Wi-Fi kept failing with "Secrets were required, but not provided". NM ran
on top of iwd while impala (SUPER+W) drove iwd directly, so two managers
held separate saved networks; iwd couldn't load its own .psk files, asked
NM for the passphrase, and NM had no secret agent to answer. impala is
iwd-only, so NM goes instead: iwd owns Wi-Fi, networkd does DHCP and
resolved does DNS, on both hosts. eduroam's iwd profile is seeded once via
tmpfiles (C, so a password added later is never overwritten). On mbp,
resolved's mDNS is off because avahi owns .local.
On pc the GigE camera link (enp7s0) is now declared: static
192.168.12.1/24, no RAs, not required for online. It used to take AAU's
IPv6 RAs on that segment, which made v6 default out a dead-end port and
every v6-first connection stall until fallback.
Drop the virtual-desktops plugin: SUPER+N now switches only the monitor
that workspace lives on, as in AeroSpace. SUPER+SHIFT+N sends the window
without following, SUPER+Tab goes back, SUPER+ALT/SHIFT+Tab sends the
workspace to the next monitor. pc's three screens get workspaces 1-3 as
their homes again.
New windows no longer open maximized: kitty 0.49 requests maximize ~250ms
after mapping, so suppress app maximize requests (SUPER+F still works).
Also bumps zen-browser.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Workspaces were pinned one-per-monitor, so switching only ever moved one
screen. The virtual-desktops plugin replaces them with vdesks that span
every monitor, and SUPER+1..5 now switches all screens together. Hyprland
plugins are ABI-locked to the compositor, so the input's nixpkgs follows
ours to compile against the hyprland we actually run. cycleworkspaces
stays off: upstream says it breaks above 2 monitors, and pc has 3.
The session had also been dying several times a day, which looked like a
Hyprland crash and was not one. There was no swap at all, and a
nixos-rebuild forks ~60 nix evaluators; stacked on a browser and a few
editor sessions that exhausted all 15G, leaving page cache squeezed to
40M while 13G sat in anon and nothing was reclaimable. The kernel then
OOM-killed 1Password (highest oom_score_adj), and because every GUI app
shares the wayland-wm@hyprland.service cgroup, systemd's default
OOMPolicy=stop tore down the whole unit -- compositor included, with
uwsm's Restart=no meaning nothing came back.
Two independent fixes: zram swap (50% of RAM, zstd) with vm.swappiness
raised to 180, so the kernel compresses anon pages instead of evicting
cache, which raises the ceiling; and OOMPolicy=continue, so that hitting
it costs one app instead of the desktop. zram rather than a swapfile
because root is compress=zstd, and a btrfs swapfile needs its own
nodatacow, uncompressed subvolume.
Also lands the pending work in this tree: hyprshot replaces grimblast for
screenshots (it reads HYPRSHOT_DIR, not XDG_SCREENSHOTS_DIR, so shots were
landing loose in ~/Pictures), hyprlock at boot so login lands on the lock
screen and unlocks the keyring, the battery popup moves to SUPER+R, and
SUPER+W/E open floating wifi and bluetooth panels.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Shrinking the macOS APFS container freed ~256G, but it landed at a lower
disk offset than the Linux partitions, so the ext4 root could never be
grown into it — a partition only ever extends into free space that follows
it. Rather than relocate the Asahi stub and ESP (the reliable way to brick
the boot chain), the root moved into the gap as a new partition:
p8 29424896..96687621 256.6G btrfs, subvol @, compress=zstd
zstd puts ~70G of data in ~37G, and free space went from 7.3G to 220G.
The old ext4 p5 is left intact as a rollback; generations <= 48 still boot
it, since each generation carries its own root UUID in its initrd.
Also lands the pending work in this tree: postgresql in home.packages,
the deepvis cachix substituter with a root-owned netrc, nixbuild.net as a
builder for both arches, the caffeine stay-awake unit with its SUPER+A
bind, and monthly btrfs autoScrub on the new root.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
