- Add autoconfig XML endpoint on autoconfig.lassul.us via nginx
- Add DNS SRV records for IMAPS and SMTP submission (RFC 6186)
- Fix vmail tmpfiles rules to use 2770 to match dovecot pre-start

mutt:
- Fix notmuch folder queries to use Maildir++ dot prefix
- INBOX opens by default via explicit notmuch spoolfile
- Unread shows all unread across all folders
- Archive (A) tags messages, hidden from INBOX on sync
- Show mailbox counts in sidebar at startup
- Set mbox_type=Maildir, auto-confirm append/create/delete

muchsync:
- Move archived messages from INBOX to archive folder before sync

Enable mail_check_stats so sidebar shows counts without opening
each mailbox first. Change archive (A) to move messages to an
archive folder on disk instead of just tagging.

notmuch indexes Maildir++ folders with the dot prefix, so queries
need folder:.to.steam not folder:to.steam. INBOX is the root
maildir, queried as folder:"".

Use tmpfiles z/Z rules to set group permissions on /var/vmail
so the virtualMail group (which lass is in) can access mail
directories for muchsync/notmuch.

Symlink ~lass/Maildir to vmail, add lass to virtualMail group,
install notmuch + muchsync for remote sync.

- notmuch: remove hardcoded mailboxes, use folder: queries instead of tags
- mutt: auto-discover sieve folders from Maildir at startup
- muchsync: connect to neoprism.lassul.us:45621 instead of green

- Remove declarative sieveScript, manage rules dynamically via ManageSieve (port 4190)
- Replace krebs.iptables with networking.firewall.allowedTCPPorts
- Add /var/sieve to borg backup paths

IMAPS, SMTP submission, sieve filtering, DKIM, full-text search.
Remove dead code internet-gateway.nix and hackerfleet exim router.
Add mail and DKIM dirs to borg backup.

Use `nix build --print-out-paths` + PYTHONPATH instead of `nix shell`
for the websocket-client bootstrap. Caches the store path in /tmp.
Goes from 30s+ to under 1s.

- Disable spurious PCIe wakeup sources via udev rule
- Add 64GB swapfile and resume config for hibernation
- Enable suspend-then-hibernate (15min s2idle, then hibernate)
- Load amdgpu in initrd for reliable resume
- Add amdgpu.gpu_recovery=1 kernel param
- Pre-evict VRAM before sleep via systemd service

- Switch flake input to github:Lassulus/opencrow/tool_n_stop
- Enable OPENCROW_SHOW_TOOL_CALLS to relay tool calls to Matrix chat
- !stop command aborts running agent turns mid-execution

Replace GTK :tooltip property with custom hover-tip widget using
eventbox onhover/onhoverlost and in-bar overlay revealer, since GTK
native tooltip popups don't work on layer-shell surfaces.

Replace FOD npm install with fetchurl tarballs + manual assembly.
npm install is non-deterministic across systems, causing hash mismatches.

fetchurl downloads exact versioned tarballs from npm registry (always
identical), then we unpack them into the node_modules structure directly.

- Add version and deps options to package schema
- Fetch tarballs with fetchurl (deterministic per version)
- Assemble node_modules tree without npm
- Strip version/deps from settings.json (only needed for nix fetching)

Replace the long list of individual mail aliases with an extraRouters
catchall that redirects all @lassul.us mail to the same destinations.
Keep only lassulus@lassul.us as an explicit alias for the ACL.

Remove aidsballs.de (domain no longer exists, DNS returns NXDOMAIN).

The ACL already accepts all local_domains, and the catchall router
picks up anything the internet_aliases router doesn't match.

extra-container uses a minimal NixOS module set for fast evaluation.
nixpkgs unstable added nixos-init.nix and systemd.nix now references
config.system.nixos-init.package, but extra-container's module set
doesn't include it.

Add a dummy nixos-init.package option to the outer container config,
matching extra-container's existing pattern for missing options.

Also fixes services.mingetty -> services.getty rename in virtulus.

The pixel8 Linux project has been extracted into its own repository.
This also fixes the nix flake check failure (pixel8 was missing
nixpkgs.hostPlatform).

- Radicale with htpasswd auth (bcrypt), proxied via nginx with ACME
- DNS CNAME for cal.lassul.us -> neoprism
- Auto-generated password stored in clan vars
- User: opencrow
- Compatible with DAVx5 (Android), Thunderbird, etc.

FlakeHub authentication is failing, causing CI to error out.
Disable it since we only need the local nix cache.

Set OPENCROW_HEARTBEAT_INTERVAL=10m. Bot uses nix run nixpkgs#notmuch
for mail indexing — no extra packages needed in the config.

All internet aliases now redirect to both lass@green.r and the
local bot user. Mail is delivered to /home/bot/Mail in Maildir
format via the local_user router.