update zen browser to 1.19.2b

.gitea/scripts/update-appimage-nix.sh

@@ -4,24 +4,15 @@ set -euo pipefail
 : "${FILE:?FILE is required}"
 : "${LATEST_RELEASE_URL:?LATEST_RELEASE_URL is required}"
 : "${DOWNLOAD_URL_TEMPLATE:?DOWNLOAD_URL_TEMPLATE is required}"
-
+: "${RELEASE_API_REPO:?RELEASE_API_REPO is required}"
-if command -v python >/dev/null 2>&1; then
-  PYTHON_BIN=python
-elif command -v python3 >/dev/null 2>&1; then
-  PYTHON_BIN=python3
-else
-  echo "python is required but was not found"
-  exit 1
-fi
 
 version_strip_prefix="${LATEST_VERSION_STRIP_PREFIX:-v}"
 release_tag_template="${RELEASE_TAG_TEMPLATE:-{version}}"
-release_tag_template="${release_tag_template//$'\r'/}"
 
-current_version=$($PYTHON_BIN - <<'PY'
+current_version=$(python - <<'PY'
 import re
 import os
-p=os.environ["FILE"]
+p=os.environ['FILE']
 s=open(p).read()
 m=re.search(r'version\s*=\s*"([^"]+)";', s)
 print(m.group(1) if m else "")
@@ -44,29 +35,37 @@ if [ -z "$latest_version" ] || [ "$latest_version" = "$current_version" ]; then
 fi
 
 download_url="${DOWNLOAD_URL_TEMPLATE//\{version\}/$latest_version}"
-new_hash=$(nix store prefetch-file --json "$download_url" | "$PYTHON_BIN" -c 'import json,sys; print(json.load(sys.stdin)["hash"])')
+new_hash=$(nix store prefetch-file --json "$download_url" | python -c 'import json,sys; print(json.load(sys.stdin)["hash"])')
 
 export LATEST_VERSION="$latest_version"
 export NEW_HASH="$new_hash"
 
-"$PYTHON_BIN" - <<'PY'
+python - <<'PY'
 import os
 import re
-p=os.environ["FILE"]
+p=os.environ['FILE']
 s=open(p).read()
 s=re.sub(r'version\s*=\s*"[^"]+"', f'version = "{os.environ["LATEST_VERSION"]}"', s, count=1)
 s=re.sub(r'hash\s*=\s*"[^"]+"', f'hash = "{os.environ["NEW_HASH"]}"', s, count=1)
-open(p,"w").write(s)
+open(p,'w').write(s)
 PY
 
-release_tag="${release_tag_template//\{version\}/$latest_version}"
-release_tag="${release_tag#\{}"
-release_tag="${release_tag%\}}"
-release_tag="${release_tag#\'}"
-release_tag="${release_tag%\'}"
-release_url="${LATEST_RELEASE_URL%/latest}/tag/${release_tag}"
-
 echo "updated=true" >> "$GITHUB_OUTPUT"
 echo "version=$latest_version" >> "$GITHUB_OUTPUT"
 echo "previous_version=$current_version" >> "$GITHUB_OUTPUT"
-echo "release_url=$release_url" >> "$GITHUB_OUTPUT"
+
+release_tag="${release_tag_template//\{version\}/$latest_version}"
+release_notes=$(curl -fsSL "https://api.github.com/repos/${RELEASE_API_REPO}/releases/tags/${release_tag}" \
+  | python -c 'import json,sys; d=json.load(sys.stdin); print((d.get("body") or "").strip())' \
+  || true)
+
+if [ -z "$release_notes" ]; then
+  release_notes="_No changelog found in upstream release notes._"
+fi
+
+delimiter="CHANGELOG_$(date +%s%N)"
+{
+  echo "changelog<<${delimiter}"
+  printf '%s\n' "$release_notes"
+  echo "${delimiter}"
+} >> "$GITHUB_OUTPUT"

.gitea/workflows/handy-update.yml

@@ -25,6 +25,7 @@ jobs:
           FILE: modules/pkgs/handy.nix
           LATEST_RELEASE_URL: https://github.com/cjpais/Handy/releases/latest
           DOWNLOAD_URL_TEMPLATE: https://github.com/cjpais/Handy/releases/download/v{version}/Handy_{version}_amd64.AppImage
+          RELEASE_API_REPO: cjpais/Handy
           RELEASE_TAG_TEMPLATE: v{version}
         shell: bash
         run: bash .gitea/scripts/update-appimage-nix.sh
@@ -45,13 +46,14 @@ jobs:
         if: steps.update.outputs.updated == 'true'
         env:
           GITEA_TOKEN: ${{ secrets.tea_token || secrets.TEA_TOKEN }}
+          CHANGELOG: ${{ steps.update.outputs.changelog }}
         shell: bash
         run: |
           set -euo pipefail
 
           version="${{ steps.update.outputs.version }}"
           previous_version="${{ steps.update.outputs.previous_version }}"
-          release_url="${{ steps.update.outputs.release_url }}"
+          release_url="https://github.com/cjpais/Handy/releases/tag/v${version}"
 
           pr_body=$(cat <<EOF
           automated update of handy appimage version and hash
@@ -60,6 +62,8 @@ jobs:
           from \`${previous_version}\` to \`${version}\`
 
           upstream release: ${release_url}
+
+          ${CHANGELOG}
           EOF
           )
 

.gitea/workflows/helium-update.yml

@@ -25,6 +25,7 @@ jobs:
           FILE: modules/pkgs/helium.nix
           LATEST_RELEASE_URL: https://github.com/imputnet/helium-linux/releases/latest
           DOWNLOAD_URL_TEMPLATE: https://github.com/imputnet/helium-linux/releases/download/{version}/helium-{version}-x86_64.AppImage
+          RELEASE_API_REPO: imputnet/helium-linux
           RELEASE_TAG_TEMPLATE: '{version}'
         shell: bash
         run: bash .gitea/scripts/update-appimage-nix.sh
@@ -45,13 +46,14 @@ jobs:
         if: steps.update.outputs.updated == 'true'
         env:
           GITEA_TOKEN: ${{ secrets.tea_token || secrets.TEA_TOKEN }}
+          CHANGELOG: ${{ steps.update.outputs.changelog }}
         shell: bash
         run: |
           set -euo pipefail
 
           version="${{ steps.update.outputs.version }}"
           previous_version="${{ steps.update.outputs.previous_version }}"
-          release_url="${{ steps.update.outputs.release_url }}"
+          release_url="https://github.com/imputnet/helium-linux/releases/tag/${version}"
 
           pr_body=$(cat <<EOF
           automated update of helium appimage version and hash
@@ -60,6 +62,8 @@ jobs:
           from \`${previous_version}\` to \`${version}\`
 
           upstream release: ${release_url}
+
+          ${CHANGELOG}
           EOF
           )
 

.gitea/workflows/zen-browser-update.yml

@@ -25,6 +25,7 @@ jobs:
           FILE: modules/pkgs/zen-browser.nix
           LATEST_RELEASE_URL: https://github.com/zen-browser/desktop/releases/latest
           DOWNLOAD_URL_TEMPLATE: https://github.com/zen-browser/desktop/releases/download/{version}/zen-x86_64.AppImage
+          RELEASE_API_REPO: zen-browser/desktop
           RELEASE_TAG_TEMPLATE: '{version}'
         shell: bash
         run: bash .gitea/scripts/update-appimage-nix.sh
@@ -45,13 +46,14 @@ jobs:
         if: steps.update.outputs.updated == 'true'
         env:
           GITEA_TOKEN: ${{ secrets.tea_token || secrets.TEA_TOKEN }}
+          CHANGELOG: ${{ steps.update.outputs.changelog }}
         shell: bash
         run: |
           set -euo pipefail
 
           version="${{ steps.update.outputs.version }}"
           previous_version="${{ steps.update.outputs.previous_version }}"
-          release_url="${{ steps.update.outputs.release_url }}"
+          release_url="https://github.com/zen-browser/desktop/releases/tag/${version}"
 
           pr_body=$(cat <<EOF
           automated update of zen browser appimage version and hash
@@ -60,6 +62,8 @@ jobs:
           from \`${previous_version}\` to \`${version}\`
 
           upstream release: ${release_url}
+
+          ${CHANGELOG}
           EOF
           )
 

README.md

@@ -20,36 +20,3 @@ NixOS configuration using a dendritic structure — `flake.nix` at the root, wit
 ```bash
 sudo nixos-rebuild switch --flake .#nixos
 ```
-
-## SMB share secrets (agenix)
-
-SMB automount is configured in `modules/hosts/nixos.nix` and activates once
-`secrets/smb-credentials.age` exists.
-
-1. Edit recipients in `secrets/secrets.nix` if needed.
-2. Create the encrypted secret (using the host SSH private key via sudo):
-
-```bash
-sudo env RULES=secrets/secrets.nix nix run github:ryantm/agenix -- -e secrets/smb-credentials.age -i /etc/ssh/ssh_host_ed25519_key
-```
-
-Use this content:
-
-```text
-username=YOUR_SMB_USER
-password=YOUR_SMB_PASSWORD
-# optional
-# domain=WORKGROUP
-```
-
-Configured shares mirror your Endeavour setup:
-
-- `//192.168.1.102/data` → `/mnt/unraid-data`
-- `//192.168.1.102/appdata` → `/mnt/unraid-appdata`
-
-Then apply:
-
-```bash
-sudo nixos-rebuild switch --flake .#nixos
-```
-

flake.lock

@@ -1,48 +1,5 @@
 {
   "nodes": {
-    "agenix": {
-      "inputs": {
-        "darwin": "darwin",
-        "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs",
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1770165109,
-        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
-        "owner": "ryantm",
-        "repo": "agenix",
-        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ryantm",
-        "repo": "agenix",
-        "type": "github"
-      }
-    },
-    "darwin": {
-      "inputs": {
-        "nixpkgs": [
-          "agenix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1744478979,
-        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
-        "owner": "lnl7",
-        "repo": "nix-darwin",
-        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "lnl7",
-        "ref": "master",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
@@ -63,27 +20,6 @@
         "type": "github"
       }
     },
-    "home-manager": {
-      "inputs": {
-        "nixpkgs": [
-          "agenix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1745494811,
-        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
     "import-tree": {
       "locked": {
         "lastModified": 1772999353,
@@ -100,22 +36,6 @@
       }
     },
     "nixpkgs": {
-      "locked": {
-        "lastModified": 1754028485,
-        "narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "59e69648d345d6e8fef86158c555730fa12af9de",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
       "locked": {
         "lastModified": 1772773019,
         "narHash": "sha256-E1bxHxNKfDoQUuvriG71+f+s/NT0qWkImXsYZNFFfCs=",
@@ -133,25 +53,9 @@
     },
     "root": {
       "inputs": {
-        "agenix": "agenix",
         "flake-parts": "flake-parts",
         "import-tree": "import-tree",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
       }
     }
   },

flake.nix

@@ -9,7 +9,6 @@
     };
 
     import-tree.url = "github:vic/import-tree";
-    agenix.url = "github:ryantm/agenix";
   };
 
   outputs =

modules/development.nix

@@ -12,7 +12,6 @@
       lazygit
       pnpm
       ni
-      code-cursor-fhs
 
       # LSPs and formatters (previously via Mason)
       stylua

modules/hosts/nixos.nix

@@ -3,20 +3,9 @@
   self,
   config,
   ...
-}: let
+}: {
-  flakeConfig = config;
+  flake.nixosModules.nixos-host = {pkgs, ...}: {
-in {
-  flake.nixosModules.nixos-host = {
-    pkgs,
-    lib,
-    config,
-    ...
-  }: let
-    smbSecretFile = ../../secrets/smb-credentials.age;
-    hasSmbSecret = builtins.pathExists smbSecretFile;
-  in {
     imports = [
-      inputs.agenix.nixosModules.default
       ../../hardware-configuration.nix
     ];
 
@@ -30,7 +19,7 @@ in {
     # Custom EDID override for Samsung 240Hz on DP-1
     boot.kernelParams = ["drm.edid_firmware=DP-1:edid/g80.bin"];
     hardware.firmware = [
-      (pkgs.runCommand "g80-edid-firmware" {} ''
+      (pkgs.runCommandNoCC "g80-edid-firmware" {} ''
         install -Dm444 ${../assets/edid/g80.bin} $out/lib/firmware/edid/g80.bin
       '')
     ];
@@ -80,7 +69,7 @@ in {
     };
 
     # User account
-    users.users.${flakeConfig.username} = {
+    users.users.${config.username} = {
       isNormalUser = true;
       description = "Thomas Gouveia Lopes";
       extraGroups = ["networkmanager" "wheel"];
@@ -102,59 +91,6 @@ in {
     # State version
     system.stateVersion = "25.11";
 
-    boot.supportedFilesystems = ["cifs"];
-
-    warnings = lib.optional (!hasSmbSecret) ''
-      SMB automount is disabled: missing ${toString smbSecretFile}.
-      Create it with agenix:
-      sudo env RULES=secrets/secrets.nix nix run github:ryantm/agenix -- -e secrets/smb-credentials.age -i /etc/ssh/ssh_host_ed25519_key
-      and set:
-      username=...
-      password=...
-      # optional
-      # domain=WORKGROUP
-    '';
-
-    age.identityPaths = ["/etc/ssh/ssh_host_ed25519_key"];
-    age.secrets."smb-credentials" = lib.mkIf hasSmbSecret {
-      file = smbSecretFile;
-      mode = "0400";
-      owner = "root";
-      group = "root";
-    };
-
-    fileSystems."/mnt/unraid-data" = lib.mkIf hasSmbSecret {
-      device = "//192.168.1.102/data";
-      fsType = "cifs";
-      options = [
-        "credentials=${config.age.secrets."smb-credentials".path}"
-        "uid=1000"
-        "gid=1000"
-        "iocharset=utf8"
-        "nofail"
-        "x-systemd.automount"
-        "_netdev"
-        "noserverino"
-        "vers=3.0"
-      ];
-    };
-
-    fileSystems."/mnt/unraid-appdata" = lib.mkIf hasSmbSecret {
-      device = "//192.168.1.102/appdata";
-      fsType = "cifs";
-      options = [
-        "credentials=${config.age.secrets."smb-credentials".path}"
-        "uid=1000"
-        "gid=1000"
-        "iocharset=utf8"
-        "nofail"
-        "x-systemd.automount"
-        "_netdev"
-        "noserverino"
-        "vers=3.0"
-      ];
-    };
-
     fileSystems."/mnt/endeavour" = {
       device = "/dev/disk/by-uuid/a32ca052-12a5-4355-bd3b-b4515d9ea4a5";
       fsType = "ext4";

modules/packages.nix

@@ -24,8 +24,6 @@
       ffmpeg
       tmux
       obs-studio
-      jjui
-      bat
     ];
   };
 }

modules/pkgs/handy.nix

@@ -2,11 +2,11 @@
   perSystem = {pkgs, ...}: {
     packages.handy = pkgs.appimageTools.wrapType2 rec {
       pname = "handy";
-      version = "0.8.0";
+      version = "0.7.10";
 
       src = pkgs.fetchurl {
         url = "https://github.com/cjpais/Handy/releases/download/v${version}/Handy_${version}_amd64.AppImage";
-        hash = "sha256-PLcssfd6iMx51mglAJ7D4+67HFazwfhJMImgU9WiNDk=";
+        hash = "sha256-vBOcXCCJr9D0u0h27nN4XLPPngx4m+toAfi6O6Fuojk=";
       };
 
       extraInstallCommands = let

modules/pkgs/helium.nix

@@ -2,11 +2,11 @@
   perSystem = { pkgs, ... }: {
     packages.helium = pkgs.appimageTools.wrapType2 rec {
       pname = "helium";
-      version = "0.10.6.1";
+      version = "0.9.4.1";
 
       src = pkgs.fetchurl {
         url = "https://github.com/imputnet/helium-linux/releases/download/${version}/${pname}-${version}-x86_64.AppImage";
-        hash = "sha256-6xqNRaP3aqitEseexRVEEjKkJClC0j1HHZoRGQanhSk=";
+        hash = "sha256-N5gdWuxOrIudJx/4nYo4/SKSxakpTFvL4zzByv6Cnug=";
       };
 
       extraInstallCommands = let

modules/pkgs/zen-browser.nix

@@ -1,11 +1,11 @@
 {lib, ...}: {
   perSystem = {pkgs, ...}: let
     pname = "zen-browser";
-    version = "1.19.3b";
+    version = "1.19.2b";
 
     src = pkgs.fetchurl {
       url = "https://github.com/zen-browser/desktop/releases/download/${version}/zen-x86_64.AppImage";
-      hash = "sha256-p00Irv2z6brDXMx3cr0234lOZZ2a7FmJMDzN494nzMw=";
+      hash = "sha256-lDn7rIYDgmyUnc3PdIASXfpXBXASL6TEdzyZfT716cI=";
     };
 
     appimageContents = pkgs.appimageTools.extract {inherit pname version src;};

modules/ui.nix

@@ -2,7 +2,6 @@
 	flake.nixosModules.ui = { pkgs, lib, ... }: {
 		# Desktop environment
 		services.xserver.enable = true;
-		services.xserver.xkb.options = "compose:ralt,cedilla:cacute";
 		services.displayManager.gdm.enable = true;
 		services.displayManager.gdm.wayland = true;
 		services.desktopManager.gnome.enable = true;

secrets/secrets.nix

@@ -1,7 +0,0 @@
-let
-  nixos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIg62Co6P+CYcvINrW9IYM1D8W7A3LNlEphAqP6vCzrv root@nixos";
-in {
-  "secrets/smb-credentials.age".publicKeys = [
-    nixos
-  ];
-}

secrets/smb-credentials.age

@@ -1,5 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 eoxNoQ +//j26EmOrSLqTMUaKWy4X/GZZ3XoJmKlT+ArQejODU
-olSV7FU5URhIcB4JczmPhGZsaQjQCs7kTm/IISCePsk
---- r7Gpe55fXHr9lghoFvwAZZVvDVckENBxTDXW3sXEjUI
-ã{„Â&ffÇj?ÛSŠÈy´|Ô™tÀܾ_3äûOÇÒåjp»	‹tS!Î,†!5iÿó©¡�ÙGoê‹_?tFKˆ%üÊ´ØÔh%up„ÁX;'•.ÿXÙðóœo=