dotfiles/systemd-units, branch masterMy linux config and rc fileshttps://git.sommerfeld.dev/dotfiles/atom/systemd-units?h=master2026-07-02T10:35:35ZUpdate Proton Bridge desktop integration2026-07-02T10:35:35Zsommerfeldsommerfeld@sommerfeld.dev2026-07-02T10:35:35Zurn:sha1:9c34010e1dce016d1b31d651dbcd332e747844e7Disable broken Proton mail startup2026-06-17T14:47:38Zsommerfeldsommerfeld@sommerfeld.dev2026-06-17T14:47:38Zurn:sha1:840691690f88711a84abfc4cb05718e9fd5d2255Reduce AUR package surface2026-06-14T23:55:43Zsommerfeldsommerfeld@sommerfeld.dev2026-06-14T23:55:43Zurn:sha1:bb607b3cdb027a2d02cf2111b8ee12dab172efad
Move pass-secret-service, snx-rs, and Sparrow under Nix/Home Manager.
Track the snx-rs system unit, pass-secret-service user unit, and pacman cache cleanup hook in the repo.
Drop the mkinitcpio firmware metapackage, overdue, pacman-cleanup-hook, and the standalone btc package group.
Update nix tools and system units2026-06-05T10:06:03Zsommerfeldsommerfeld@sommerfeld.dev2026-06-05T10:06:03Zurn:sha1:ddb31f2e965fb71ab949a54043c82f958b818442Move more host tooling to Nix2026-06-05T10:06:02Zsommerfeldsommerfeld@sommerfeld.dev2026-06-05T10:06:02Zurn:sha1:b0e83e2ee3fc328e55119ee7c1f09ad7ed20a635refactor(mail): migrate protonmail-bridge from pacman to nix2026-06-05T10:06:02Zsommerfeldsommerfeld@sommerfeld.dev2026-06-05T10:06:02Zurn:sha1:4d8cf1bc30a076e2976787051d28d8072f8f5321
Move the ProtonMail Bridge off the AUR protonmail-bridge-core package
and onto nix/host.nix, consistent with the other migrated user-leaf
tools. Since the AUR package previously supplied the systemd user unit
(customized via a drop-in), ship a repo-owned
dot_config/systemd/user/protonmail-bridge.service instead: it runs the
nix binary by absolute %h/.nix-profile/bin path with --noninteractive
and folds the former drop-in's PASSWORD_STORE_DIR into the unit, so the
now-redundant protonmail-bridge.service.d/override.conf is removed.
Drop protonmail-bridge-core from meta/base.txt (the git send-email Perl
prereqs stay). No vm.nix change: the bridge is host-only and user units
are not symlinked on the headless VM.
fix(systemd): ship poweralertd.service user unit2026-06-05T10:06:02Zsommerfeldsommerfeld@sommerfeld.dev2026-06-05T10:06:02Zurn:sha1:7414a25165e1469cacee3fa9d8e9dd25df640aa0
poweralertd was migrated to nix (host.nix) but, like mako, the nix
package does not ship a systemd user unit on the manager's search
path. sway-session.target's Wants=poweralertd.service referenced a
non-existent unit (previously the pacman package supplied
/usr/lib/systemd/user/poweralertd.service), so battery/AC
notifications never started at login.
Add a repo-owned poweralertd.service (absolute nix-profile path) and
register it in systemd-units/user.txt.
fix(systemd): ship mako.service user unit2026-06-05T10:06:01Zsommerfeldsommerfeld@sommerfeld.dev2026-06-05T10:06:01Zurn:sha1:c613f5b23418c5b68c6116ec22ce46d1a1fb42a2
The nix mako package does not ship a systemd user unit on the user
manager's search path, so sway-session.target's Wants=mako.service
referenced a non-existent unit after the pacman->nix migration
(previously the Arch mako package provided /usr/lib/systemd/user/
mako.service). mako only started on first D-Bus notification, never
eagerly at session login.
Add a repo-owned mako.service (Type=dbus, org.freedesktop.Notifications)
using the absolute nix-profile path, matching the other sway-session
units, and register it in systemd-units/user.txt.
refactor(suspend): gate suspend on AC, drop bespoke zellij inhibit2026-05-29T10:18:15Zsommerfeldsommerfeld@sommerfeld.dev2026-05-29T10:18:15Zurn:sha1:ec3734c5ef9fcfe97c21cd19f198ec779ab5f052
New, simpler suspend policy:
AC plugged in -> never auto-suspends (lid close ignored, idle no-op)
On battery only -> lid close suspends, swayidle suspends at 30 min idle
This replaces the SSH/zellij-aware inhibit machinery with a rule that
matches the user's mental model: if you don't want the machine to
sleep, plug it in. Long-running tasks (builds, downloads, SSH
sessions, headless services) just need AC.
Changes:
* etc/systemd/logind.conf.d/20-lid-ac.conf: set
HandleLidSwitchExternalPower=ignore so logind itself handles the AC
case at the source. No userspace daemon, no race, no rate-limit risk.
* dot_local/bin/on-battery-suspend: tiny POSIX wrapper that exits 0
when any /sys/class/power_supply/{AC,ADP}*/online == 1, else execs
`systemctl suspend`.
* dot_config/systemd/user/swayidle.service: add
`timeout 1800 on-battery-suspend`. Idle suspend now exists, but only
when on battery.
* Delete zellij-inhibit-suspend.{path,service} + watcher script and
remove the entry from systemd-units/user.txt. The .path
re-trigger storm bug is moot because the whole mechanism is gone.
Manual suspends (sway XF86Sleep keybind, sway power submode `s`,
`systemctl suspend` over SSH) still always work regardless of AC --
explicit user intent wins.
Also drop /migrate-podman-to-btrfs.sh from .gitignore; the one-off
migration script has been deleted now that the user has switched their
podman storage to the btrfs driver.
On-host steps to apply:
chezmoi apply -v
systemctl --user daemon-reload
systemctl --user reset-failed zellij-inhibit-suspend.service zellij-inhibit-suspend.path || true
systemctl --user stop zellij-inhibit-suspend.path zellij-inhibit-suspend.service || true
systemctl --user disable zellij-inhibit-suspend.path || true
systemctl --user restart swayidle.service
# logind drop-in is reloaded automatically by the etc deploy script.
Verify:
systemctl status systemd-logind | grep -i lid
loginctl show-session $XDG_SESSION_ID | grep -i lid
# Unplug AC -> close lid -> should suspend.
# Plug AC -> close lid -> nothing happens.
feat(suspend): re-enable suspend on s2idle, drop diagnostic scaffolding2026-05-29T10:18:15Zsommerfeldsommerfeld@sommerfeld.dev2026-05-29T10:18:15Zurn:sha1:6e0c5c33438e5e898bd075c33a45b3abf9d1b26b
Confirmed root cause: this hardware's S3 (deep) firmware path triggers a
fatal wake-from-suspend hang only on linux-hardened. INIT_ON_FREE + slab
hardening + tighter locking turn a latent driver race that stock linux
gets away with into an unrecoverable panic so early the journal isn't
even flushed. mem_sleep_default=s2idle bypasses the BIOS S3 path
entirely (s0ix is a pure-kernel low-power state) and suspends/resumes
reliably under hardened.
This is a widespread Lenovo S3 firmware issue across post-2018
ThinkPads (see Ubuntu T560, X1C9/10/11 reports). Lenovo themselves
moved newer firmwares to s2idle-only. Not a linux-hardened bug per se;
just hardened being a strict enough kernel to make the bug fatal.
Keep:
* mem_sleep_default=s2idle in etc/kernel/cmdline-linux-hardened.tmpl
(only the hardened UKI; stock linux keeps unchanged shared cmdline)
Revert (all the diagnostic / speculative scaffolding from the last
few commits):
* MODULES=(intel_lpss_pci) → MODULES=() — Arch wiki touchpad fix was
not the cause here
* nmi_watchdog=panic softlockup_panic=1 panic=10 — only needed to
auto-reboot during diagnosis
* no_console_suspend — diagnostic-only
* etc/systemd/logind.conf.d/20-no-suspend.conf — masking workaround
* sleep-target masking block in run_onchange_after_deploy-etc.sh.tmpl,
replaced with a one-shot cleanup that removes any leftover
/dev/null symlinks from systems that ran the previous version
* systemd-pstore.service from systemd-units/system.txt — added only to
catch the diagnostic panic
* diagnose-suspend.sh helper (and its .gitignore/.chezmoiignore entries)
* sway suspend → lock-session keybind workaround
* power-menu.sh Suspend entry restoration
* KEYBINDS.md docs