chore(paseo): remove paseo

Remove the service from atlas and maia, along with its flake input, module, and secret.

Assisted-by: pi (openai-codex/gpt-5.6-sol)

flake.lock

@@ -379,27 +379,6 @@
         "type": "github"
       }
     },
-    "paseo": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1783370453,
-        "narHash": "sha256-A2zJNnuvltg5SmUp0anrz/WoLPTKL+T6R/U6q2Gw7P0=",
-        "owner": "yhori991",
-        "repo": "paseo",
-        "rev": "dbc60c825c4888c5417ffb82ecfa619a7291b2dd",
-        "type": "github"
-      },
-      "original": {
-        "owner": "yhori991",
-        "ref": "fix/nix-local-speech-worker",
-        "repo": "paseo",
-        "type": "github"
-      }
-    },
     "pre-commit": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -435,7 +414,6 @@
         "nix-minecraft": "nix-minecraft",
         "nixos-mailserver": "nixos-mailserver",
         "nixpkgs": "nixpkgs",
-        "paseo": "paseo",
         "sops-nix": "sops-nix",
         "systems": "systems_2",
         "website": "website"

flake.nix

@@ -59,12 +59,6 @@
       url = "github:TNAZEP/HytaleLauncherFlake";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    paseo = {
-      # FIXME: Return to getpaseo/paseo once getpaseo/paseo#1587 is merged.
-      url = "github:yhori991/paseo/fix/nix-local-speech-worker";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     # My own programs, packaged with nix
     website = {
       url = "path:./projects/website";

hosts/atlas/default.nix

@@ -15,7 +15,6 @@
     ../common/users/gabriel
 
     ../common/optional/peripherals.nix
-    ../common/optional/paseo.nix
     ../common/optional/regreet.nix
     ../common/optional/nginx.nix
     ../common/optional/pipewire.nix

hosts/common/optional/paseo.nix

@@ -1,84 +0,0 @@
-{
-  config,
-  inputs,
-  lib,
-  pkgs,
-  ...
-}: {
-  imports = [inputs.paseo.nixosModules.default];
-
-  services.paseo = {
-    enable = true;
-    package = inputs.paseo.packages.${pkgs.system}.default.overrideAttrs (old: {
-      # Upstream's daemon-only source filter excludes the web app sources.
-      src = inputs.paseo;
-      postBuild =
-        (old.postBuild or "")
-        + ''
-          npm run build:daemon-web-ui
-        '';
-      postInstall =
-        (old.postInstall or "")
-        + ''
-          cp -a packages/server/dist/server/web-ui \
-            $out/lib/paseo/packages/server/dist/server/
-        '';
-    });
-    user = "gabriel";
-    group = "users";
-    listenAddress = "0.0.0.0";
-    relay.enable = false;
-    settings = {
-      daemon = {
-        mcp = {
-          enabled = true;
-          injectIntoAgents = true;
-        };
-        browserTools.enabled = false;
-        autoArchiveAfterMerge = false;
-        enableTerminalAgentHooks = false;
-        hostnames = [config.networking.hostName];
-      };
-      agents = {
-        providers = {
-          claude.enabled = false;
-          codex.enabled = false;
-          copilot.enabled = false;
-          opencode.enabled = false;
-          omp.enabled = false;
-          pi.enabled = true;
-        };
-        metadataGeneration.providers = [];
-      };
-      features = {
-        dictation.enabled = true;
-        voiceMode = {
-          enabled = true;
-          llm.provider = "pi";
-          stt = {
-            provider = "local";
-            model = "parakeet-tdt-0.6b-v3-int8";
-          };
-          tts = {
-            provider = "local";
-            model = "kokoro-en-v0_19";
-            speakerId = 0;
-          };
-        };
-        webUi.enabled = true;
-      };
-    };
-  };
-
-  sops.secrets.paseo-password.sopsFile = ../secrets.yaml;
-  systemd.services.paseo.serviceConfig = {
-    ExecStart = lib.mkForce (pkgs.writeShellScript "paseo-server" ''
-      export PASEO_PASSWORD="$(<"$CREDENTIALS_DIRECTORY/paseo-password")"
-      exec ${config.services.paseo.package}/bin/paseo-server
-    '');
-    LoadCredential = "paseo-password:${config.sops.secrets.paseo-password.path}";
-  };
-
-  # Reachable directly over the tailnet, but not from LAN/public interfaces.
-  networking.firewall.interfaces.tailscale0.allowedTCPPorts = [6767];
-}

hosts/common/secrets.yaml

@@ -7,7 +7,6 @@ firefly-pat: ENC[AES256_GCM,data:WzTOm6OygWIP/qxvNT5BmU/S7Omv6A6MuSE86jF/ICNHvQH
 pluggy-secret: ENC[AES256_GCM,data:phAnBkixZIY65oiIs8jDa1kqZrGs8PxwjcptUaGaN+g8c2C6,iv:fJ+Jy1vykrVv/ojRT4iUWWfcFJn8xMNAbXxBsCsKrYw=,tag:YmV+3BHHlSTjiZyYuMV3Dw==,type:str]
 brave_api_key: ENC[AES256_GCM,data:AN16nQQwdqKp+L2XPP9GKJulEXIoT32TmDD2nohPTA==,iv:1vjVA+tFVh1+stW/S9IBtpeAYteb/hyGxDcF4+dc07A=,tag:4kpf73bEYX7KbKas2l3iJQ==,type:str]
 kagi_session_token: ENC[AES256_GCM,data:X8uPQYehrAKfshJCz2sSxz5NY5Ab4N+IVsT2zrwxYQmuHy2CYlMbLZkx5ssolzlW9CEivH65mdzsiyMqXnr987KpwWZWZqr+8sPDS/lvZ2/vzSihYf5+,iv:CdIhSFhfjNdNVgesKnmycmRKVldgv7BGlveubWug620=,tag:drw73skWYc1dKW/GLWE3Kg==,type:str]
-paseo-password: ENC[AES256_GCM,data:8bBXkKq31vuA,iv:iop0OGj6X/7cGb6TzAaP+12rYIRhjqgZ/LRL1/znB84=,tag:iTm2g3dPKTDLobs/Z6jnaA==,type:str]
 sops:
     age:
         - enc: |
@@ -73,8 +72,8 @@ sops:
             /vIUXyaug3bAVvDk2zVQFLGE7JSUN3qI2ayczv/ogGnIX3/bwrgrJw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1mhlh8lj8jv58xy9mdhsarfyanckyx8c2xdu09xrn23nrc56e94xserztxx
-    lastmodified: "2026-07-13T02:01:48Z"
-    mac: ENC[AES256_GCM,data:izQ4cZiwVbrBJZeOX4sEdqngSDbeOjzIuH3pJZXcfiTsR8zrWgj+134jW/qmHxmNaJPUkmb5cJYxf7+TFKvyrEGb3WTwC65312hB5qIJlq+PXFLN9EN5/IMGc6G6EmIdwy5sW1HZRNhZ94ruMOzKlNz/nUc2sYulqEKK80GRQPc=,iv:/ublyPy6yuxAqmVeBrl36z6PJ3Qk+5HlorrVgYMWEm8=,tag:kkE1+NA2p65IKDMBmVcPGQ==,type:str]
+    lastmodified: "2026-07-13T19:00:17Z"
+    mac: ENC[AES256_GCM,data:bw/AeUywRng65sX7IRizPpjt5vOcBLxnJv2rzz3IN5kNW5MLTVUFF73u1BK/buRixjwz3xYW0CzbKVPhxkWqEFE4qrlC4VGjbjd9HPkPIpuy2pG1eLIo9D9CnVuv+0fWDXVwumawcvdvp55uKC3e4kHKxrE6GGnnLDvKrAHHdHw=,iv:ZvO366sZTwBI6FfTYs7nQEj14qXpefxFLqH1KGNqbMU=,tag:MBqZ+jm4i4ohLSuiUTcS8Q==,type:str]
     pgp:
         - created_at: "2025-09-22T16:23:03Z"
           enc: |-

hosts/maia/default.nix

@@ -13,7 +13,6 @@
     ../common/users/gabriel
 
     ../common/optional/peripherals.nix
-    ../common/optional/paseo.nix
     ../common/optional/regreet.nix
     ../common/optional/pipewire.nix
     ../common/optional/quietboot.nix