manatee: Add wl-clipboard

Add a start-limit (5 restarts / 5 min) to the romm, romm-db, romm-redis
and homeassistant podman services so a failing container enters a
`failed` state instead of retrying forever. A slow crash-loop (~5s per
attempt) stays under systemd's default 5-starts-per-10s limit, so a
longer window is needed to catch it.

flake.lock

@@ -205,6 +205,24 @@
         "type": "github"
       }
     },
+    "flake-utils_4": {
+      "inputs": {
+        "systems": "systems_7"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -859,11 +877,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784142376,
+        "lastModified": 1784906229,
-        "narHash": "sha256-LEsjkwV49nuFu+47BjY5FhR9xBihD385haG5hZhNbLk=",
+        "narHash": "sha256-9ZzpwieFwushXgbZZj1W4i8uhI0dmLZCcQSb6qVhn18=",
         "ref": "main",
-        "rev": "0ebaa11c934ecfa60eb238ebe1a8a7a2c8478982",
+        "rev": "374e630d8fd0fa063753ffaa3537ada4fb4bc11e",
-        "revCount": 53,
+        "revCount": 55,
         "type": "git",
         "url": "ssh://gitea@git.ppp.pm:1122/alex/puppy-tracker.git"
       },
@@ -892,10 +910,33 @@
         "nixpkgs": "nixpkgs_3",
         "pppdotpm-site": "pppdotpm-site",
         "puppy-tracker": "puppy-tracker",
+        "solo-referee": "solo-referee",
         "whib-backend": "whib-backend",
         "whib-frontend": "whib-frontend"
       }
     },
+    "solo-referee": {
+      "inputs": {
+        "flake-utils": "flake-utils_4",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785015267,
+        "narHash": "sha256-NHaaFMznPus9jABGXlSHo++bYcbQeBnxvYPt/CzBEHg=",
+        "ref": "main",
+        "rev": "42af5dc48d1e2466a6b09273c7c96dfe2ab13c0b",
+        "revCount": 10,
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/solo-referee.git"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "ssh://gitea@git.ppp.pm:1122/alex/solo-referee.git"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -986,6 +1027,21 @@
         "type": "github"
       }
     },
+    "systems_7": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "whib-backend": {
       "inputs": {
         "nixpkgs": [

flake.nix

@@ -92,6 +92,12 @@
       # url = "path:/home/alex/code/puppy-tracker";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    solo-referee = {
+      url = "git+ssh://gitea@git.ppp.pm:1122/alex/solo-referee.git?ref=main";
+      # url = "path:/home/alex/code/solo-referee";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =

hosts/manatee/home.nix

@@ -15,6 +15,8 @@
 
         home.packages = [
           pkgs.streamrip
+          pkgs.claude-code
+          pkgs.wl-clipboard
         ];
 
         home.stateVersion = "24.11";

hosts/manatee/modules/default.nix

@@ -26,6 +26,7 @@ in
       homepage.enable = true;
       disk-smart.enable = true;
       puppy-tracker.enable = true;
+      solo-referee.enable = true;
     };
   };
 }

hosts/manatee/modules/home-assistant/default.nix

@@ -117,6 +117,16 @@ in
 
     hardware.bluetooth.enable = true;
 
+    # Give up and enter a `failed` state (visible in `systemctl --failed`) if the
+    # container restarts more than 5 times in 5 minutes, instead of crash-looping
+    # forever. The window is deliberately long: a slow crash-loop (~5s per attempt)
+    # stays under systemd's default 5-starts-per-10s limit and would otherwise
+    # retry indefinitely.
+    systemd.services.podman-homeassistant = {
+      startLimitIntervalSec = 300;
+      startLimitBurst = 5;
+    };
+
     virtualisation.oci-containers = {
       backend = "podman";
 

hosts/manatee/modules/romm/default.nix

@@ -26,6 +26,16 @@ let
             - 'Thumbs.db'
             - '.DS_Store'
   '';
+
+  # Give up and enter a `failed` state (visible in `systemctl --failed`) if a
+  # container restarts more than 5 times in 5 minutes, instead of crash-looping
+  # forever. The window is deliberately long: a slow crash-loop (~5s per attempt)
+  # stays under systemd's default 5-starts-per-10s limit and would otherwise
+  # retry indefinitely.
+  crashLoopGuard = {
+    startLimitIntervalSec = 300;
+    startLimitBurst = 5;
+  };
 in
 {
   options = {
@@ -51,6 +61,10 @@ in
       "d /var/lib/romm/assets 0755 root root -"
     ];
 
+    systemd.services.podman-romm = crashLoopGuard;
+    systemd.services.podman-romm-db = crashLoopGuard;
+    systemd.services.podman-romm-redis = crashLoopGuard;
+
     systemd.services.romm-net = {
       description = "Create Podman network for RomM";
       after = [ "podman.service" ];

hosts/manatee/modules/solo-referee/default.nix

@@ -0,0 +1,46 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
+let
+  enabled = config.mod.solo-referee.enable;
+  port = 8090;
+in
+{
+  options = {
+    mod.solo-referee = {
+      enable = lib.mkEnableOption "Enable solo-referee module";
+    };
+  };
+
+  imports = [
+    inputs.solo-referee.nixosModules.default
+  ];
+
+  config = lib.mkIf enabled {
+    mod.homepage.services = [
+      {
+        name = "Solo Referee";
+        port = port;
+        description = "Solo-RPG tool with Claude as GM";
+        # url omitted → homepage links to http://manatee:${port}.
+      }
+    ];
+
+    services.solo-referee = {
+      enable = true;
+      inherit port;
+      # Reachable on the LAN / Tailscale at manatee:${port}; no public vhost.
+      address = "0.0.0.0";
+      openFirewall = true;
+      # Anthropic API key kept out of the store; the file holds
+      # `ANTHROPIC_API_KEY=...`. Without it the offline stub GM runs.
+      apiKeyFile = config.age.secrets."solo-referee-api-key".path;
+    };
+
+    age.secrets."solo-referee-api-key".file =
+      ../../../../secrets/manatee/solo-referee-api-key.age;
+  };
+}

secrets/secrets.nix

@@ -43,6 +43,7 @@ in {
   "manatee/romm-db-password.age".publicKeys = [ manatee alex ];
   "manatee/romm-metadata-api-keys.age".publicKeys = [ manatee alex ];
   "manatee/puppy-tracker-invite-code.age".publicKeys = [ manatee alex ];
+  "manatee/solo-referee-api-key.age".publicKeys = [ manatee alex ];
 
   "backwards/root.backwards.age".publicKeys = [ backwards alex ];
   "backwards/root.backwards.pub.age".publicKeys = [ backwards alex ];