Remove former work environment configuration

24 files changed, 9 insertions, 174 deletions

diff --git a/dot_config/git/config b/dot_config/git/config
index a4831cf..56e14be 100644
--- a/dot_config/git/config
+++ b/dot_config/git/config
@@ -128,10 +128,6 @@
     swd = switch -d
     unstage = reset HEAD --
     update=!git fetch && git merge --ff-only
-[includeIf "gitdir:/home/*/work/"]
-    path = config-work
-[includeIf "gitdir:/home/swuser/"]
-    path = config-work
 [includeIf "gitdir:~/doxfiles/.git"]
     path = config-personal
 [includeIf "gitdir:~/dev/copilot/.git"]
diff --git a/dot_config/mimeapps.list b/dot_config/mimeapps.list
index b8e8db7..79ed4ed 100644
--- a/dot_config/mimeapps.list
+++ b/dot_config/mimeapps.list
@@ -93,7 +93,6 @@ x-scheme-handler/webcal=org.mozilla.thunderbird.desktop
 text/calendar=org.mozilla.thunderbird.desktop
 application/x-extension-ics=org.mozilla.thunderbird.desktop
 x-scheme-handler/webcals=org.mozilla.thunderbird.desktop
-x-scheme-handler/msteams=teams-xsight.desktop
 
 [Added Associations]
 x-scheme-handler/http=io.gitlab.librewolf-community.desktop;
@@ -110,4 +109,3 @@ x-scheme-handler/mailto=org.mozilla.thunderbird.desktop;
 x-scheme-handler/mid=org.mozilla.thunderbird.desktop;
 x-scheme-handler/webcal=org.mozilla.thunderbird.desktop;
 x-scheme-handler/webcals=org.mozilla.thunderbird.desktop;
-x-scheme-handler/msteams=teams-xsight.desktop;
diff --git a/dot_config/sway/config b/dot_config/sway/config
index 6490001..32e7320 100644
--- a/dot_config/sway/config
+++ b/dot_config/sway/config
@@ -53,11 +53,6 @@ for_window [class="Tor Browser"] floating enable
 for_window [app_id="org.mozilla.thunderbird" title=".*Mozilla Thunderbird$"] mark --add tb-main
 for_window [shell=".*"] inhibit_idle fullscreen
 
-# virt-viewer / virt-manager grab the Mod key via the keyboard-shortcuts-inhibit
-# Wayland protocol. Refuse so $mod+... bindings keep working while the VM has focus.
-for_window [app_id="virt-viewer"] shortcuts_inhibitor disable
-for_window [app_id="remote-viewer"] shortcuts_inhibitor disable
-for_window [app_id="virt-manager"] shortcuts_inhibitor disable
 for_window [app_id="^[Ww]aydroid.*"] shortcuts_inhibitor disable
 
 # ── Standard keybinds (sway defaults) ─────────────────────────────────────────
diff --git a/dot_config/sway/executable_type-vpn-otp.sh b/dot_config/sway/executable_type-vpn-otp.sh
deleted file mode 100644
index f62ecbc..0000000
--- a/dot_config/sway/executable_type-vpn-otp.sh
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env dash
-# Fetch the current VPN TOTP from pass-otp and type it into the focused
-# surface via wtype. If wtype isn't available or fails (focused surface
-# lacks virtual-keyboard support, e.g. an Xwayland app), copy the code
-# to the Wayland clipboard instead and notify so the user can Ctrl+V it.
-set -eu
-
-code=$(pass otp show vpn/totp 2>/dev/null | tr -d ' \t\n\r') || {
-  notify-send -u critical "VPN OTP" "pass otp show vpn/totp failed"
-  exit 1
-}
-
-if [ -z "$code" ]; then
-  notify-send -u critical "VPN OTP" "empty code from pass-otp"
-  exit 1
-fi
-
-if command -v wtype >/dev/null 2>&1 && wtype -- "$code" 2>/dev/null; then
-  exit 0
-fi
-
-printf '%s' "$code" | wl-copy
-notify-send "VPN OTP" "Typed via wtype failed — code copied to clipboard"
diff --git a/dot_config/systemd/user/teams-sii.service b/dot_config/systemd/user/teams-sii.service
deleted file mode 100644
index 92a2bac..0000000
--- a/dot_config/systemd/user/teams-sii.service
+++ /dev/null
@@ -1,28 +0,0 @@
-[Unit]
-Description=Microsoft Teams — Sii account (flatpak)
-PartOf=graphical-session.target
-After=graphical-session.target
-ConditionEnvironment=WAYLAND_DISPLAY
-
-[Service]
-Type=simple
-# Mirrors the Exec= line in teams-sii.desktop. --user-data-dir isolates this
-# instance from teams-xsight; --class is for sway window matching.
-ExecStart=/usr/bin/flatpak run com.github.IsmaelMartinez.teams_for_linux \
-  --class=teams-sii \
-  --user-data-dir=%h/.var/app/com.github.IsmaelMartinez.teams_for_linux/config/profile-sii \
-  --appIcon=%h/.local/share/icons/hicolor/256x256/apps/teams-sii.png \
-  "--appTitle=Teams — Sii" \
-  --minimized=true
-# Both Teams instances share the same flatpak app id, so we can't use
-# `flatpak kill <app-id>` in ExecStop (it would also kill the xsight one).
-# KillMode=mixed sends SIGTERM to the main process only — teams-for-linux
-# treats that as a real Quit (not tray-hide), and SIGKILL hits stragglers
-# after the stop timeout if Electron misbehaves.
-KillMode=mixed
-Restart=on-failure
-RestartSec=5s
-TimeoutStopSec=15s
-
-[Install]
-WantedBy=sway-session.target
diff --git a/dot_config/systemd/user/teams-xsight.service b/dot_config/systemd/user/teams-xsight.service
deleted file mode 100644
index a212196..0000000
--- a/dot_config/systemd/user/teams-xsight.service
+++ /dev/null
@@ -1,28 +0,0 @@
-[Unit]
-Description=Microsoft Teams — XSight account (flatpak)
-PartOf=graphical-session.target
-After=graphical-session.target
-ConditionEnvironment=WAYLAND_DISPLAY
-
-[Service]
-Type=simple
-# Mirrors the Exec= line in teams-xsight.desktop. --user-data-dir isolates
-# this instance from teams-sii; --class is for sway window matching.
-ExecStart=/usr/bin/flatpak run com.github.IsmaelMartinez.teams_for_linux \
-  --class=teams-xsight \
-  --user-data-dir=%h/.var/app/com.github.IsmaelMartinez.teams_for_linux/config/profile-xsight \
-  --appIcon=%h/.local/share/icons/hicolor/256x256/apps/teams-xsight.png \
-  "--appTitle=Teams — XSight" \
-  --minimized=true
-# Both Teams instances share the same flatpak app id, so we can't use
-# `flatpak kill <app-id>` in ExecStop (it would also kill the sii one).
-# KillMode=mixed sends SIGTERM to the main process only — teams-for-linux
-# treats that as a real Quit (not tray-hide), and SIGKILL hits stragglers
-# after the stop timeout if Electron misbehaves.
-KillMode=mixed
-Restart=on-failure
-RestartSec=5s
-TimeoutStopSec=15s
-
-[Install]
-WantedBy=sway-session.target
diff --git a/dot_config/zsh/dot_zprofile b/dot_config/zsh/dot_zprofile
index cc92558..a2f5c8b 100644
--- a/dot_config/zsh/dot_zprofile
+++ b/dot_config/zsh/dot_zprofile
@@ -70,8 +70,8 @@ export LESS="-F --RAW-CONTROL-CHARS"
 
 # ── GPG / SSH ─────────────────────────────────────────────────────────────────
 unset SSH_AGENT_PID
-# Always route SSH auth through the machine-local gpg-agent. The VM imports its
-# own work GPG key; we deliberately do not use forwarded ssh-agent sockets.
+# Always route SSH auth through the machine-local gpg-agent. We deliberately do
+# not use forwarded ssh-agent sockets.
 SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
 export SSH_AUTH_SOCK
 
@@ -138,8 +138,6 @@ case $(uname -n) in
         ;;
     hercules)
         export OCL_ICD_VENDORS=nvidia
-    # shellcheck disable=SC1091  # optional, loaded only on hosts that have it
-        [[ -r "$XDG_CONFIG_HOME/sh/work-envrc" ]] && source "$XDG_CONFIG_HOME/sh/work-envrc"
         ;;
 esac
 
diff --git a/dot_config/zsh/dot_zshrc b/dot_config/zsh/dot_zshrc
index d432e45..17c3d1b 100644
--- a/dot_config/zsh/dot_zshrc
+++ b/dot_config/zsh/dot_zshrc
@@ -245,7 +245,6 @@ alias ip="ip -color=auto"
 alias lsip="ip -human -color=auto --brief address show"
 alias ipa="ip -stats -details -human -color=auto address show"
 alias ipecho='curl ipecho.net/plain'
-alias mw="mosh --server=/home/swuser/.nix-profile/bin/mosh-server work.wg -- /home/swuser/.nix-profile/bin/zsh -lic 'za'"
 alias ss='sudo ss -tupnl'
 
 # Privilege escalation
diff --git a/dot_local/share/applications/com.github.IsmaelMartinez.teams_for_linux.desktop b/dot_local/share/applications/com.github.IsmaelMartinez.teams_for_linux.desktop
deleted file mode 100644
index 1f2c6e9..0000000
--- a/dot_local/share/applications/com.github.IsmaelMartinez.teams_for_linux.desktop
+++ /dev/null
@@ -1,5 +0,0 @@
-[Desktop Entry]
-Type=Application
-Name=Teams for Linux (default — hidden)
-NoDisplay=true
-Hidden=true
diff --git a/dot_local/share/applications/teams-sii.desktop.tmpl b/dot_local/share/applications/teams-sii.desktop.tmpl
deleted file mode 100644
index a6e014a..0000000
--- a/dot_local/share/applications/teams-sii.desktop.tmpl
+++ /dev/null
@@ -1,11 +0,0 @@
-[Desktop Entry]
-Name=Teams (Sii)
-Comment=Microsoft Teams — Sii account
-Exec=flatpak run com.github.IsmaelMartinez.teams_for_linux --class=teams-sii --user-data-dir={{ .chezmoi.homeDir }}/.var/app/com.github.IsmaelMartinez.teams_for_linux/config/profile-sii --appIcon={{ .chezmoi.homeDir }}/.local/share/icons/hicolor/256x256/apps/teams-sii.png "--appTitle=Teams — Sii" %U
-Icon=teams-sii
-Terminal=false
-Type=Application
-Categories=Network;InstantMessaging;
-MimeType=x-scheme-handler/msteams;
-StartupWMClass=teams-sii
-StartupNotify=true
diff --git a/dot_local/share/applications/teams-xsight.desktop.tmpl b/dot_local/share/applications/teams-xsight.desktop.tmpl
deleted file mode 100644
index 0b8a5ed..0000000
--- a/dot_local/share/applications/teams-xsight.desktop.tmpl
+++ /dev/null
@@ -1,11 +0,0 @@
-[Desktop Entry]
-Name=Teams (XSight)
-Comment=Microsoft Teams — XSight account
-Exec=flatpak run com.github.IsmaelMartinez.teams_for_linux --class=teams-xsight --user-data-dir={{ .chezmoi.homeDir }}/.var/app/com.github.IsmaelMartinez.teams_for_linux/config/profile-xsight --appIcon={{ .chezmoi.homeDir }}/.local/share/icons/hicolor/256x256/apps/teams-xsight.png "--appTitle=Teams — XSight" %U
-Icon=teams-xsight
-Terminal=false
-Type=Application
-Categories=Network;InstantMessaging;
-MimeType=x-scheme-handler/msteams;
-StartupWMClass=teams-xsight
-StartupNotify=true
diff --git a/dot_local/share/icons/hicolor/256x256/apps/teams-sii.png b/dot_local/share/icons/hicolor/256x256/apps/teams-sii.png
deleted file mode 100644
index 50c454c..0000000
--- a/dot_local/share/icons/hicolor/256x256/apps/teams-sii.png
+++ /dev/null
diff --git a/dot_local/share/icons/hicolor/256x256/apps/teams-xsight.png b/dot_local/share/icons/hicolor/256x256/apps/teams-xsight.png
deleted file mode 100644
index c27233b..0000000
--- a/dot_local/share/icons/hicolor/256x256/apps/teams-xsight.png
+++ /dev/null
diff --git a/etc/systemd/resolved.conf.d/10-single-label.conf b/etc/systemd/resolved.conf.d/10-single-label.conf
deleted file mode 100644
index b2b1e9a..0000000
--- a/etc/systemd/resolved.conf.d/10-single-label.conf
+++ /dev/null
@@ -1,8 +0,0 @@
-[Resolve]
-# Forward single-label (non-FQDN) queries upstream instead of dropping
-# them to LLMNR/mDNS. Needed so corp shortnames like `sw-jenkins01`
-# (CNAME'd to `*.xsight.ent` on Pi-hole) resolve via the xsight WG bridge.
-# Trade-off: single-label queries now leak to whatever DNS the active
-# link provides — acceptable on a home/work-managed laptop, less so on
-# public wifi. See `man resolved.conf` → ResolveUnicastSingleLabel=.
-ResolveUnicastSingleLabel=yes
diff --git a/etc/systemd/system/snx-rs.service b/etc/systemd/system/snx-rs.service
deleted file mode 100644
index 6e8953c..0000000
--- a/etc/systemd/system/snx-rs.service
+++ /dev/null
@@ -1,13 +0,0 @@
-[Unit]
-Description=SNX-RS VPN client
-After=network.target network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-ExecStart=/home/sommerfeld/.nix-profile/bin/snx-rs -m command -l info
-Restart=on-failure
-RestartPreventExitStatus=1 2 255
-
-[Install]
-WantedBy=multi-user.target
diff --git a/meta/flatpak.txt b/meta/flatpak.txt
index 69b9e4c..9a4d1c3 100644
--- a/meta/flatpak.txt
+++ b/meta/flatpak.txt
@@ -18,9 +18,7 @@ org.mozilla.thunderbird
 org.pwmt.zathura
 org.signal.Signal
 org.torproject.torbrowser-launcher
-com.nomachine.nxplayer
 com.mattermost.Desktop
-com.github.IsmaelMartinez.teams_for_linux
 
 # Portuguese Citizen Card (eID) middleware + GUI. Not on Flathub; ships
 # as a standalone .flatpak bundle from upstream. Bump version by editing
diff --git a/meta/work.txt b/meta/work.txt
deleted file mode 100644
index 50a54dc..0000000
--- a/meta/work.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-dnsmasq
-edk2-ovmf
-libvirt
-qemu-desktop
-swtpm
-virt-manager
-virt-viewer
-virtiofsd
diff --git a/nix/README.md b/nix/README.md
index 123bf60..e7ce9d0 100644
--- a/nix/README.md
+++ b/nix/README.md
@@ -97,7 +97,7 @@ up). Don't add it to `common.nix`/`host.nix`/`vm.nix`.
 
 ## Commit signing and SSH auth on the VM (GPG)
 
-The VM uses its own local `gpg-agent`, like the host. Import the work
+The VM uses its own local `gpg-agent`, like the host. Import the required
 GPG private key manually on the VM; do not use SSH agent forwarding for
 commit signing or SSH auth.
 
@@ -107,9 +107,11 @@ One-time setup on the VM:
 rm -f ~/.ssh/agent.sock ~/.config/git/allowed_signers
 just fix-gpg-agent
 gpg-connect-agent 'getinfo version' /bye
-gpg --import /path/to/work-private-key.asc
-gpg --edit-key 3298945F717C85F8 trust quit
-gpg --list-secret-keys --with-keygrip 3298945F717C85F8
+gpg --import /path/to/private-key.asc
+printf 'Imported key fingerprint: '
+read -r KEY_FINGERPRINT
+gpg --edit-key "$KEY_FINGERPRINT" trust quit
+gpg --list-secret-keys --with-keygrip "$KEY_FINGERPRINT"
 ```
 
 Chezmoi deploys the repo-owned `gpg.conf`, `gpg-agent.conf`, and
@@ -132,7 +134,7 @@ git log --show-signature -1
 ## Caveats
 
 - **GPG / pass**: HM installs `gnupg` and `pass` but does _not_ import
-  any private key. On the VM, import the work key manually; repo-owned
+  any private key. On the VM, import the required key manually; repo-owned
   `gpg.conf`, `gpg-agent.conf`, and `sshcontrol` are deployed by
   chezmoi. On the host, smartcard access via `pcscd` is configured in
   `host.nix` (`~/.gnupg/scdaemon.conf`).
diff --git a/nix/host.nix b/nix/host.nix
index c44319e..f968b9b 100644
--- a/nix/host.nix
+++ b/nix/host.nix
@@ -117,9 +117,6 @@ in
     # ── File sync ───────────────────────────────────────────────────────────────
     syncthing
 
-    # ── Work VPN ──────────────────────────────────────────────────────────────
-    snx-rs
-
     # ── Bitcoin wallet ───────────────────────────────────────────────────────
     sparrow
 
diff --git a/private_dot_gnupg/sshcontrol b/private_dot_gnupg/sshcontrol
index 535db04..aa79e08 100644
--- a/private_dot_gnupg/sshcontrol
+++ b/private_dot_gnupg/sshcontrol
@@ -15,6 +15,5 @@
 5E9259E1EFFFB85520F62A5C31C97033C1DEDBD8
 515584E3A76C03EEA4A563156882938003FBEC90
 E843F385FEEAE6CA2E1B9A67796241FDA5423CA3
-07F20B2165441FFABB82E1824A027ADD357BD257
 9680C39B2AFDB203DBD32013C0B979E9A454F660
 9170EC13FE6ED1D7C5F93894A71FEECE622D7ECB
diff --git a/private_dot_ssh/config b/private_dot_ssh/config
index 1671625..0045e68 100644
--- a/private_dot_ssh/config
+++ b/private_dot_ssh/config
@@ -12,7 +12,5 @@ Match host * exec "gpg-connect-agent UPDATESTARTUPTTY /bye"
 IdentityFile ~/.ssh/nym.pub
 IdentitiesOnly yes
 
-Include work.config
-
 Host git.sommerfeld.dev
   Hostname mandibles.wg
diff --git a/run_onchange_after_deploy-flatpak-overrides.sh.tmpl b/run_onchange_after_deploy-flatpak-overrides.sh.tmpl
index 441c3ff..47f3201 100644
--- a/run_onchange_after_deploy-flatpak-overrides.sh.tmpl
+++ b/run_onchange_after_deploy-flatpak-overrides.sh.tmpl
@@ -26,8 +26,3 @@ apply io.gitlab.librewolf-community --device=all
 # offers; the host udev rule (etc/udev/rules.d/50-zsa.rules) restricts
 # which hidraw nodes the user can actually open.
 apply io.github.ungoogled_software.ungoogled_chromium --device=all
-
-# Teams-for-Linux needs read access to our chezmoi-managed hicolor icon
-# tree so the per-profile --appIcon= path resolves inside the sandbox
-# (used by teams-sii.desktop / teams-xsight.desktop).
-apply com.github.IsmaelMartinez.teams_for_linux --filesystem=xdg-data/icons:ro
diff --git a/systemd-units/system.txt b/systemd-units/system.txt
index 6a981e5..bb24e0b 100644
--- a/systemd-units/system.txt
+++ b/systemd-units/system.txt
@@ -36,8 +36,5 @@ nix-daemon.socket
 # connect, the .socket is what gets enabled) ---
 libvirtd.socket
 
-# --- work VPN (command-mode daemon; binary comes from the user's nix profile) ---
-snx-rs.service
-
 # --- file sync (system template; binary comes from the user's nix profile) ---
 syncthing@sommerfeld.service
diff --git a/systemd-units/user.txt b/systemd-units/user.txt
index b254aea..076a265 100644
--- a/systemd-units/user.txt
+++ b/systemd-units/user.txt
@@ -13,8 +13,6 @@ poweralertd.service
 signal.service
 swayidle.service
 swayrd.service
-teams-sii.service
-teams-xsight.service
 waybar.service
 wob.service