Upgrade to NixOS-WSL 25.11

TODO.md

@@ -33,11 +33,9 @@ This file tracks remaining tasks and known issues for the NixOS configuration.
 
 - [ ] Consider adding additional shell aliases
 - [ ] Review if any macOS-specific tools need Linux alternatives
-- [ ] Consider adding dircolors configuration
 
 ### Documentation
 
-- [ ] Add screenshots of tmux setup
 - [ ] Document custom Neovim configuration (lua files)
 - [ ] Create troubleshooting guide for common issues
 
@@ -51,69 +49,20 @@ This file tracks remaining tasks and known issues for the NixOS configuration.
 
 These were not in the original Home Manager config but might be useful on NixOS:
 
-- [ ] Desktop environment / Window manager
-- [ ] Display manager (GDM, SDDM, LightDM)
-- [ ] Sound configuration (PipeWire/PulseAudio)
-- [ ] Printing support
-- [ ] Bluetooth support
 - [ ] Docker / Podman
-- [ ] Virtualization (QEMU/KVM)
 
 ## Known Issues
 
-### Nvim Configuration Files
-
-The nvim configuration references lua files from the parent directory:
-```nix
-initLua = builtins.concatStringsSep "\n" [
-  (lib.strings.fileContents ../../../nvim/base.lua)
-  (lib.strings.fileContents ../../../nvim/keymaps.lua)
-  (lib.strings.fileContents ../../../nvim/plugins.lua)
-  (lib.strings.fileContents ../../../nvim/filetype.lua)
-];
-```
-
-**Status**: Should work if nvim/ directory exists at `/home/pan/dev/config/dot/nvim/`
-
-**Action**: Verify these files exist or adjust paths
-
-### Profile Loading
-
-The shell configuration is now configurable via `dot.sh.sourceProfile`:
-```nix
-profileExtra = lib.mkIf cfg.sourceProfile ''
-  source $HOME/.profile
-'';
-```
-
-**Status**: Disabled by default. Only enabled for work host.
-
-**Action**: Verify `~/.profile` exists on hosts where `dot.sh.sourceProfile = true` is set.
-
 ## Testing Checklist
 
 Before considering this configuration complete:
 
-- [ ] System boots successfully
-- [ ] User can login as `pan`
-- [ ] Zsh loads with Prezto
-- [ ] Tmux starts without errors
-- [ ] Neovim opens and plugins load
 - [ ] LSP servers work in Neovim
-- [ ] Git commands work with correct identity
-- [ ] Lazygit opens and works
-- [ ] Jujutsu commands work
-- [ ] Taskwarrior shows tasks
-- [ ] Direnv loads `.envrc` files
-- [ ] fzf keybindings work (Ctrl+R)
-- [ ] zoxide navigation works
-- [ ] All shell aliases work
 
 ## Future Enhancements
 
 - [ ] Add backup/restore scripts
 - [ ] Create CI/CD for testing configuration
-- [ ] Add secrets management (agenix or sops-nix)
 - [ ] Consider using flake-parts for better organization
 - [ ] Add system monitoring tools
 - [ ] Configure automatic updates

flake.lock

@@ -16,16 +16,34 @@
         "type": "github"
       }
     },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1769996383,
+        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1731533236,
+        "lastModified": 1681202837,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
         "type": "github"
       },
       "original": {
@@ -41,11 +59,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770260404,
+        "lastModified": 1772985280,
-        "narHash": "sha256-3iVX1+7YUIt23hBx1WZsUllhbmP2EnXrV8tCRbLxHc8=",
+        "narHash": "sha256-FdrNykOoY9VStevU4zjSUdvsL9SzJTcXt4omdEDZDLk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0d782ee42c86b196acff08acfbf41bb7d13eed5b",
+        "rev": "8f736f007139d7f70752657dff6a401a585d6cbc",
         "type": "github"
       },
       "original": {
@@ -62,16 +80,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1763992789,
+        "lastModified": 1772985280,
-        "narHash": "sha256-WHkdBlw6oyxXIra/vQPYLtqY+3G8dUVZM8bEXk0t8x4=",
+        "narHash": "sha256-FdrNykOoY9VStevU4zjSUdvsL9SzJTcXt4omdEDZDLk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "44831a7eaba4360fb81f2acc5ea6de5fde90aaa3",
+        "rev": "8f736f007139d7f70752657dff6a401a585d6cbc",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-25.05",
+        "ref": "release-25.11",
         "repo": "home-manager",
         "type": "github"
       }
@@ -83,11 +101,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770184146,
+        "lastModified": 1773000227,
-        "narHash": "sha256-DsqnN6LvXmohTRaal7tVZO/AKBuZ02kPBiZKSU4qa/k=",
+        "narHash": "sha256-zm3ftUQw0MPumYi91HovoGhgyZBlM4o3Zy0LhPNwzXE=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "0d7874ef7e3ba02d58bebb871e6e29da36fa1b37",
+        "rev": "da529ac9e46f25ed5616fd634079a5f3c579135f",
         "type": "github"
       },
       "original": {
@@ -96,6 +114,27 @@
         "type": "github"
       }
     },
+    "nixos-vscode-server": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1770124655,
+        "narHash": "sha256-yHmd2B13EtBUPLJ+x0EaBwNkQr9LTne1arLVxT6hSnY=",
+        "owner": "nix-community",
+        "repo": "nixos-vscode-server",
+        "rev": "92ce71c3ba5a94f854e02d57b14af4997ab54ef0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixos-vscode-server",
+        "type": "github"
+      }
+    },
     "nixos-wsl": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -104,26 +143,27 @@
         ]
       },
       "locked": {
-        "lastModified": 1770494267,
+        "lastModified": 1772455238,
-        "narHash": "sha256-LBKeSntmhCBj0tHFVFGfT4+KBmKi57gAnr240/F1Qkc=",
+        "narHash": "sha256-QE29mlgasni5gszxs9/qNLnp6wvXgicP2iSh0gybPfw=",
         "owner": "nix-community",
-        "repo": "NixOS-WSL",
+        "repo": "nixos-wsl",
-        "rev": "843582709028607bf112d7cdc99af825e224a29b",
+        "rev": "eabb9a917f546c0bb64654850dd5f57f7694d1a3",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "repo": "NixOS-WSL",
+        "ref": "release-25.11",
+        "repo": "nixos-wsl",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1770562336,
+        "lastModified": 1772963539,
-        "narHash": "sha256-ub1gpAONMFsT/GU2hV6ZWJjur8rJ6kKxdm9IlCT0j84=",
+        "narHash": "sha256-9jVDGZnvCckTGdYT53d/EfznygLskyLQXYwJLKMPsZs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d6c71932130818840fc8fe9509cf50be8c64634f",
+        "rev": "9dcb002ca1690658be4a04645215baea8b95f31d",
         "type": "github"
       },
       "original": {
@@ -133,13 +173,28 @@
         "type": "github"
       }
     },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1769909678,
+        "narHash": "sha256-cBEymOf4/o3FD5AZnzC3J9hLbiZ+QDT/KDuyHXVJOpM=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "72716169fe93074c333e8d0173151350670b824c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1770464364,
+        "lastModified": 1773068389,
-        "narHash": "sha256-z5NJPSBwsLf/OfD8WTmh79tlSU8XgIbwmk6qB1/TFzY=",
+        "narHash": "sha256-vMrm7Pk2hjBRPnCSjhq1pH0bg350Z+pXhqZ9ICiqqCs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "23d72dabcb3b12469f57b37170fcbc1789bd7457",
+        "rev": "44bae273f9f82d480273bab26f5c50de3724f52f",
         "type": "github"
       },
       "original": {
@@ -151,16 +206,32 @@
     },
     "nixpkgs-wsl-stable": {
       "locked": {
-        "lastModified": 1767313136,
+        "lastModified": 1773068389,
-        "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
+        "narHash": "sha256-vMrm7Pk2hjBRPnCSjhq1pH0bg350Z+pXhqZ9ICiqqCs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
+        "rev": "44bae273f9f82d480273bab26f5c50de3724f52f",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-25.05",
+        "ref": "nixos-25.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1771369470,
+        "narHash": "sha256-0NBlEBKkN3lufyvFegY4TYv5mCNHbi5OmBDrzihbBMQ=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "0182a361324364ae3f436a63005877674cf45efb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -170,6 +241,7 @@
         "home-manager": "home-manager",
         "home-manager-wsl": "home-manager-wsl",
         "nix-darwin": "nix-darwin",
+        "nixos-vscode-server": "nixos-vscode-server",
         "nixos-wsl": "nixos-wsl",
         "nixpkgs": "nixpkgs",
         "nixpkgs-stable": "nixpkgs-stable",
@@ -185,11 +257,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770526836,
+        "lastModified": 1773096132,
-        "narHash": "sha256-xbvX5Ik+0inJcLJtJ/AajAt7xCk6FOCrm5ogpwwvVDg=",
+        "narHash": "sha256-M3zEnq9OElB7zqc+mjgPlByPm1O5t2fbUrH3t/Hm5Ag=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "d6e0e666048a5395d6ea4283143b7c9ac704720d",
+        "rev": "d1ff3b1034d5bab5d7d8086a7803c5a5968cd784",
         "type": "github"
       },
       "original": {
@@ -215,21 +287,20 @@
     },
     "tasksquire": {
       "inputs": {
-        "flake-utils": "flake-utils",
+        "flake-parts": "flake-parts",
-        "nixpkgs": [
+        "nixpkgs": "nixpkgs_2"
-          "nixpkgs"
-        ]
       },
       "locked": {
-        "lastModified": 1770493706,
+        "lastModified": 1771878653,
-        "narHash": "sha256-r8tbD+K3skUd3nDD+M6FIZ82azewnDYdhyLfFAEkCFs=",
+        "narHash": "sha256-+OkJmYH+h5dgAbUtbGq8fZ90g5/rwiew5WPmbexD9kI=",
-        "ref": "refs/heads/dev",
+        "ref": "dev",
-        "rev": "e3effe8b2570a815c9710d94a1e9541b9532bfb6",
+        "rev": "6b1418fc71be513ba5ebb718da29e3190c3fda58",
-        "revCount": 46,
+        "revCount": 52,
         "type": "git",
         "url": "ssh://git@git.pander.me/martin/tasksquire.git"
       },
       "original": {
+        "ref": "dev",
         "type": "git",
         "url": "ssh://git@git.pander.me/martin/tasksquire.git"
       }

flake.nix

@@ -7,10 +7,10 @@
 
     nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.11";
 
-    nixpkgs-wsl-stable.url = "github:nixos/nixpkgs/nixos-25.05";
+    nixpkgs-wsl-stable.url = "github:nixos/nixpkgs/nixos-25.11";
 
     nixos-wsl = {
-      url = "github:nix-community/NixOS-WSL";
+      url = "github:nix-community/nixos-wsl/release-25.11";
       inputs.nixpkgs.follows = "nixpkgs-wsl-stable";
     };
 
@@ -20,7 +20,7 @@
     };
 
     home-manager-wsl = {
-      url = "github:nix-community/home-manager/release-25.05";
+      url = "github:nix-community/home-manager/release-25.11";
       inputs.nixpkgs.follows = "nixpkgs-wsl-stable";
     };
 
@@ -29,18 +29,23 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    # individual packages
     sops-nix = {
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    tasksquire = {
+    nixos-vscode-server = {
-      url = "git+ssh://git@git.pander.me/martin/tasksquire.git";
+      url = "github:nix-community/nixos-vscode-server";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    tasksquire = {
+      url = "git+ssh://git@git.pander.me/martin/tasksquire.git?ref=dev";
+    };
   };
 
-  outputs = { self, nixpkgs, nixpkgs-stable, nixpkgs-wsl-stable, nixos-wsl, home-manager, home-manager-wsl, nix-darwin, sops-nix, ... }@inputs:
+  outputs = { self, nixpkgs, nixpkgs-stable, nixpkgs-wsl-stable, nixos-wsl, home-manager, home-manager-wsl, nix-darwin, ... }@inputs:
     let
       linuxSystem = "x86_64-linux";
       linuxAarchSystem = "aarch64-linux";
@@ -73,6 +78,10 @@
               };
               home-manager.users.pan = import ./hosts/work/nixos/home.nix;
             }
+            inputs.nixos-vscode-server.nixosModules.default
+            ({ pkgs,  ... }: {
+                services.vscode-server.enable = true;
+            })
           ];
         };
 

hosts/home/common.nix

@@ -18,5 +18,7 @@
   dot.llm = {
     enable = true;
     gemini-cli.enable = true;
+    opencode.enable = true;
+    opencode.enableConfig = true;
   };
 }

hosts/work/common.nix

@@ -19,7 +19,10 @@
     enable = true;
     claude-code.enable = true;
     opencode.enable = true;
+    opencode.enableConfig = true;
+    opencode.workMode = true;
   };
 
   dot.tmux.workMode = true;
+  dot.nvim.workMode = true;
 }

hosts/work/nixos/configuration.nix

@@ -18,5 +18,11 @@
     shell = pkgs.zsh;
   };
 
+  fileSystems."/home/pan/pro" = {
+    device = "/dev/disk/by-uuid/9a37862c-85db-4434-b06a-ec8c2713ecc9";
+    fsType = "ext4"; # or xfs, etc.
+    options = [ "defaults" "nofail" "x-systemd.automount" ];
+  };
+
   system.stateVersion = "25.05"; 
 }

modules/home/common.nix

@@ -0,0 +1,60 @@
+{ config, pkgs, lib, ... }:
+
+{
+  options.dot = {
+    dotfilesPath = lib.mkOption {
+      type = lib.types.str;
+      default = "${config.home.homeDirectory}/dev/dot";
+      description = "Absolute path to the dotfiles repository on the local machine.";
+    };
+  };
+
+  imports = [
+    ./secrets.nix
+    ./sh.nix
+    ./tmux.nix
+    ./git.nix
+    ./dev.nix
+    ./nvim.nix
+    ./task.nix
+    ./opencode.nix
+  ];
+
+  config = {
+    home.packages = with pkgs; [
+      nerd-fonts.fira-code
+      nil # Nix LSP
+
+      # Language servers
+      yaml-language-server
+      marksman
+      pkgs.unstable.dockerfile-language-server  # Use unstable for latest LSP features
+
+      # Secrets management
+      sops
+      age
+    ];
+
+    programs.ssh = {
+      enable = true;
+      enableDefaultConfig = false;
+      includes = [ "config.local" ];
+      matchBlocks = {
+        "*" = {
+          addKeysToAgent = "yes";
+        };
+
+        "git.pander.me" = {
+          hostname = "git.pander.me";
+          user = "git";
+          identityFile = "~/.ssh/private_git";
+          port = 2222;
+        };
+      };
+    };
+
+    news.display = "silent";
+
+    programs.home-manager.enable = true;
+  };
+}

modules/home/dev.nix

@@ -38,6 +38,7 @@ in
 
       home.packages = with pkgs; [
         visidata
+        codespelunker
       ];
     }
     

modules/home/git.nix

@@ -83,6 +83,8 @@
     settings = {
       aliases = {
         tug = ["bookmark" "move" "--from" "heads(::@- & bookmarks())" "--to" "@-"];
+        lg = ["log"];
+        des = ["describe"];
       };
     };
   };

modules/home/nvim.nix

@@ -0,0 +1,103 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.dot.nvim;
+in
+{
+  options.dot.nvim = {
+    workMode = lib.mkEnableOption "work-specific neovim configuration";
+  };
+
+  config = {
+    programs.neovim = {
+      enable = true;
+
+      defaultEditor = true;
+      vimAlias = true;
+
+      plugins = with pkgs.vimPlugins; [
+        vim-repeat
+        vim-surround
+        ts-comments-nvim
+        vim-fugitive
+        gitsigns-nvim
+        nvim-tree-lua
+        targets-vim
+        mini-pairs
+        mini-align
+        mini-bracketed
+        mini-splitjoin
+        mini-move
+        mini-ai
+        mini-icons
+        flash-nvim
+        trouble-nvim
+        conform-nvim
+        nvim-lint
+        promise-async
+        nvim-ufo
+        vim-windowswap
+        plenary-nvim
+        telescope-nvim
+        telescope-fzf-native-nvim
+        telescope-ui-select-nvim
+        yanky-nvim
+        lualine-nvim
+        undotree
+        luasnip
+        nvim-cmp
+        cmp_luasnip
+        cmp-buffer
+        cmp-path
+        cmp-cmdline
+        cmp-nvim-lsp
+        cmp-nvim-lsp-signature-help
+        cmp_yanky
+        cmp-git
+        nvim-lspconfig
+        lspkind-nvim
+        copilot-lua
+        copilot-cmp
+        CopilotChat-nvim
+        # opencode-nvim
+        bullets-vim
+        nvim-dap
+        nvim-nio
+        # nvim-dap-ui
+        nvim-dap-view
+        nvim-dap-virtual-text
+        nvim-dap-go
+        nvim-dap-python
+        nvim-dap-lldb
+        todo-comments-nvim
+        vim-markdown
+        zen-mode-nvim
+        plantuml-syntax
+        obsidian-nvim
+        render-markdown-nvim
+        image-nvim
+        img-clip-nvim
+        vim-nix
+        (nvim-treesitter.withPlugins (p: [ p.awk p.bash p.c p.c_sharp p.cpp p.css p.diff p.dockerfile p.doxygen p.git_config p.gitcommit p.go p.gomod p.gosum p.gotmpl p.helm p.haskell p.html p.http p.java p.javascript p.json p.latex p.lua p.markdown p.markdown_inline p.matlab p.nix p.printf p.python p.regex p.rust p.sql p.strace p.supercollider p.svelte p.swift p.terraform p.tmux p.toml p.typescript p.vim p.xml p.yaml p.zig ]))
+      ];
+
+      extraLuaConfig = ''
+        _G.is_work = ${if cfg.workMode then "true" else "false"}
+        _G.is_mac = ${if pkgs.stdenv.isDarwin then "true" else "false"}
+        _G.is_private_nixos = ${if !cfg.workMode && pkgs.stdenv.isLinux then "true" else "false"}
+
+        require('base')
+        require('keymaps')
+        require('plugins')
+        require('filetype')
+      '';
+    };
+
+    # Allow for editing the lua modules without a nix rebuild
+    xdg.configFile."nvim/lua".source = config.lib.file.mkOutOfStoreSymlink "${config.dot.dotfilesPath}/modules/nvim/lua";
+
+    home.packages = with pkgs; [
+      nodejs-slim
+    ];
+  };
+}

modules/home/opencode.nix

@@ -0,0 +1,89 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.dot.llm.opencode;
+in
+{
+  options.dot.llm.opencode = {
+    enableConfig = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Enable managed OpenCode configuration";
+    };
+
+    workMode = lib.mkEnableOption "work-specific opencode configuration";
+  };
+
+  config = lib.mkIf cfg.enableConfig {
+    # Declare the sops secret
+    sops.secrets.langdock_api_key = {
+      # Uses defaultSopsFile from secrets.nix
+    };
+
+    # Create the OpenCode config.json template with secret substitution
+    sops.templates."opencode/opencode.json" = {
+      content = builtins.toJSON (let
+        baseConfig = {
+          "$schema" = "https://opencode.ai/config.json";
+          default_agent = "plan";
+        };
+
+        workConfig = {
+          enabled_providers = [ "anthropic" "langdock-openai" "ollama" ];
+          model = "anthropic/claude-opus-4-6-default";
+          small_model = "anthropic/claude-haiku-4-5-20251001";
+          provider = {
+            langdock-openai = {
+              npm = "@ai-sdk/openai-compatible";
+              name = "Langdock OpenAI";
+              options = {
+                baseURL = "https://api.langdock.com/openai/eu/v1";
+                apiKey = config.sops.placeholder.langdock_api_key;
+              };
+              models = {
+                "gpt-5.2" = { name = "GPT-5.2"; };
+                "gpt-5-mini" = { name = "GPT-5 mini"; };
+              };
+            };
+            anthropic = {
+              options = {
+                baseURL = "https://api.langdock.com/anthropic/eu/v1";
+                apiKey = config.sops.placeholder.langdock_api_key;
+              };
+              models = {
+                "claude-opus-4-6-default" = { name = "Opus 4.6"; };
+                "claude-sonnet-4-6-default" = { name = "Sonnet 4.6"; };
+                "claude-haiku-4-5-20251001" = { name = "Haiku 4.5"; };
+              };
+              whitelist = [ "claude-opus-4-6-default" "claude-sonnet-4-6-default" "claude-haiku-4-5-20251001"];
+            };
+            ollama = {
+              npm = "@ai-sdk/openai-compatible";
+              name = "Ollama (Local)";
+              options = {
+                baseURL = "http://192.168.11.23:11434/v1";
+              };
+              models = {
+                "qwen3-coder:30b" = { name = "Qwen 3 Coder 30B"; };
+                "codellama:34b-instruct" = { name = "CodeLlama 34B Instruct"; };
+              };
+            };
+          };
+        };
+
+        personalConfig = {
+          plugin = [ "opencode-gemini-auth@latest" ];
+          model = "google/gemini-3-pro-preview";
+          small_model = "google/gemini-3-flash-preview";
+          enabled_providers = [ "google" ];
+        };
+      in
+        # Merge base config with the selected mode config
+        baseConfig // (if cfg.workMode then workConfig else personalConfig)
+      );
+    };
+
+    # Link the generated config to the expected location
+    xdg.configFile."opencode/opencode.json".source = config.lib.file.mkOutOfStoreSymlink config.sops.templates."opencode/opencode.json".path;
+  };
+}

modules/home/sh.nix

@@ -96,6 +96,7 @@ in
       ripgrep-all
       viddy
       duf
+      lsof
     ];
 
     home.sessionVariables = {

modules/home/task.nix

@@ -62,7 +62,7 @@
 
   home.packages = with pkgs; [
     taskwarrior-tui
-    timewarrior
+    unstable.timewarrior
     inputs.tasksquire.packages.${pkgs.system}.default
   ];
 

modules/home/tmux.nix

@@ -14,7 +14,7 @@ in
       shortcut = "a";
       mouse = true;
       keyMode = "vi";
-      escapeTime = 0;
+      escapeTime = 10;
       terminal = "screen-256color";
       tmuxp.enable = true;
       extraConfig = ''
@@ -22,12 +22,15 @@ in
 
         unbind S
         bind S command-prompt "switch -t %1"
+        bind-key , command-prompt -p "rename-window:" "rename-window '%%'"
 
-        bind-key -n M-K switch-client -p
+        # Check if we are in vim
-        bind-key -n M-J switch-client -n
+        is_vim="ps -o state= -o comm= -t '#{pane_tty}' | grep -iqE '^[^TXZ ]+ +(\\S+\\/)?g?(view|n?vim?x?)(diff)?$'"
 
-        bind-key -n M-L next-window
+        bind-key -n C-M-h if-shell "$is_vim" { send-keys C-M-h } { if -F "#{pane_at_left}" "previous-window" "select-pane -L" }
-        bind-key -n M-H previous-window
+        bind-key -n C-M-j if-shell "$is_vim" { send-keys C-M-j } { if -F "#{pane_at_bottom}" "switch-client -n" "select-pane -D" }
+        bind-key -n C-M-k if-shell "$is_vim" { send-keys C-M-k } { if -F "#{pane_at_top}" "switch-client -p" "select-pane -U" }
+        bind-key -n C-M-l if-shell "$is_vim" { send-keys C-M-l } { if -F "#{pane_at_right}" "next-window" "select-pane -R" }
 
         bind '"' split-window -c "#{pane_current_path}"
         bind % split-window -h -c "#{pane_current_path}"

modules/nixos/common.nix

@@ -22,6 +22,7 @@
 
   programs.zsh.enable = true;
   programs.ssh.startAgent = true;
+  programs.nix-ld.enable = true;
 
   nix.settings = {
     experimental-features = [ "nix-command" "flakes" ];

modules/nvim/lua/base.lua

@@ -36,7 +36,6 @@ vim.opt.foldopen = vim.opt.foldopen - 'block'
 vim.opt.foldlevel = 99
 vim.opt.lazyredraw = true
 vim.opt.listchars = 'eol:¬,tab:▸ ,trail:·'
-vim.opt.fillchars = 'vert:|,fold: '
 vim.opt.list = true
 vim.opt.laststatus = 3
 vim.opt.scrolloff = 8
@@ -133,7 +132,7 @@ vim.api.nvim_create_user_command('TrimWhiteSpace', function()
    vim.cmd('%s/\\s\\+$//e')
 end, {})
 
-local function ToggleDiagnostics()
+function ToggleDiagnostics()
   vim.diagnostic.enable(not vim.diagnostic.is_enabled())
   if vim.diagnostic.is_enabled() then
     print("Diagnostics enabled")

modules/nvim/lua/filetype.lua

@@ -3,60 +3,128 @@ local capabilities = require('cmp_nvim_lsp').default_capabilities()
 vim.api.nvim_create_augroup('FileTypeConfigs', { clear = true })
 
 vim.api.nvim_create_autocmd('FileType', {
-  group = 'FileTypeConfigs',
+  group = vim.api.nvim_create_augroup('FileTypeConfigs', { clear = true }),
   pattern = 'python',
+  once = true,
   callback = function()
     require('dap-python').setup()
-    -- lspconfig.pyright.setup({ capabilities = capabilities })
-    -- require("conform").setup({
-    --   python = {"black"},
-    -- })
   end,
 })
 
--- vim.api.nvim_create_autocmd('FileType', {
+vim.api.nvim_create_autocmd('FileType', {
---   group = 'FileTypeConfigs',
+  group = vim.api.nvim_create_augroup('FileTypeConfigs', { clear = true }),
---   pattern = 'go',
+  pattern = 'go',
---   callback = function()
+  once = true,
--- require('dap-python').setup()
+  callback = function()
--- require('dap-go').setup()
+    vim.lsp.enable('ty')
+    vim.lsp.enable('gopls')
+    require('dap-go').setup()
+  end,
+})
+
+vim.api.nvim_create_autocmd('FileType', {
+  group = vim.api.nvim_create_augroup('FileTypeConfigs', { clear = true }),
+  pattern = 'proto',
+  once = true,
+  callback = function()
+    vim.lsp.config('buf_ls', {
+      cmd = { 'buf', 'lsp', 'serve' },
+      filetypes = { 'proto' },
+      root_markers = { 'buf.yaml', '.git' },
+    })
+
+    vim.lsp.enable('buf_ls')
+  end,
+})
+
+vim.api.nvim_create_autocmd('FileType', {
+  group = vim.api.nvim_create_augroup('FileTypeConfigs', { clear = true }),
+  pattern = 'markdown',
+  once = true,
+  callback = function()
+    vim.lsp.enable('marksman')
+  end,
+})
+
+vim.api.nvim_create_autocmd('FileType', {
+  group = vim.api.nvim_create_augroup('FileTypeConfigs', { clear = true }),
+  pattern = 'sql',
+  once = true,
+  callback = function()
+    vim.lsp.enable('sqls')
+  end,
+})
+
+vim.api.nvim_create_autocmd('FileType', {
+  group = vim.api.nvim_create_augroup('FileTypeConfigs', { clear = true }),
+  pattern = { 'dockerfile', 'yaml.docker-compose' },
+  once = true,
+  callback = function()
+    vim.lsp.enable('dockerls')
+    vim.lsp.enable('docker_compose_language_service')
+  end,
+})
+
+vim.api.nvim_create_autocmd('FileType', {
+  group = vim.api.nvim_create_augroup('FileTypeConfigs', { clear = true }),
+  pattern = 'rust',
+  once = true,
+  callback = function()
+    vim.lsp.enable('rust_analyzer')
+  end,
+})
+
+vim.api.nvim_create_autocmd('FileType', {
+  group = vim.api.nvim_create_augroup('FileTypeConfigs', { clear = true }),
+  pattern = { 'c', 'cpp' },
+  once = true,
+  callback = function()
+    vim.lsp.enable('clangd')
+  end,
+})
+
+vim.api.nvim_create_autocmd('FileType', {
+  group = vim.api.nvim_create_augroup('FileTypeConfigs', { clear = true }),
+  pattern = { 'zig' },
+  pattern = 'sql',
+  once = true,
+  callback = function()
+    vim.lsp.enable('zls')
+  end,
+})
+
+vim.api.nvim_create_autocmd('FileType', {
+  group = vim.api.nvim_create_augroup('FileTypeConfigs', { clear = true }),
+  pattern = { 'yaml' },
+  pattern = 'sql',
+  once = true,
+  callback = function()
+    vim.lsp.enable('yamlls')
+  end,
+})
+
+vim.api.nvim_create_autocmd('FileType', {
+  group = vim.api.nvim_create_augroup('FileTypeConfigs', { clear = true }),
+  pattern = { 'cs' },
+  pattern = 'sql',
+  once = true,
+  callback = function()
+    vim.lsp.enable('omnisharp')
+  end,
+})
+
 
-vim.lsp.enable('ruff')
-vim.lsp.enable('gopls')
-vim.lsp.enable('marksman')
-vim.lsp.enable('rust_analyzer')
-vim.lsp.enable('dockerls')
-vim.lsp.enable('docker_compose_language_service')
-vim.lsp.enable('clangd')
-vim.lsp.enable('sqls')
-vim.lsp.enable('zls')
-vim.lsp.enable('omnisharp')
-vim.lsp.enable('yamlls')
 
--- lspconfig.gopls.setup({ capabilities = capabilities })
--- lspconfig.marksman.setup({ capabilities = capabilities })
--- lspconfig.rust_analyzer.setup({
---   capabilities = capabilities,
---   settings = {
---   ["rust-analyzer"] = {
---     checkOnSave = {
---       command = "clippy",
---     },
---   },
---   },
--- })
--- lspconfig.dockerls.setup({ capabilities = capabilities })
--- lspconfig.docker_compose_language_service.setup({ capabilities = capabilities })
--- lspconfig.clangd.setup({ capabilities = capabilities })
--- lspconfig.sqls.setup({ capabilities = capabilities })
--- lspconfig.zls.setup({ capabilities = capabilities })
--- lspconfig.omnisharp.setup({ capabilities = capabilities })
--- lspconfig.yamlls.setup({ capabilities = capabilities })
 
 require("conform").setup({
   go = {"gofmt"},
   python = {"black"},
   rust = {"rustfmt"},
+
+  format_on_save = {
+    timeout_ms = 500,
+    lsp_fallback = true,
+  },
 })
 --   end,
 -- })

modules/nvim/lua/keymaps.lua

@@ -4,14 +4,14 @@ vim.g.mapleader = " "
 vim.keymap.set({'n', 'v'}, 'j', 'gj', {})
 vim.keymap.set({'n', 'v'}, 'k', 'gk', {})
 
-vim.keymap.set('n', '<C-M-h>', '<C-w>h', {})
+-- vim.keymap.set('n', '<C-M-h>', '<C-w>h', {})
-vim.keymap.set('n', '<C-M-j>', '<C-w>j', {})
+-- vim.keymap.set('n', '<C-M-j>', '<C-w>j', {})
-vim.keymap.set('n', '<C-M-k>', '<C-w>k', {})
+-- vim.keymap.set('n', '<C-M-k>', '<C-w>k', {})
-vim.keymap.set('n', '<C-M-l>', '<C-w>l', {})
+-- vim.keymap.set('n', '<C-M-l>', '<C-w>l', {})
-vim.keymap.set('t', '<C-M-h>', '<C-\\><C-n><C-w>h', {})
+-- vim.keymap.set('t', '<C-M-h>', '<C-\\><C-n><C-w>h', {})
-vim.keymap.set('t', '<C-M-j>', '<C-\\><C-n><C-w>j', {})
+-- vim.keymap.set('t', '<C-M-j>', '<C-\\><C-n><C-w>j', {})
-vim.keymap.set('t', '<C-M-k>', '<C-\\><C-n><C-w>k', {})
+-- vim.keymap.set('t', '<C-M-k>', '<C-\\><C-n><C-w>k', {})
-vim.keymap.set('t', '<C-M-l>', '<C-\\><C-n><C-w>l', {})
+-- vim.keymap.set('t', '<C-M-l>', '<C-\\><C-n><C-w>l', {})
 vim.keymap.set('n', '<leader>zm', '<C-W>_<C-W>|', { noremap = true, silent = true })
 vim.keymap.set('n', '<C-M-Y>', '<C-w>5<', {})
 vim.keymap.set('n', '<C-M-U>', '<C-w>5+', {})
@@ -123,9 +123,48 @@ vim.keymap.set('n', "<leader>dr", function() require("dap").repl.toggle() end)
 vim.keymap.set('n', "<leader>ds", function() require("dap").session() end)
 vim.keymap.set('n', "<leader>dt", function() require("dap").terminate() end)
 vim.keymap.set('n', "<leader>dw", function() require("dap.ui.widgets").hover() end)
+vim.keymap.set('n', "<leader>dv", function() require("dap-view").toggle() end)
 
 vim.keymap.set('n', "<F5>", function() require("dap").continue() end)
-vim.keymap.set('n', "<F11>", function() require("dap").step_into() end)
+vim.keymap.set('n', "<F2>", function() require("dap").step_into() end)
-vim.keymap.set('n', "<F10>", function() require("dap").step_over() end)
+vim.keymap.set('n', "<F1>", function() require("dap").step_over() end)
-vim.keymap.set('n', "<F12>", function() require("dap").step_out() end)
+vim.keymap.set('n', "<F3>", function() require("dap").step_out() end)
+
+
+-- Tmux Navigator
+vim.g.tmux_navigator_no_mappings = 1
+
+local function tmux_navigate(direction)
+  local old_win = vim.api.nvim_get_current_win()
+  vim.cmd('wincmd ' .. direction)
+  local new_win = vim.api.nvim_get_current_win()
+  
+  if old_win == new_win then
+     -- We are at the edge, let tmux handle it
+     -- This requires the tmux config to be set up to handle these keys when not in vim,
+     -- BUT since we are IN vim, we need to explicitly trigger the tmux action.
+     -- However, simply sending the key to tmux might just send it back to vim if we aren't careful,
+     -- or we can just run the tmux command directly.
+     
+     local tmux_cmd = ""
+     if direction == 'h' then
+        tmux_cmd = 'if -F "#{pane_at_left}" "previous-window" "select-pane -L"'
+     elseif direction == 'j' then
+        tmux_cmd = 'if -F "#{pane_at_bottom}" "switch-client -n" "select-pane -D"'
+     elseif direction == 'k' then
+        tmux_cmd = 'if -F "#{pane_at_top}" "switch-client -p" "select-pane -U"'
+     elseif direction == 'l' then
+        tmux_cmd = 'if -F "#{pane_at_right}" "next-window" "select-pane -R"'
+     end
+     
+     -- We use vim.fn.system to execute the tmux command
+     -- We need to wrap the command in 'tmux' call
+     vim.fn.system('tmux ' .. tmux_cmd)
+  end
+end
+
+vim.keymap.set('n', '<C-M-h>', function() tmux_navigate('h') end)
+vim.keymap.set('n', '<C-M-j>', function() tmux_navigate('j') end)
+vim.keymap.set('n', '<C-M-k>', function() tmux_navigate('k') end)
+vim.keymap.set('n', '<C-M-l>', function() tmux_navigate('l') end)
 

modules/nvim/lua/plugins.lua

@@ -10,10 +10,6 @@ require('mini.move').setup()
 require('flash').setup()
 require('ts-comments').setup()
 
-local function is_wsl_env()
-    return os.getenv("WSL_DISTRO_NAME") ~= nil or os.getenv("WSL_INTEROP") ~= nil
-end
-
 vim.g.tagbar_left=1
 vim.g.tagbar_autoclose=1
 vim.g.tagbar_autofocus=1
@@ -341,10 +337,10 @@ require('lint').linters_by_ft = {
 require("trouble").setup()
 require("todo-comments").setup()
 
-require("dapui").setup()
+require("dap-view").setup()
 require("nvim-dap-virtual-text").setup()
 
-local dap, dapui = require("dap"), require("dapui")
+local dap, dapui = require("dap"), require("dap-view")
 dap.listeners.before.attach.dapui_config = function()
   dapui.open()
 end
@@ -367,21 +363,21 @@ dap.adapters.codelldb = {
   }
 }
 
-dap.configurations.zig = {
+-- dap.configurations.zig = {
-  {
+--   {
-    name = "Launch Zig Program",
+--     name = "Launch Zig Program",
-    type = "codelldb",
+--     type = "codelldb",
-    request = "launch",
+--     request = "launch",
-    program = function()
+--     program = function()
-      -- Prompts for the executable path when you start debugging
+--       -- Prompts for the executable path when you start debugging
-      return vim.fn.input('Path to executable: ', vim.fn.getcwd() .. '/zig-out/bin/', 'file')
+--       return vim.fn.input('Path to executable: ', vim.fn.getcwd() .. '/zig-out/bin/', 'file')
-    end,
+--     end,
-    cwd = "${workspaceFolder}",
+--     cwd = "${workspaceFolder}",
-    stopOnEntry = false,
+--     stopOnEntry = false,
-  },
+--   },
-}
+-- }
 
-if vim.fn.has("mac") then
+if _G.is_mac then
   workspaces = {
     {
       name = "privat",
@@ -400,7 +396,7 @@ if vim.fn.has("mac") then
   }
 end
 
-if is_wsl_env() then
+if _G.is_work then
   workspaces = {
     {
       name = "work",
@@ -414,6 +410,16 @@ if is_wsl_env() then
   daily_notes = {}
 end
 
+if _G.is_private_nixos then
+  workspaces = {
+    {
+      name = "tech",
+      path = "~/notes",
+    },
+  }
+  daily_notes = {}
+end
+
 require("obsidian").setup({
   workspaces = workspaces,
   templates = {

nix/modules/home/common.nix

@@ -1,49 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  imports = [
-    ./secrets.nix
-    ./sh.nix
-    ./tmux.nix
-    ./git.nix
-    ./dev.nix
-    ./nvim.nix
-    ./task.nix
-  ];
-
-  home.packages = with pkgs; [
-    nerd-fonts.fira-code
-    nil # Nix LSP
-
-    # Language servers
-    yaml-language-server
-    marksman
-    pkgs.unstable.dockerfile-language-server  # Use unstable for latest LSP features
-
-    # Secrets management
-    sops
-    age
-  ];
-
-  programs.ssh = {
-    enable = true;
-    enableDefaultConfig = false;
-    includes = [ "config.local" ];
-    matchBlocks = {
-      "*" = {
-        addKeysToAgent = "yes";
-      };
-
-      "git.pander.me" = {
-        hostname = "git.pander.me";
-        user = "git";
-        identityFile = "~/.ssh/private_git";
-        port = 2222;
-      };
-    };
-  };
-
-  news.display = "silent";
-
-  programs.home-manager.enable = true;
-}

nix/modules/home/nvim.nix

@@ -1,87 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  programs.neovim = {
-    enable = true;
-
-    defaultEditor = true;
-    vimAlias = true;
-
-    plugins = with pkgs.vimPlugins; [
-      vim-repeat
-      vim-surround
-      ts-comments-nvim
-      vim-fugitive
-      gitsigns-nvim
-      nvim-tree-lua
-      targets-vim
-      mini-pairs
-      mini-align
-      mini-bracketed
-      mini-splitjoin
-      mini-move
-      mini-ai
-      mini-icons
-      flash-nvim
-      trouble-nvim
-      conform-nvim
-      nvim-lint
-      promise-async
-      nvim-ufo
-      vim-windowswap
-      plenary-nvim
-      telescope-nvim
-      telescope-fzf-native-nvim
-      telescope-ui-select-nvim
-      yanky-nvim
-      lualine-nvim
-      undotree
-      luasnip
-      nvim-cmp
-      cmp_luasnip
-      cmp-buffer
-      cmp-path
-      cmp-cmdline
-      cmp-nvim-lsp
-      cmp-nvim-lsp-signature-help
-      cmp_yanky
-      cmp-git
-      nvim-lspconfig
-      lspkind-nvim
-      copilot-lua
-      copilot-cmp
-      CopilotChat-nvim
-      bullets-vim
-      nvim-dap
-      nvim-nio
-      nvim-dap-ui
-      nvim-dap-virtual-text
-      nvim-dap-go
-      nvim-dap-python
-      nvim-dap-lldb
-      todo-comments-nvim
-      vim-markdown
-      zen-mode-nvim
-      plantuml-syntax
-      obsidian-nvim
-      render-markdown-nvim
-      image-nvim
-      img-clip-nvim
-      vim-nix
-      (nvim-treesitter.withPlugins (p: [ p.awk p.bash p.c p.c_sharp p.cpp p.css p.diff p.dockerfile p.doxygen p.git_config p.gitcommit p.go p.gomod p.gosum p.gotmpl p.helm p.haskell p.html p.http p.java p.javascript p.json p.latex p.lua p.markdown p.markdown_inline p.matlab p.nix p.printf p.python p.regex p.rust p.sql p.strace p.supercollider p.svelte p.swift p.terraform p.tmux p.toml p.typescript p.vim p.xml p.yaml p.zig ]))
-    ];
-
-    # Use extraLuaConfig for home-manager 25.11 compatibility
-    # (initLua was renamed from extraLuaConfig in later versions)
-    extraLuaConfig = builtins.concatStringsSep "\n" [
-      (lib.strings.fileContents  ../../../nvim/base.lua)
-      (lib.strings.fileContents ../../../nvim/keymaps.lua)
-      (lib.strings.fileContents ../../../nvim/plugins.lua)
-      (lib.strings.fileContents ../../../nvim/filetype.lua)
-    ];
-  };
-
-  home.packages = with pkgs; [
-    nodejs-slim
-  ];
-}

nix/secrets/secrets.yaml

@@ -1,25 +0,0 @@
-gemini_api_key: ENC[AES256_GCM,data:nN7Hng==,iv:uOL0UyHpiRpAXfkX8qyVAnJZFm4ljkgYiZycrdSoW9U=,tag:7A/rHJcEykcoyJLeTV/gaw==,type:str]
-sops:
-    age:
-        - recipient: age1hmgy68ukugduef75ev72jnpu77ff3lajadpf7u0zv3ex4nt7f5qs5nxx2l
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxUEZwYkFDYVd4ek53QU13
-            YStKbEVOeTJaalVIWXh1SUlrSnUzanM0anpBCktBMytXQUNyOTZaZGc4NG1Ta1lX
-            Mi91UWxXZWZjRDZqNDJWQU1YODgzUkkKLS0tIFY4TjUyczQ0SGZMOUM0NkQvUC94
-            WDBpdDJMaWVvUGZUcXZLZE9oYjdKLzgK4B25MbF/3bUFJ5+zxUfpSNM79HT13nux
-            dvlcwkwYKIkS9YZpnyiYXZGupFhUcq1ipIvsbq/B3WR9IFn4xromPw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1yez9q5q94kt99d9q8eqgqrkz7djmk3kwsqdjp7ww7e0fquzjevpsjkk5x4
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvK0lsajZ1b3dlMVA4Z2hm
-            ek9lZENNYnVnQXp2U0hGM2pDd0FSL2JVbVhVClZUTWhNcmJadSttU2UrRVhTWU1y
-            RVV6NlpndEsyYk9zSmRqLytOWUtCNWMKLS0tIGN1TDJPY2orMGJobFExUEhWYzdx
-            dDB3YWVlbUY4V25pa0IvTW1xNG1XcmMK+LLoW8f+M0eBIyxwI3tD637Fw/FuXmYx
-            RV/hAOaznmfq3filh9KAEA+A/9mDI2lUeF/ye/g27tEEVtNRF9H+Dg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-07T15:11:34Z"
-    mac: ENC[AES256_GCM,data:Pgi9tYWnrMrlM9NjqDy0+BrH51/0T4c7M6dornLCumnRtR2Y3MZYGyA2E97kbwuqoPJCOWkzhJt7smwCRI+H0rXveO+ps+v5iUxzP+7MQmepn5wjS32HoL5c2Oer4CR7PkKY7YvL7z5IT6QcIgRXMODhsVbWgB8CjPrn/GYqb5Y=,iv:A2AyCNHfQEdx/wvUJQGc9ndL2/OYGGxBMidYOTHXO7Q=,tag:9uzJcu3bogQgVj0bDOPCwg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.11.0

secrets/.sops.yaml

@@ -1,6 +1,7 @@
 keys:
   - &macbook age1hmgy68ukugduef75ev72jnpu77ff3lajadpf7u0zv3ex4nt7f5qs5nxx2l
   - &macnix age1yez9q5q94kt99d9q8eqgqrkz7djmk3kwsqdjp7ww7e0fquzjevpsjkk5x4
+  - &worknix age1wufdcd234uw69lcw6gtv9r5zfz7h5tvu0fzcg5d8tn67yx6pv47sary4q2
 
 creation_rules:
   - path_regex: secrets\.yaml$
@@ -8,3 +9,4 @@ creation_rules:
       - age:
           - *macbook
           - *macnix
+          - *worknix

secrets/secrets.yaml

@@ -0,0 +1,34 @@
+langdock_api_key: ENC[AES256_GCM,data:9CTt73dQowcjIdjQoPMjsmGeIgV0nyHZxePOwak/m09ePfu4Gb3gDC17wq9Hde5J9IqpEID73Kdo/DsGm9m765rPGQFxGwTo3MO5eZgXAQjFXQNNhYm+sug=,iv:TVuiMG/7HYjncK3oC8r5xYrnNGXFcrBrpq9OO+7plNY=,tag:EZqUOGYwTHcukDop8p/JBw==,type:str]
+sops:
+    age:
+        - recipient: age1hmgy68ukugduef75ev72jnpu77ff3lajadpf7u0zv3ex4nt7f5qs5nxx2l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJcTBpZ3BwNnVxVkFQQWgy
+            VWFsMFF0WGIzbTBFZ0htQ251dGlVdW5PckdNCmtldkZZL0Z3SER2OHZuUGdvNVpI
+            Vk1KS1ZYVzZXZGtUbTNtZnhPeStSTlUKLS0tICtXYTgxMHc0alBYUDAzcXVXcm9J
+            YjQrUGZaWmpaV2tGOXJmbGR5K3l1VFEK+bsmeV/PjYcSlsJz0ZQZ8U9EYSu8bTJM
+            BJ0T910cPudb/dkMrU9QSWUlBbOKk78ivKvDbwqPBfguSqU5GevLGg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1yez9q5q94kt99d9q8eqgqrkz7djmk3kwsqdjp7ww7e0fquzjevpsjkk5x4
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3WXdEM2RORG56N3hVRGx5
+            NVZnWHY4TG5sRmdyQnJqVm4waUpoNGc4eFQ0CkNoanF3ZFRNQzQ5dHBST1BkSko0
+            cDAwYlBKVUZ3amJrcDJHcTloaXIwcWsKLS0tIDlMa0dqNmJvMjZZSVBPWjJncGlK
+            Q3F3cHFoWC9Ga0Q4S3VqQ1psRjZZUmsK7+d9wMgC27xaOu1CLX8YbG8BbJdYhLLg
+            dc8RHujixqkvheiv9syzCNF0z6Oc2qT5Vw2v7gCZ1SPgomOf3oHNHQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1wufdcd234uw69lcw6gtv9r5zfz7h5tvu0fzcg5d8tn67yx6pv47sary4q2
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpWjdzMWpCemJJR2FvUjJ2
+            b0hraEVBWDdJeG9JRFpLYm5XV1FDUDFMeFdnCktwRElvTmoyZmpPQ3VjbldXVHo4
+            SmpjQlRPK2o3YnNLMklyMnVwWERtb28KLS0tIDNjcGJhMkR1bCtBWUV1WU5TZjVR
+            YjBrekY4Y2JSczBEQ3BObjhKZkhYc3MKMrGlO/w7Hvp23rpL71/XDsJDcbc3t73C
+            iXdD2Oc9V5g5Jz3H7mkaAlNRg8u+LwGXYdwZiG7NWSyQnARPgeMBwQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-10T21:55:05Z"
+    mac: ENC[AES256_GCM,data:Qmwba0kQ8uzz72UbkVx+41i+iFtjI07nRLkYI9+G3TNCDVcWSFdPXCjWxdozU1jTOYyt9EZpP5x+5DLRCbNIlsKpClMvVGwAbu8XKvqQoF5Ao4PXOFNg6hyWTPjoVDLHkEaykpgpg1fr29CHUDkyyFGniQ+Slv5LAndAx+ncTAA=,iv:ehZZi7DUlYlGcBMgV25h+cew/amgbH2tKFMr7jaNw/U=,tag:ag2vcgc29Dlx+QI8qju/LQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0