Add 1Password GUI and CLI via NixOS programs module

Enables programs._1password (CLI) and programs._1password-gui with
polkit authorization for user chexit. allowUnfree is already set,
so packages install without additional config.

https://claude.ai/code/session_01NS2hpapno51a1Ng7hWaQKy

configuration.nix

@@ -7,7 +7,7 @@
     ./desktop.nix
     ./nvidia.nix
     ./shell.nix
-    ./yami-dev-stack.nix 
+    # ./yami-dev-stack.nix  # uncomment to enable Yami dev stack, then set services.yami-dev-stack below
   ];
 
   nix = {
@@ -77,10 +77,16 @@
   users.users.chexit = {
     isNormalUser = true;
     description = "chexit";
-    shell = pkgs.zsh;
+    shell = pkgs.fish;
     extraGroups = [ "networkmanager" "wheel" "docker" ];
   };
 
+  programs._1password.enable = true;
+  programs._1password-gui = {
+    enable = true;
+    polkitPolicyOwners = [ "chexit" ];
+  };
+
   programs.throne = {
     enable = true;
     tunMode.enable = true;
@@ -98,11 +104,5 @@
   # Docker is now managed by yami-dev-stack.nix when that module is enabled.
   # services.yami-dev-stack = { enable = true; user = "chexit"; };
 
-  services.yami-dev-stack = {                               
-    enable = true;                                                                                        
-    user   = "chexit";
-    dataDir = "/mnt/ssd_110/yami";
-  };  
-
   system.stateVersion = "25.11";
 }

home.nix

@@ -1,22 +1,21 @@
-{ pkgs, ... }:
+{ ... }:
 
 {
   home.username = "chexit";
   home.homeDirectory = "/home/chexit";
   home.stateVersion = "25.11";
 
-  programs.zsh = {
+  programs.fish = {
     enable = true;
-    enableCompletion = true;
-    autosuggestion.enable = true;
-    syntaxHighlighting.enable = true;
-    initContent = ''
-      source ${pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k/powerlevel10k.zsh-theme
-    '';
     shellAliases = {
       rebuild = "sudo nixos-rebuild switch --flake ~/nixos-config#chexit";
     };
   };
 
+  programs.starship = {
+    enable = true;
+    enableFishIntegration = true;
+  };
+
   programs.home-manager.enable = true;
 }

shell.nix

@@ -1,5 +1,5 @@
 { ... }:
 
 {
-  programs.zsh.enable = true;
+  programs.fish.enable = true;
 }

yami-dev-stack.nix

@@ -13,20 +13,9 @@ in
       type = types.str;
       description = "User that will own runner token and be added to docker group";
     };
-
-    dataDir = mkOption {
-      type = types.nullOr types.path;
-      default = null;
-      example = "/mnt/ssd_110/yami";
-      description = ''
-        If set, bind-mounts /var/lib/{gitea,postgresql,gitea-runner} under this
-        path so all stack data lives on a separate disk. Directories are created
-        automatically; existing data must be rsync'd manually before enabling.
-      '';
-    };
   };
 
-  config = mkIf cfg.enable (mkMerge [ {
+  config = mkIf cfg.enable {
 
     # ── Systemd target ─────────────────────────────────────────────────────────
     # Manual-only: nothing in wantedBy, so it never starts on boot.
@@ -59,10 +48,6 @@ in
       enable   = true;
       appName  = "Yami Git";
 
-      # LFS enabled via the NixOS helper so the module manages LFS_JWT_SECRET
-      # (writing it to app.ini, which is read-only by design).
-      lfs.enable = true;
-
       database = {
         type   = "postgres";
         socket = "/run/postgresql";
@@ -78,6 +63,7 @@ in
           HTTP_PORT        = 3000;
           SSH_PORT         = 2222;
           START_SSH_SERVER = true;
+          LFS_START_SERVER = true;
         };
 
         service = {
@@ -139,11 +125,7 @@ in
       enable    = true;
       name      = "home-runner";
       url       = "http://localhost:3000";
-      # NOT under /var/lib/gitea-runner — that path is systemd-managed for the
+      tokenFile = "/var/lib/gitea-runner/token";
-      # service (DynamicUser + StateDirectory means it becomes a symlink to
-      # /var/lib/private/gitea-runner). Pre-creating it ourselves breaks the
-      # service with "Failed to set up special execution directory: File exists".
-      tokenFile = "/var/lib/gitea-runner-secret/token";
       labels    = [
         "ubuntu-latest:docker://node:20"
         "native:host"
@@ -157,14 +139,9 @@ in
       requires = [ "gitea.service" "docker.service" ];
     };
 
-    # Runner uses DynamicUser, so there's no static gitea-runner user/group.
+    # Directory for the runner token file; owner matches the runner service user.
-    # Token lives in a sibling dir (not /var/lib/gitea-runner — that's systemd's
-    # StateDirectory and pre-creating it breaks DynamicUser bind setup).
-    # The file MUST be in env-file format, not a raw token:
-    #     TOKEN=<paste-registration-token-from-gitea-ui>
-    # Get the token from Site Administration → Actions → Runners → Create new Runner.
     systemd.tmpfiles.rules = [
-      "d /var/lib/gitea-runner-secret 0700 root root -"
+      "d /var/lib/gitea-runner 0700 gitea-runner gitea-runner -"
     ];
 
     # ── Shell aliases ──────────────────────────────────────────────────────────
@@ -178,31 +155,5 @@ in
     # ── Firewall ───────────────────────────────────────────────────────────────
     # Merged with existing rules (Steam etc.); does not overwrite them.
     networking.firewall.allowedTCPPorts = [ 3000 2222 ];
-  }
+  };
-
-  # ── Optional: move all stack data to a separate disk via bind-mounts ─────────
-  (mkIf (cfg.dataDir != null) (
-    let
-      # gitea-runner intentionally NOT bind-mounted: its service uses
-      # DynamicUser + StateDirectory, which refuses to adopt an existing
-      # mount point ("Failed to set up special execution directory: File exists").
-      # Its data is tiny (token + .runner state) so it stays on the system disk.
-      subs = [ "gitea" "postgresql" ];
-      mkBind = name: {
-        name = "/var/lib/${name}";
-        value = {
-          device  = "${cfg.dataDir}/${name}";
-          fsType  = "none";
-          options = [ "bind" ];
-        };
-      };
-    in {
-      # Ensure target dirs exist on the data disk before mounts happen.
-      systemd.tmpfiles.rules = map (n: "d ${cfg.dataDir}/${n} 0755 root root -") subs
-        ++ [ "d ${cfg.dataDir} 0755 root root -" ];
-
-      fileSystems = listToAttrs (map mkBind subs);
-    }
-  ))
-  ]);
 }