24699c3664d5966b9ef36f388e2ca",
-        "repo": "nixpkgs",
+        "type": "tarball",
-        "rev": "d407951447dcd00442e97087bf374aad70c04cea",
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.1550.bd0ff2d3eac2/nixexprs.tar.xz"
-        "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "type": "tarball",
-        "ref": "nixos-unstable",
+        "url": "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz"
-        "repo": "nixpkgs",
-        "type": "github"
       }
     },
     "nixpkgs-23-11": {
@@ -319,11 +190,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1782614948,
+        "lastModified": 1777168982,
-        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
+        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
+        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
         "type": "github"
       },
       "original": {
@@ -348,29 +219,13 @@
         "type": "github"
       }
     },
-    "nixpkgs-stable": {
-      "locked": {
-        "lastModified": 1782847189,
-        "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1784796856,
+        "lastModified": 1782467914,
-        "narHash": "sha256-vwxWgF+Gj276WznzGb1LxGsK/39HaQwgQXiU3EkC844=",
+        "narHash": "sha256-inDx/w70OSJoJPqtKh0BrzAsbZZhpya7YgS43jHnhwg=",
-        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
+        "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1040357.e2587caef70c/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1022855.e73de5be04e0/nixexprs.tar.xz"
       },
       "original": {
         "id": "nixpkgs",
@@ -379,35 +234,6 @@
       }
     },
     "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1784796856,
-        "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1783148766,
-        "narHash": "sha256-H9+N+GFtsbVC8ZniHliChM7ndizxtqVZs6bnGOLM3WQ=",
-        "rev": "a50de1b7d8a586adc18d2395c19de7d6058e6030",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.4193.a50de1b7d8a5/nixexprs.tar.xz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz"
-      }
-    },
-    "nixpkgs_4": {
       "locked": {
         "lastModified": 1767892417,
         "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
@@ -420,13 +246,13 @@
         "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
       }
     },
-    "nixpkgs_5": {
+    "nixpkgs_3": {
       "locked": {
-        "lastModified": 1784707089,
+        "lastModified": 1782375420,
-        "narHash": "sha256-DUedXhD2Rg8q4Xyd07Sb90eZGy4gg6W+Vl/WbLNwAZo=",
+        "narHash": "sha256-f+/IH5ng5P91VHrhcNxqpW2RYDySD68V1fcX00COQy4=",
-        "rev": "b3fe9581c9061c749abef42b6d4ee7b7c05c33fa",
+        "rev": "4062d36ebeae843c750011eef6b61ec9a9dbc9a9",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.5845.b3fe9581c906/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.3250.4062d36ebeae/nixexprs.tar.xz"
       },
       "original": {
         "id": "nixpkgs",
@@ -436,49 +262,13 @@
     },
     "root": {
       "inputs": {
-        "dank": "dank",
         "flake-parts": "flake-parts",
-        "home-manager": "home-manager",
-        "niri": "niri",
         "nix": "nix",
         "nixos-generators": "nixos-generators",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": "nixpkgs_3",
         "nixpkgs-unstable": "nixpkgs-unstable"
       }
-    },
-    "xwayland-satellite-stable": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1755491097,
-        "narHash": "sha256-m+9tUfsmBeF2Gn4HWa6vSITZ4Gz1eA1F5Kh62B0N4oE=",
-        "owner": "Supreeeme",
-        "repo": "xwayland-satellite",
-        "rev": "388d291e82ffbc73be18169d39470f340707edaa",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Supreeeme",
-        "ref": "v0.7",
-        "repo": "xwayland-satellite",
-        "type": "github"
-      }
-    },
-    "xwayland-satellite-unstable": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1784679892,
-        "narHash": "sha256-Mb7jpqnrcYCfNSItIkkHpuR3YxWFxPuIBfcwNKlRBkk=",
-        "owner": "Supreeeme",
-        "repo": "xwayland-satellite",
-        "rev": "8d135d3b2854b30fd01ea6cd6c27e523dd50a839",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Supreeeme",
-        "repo": "xwayland-satellite",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -11,12 +11,6 @@
       url = "github:nix-community/nixos-generators";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    home-manager = {
-      url = "github:nix-community/home-manager/release-26.05";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    niri.url = "github:sodiboo/niri-flake";
-    dank.url = "github:AvengeMedia/DankMaterialShell";
 
   };
 

machines/jupiter/environments.nix

@@ -23,6 +23,7 @@ in
     jellyseerr.enable = true;
     development.enable = true;
     home-assistant.enable = true;
+    ntfy.enable = true;
 
     homepage.enable = true;
     paperless = {

machines/mibook/configuration.nix

@@ -44,14 +44,6 @@
 
   services.openssh.enable = true;
 
-  # KDE (PowerDevil) power settings: do nothing on lid close while on AC power.
-  # Shipped as a system-wide default; KConfig cascades so a user's own
-  # ~/.config/powerdevilrc will override this if present.
-  environment.etc."xdg/powerdevilrc".text = ''
-    [AC][SuspendAndShutdown]
-    LidAction=0
-  '';
-
   system = {
     stateVersion = "23.05";
     autoUpgrade.enable = true;

machines/mibook/environments.nix

@@ -6,7 +6,6 @@ in
 {
   my.profiles = {
     kde-desktop.enable = true;
-    dank.enable = false;
     zsh.enable = true;
     apps = {
       desktop_apps = true;

modules/environments/dank/default.nix

@@ -1,48 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  self,
-  ...
-}:
-let
-  cfg = config.my.profiles.dank;
-in
-{
-  imports = [ self.inputs.dank.nixosModules.dank-material-shell ];
-
-  options.my.profiles.dank.enable = lib.mkEnableOption "DankMaterialShell on niri";
-
-  config = lib.mkIf cfg.enable {
-    # Dependency: declarative user config comes from home-manager.
-    my.profiles.home-manager.enable = true;
-
-    # System side: niri Wayland session + DMS daemons/packages.
-    programs.niri.enable = true;
-
-    programs.dank-material-shell = {
-      enable = true;
-      systemd.enable = true;
-      quickshell.package = pkgs.unstable.quickshell;
-    };
-
-    # Home side: DMS shell + niri spawn for finn (keybinds come via includes).
-    home-manager.users.finn = {
-      imports = [
-        inputs.niri.homeModules.niri
-        inputs.dank.homeModules.dank-material-shell
-        inputs.dank.homeModules.niri
-      ];
-
-      programs.dank-material-shell = {
-        enable = true;
-        systemd.enable = true;
-        quickshell.package = pkgs.unstable.quickshell;
-        niri.enableSpawn = true;
-      };
-
-      home.stateVersion = "26.05";
-    };
-  };
-}

modules/environments/default.nix

@@ -7,9 +7,8 @@
     ./claude-code
     ./development
     ./home-assistant
+    ./ntfy
     ./hyprland
-    ./home-manager
-    ./dank
     ./zsh
     ./paperless
     ./prowlarr

modules/environments/home-manager/default.nix

@@ -1,21 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  self,
-  ...
-}:
-let
-  cfg = config.my.profiles.home-manager;
-in
-{
-  imports = [ self.inputs.home-manager.nixosModules.home-manager ];
-
-  options.my.profiles.home-manager.enable = lib.mkEnableOption "home-manager integration";
-
-  config = lib.mkIf cfg.enable {
-    home-manager.useGlobalPkgs = true;
-    home-manager.useUserPackages = true;
-    home-manager.extraSpecialArgs = { inherit inputs self; };
-  };
-}

modules/environments/ntfy/default.nix

@@ -0,0 +1,74 @@
+# self-hosted push notification server (ntfy)
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.profiles.ntfy;
+  hostName = config.networking.hostName;
+in
+{
+  options.my.profiles.ntfy = with lib; {
+    enable = mkEnableOption "ntfy notification server";
+
+    port = mkOption {
+      type = types.port;
+      default = 2586;
+      description = "HTTP port ntfy listens on.";
+    };
+
+    topic = mkOption {
+      type = types.str;
+      default = "ha";
+      description = "Topic Home Assistant publishes notifications to.";
+    };
+
+    haIntegration.enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Wire a Home Assistant rest_command that publishes to ntfy.";
+    };
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      services.ntfy-sh = {
+        enable = true;
+        settings = {
+          base-url = "http://${hostName}:${toString cfg.port}";
+          listen-http = ":${toString cfg.port}";
+          auth-file = "/var/lib/ntfy-sh/user.db";
+          auth-default-access = "deny-all";
+        };
+      };
+
+      networking.firewall.allowedTCPPorts = [ cfg.port ];
+
+      my.homepage.services = [
+        {
+          group = "Services";
+          name = "ntfy";
+          description = "Push notifications";
+          href = "http://${hostName}:${toString cfg.port}";
+          icon = "ntfy.svg";
+        }
+      ];
+    })
+
+    (lib.mkIf (cfg.enable && cfg.haIntegration.enable && config.my.profiles.home-assistant.enable) {
+      services.home-assistant.config.rest_command.ntfy_send = {
+        url = "http://${hostName}:${toString cfg.port}/${cfg.topic}";
+        method = "POST";
+        payload = "{{ message }}";
+        content_type = "text/plain";
+        username = "homeassistant";
+        password = "!secret ntfy_password";
+        headers = {
+          Title = "{{ title | default('Home Assistant') }}";
+          Priority = "{{ priority | default('default') }}";
+        };
+      };
+    })
+  ];
+}