chore: Flake update

homepage-dashboard parses the widget url with JS's URL() and reads
.hostname/.port off the result. Without a "scheme://" prefix,
"rechberg.online:25565" parses "rechberg.online" as the scheme and
leaves hostname empty, which the minecraftstatuspinger lookup()
rejects with "No hostname was provided!" (confirmed via
journalctl -u homepage-dashboard). The scheme itself is discarded by
the widget code, so any scheme works; tcp:// documents intent since
this widget always does a plain TCP server-list ping.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HCHg6BFAjZGUZer7RW5faD

docs/superpowers/plans/2026-04-23-homepage-widgets.md

@@ -0,0 +1,164 @@
+# Homepage Widgets Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add a `my.homepage.widgets` NixOS option so widgets can be declared in the homepage module and contributed from other modules, mirroring how `my.homepage.services` works today.
+
+**Architecture:** Add a `my.homepage.widgets` option (typed `listOf attrs` since widget shapes vary by type) to the homepage module, import a `manual-widgets.nix` for ad-hoc definitions, merge both and pass to `services.homepage-dashboard.widgets`. Add starter widgets in `machines/jupiter/environments.nix` to confirm the wiring works end-to-end.
+
+**Tech Stack:** Nix, NixOS module system, gethomepage.dev (`services.homepage-dashboard`)
+
+---
+
+## File Map
+
+| Action | File | Responsibility |
+|--------|------|----------------|
+| Modify | `modules/environments/homepage/default.nix` | Add `my.homepage.widgets` option + wire to dashboard |
+| Create | `modules/environments/homepage/manual-widgets.nix` | Empty list for ad-hoc widgets (parallel to `manual-services.nix`) |
+| Modify | `machines/jupiter/environments.nix` | Declare starter widgets to verify the feature end-to-end |
+
+---
+
+### Task 1: Add `my.homepage.widgets` option to the homepage module
+
+**Files:**
+- Modify: `modules/environments/homepage/default.nix`
+- Create: `modules/environments/homepage/manual-widgets.nix`
+
+- [ ] **Step 1: Create `manual-widgets.nix`** — empty list, same pattern as `manual-services.nix`
+
+```nix
+# modules/environments/homepage/manual-widgets.nix
+[ ]
+```
+
+- [ ] **Step 2: Add `manualWidgets` import in the `let` block of `default.nix`**
+
+Current `let` block (lines 7–42) ends with `homepageServices`. Add one line after `manualServices`:
+
+```nix
+  manualServices = import ./manual-services.nix;
+  manualWidgets = import ./manual-widgets.nix;
+```
+
+- [ ] **Step 3: Add the `my.homepage.widgets` option**
+
+After the closing brace of `options.my.homepage.services` (line 80), add:
+
+```nix
+  options.my.homepage.widgets = with lib; mkOption {
+    type = types.listOf types.attrs;
+    default = [ ];
+    description = "Widget definitions passed directly to services.homepage-dashboard.widgets. Each entry is an attrset like { resources = { cpu = true; memory = true; }; }.";
+  };
+```
+
+- [ ] **Step 4: Wire widgets to the dashboard in the `config` block**
+
+The `config` block currently sets `services = homepageServices ++ manualServices;`. Add `widgets`:
+
+```nix
+  config = lib.mkIf cfg.enable {
+    services.homepage-dashboard = {
+      enable = true;
+      listenPort = dashboardPort;
+      allowedHosts = "${dashboardHost}:${toString dashboardPort},localhost:${toString dashboardPort},127.0.0.1:${toString dashboardPort},jupiter.solar.internal:${toString dashboardPort}";
+      bookmarks = import ./bookmarks.nix;
+      services = homepageServices ++ manualServices;
+      widgets = config.my.homepage.widgets ++ manualWidgets;
+    };
+    # ... rest of config unchanged
+  };
+```
+
+- [ ] **Step 5: Build to check for eval errors (no switch yet)**
+
+```bash
+nixos-rebuild build --flake /Users/finnmarkwitz/development/nixos#jupiter 2>&1 | tail -20
+```
+
+Expected: build succeeds with no errors (widgets list is empty, so no visible change yet).
+
+- [ ] **Step 6: Commit**
+
+```bash
+cd /Users/finnmarkwitz/development/nixos
+git add modules/environments/homepage/default.nix modules/environments/homepage/manual-widgets.nix
+git commit -m "feat: add my.homepage.widgets option to homepage module"
+```
+
+---
+
+### Task 2: Add starter widgets in `environments.nix`
+
+**Files:**
+- Modify: `machines/jupiter/environments.nix`
+
+- [ ] **Step 1: Add `my.homepage.widgets` to `environments.nix`**
+
+Add the following after the `my.profiles` block (e.g. after line 39, before the `my.hardware` block):
+
+```nix
+  my.homepage.widgets = [
+    {
+      search = {
+        provider = "google";
+        target = "_blank";
+      };
+    }
+    {
+      resources = {
+        cpu = true;
+        memory = true;
+        disk = "/";
+        cacheInterval = 5000;
+      };
+    }
+    {
+      datetime = {
+        text_size = "xl";
+        format = {
+          timeStyle = "short";
+          dateStyle = "short";
+          hour12 = false;
+        };
+      };
+    }
+  ];
+```
+
+- [ ] **Step 2: Build to confirm eval**
+
+```bash
+nixos-rebuild build --flake /Users/finnmarkwitz/development/nixos#jupiter 2>&1 | tail -20
+```
+
+Expected: build succeeds.
+
+- [ ] **Step 3: Switch and verify visually**
+
+```bash
+sudo nixos-rebuild switch --flake /Users/finnmarkwitz/development/nixos#jupiter
+```
+
+Open `http://jupiter.solar.internal:8082` (or `http://localhost:8082`) in a browser.
+
+Expected: search bar, CPU/memory/disk resource monitor, and date/time widget appear at the top of the dashboard.
+
+- [ ] **Step 4: Commit**
+
+```bash
+cd /Users/finnmarkwitz/development/nixos
+git add machines/jupiter/environments.nix
+git commit -m "feat: add starter homepage widgets (search, resources, datetime)"
+```
+
+---
+
+## Verification Checklist
+
+- [ ] `nixos-rebuild build` passes with no eval errors
+- [ ] Dashboard at `:8082` shows widgets at top of page
+- [ ] Existing services and bookmarks are unchanged
+- [ ] Other modules can now contribute widgets via `my.homepage.widgets = [ ... ];` in their `config` block

flake.lock

@@ -21,11 +21,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1788450739,
+        "lastModified": 1790898470,
-        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
+        "narHash": "sha256-zTwuwezD0w3hpga6a6P8emidzAZFyWqlNeRBlpWOOl8=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
+        "rev": "024633cd702b10285db5cb19b40ad48d2399ba60",
         "type": "github"
       },
       "original": {
@@ -63,11 +63,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788450739,
+        "lastModified": 1790898470,
-        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
+        "narHash": "sha256-zTwuwezD0w3hpga6a6P8emidzAZFyWqlNeRBlpWOOl8=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
+        "rev": "024633cd702b10285db5cb19b40ad48d2399ba60",
         "type": "github"
       },
       "original": {
@@ -87,11 +87,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788267358,
+        "lastModified": 1790500375,
-        "narHash": "sha256-nt+lUqYVpc9Y6JeMd2WmXzCDojasdadKo0mWcluvY2Y=",
+        "narHash": "sha256-XN3sDtn8TU9hAc9xqZ+SqRB/HHm2wjxM6aSWYLJU+oo=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "27555e2624241fb116b49095df4caaee85a25691",
+        "rev": "a0e4241b51206fbcbf52fd322eb5f0cd80f153c4",
         "type": "github"
       },
       "original": {
@@ -113,11 +113,11 @@
         "uv2nix": "uv2nix"
       },
       "locked": {
-        "lastModified": 1789999030,
+        "lastModified": 1792650380,
-        "narHash": "sha256-oqEWD3Ih/CDejvfWNXFhbwUxvU4RwQZQ9DrI5dD+P10=",
+        "narHash": "sha256-4l8C4z7K4VQDq2ExP6v9NUdCpSFagB1hbt4gh/Y6YSw=",
         "owner": "NousResearch",
         "repo": "hermes-agent",
-        "rev": "8f7b3b48fc61dc411cac6ebcb0aaaf451ba9c1cb",
+        "rev": "81a55437f3f31a9f12a30c53b6c5d49d420898aa",
         "type": "github"
       },
       "original": {
@@ -157,11 +157,11 @@
         "nixpkgs-regression": "nixpkgs-regression"
       },
       "locked": {
-        "lastModified": 1789933661,
+        "lastModified": 1792618091,
-        "narHash": "sha256-GtfSaYgUPu91AafiBAQIVEwQiPfIOrgqwmxGtMNDtMI=",
+        "narHash": "sha256-sDmJ6tgPjlSk9P2jCXXjV2l0Ewe7K9CwclMcAvpEyR0=",
         "owner": "NixOS",
         "repo": "nix",
-        "rev": "5711f8fed2fcff91a52646e2e856648eca86c331",
+        "rev": "42d96171bbef8a8073106dd93ca68878d7339abd",
         "type": "github"
       },
       "original": {
@@ -211,11 +211,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1789978172,
+        "lastModified": 1792491056,
-        "narHash": "sha256-FIRXajv1pPZ+l6On6ekkmcQ6le0Zi0ncRUoR3nB0vKA=",
+        "narHash": "sha256-6n1Dn+WYtD8lprnSi+0k4FjbKfIVNG8lblpJ5MiiqXs=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "9ebcb7766700d7e006d9505247bd7ce0426f4232",
+        "rev": "efb6d0d5e2394c3c5416a18652808aba206c0988",
         "type": "github"
       },
       "original": {
@@ -255,11 +255,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1788057806,
+        "lastModified": 1790477367,
-        "narHash": "sha256-DTQSMxzDWmT0zhguthvegnVkn7CFqGCv4IHCzk5ZUpM=",
+        "narHash": "sha256-oujbxmVKDhci2E4EM3KyAbRUgp5/IsCoiA/LfEF7OOk=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "596e2e3940e09b2abbeb03f75fa1828c57fcd72c",
+        "rev": "f7cd230690d9fc982d06129f9189b101fddcfa3b",
         "type": "github"
       },
       "original": {
@@ -286,11 +286,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1789921291,
+        "lastModified": 1792502884,
-        "narHash": "sha256-uLLUj+TLUmBc6KrUzx76KZdPi5ZkI1ORR9A6lJUIZlo=",
+        "narHash": "sha256-ij8QUxzTOHovLrNOxVRx+RAhGQFOMsJbji0veiatH5k=",
-        "rev": "44a91898084f46797b5fac650c7e8c9ac38c43d4",
+        "rev": "02c087f3fe673c9e317f206a627cb6b910336dbe",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1077143.44a91898084f/nixexprs.tar.zst"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1097682.02c087f3fe67/nixexprs.tar.zst"
       },
       "original": {
         "id": "nixpkgs",
@@ -313,11 +313,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1789885152,
+        "lastModified": 1792615934,
-        "narHash": "sha256-lIL3uDaS4Q9Ks6klLrBlDr+XS71sbjMJFSipIp2yPjs=",
+        "narHash": "sha256-q1ku4ygV7tdmv5Q9QYwhVDsNMZRJcRYjVczoX5+XWBo=",
-        "rev": "6d663c0533ff269008fb84e45930151e37c99db9",
+        "rev": "da6dc0e7b26060f2f71ce3ef7088fb56ee44fa36",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.10304.6d663c0533ff/nixexprs.tar.zst"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.12400.da6dc0e7b260/nixexprs.tar.zst"
       },
       "original": {
         "id": "nixpkgs",
@@ -415,11 +415,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789890976,
+        "lastModified": 1792056300,
-        "narHash": "sha256-GKwH3zpy7tartuJMG0Rv/xUsdetG1QLmTVv8UKgJLmA=",
+        "narHash": "sha256-YU1LjDe1o2Ymg5zEiCHbmMXLkDCtxHQRiVqZ3nC5GGk=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "7214124c20c1542c90deb54af50e2f53ae02711f",
+        "rev": "44931708c62937c2b1bf7953902989fa5bb9ee1b",
         "type": "github"
       },
       "original": {

machines/core/nix.nix

@@ -12,6 +12,13 @@
 
     settings = {
       auto-optimise-store = true;
+      # Without these, gc sweeps away eval-time-only sources (flake inputs,
+      # their build deps) since they're not part of the runtime closure.
+      # The next evaluation then cold-refetches everything from GitHub,
+      # which is enough on its own to trip GitHub's unauthenticated rate
+      # limit for large dependency trees (e.g. hermes-agent's).
+      keep-outputs = true;
+      keep-derivations = true;
     };
 
     gc = {

machines/jupiter/configuration.nix

@@ -72,6 +72,9 @@
 
   system = {
     stateVersion = "23.05";
-    autoUpgrade.enable = true;
+    # Was silently failing daily (legacy channel path, no --flake set) without
+    # ever reaching the network. Disabled rather than fixed: rebuilds should
+    # only happen when triggered manually.
+    autoUpgrade.enable = false;
   };
 }

machines/jupiter/environments.nix

@@ -17,7 +17,7 @@ _: {
     readarr.enable = true;
     sonarr.enable = true;
     jellyfin.enable = true;
-    jellyseerr.enable = true;
+    seerr.enable = true;
     immich.enable = true;
     development.enable = true;
     home-assistant.enable = true;

machines/mibook/configuration.nix

@@ -61,6 +61,9 @@
 
   system = {
     stateVersion = "23.05";
-    autoUpgrade.enable = true;
+    # Was silently failing daily (legacy channel path, no --flake set) without
+    # ever reaching the network. Disabled rather than fixed: rebuilds should
+    # only happen when triggered manually.
+    autoUpgrade.enable = false;
   };
 }

machines/mibook/environments.nix

@@ -4,8 +4,8 @@ _: {
     kde-desktop.enable = true;
     zsh.enable = true;
     apps = {
-      desktop_apps = true;
+      desktop_apps = false;
-      dev_apps = true;
+      dev_apps = false;
     };
     development.enable = true;
     docker.enable = true;
@@ -19,7 +19,7 @@ _: {
     nvidia.enable = false;
   };
   my.services = {
-    vpn.enable = true;
+    vpn.enable = false;
   };
 
 }

machines/mibook/network.nix

@@ -4,5 +4,6 @@ _: {
   # firewall otherwise blocks inbound connections from other devices.
   networking.firewall.allowedTCPPorts = [
     9119 # athena hermes dashboard
+    47823 # hermes agent ad-hoc webpage server
   ];
 }

modules/environments/apps/default.nix

@@ -25,11 +25,13 @@ in
       spotify
       keepassxc
       moonlight-qt
+      # jetbrains.idea-ultimate
       nextcloud-client
       pipewire
       wireplumber
       vlc
       ghostty
+      zed-editor
     ];
   };
 }

modules/environments/default.nix

@@ -18,7 +18,7 @@
     ./readarr
     ./sonarr
     ./jellyfin
-    ./jellyseerr
+    ./seerr
     ./immich
     ./hermes-agent
   ];

modules/environments/development/default.nix

@@ -15,11 +15,7 @@ in
 
   config = lib.mkIf cfg.enable {
     users.users.finn.packages = with pkgs; [
-      google-chrome
-      vscode
-      zed-editor
       neovim
-      # jetbrains.idea-ultimate
       go
       nodejs # bundles npm
       (python3.withPackages (

modules/environments/hermes-agent/default.nix

@@ -19,7 +19,10 @@ in
     services.hermes-agent = {
       enable = true;
       # Deliberate pin, matches the approved design — bump on purpose, not by drift.
-      settings.model.default = "anthropic/claude-sonnet-4-5";
+      settings.model.default = "anthropic/claude-sonnet-5-5";
+      # The Nix flake input is the source of truth for hermes's version here; its
+      # built-in self-updater polling GitHub independently just burns API quota.
+      settings.updates.check = false;
       environmentFiles = [ config.sops.secrets."hermes-env".path ];
       addToSystemPackages = true;
 

modules/environments/homepage/bookmarks.nix

@@ -6,7 +6,6 @@
           {
             icon = "reddit.png";
             href = "https://reddit.com/";
-            description = "The front page of the internet";
           }
         ];
       }
@@ -17,7 +16,7 @@
       {
         YouTube = [
           {
-            abbr = "YT";
+            icon = "youtube.png";
             href = "https://youtube.com/";
           }
         ];

modules/environments/homepage/manual-services.nix

@@ -32,4 +32,40 @@
       }
     ];
   }
+  {
+    "Gaming" = [
+      {
+        "Talon" = {
+          href = "https://ethraldos.online";
+          description = "Kunst der Täuschung";
+          icon = "foundry-vtt.png";
+        };
+      }
+      {
+        "Tyranny of Dragons" = {
+          href = "https://hotdq.smoothcloud.de";
+          description = "Tyranny of Dragons (D&D)";
+          icon = "foundry-vtt.png";
+        };
+      }
+      {
+        "Beholder D&D" = {
+          href = "https://beholder.ethraldos.online";
+          description = "Andrey FoundryVTT Server";
+          icon = "foundry-vtt.png";
+        };
+      }
+      {
+        "Minecraft" = {
+          href = "https://rechberg.online";
+          description = "Java Minecraft Server";
+          icon = "minecraft.png";
+          widget = {
+            type = "minecraft";
+            url = "tcp://rechberg.online:25565";
+          };
+        };
+      }
+    ];
+  }
 ]

modules/environments/seerr/default.nix

@@ -1,17 +1,17 @@
 # manages and downloads films
 { config, lib, ... }:
 let
-  cfg = config.my.profiles.jellyseerr;
+  cfg = config.my.profiles.seerr;
   hostName = config.networking.hostName;
   port = 5055;
 in
 {
-  options.my.profiles.jellyseerr = with lib; {
+  options.my.profiles.seerr = with lib; {
-    enable = mkEnableOption "JellySeerr Media Service";
+    enable = mkEnableOption "Seerr Media Service";
   };
 
   config = lib.mkIf cfg.enable {
-    services.jellyseerr = {
+    services.seerr = {
       enable = true;
       openFirewall = true;
     };
@@ -19,14 +19,14 @@ in
     my.homepage.services = [
       {
         group = "Media";
-        name = "Jellyseerr";
+        name = "Seerr";
         description = "Media requests";
         href = "http://${hostName}:${toString port}";
         icon = "mdi-television-guide";
       }
     ];
 
-    systemd.services.jellyseerr = {
+    systemd.services.seerr = {
       after = [ "network-online.target" ];
     };
   };