Add a calibre.m7.rs vhost proxying the calibre-server content server,
restricted to localhost and the headscale tailnet prefixes, and enable
calibre-server auth so the endpoint is not anonymous.
calibre-web wrote metadata.db directly, which desynced calibre-server's
in-memory library cache: books uploaded through books.m7.rs stayed
invisible on the content server until it was restarted, and two writers
on one library risk clobbering each other's metadata.
Drop calibre-web from the readarr and calibre-server groups and force
ReadWritePaths down to its state directory, so the pre-existing
ProtectSystem=strict leaves the library read-only. The 0002 umask only
existed to keep those shared-library writes group-writable, so it goes
too. Readarr already writes through the content server API, so
calibre-server is now the sole writer.
Note that services.calibre-web.options.enableBookUploading does not
cover this on its own: config_uploading only drives the templates, while
POST /upload stays gated on the per-user ROLE_UPLOAD bit alone.
Assisted-by: pi (claude-opus-5)
aerc ships no default keybind for :flag, so marking a message as
important meant typing the command. F was free in both messages and
view ('f' is :forward).
Assisted-by: pi (claude-opus-5)
ffsubsync selects the embedded subtitle track with the latest final cue,
which a Signs & Songs track wins on its trailing title card despite
carrying no dialogue. Select on total speech instead.
Assisted-by: pi (claude-opus-5)
ffsubsync references whichever embedded track ends last, which ties to
Signs & Songs on anime releases. Probe and pick a dialogue track instead.
Assisted-by: pi (claude-opus-5)
Mirror the NixOS openssh config on system-manager: no password auth, no
root login, ed25519 host key only, and gabriel's authorized keys. Its
module runs Ubuntu's /usr/sbin/sshd, so PAM keeps working.
Also enable programs.ssh for system-wide known hosts, and teach the NixOS
side about system-manager hosts so they know electra.
Raise the Axios response limit to 64 MiB only for Lidarr so large album libraries can complete SeerrNG scans without weakening the cap for other external APIs.
Assisted-by: pi (gpt-5.6-sol)
Point SeerrNG directly at systemd's private StateDirectory target so its log
path security check does not reject the public DynamicUser symlink.
Assisted-by: pi (gpt-5.6-sol)
Move Kavita to port 5001 because JellySearch already occupies its default
port 5000, which left Kavita restarting against JellySearch's listener.
Assisted-by: pi (gpt-5.6-sol)
Serve the Readarr-owned library through read-only Kavita, with a persisted
machine-local token key and the existing public books.m7.rs endpoint.
Assisted-by: pi (gpt-5.6-sol)
Drop defaults where one desktop entry is already the sole available handler,
whether declared by the desktop or added explicitly. Keep browser defaults
because their ordering is intentional.
Assisted-by: pi (gpt-5.6-sol)
Add khal-import.desktop for interactive text/calendar imports. Associate
pkgs.khal's existing khal.desktop, which launches ikhal, with
x-scheme-handler/calendar and use that handler from Waybar.
Assisted-by: pi (gpt-5.6-sol)
Watch and reload the Home Manager GTK 4 user stylesheet so theme switches replace the immutable imported theme without restarting Khora.
Assisted-by: pi (gpt-5.6-sol)
Map libadwaita accent roles to the active GTK theme selection colors so generated themes control highlights, focus rings, and selected dates.
Assisted-by: pi (gpt-5.6-sol)
Reset the full GTK background shorthand for clickable event buttons so flat-button theme imagery cannot hide calendar colors.
Assisted-by: pi (gpt-5.6-sol)
Render a six-week month grid with colored event chips, overflow links, adjacent-month dates, and navigation into day or agenda views.
Assisted-by: pi (gpt-5.6-sol)
Gabriel Fontes