manatee: Add wl-clipboard

Add a start-limit (5 restarts / 5 min) to the romm, romm-db, romm-redis
and homeassistant podman services so a failing container enters a
`failed` state instead of retrying forever. A slow crash-loop (~5s per
attempt) stays under systemd's default 5-starts-per-10s limit, so a
longer window is needed to catch it.

flake.lock

@@ -205,6 +205,24 @@
         "type": "github"
       }
     },
+    "flake-utils_4": {
+      "inputs": {
+        "systems": "systems_7"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -859,11 +877,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784111782,
-        "narHash": "sha256-ENyFhyrCfdN1CMnD4aU0FtM6crwf1kwzj/lqXBp00Fk=",
+        "lastModified": 1784906229,
+        "narHash": "sha256-9ZzpwieFwushXgbZZj1W4i8uhI0dmLZCcQSb6qVhn18=",
         "ref": "main",
-        "rev": "ab0e51108c0801ef46f184f1e4c051cbfc8bd072",
-        "revCount": 42,
+        "rev": "374e630d8fd0fa063753ffaa3537ada4fb4bc11e",
+        "revCount": 55,
         "type": "git",
         "url": "ssh://gitea@git.ppp.pm:1122/alex/puppy-tracker.git"
       },
@@ -892,10 +910,33 @@
         "nixpkgs": "nixpkgs_3",
         "pppdotpm-site": "pppdotpm-site",
         "puppy-tracker": "puppy-tracker",
+        "solo-referee": "solo-referee",
         "whib-backend": "whib-backend",
         "whib-frontend": "whib-frontend"
       }
     },
+    "solo-referee": {
+      "inputs": {
+        "flake-utils": "flake-utils_4",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785015267,
+        "narHash": "sha256-NHaaFMznPus9jABGXlSHo++bYcbQeBnxvYPt/CzBEHg=",
+        "ref": "main",
+        "rev": "42af5dc48d1e2466a6b09273c7c96dfe2ab13c0b",
+        "revCount": 10,
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/solo-referee.git"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/solo-referee.git"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -986,6 +1027,21 @@
         "type": "github"
       }
     },
+    "systems_7": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "whib-backend": {
       "inputs": {
         "nixpkgs": [

flake.nix

@@ -92,6 +92,12 @@
       # url = "path:/home/alex/code/puppy-tracker";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    solo-referee = {
+      url = "git+ssh://gitea@git.ppp.pm:1122/alex/solo-referee.git?ref=main";
+      # url = "path:/home/alex/code/solo-referee";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =

hosts/manatee/home.nix

@@ -15,6 +15,8 @@
 
         home.packages = [
           pkgs.streamrip
+          pkgs.claude-code
+          pkgs.wl-clipboard
         ];
 
         home.stateVersion = "24.11";

hosts/manatee/modules/default.nix

@@ -26,6 +26,7 @@ in
       homepage.enable = true;
       disk-smart.enable = true;
       puppy-tracker.enable = true;
+      solo-referee.enable = true;
     };
   };
 }

hosts/manatee/modules/home-assistant/default.nix

@@ -117,6 +117,16 @@ in
 
     hardware.bluetooth.enable = true;
 
+    # Give up and enter a `failed` state (visible in `systemctl --failed`) if the
+    # container restarts more than 5 times in 5 minutes, instead of crash-looping
+    # forever. The window is deliberately long: a slow crash-loop (~5s per attempt)
+    # stays under systemd's default 5-starts-per-10s limit and would otherwise
+    # retry indefinitely.
+    systemd.services.podman-homeassistant = {
+      startLimitIntervalSec = 300;
+      startLimitBurst = 5;
+    };
+
     virtualisation.oci-containers = {
       backend = "podman";
 

hosts/manatee/modules/romm/default.nix

@@ -26,6 +26,16 @@ let
             - 'Thumbs.db'
             - '.DS_Store'
   '';
+
+  # Give up and enter a `failed` state (visible in `systemctl --failed`) if a
+  # container restarts more than 5 times in 5 minutes, instead of crash-looping
+  # forever. The window is deliberately long: a slow crash-loop (~5s per attempt)
+  # stays under systemd's default 5-starts-per-10s limit and would otherwise
+  # retry indefinitely.
+  crashLoopGuard = {
+    startLimitIntervalSec = 300;
+    startLimitBurst = 5;
+  };
 in
 {
   options = {
@@ -51,6 +61,10 @@ in
       "d /var/lib/romm/assets 0755 root root -"
     ];
 
+    systemd.services.podman-romm = crashLoopGuard;
+    systemd.services.podman-romm-db = crashLoopGuard;
+    systemd.services.podman-romm-redis = crashLoopGuard;
+
     systemd.services.romm-net = {
       description = "Create Podman network for RomM";
       after = [ "podman.service" ];

hosts/manatee/modules/solo-referee/default.nix

@@ -0,0 +1,46 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
+let
+  enabled = config.mod.solo-referee.enable;
+  port = 8090;
+in
+{
+  options = {
+    mod.solo-referee = {
+      enable = lib.mkEnableOption "Enable solo-referee module";
+    };
+  };
+
+  imports = [
+    inputs.solo-referee.nixosModules.default
+  ];
+
+  config = lib.mkIf enabled {
+    mod.homepage.services = [
+      {
+        name = "Solo Referee";
+        port = port;
+        description = "Solo-RPG tool with Claude as GM";
+        # url omitted → homepage links to http://manatee:${port}.
+      }
+    ];
+
+    services.solo-referee = {
+      enable = true;
+      inherit port;
+      # Reachable on the LAN / Tailscale at manatee:${port}; no public vhost.
+      address = "0.0.0.0";
+      openFirewall = true;
+      # Anthropic API key kept out of the store; the file holds
+      # `ANTHROPIC_API_KEY=...`. Without it the offline stub GM runs.
+      apiKeyFile = config.age.secrets."solo-referee-api-key".path;
+    };
+
+    age.secrets."solo-referee-api-key".file =
+      ../../../../secrets/manatee/solo-referee-api-key.age;
+  };
+}

hosts/pinwheel/modules/emacs/config.org

@@ -58,7 +58,7 @@
 #+END_SRC
 *** This makes emacsclient startup faster in TUI-mode
  #+BEGIN_SRC emacs-lisp
- (setq-default xterm-query-timeout nil)
+ (setq-default xterm-query-timeout 0.1)
  #+END_SRC
 *** Disable startup messages
 #+BEGIN_SRC emacs-lisp

hosts/pinwheel/modules/git/default.nix

@@ -6,6 +6,38 @@
 }:
 let
   enabled = config.mod.git.enable;
+
+  # Wrapper around `ssh-keygen` used as git's SSH signing program. Before a
+  # signing operation it ensures the passphrase-protected signing key is loaded
+  # into the agent — `ssh-keygen -Y sign` reads the key from disk and re-prompts
+  # every commit otherwise, since `AddKeysToAgent` only ever caches auth keys.
+  # Loading it once (through the GUI askpass) lets later commits reuse the
+  # cached key from the agent. Verification and every other op pass straight
+  # through to the real ssh-keygen untouched.
+  sshSignWrapper = pkgs.writeShellApplication {
+    name = "git-ssh-sign";
+    runtimeInputs = [
+      pkgs.openssh
+      pkgs.gawk
+      pkgs.gnugrep
+    ];
+    text = ''
+      key="${config.age.secrets."alex.pinwheel-github.com-signing".path}"
+
+      case " $* " in
+        *" -Y sign "*)
+          fp=""
+          fp="$(ssh-keygen -lf "$key.pub" 2>/dev/null | awk '{print $2}')" || true
+          if [ -n "$fp" ] && ! ssh-add -l 2>/dev/null | grep -qF "$fp"; then
+            # </dev/null detaches stdin so ssh-add uses SSH_ASKPASS (the GUI).
+            ssh-add "$key" </dev/null || true
+          fi
+          ;;
+      esac
+
+      exec ssh-keygen "$@"
+    '';
+  };
 in
 {
   options = {
@@ -33,6 +65,11 @@ in
 
           # Tells Git to use SSH instead of the default GPG
           gpg.format = "ssh";
+
+          # Sign via a wrapper that loads the signing key into the agent on
+          # first use, so subsequent signed commits reuse the cached key
+          # instead of re-prompting for the passphrase every time.
+          gpg.ssh.program = "${sshSignWrapper}/bin/git-ssh-sign";
         };
       };
 

hosts/pinwheel/modules/hyprland/default.nix

@@ -97,6 +97,7 @@ in
       wayland.windowManager.hyprland = {
         enable = true;
         systemd.enable = false;
+        configType = "hyprlang";
 
         extraConfig = ''
           exec-once = uwsm app -- waybar

hosts/pinwheel/modules/ssh/default.nix

@@ -13,6 +13,20 @@
       components = [ "secrets" ];
     };
 
+    home.sessionVariables = {
+      # gnome-keyring's PAM hooks export SSH_AUTH_SOCK pointing at a dead gcr
+      # socket (gcr-ssh-agent is disabled above), which shadows openssh's own
+      # agent and silently breaks passphrase caching. Force it back to the
+      # openssh agent started by `programs.ssh.startAgent`.
+      SSH_AUTH_SOCK = "$XDG_RUNTIME_DIR/ssh-agent";
+
+      # Route passphrase prompts through seahorse's GUI askpass instead of the
+      # terminal. `prefer` uses the GUI even when a tty is attached (ssh only
+      # falls back to askpass with no controlling terminal otherwise).
+      SSH_ASKPASS = "${pkgs.seahorse}/libexec/seahorse/ssh-askpass";
+      SSH_ASKPASS_REQUIRE = "prefer";
+    };
+
     programs.ssh = {
       enable = true;
       enableDefaultConfig = false;
@@ -135,19 +149,6 @@
       owner = "alex";
       group = "users";
     };
-
-    "alex.pinwheel-tadpole-ed25519" = {
-      file = ../../../../secrets/pinwheel/alex.pinwheel-tadpole-ed25519.age;
-      path = "/home/alex/.ssh/alex.pinwheel-tadpole-ed25519";
-      owner = "alex";
-      group = "users";
-    };
-    "alex.pinwheel-tadpole-ed25519.pub" = {
-      file = ../../../../secrets/pinwheel/alex.pinwheel-tadpole-ed25519.pub.age;
-      path = "/home/alex/.ssh/alex.pinwheel-tadpole-ed25519.pub";
-      owner = "alex";
-      group = "users";
-    };
   };
 
   services.openssh = {

hosts/pinwheel/modules/zsh/default.nix

@@ -56,6 +56,14 @@ in
 
         initContent = lib.strings.concatStringsSep "\n" [
           "export KEYTIMEOUT=1"
+
+          # Point every interactive shell at openssh's ssh-agent. home-manager's
+          # session vars set this too, but hm-session-vars runs once and is then
+          # inherited — so a tmux server that outlives this change (or started
+          # with the stale gcr socket) hands new panes a dead SSH_AUTH_SOCK.
+          # Re-exporting the fixed path per-shell keeps every pane on the same
+          # agent, so each key is only ever prompted for once per session.
+          ''export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent"''
           "bindkey -v '^?' backward-delete-char"
           "bindkey '^a' beginning-of-line"
           "bindkey '^e' end-of-line"

hosts/tadpole/modules/ssh/default.nix

@@ -98,11 +98,6 @@ in
         path = "${authorizedKeysPath}/alex.pinwheel-tadpole.pub";
       };
 
-      "alex.pinwheel-tadpole-ed25519.pub" = {
-        file = ../../../../secrets/pinwheel/alex.pinwheel-tadpole-ed25519.pub.age;
-        path = "${authorizedKeysPath}/alex.pinwheel-tadpole-ed25519.pub";
-      };
-
       "alex.tadpole-git.ppp.pm" = {
         file = ../../../../secrets/tadpole/alex.tadpole-git.ppp.pm.age;
         path = "/home/alex/.ssh/alex.tadpole-git.ppp.pm";

secrets/secrets.nix

@@ -15,8 +15,6 @@ in {
   "pinwheel/alex.pinwheel-backwards.pub.age".publicKeys = [ pinwheel backwards alex ];
   "pinwheel/alex.pinwheel-tadpole.age".publicKeys = [ pinwheel alex ];
   "pinwheel/alex.pinwheel-tadpole.pub.age".publicKeys = [ pinwheel tadpole alex ];
-  "pinwheel/alex.pinwheel-tadpole-ed25519.age".publicKeys = [ pinwheel alex ];
-  "pinwheel/alex.pinwheel-tadpole-ed25519.pub.age".publicKeys = [ pinwheel tadpole alex ];
   "pinwheel/alex.pinwheel-github.com.age".publicKeys = [ pinwheel alex ];
   "pinwheel/alex.pinwheel-github.com.pub.age".publicKeys = [ pinwheel alex ];
   "pinwheel/alex.pinwheel-github.com-signing.age".publicKeys = [ pinwheel alex ];
@@ -45,6 +43,7 @@ in {
   "manatee/romm-db-password.age".publicKeys = [ manatee alex ];
   "manatee/romm-metadata-api-keys.age".publicKeys = [ manatee alex ];
   "manatee/puppy-tracker-invite-code.age".publicKeys = [ manatee alex ];
+  "manatee/solo-referee-api-key.age".publicKeys = [ manatee alex ];
 
   "backwards/root.backwards.age".publicKeys = [ backwards alex ];
   "backwards/root.backwards.pub.age".publicKeys = [ backwards alex ];