General improvements and refactoring

.gitignore

@@ -2,3 +2,4 @@
 result
 .pre-commit-config.yaml
 /.codex
+/.claude

README.md

@@ -45,9 +45,9 @@ nh home switch -c nix@firefly .
 # nix build installer iso
 nix build .#nixosConfigurations.vinox.config.system.build.isoImage
 
-# nh remote switch
-nh os switch --hostname kubex . -d always --target-host kubex
-nh os switch --hostname nixberry . -d always --target-host <IP>
+# nh remote switch / update
+nh os boot --hostname kubex . -d always --target-host kubex
+nh os boot --hostname nixberry . -d always --target-host <IP>
 
 # nix remote switch
 nixos-rebuild switch --flake .#kubex --target-host 192.168.55.10 --sudo
@@ -78,6 +78,7 @@ sudo nixos-install --flake .#zion
 
 ## :open_book: Docs
 
+- [Gaming and Battle.net](./docs/gaming.md)
 - [Hyprland - Keymap](./docs/hyprland.md#keymap)
 - [NVIM - Keymap](https://github.com/RAPSNX/neonix/tree/main/docs/keymap.md)
 

dev-shells.nix

@@ -34,6 +34,7 @@ in
         deadnix
         nixfmt
         nix-inspect
+        nix-tree
         ;
 
       inherit

docs/bootstrap.md → docs/guides/bootstrap.md

@@ -4,6 +4,3 @@
 ### PWAs
 Manually installed `PWAs` in `Chromium`:
 - todoist
-
-## Firefly
-Look into [./firefly.md](Firefly bootstrap)

docs/guides/dual-boot.md

@@ -0,0 +1,31 @@
+# Dual-boot
+If reinstall / install `zion` or a workstation with dual-boot, follow this order:
+
+1. Install `Windows` first, create the correct partitions while running the installer.
+Ensure that the bootloader partition is big enough.
+2. Next boot into `NixOS` live and install `NixOS` with the bootloader partition from windows.
+// TODO: Add / Update this to use directly `nixos-install`?
+
+# Dual-boot entry lost
+When updating the `BIOS` the `nvram` gets cleared, resulting in a lost boot entry for `NixOS`.
+This can not be fixed by simply boot into live-system and rebuild the bootloader like written in the public docs.
+Follow this procedure to recreate the `nvram` boot-entry again:
+
+1. Boot into `NixOS` live system using the `vinox` iso.
+2. Mount and `chroot` into the main system.
+
+```bash
+sudo -i # Sudo is needed for every action
+
+mount /dev/nvme0n1p{X} /mnt # mount root system
+mount /dev/nvme0n1p{X} /mnt/boot # mount bootloader
+
+nixos-enter
+NIXOS_INSTALL_BOOTLOADER=1 /nix/var/nix/profiles/system/bin/switch-to-configuration boot # not sure if this is needed
+
+sudo efibootmgr --create \
+  --disk /dev/nvme0n1 \ # Disk not partition
+  --part 1 \
+  --label "NixOS" \
+  --loader '\EFI\systemd\systemd-bootx64.efi' \ # Mind the backslashes
+```

docs/guides/gaming.md

@@ -0,0 +1,58 @@
+# Gaming and Battle.net
+
+`hostConfig.roles.gaming.enable` installs Steam, Lutris, UMU, Gamescope, and
+GameMode. Steam owns the Proton 11+ runtime; Home Manager links that runtime to
+UMU so it can launch Lutris games without downloading a second copy.
+
+## One-time Steam Runtime setup
+
+Run these commands as `rap` after enabling the gaming role. Steam Runtime 4.0
+is Steam tool `4183110` and is required by Proton 11+.
+
+```sh
+steam steam://install/4183110
+```
+
+Wait for Steam to finish the download, then verify the runtime exists:
+
+```sh
+runtime="$HOME/.local/share/Steam/steamapps/common/SteamLinuxRuntime_4"
+test -f "$runtime/toolmanifest.vdf" && test -f "$runtime/mtree.txt.gz" \
+  && echo "Steam Runtime 4 is ready"
+```
+
+Remove any incomplete runtime that UMU created before activating the Home
+Manager link:
+
+```sh
+rm -rf "$HOME/.local/share/umu/steamrt4"
+```
+
+From this repository, apply the system and home configurations:
+
+```sh
+nh os switch .
+nh home switch .
+```
+
+Start a new graphical session, then confirm that UMU resolves to Steam's
+runtime:
+
+```sh
+readlink -f "$HOME/.local/share/umu/steamrt4"
+```
+
+The command should print
+`$HOME/.local/share/Steam/steamapps/common/SteamLinuxRuntime_4`.
+
+## Battle.net
+
+Open Lutris, select **+** → **Search the Lutris website for installers**, and
+install the standard Battle.net entry into a new Lutris-managed directory such
+as `~/Games/battlenet`. Do not run the Battle.net installer manually with
+`wine` or set `WINEPREFIX` yourself.
+
+If UMU reports an HTTP 403 while checking for runtime updates, the valid linked
+Steam runtime is still used. A `FileNotFoundError` for
+`steamrt4/toolmanifest.vdf` means the Steam Runtime bootstrap or Home Manager
+link is incomplete.

docs/guides/new-host.md

@@ -0,0 +1,11 @@
+# Setup new host
+
+Create host directory with `hardware-configuration.nix` & `default.nix`, configuring NixOS modules via the `system`
+option.
+
+## Github action
+
+There are Github Actions, to check and build every host against a `PR`.
+For each new host there needs to be config for the pipeline.
+
+# TODO(docs): Add workdevice manual steps, ppa hyprland and uwsm

docs/hosts/firefly.md

@@ -0,0 +1,134 @@
+# Backups
+
+1. Firefox profile
+
+```bash
+# TODO: Add this to home.nix
+rsync -av --update  ~/.mozilla/firefox/default ~/Nextcloud/Home/Backups/firefox_profile/
+```
+
+2. Check atuin `key` match with the key in vault.
+
+# Install device
+1. Install `nix` (May disable any VPN)
+
+```bash
+Verify command on nixos.org/download
+sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install) --daemon
+```
+
+2. Clone dotfiles
+  1. Change username `home.nix`, if necessary.
+3. Switch config via `devshells` target.
+
+```bash
+nix develop
+switch-firefly
+```
+
+4. Create compositor desktop files.
+
+`firefly` uses `roles.desktop.hyprland.configOnly = true`, so Home Manager only writes Hyprland configuration. Hyprland itself must come from the cppiber PPA and the display manager must start the APT/PPA binary directly.
+
+```bash
+echo "[Desktop Entry]
+Name=Hyprland
+Comment=An intelligent dynamic tiling Wayland compositor
+Exec=/usr/bin/Hyprland
+Type=Application" | sudo tee /usr/share/wayland-sessions/hyprland.desktop
+```
+
+`firefly` also has `roles.desktop.niri.enable = true` (PoC), backed by [niri-flake](https://github.com/sodiboo/niri-flake)'s `homeModules.niri`. Unlike Hyprland, there is no APT/PPA package for niri, so this module lets Home Manager install and manage niri itself (`programs.niri.package`, default `niri-stable` from niri-flake) in addition to generating `~/.config/niri/config.kdl` from `programs.niri.settings` (validated at build time via `niri validate`).
+
+niri-flake has its own binary cache to avoid building niri from source. Since `firefly` doesn't use the NixOS module (which wires the cache in automatically), add it once manually:
+
+```bash
+cachix use niri
+```
+
+The display manager launches session files without the user's shell `PATH`, so the `Exec` line must use the absolute path into the Home Manager profile (`niri-session` handles systemd/portal integration, unlike calling the raw `niri` binary). `DesktopNames=niri` sets `XDG_CURRENT_DESKTOP`, which portals/theming rely on to detect the session:
+
+```bash
+echo "[Desktop Entry]
+Name=Niri
+Comment=A scrollable-tiling Wayland compositor
+Exec=/home/$(whoami)/.nix-profile/bin/niri-session
+Type=Application
+DesktopNames=niri" | sudo tee /usr/share/wayland-sessions/niri.desktop
+```
+
+`niri --session` (invoked by `niri-session`) is systemd-integrated, like Hyprland — it expects `niri.service`/`niri-shutdown.target` user units to exist so GDM can track the session. Those ship inside the niri package itself, but only get linked into `~/.config/systemd/user/` automatically on NixOS; the `roles.desktop.niri` Home Manager module links them explicitly for non-NixOS hosts like `firefly` (see `modules/home/desktops/niri/default.nix`). Without that, GDM logs `Failed to start niri.service: Unit niri.service not found.` and silently falls back to another session.
+
+5. Copy user-certificate to firefox
+
+```bash
+# TODO: Add this to home.nix (as activation script for example)
+ln -sf ~/.pki/nssdb/* ~/.mozilla/firefox/default/
+```
+
+## Manual things
+
+### Disable gpg-agent
+```
+systemctl --user mask --now gpg-agent.service gpg-agent.socket \
+  gpg-agent-ssh.socket gpg-agent-extra.socket gpg-agent-browser.socket
+```
+
+### Chromium
+
+Extension: `Open in firefox`:
+
+**Other Settings**
+
+- Enable Reverse Mode
+
+**Automation Rules**
+
+Comma-separated list of URLs:
+```
+*://*.google.com/*, *://chat.ske.eu01.stackit.cloud/*
+```
+
+
+### GTK Theme
+
+`nwg-look` is used to configure theme in multiple locations.
+Run it, ensure to remove the check of `GTK4` files in preferences.
+Set `widgets -> colorScheme -> prefer dark`.
+
+```bash
+dconf read /org/gnome/desktop/interface/gtk-theme # Read the actual name
+```
+
+## Installed via APT
+
+Those programs are installed via apt, since they do not work within `nix`.
+
+```bash
+sudo add-apt-repository ppa:cppiber/hyprland
+sudo apt update
+sudo apt -y install \
+  hyprland \
+  xdg-desktop-portal \
+  xdg-desktop-portal-hyprland \
+  xdg-desktop-portal-gtk \
+  mumble \
+  swaylock \
+  podman
+```
+
+Home Manager must not manage Hyprland or portal packages on `firefly`. Verify the active setup after switching:
+
+```bash
+readlink -f "$(command -v Hyprland)"
+systemctl --user cat xdg-desktop-portal*.service
+systemctl --user show-environment | grep NIX_XDG_DESKTOP_PORTAL_DIR
+find ~/.config/xdg-desktop-portal ~/.nix-profile/share/xdg-desktop-portal -maxdepth 3 -type f 2>/dev/null
+```
+
+Expected results:
+
+- `Hyprland` resolves to `/usr/bin/Hyprland`.
+- Portal services come from the host packages, not Home Manager-generated user units.
+- `NIX_XDG_DESKTOP_PORTAL_DIR` is absent from the user systemd environment.
+- The `find` command does not show Home Manager-generated portal config under `~/.config/xdg-desktop-portal` or Nix profile portal definitions under `~/.nix-profile/share/xdg-desktop-portal`.

docs/k3s.md → docs/hosts/kubex.md

@@ -31,6 +31,13 @@ sudo zpool create -f \
     raidz2 /dev/sda /dev/sdb /dev/sdc /dev/sdd
 ```
 
+The `k3s` role includes a `wait-for-zfs-pool.service` unit that imports `kubex-main`
+if needed, then loads its encryption key from `rap@nixberry` before `k3s.service`
+starts.
+
+Because the unit runs non-interactively, `kubex` is configured for passwordless sudo
+for members of the `wheel` group.
+
 ## Copy kubeconfig
 
 ```bash