`just update system` re-locks + rebuilds the NixOS system flake,
`just update home` re-locks + switches the Home Manager flake, and
`just update` with no arg does both (system first). Previously update
only touched the system flake, leaving the Home Manager side stale.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Thunar didn't integrate cleanly with the GNOME session. Drop the
XFCE file-manager module (thunar/xfconf/exo/tumbler) and restore
Nautilus as the native file manager: un-exclude nautilus, point the
dash favorite at org.gnome.Nautilus.desktop, remove the Thunar
desktop override, and keep gvfs (moved into gnome.nix) for mounting,
trash, and network shares. Add file-roller for archive-manager
integration in Nautilus.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Strict RPF (NixOS default) drops the encrypted return traffic of an active
exit node: table 52's 'default dev tailscale0' makes the reverse-path lookup
for packets arriving on the physical interface resolve to tailscale0, so they
are dropped before Tailscale decrypts them (rx stays 0). Loose RPF still blocks
spoofed/unroutable sources but removes the interface-match requirement, as
recommended by Tailscale/NixOS for exit nodes and subnet routers.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Eagerly calling __bp_install at source time made bash-preexec install
before starship/atuin/zoxide/ghostty modified PROMPT_COMMAND, so their
hooks landed after __bp_interactive_mode. bash-preexec then never marked
typed commands as interactive and skipped preexec_functions, so atuin's
__atuin_preexec never fired and history stopped recording
(ATUIN_PREEXEC_BACKEND stuck at "<shlvl>:none").
Remove the eager __bp_install and the manual PROMPT_COMMAND/array wiring
for starship, atuin and zoxide; each tool registers with bash-preexec
itself, and deferred install on the first prompt keeps
__bp_interactive_mode last (verified against bash-preexec 0.6.0).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
