muchsync writes tags directly to the xapian database, bypassing
notmuch's synchronize_flags. This means read/unread status from
mutt never gets reflected in Maildir filenames, so Dovecot (IMAP)
still shows messages as unread.

Add a systemd path unit that watches the notmuch xapian directory
and renames files to add/remove the S (Seen) flag based on the
notmuch unread tag.

- User systemd with linger, uvicorn --reload from bare repo worktree
- Vendor files (diff2html) fetched and symlinked at startup
- kannix-ctl wrapper script in user packages

- Add kannix flake input (local git repo)
- 2configs/kannix.nix: kannix service on port 4243, nginx at kannix.lassul.us
- Git integration enabled (repos + worktrees in /var/lib/kannix/)
- SSH keys for kannix user
- Backup updated: /var/lib/kannix instead of /var/lib/kanvibe

Disable the AWS harvester in jitsi-videobridge since it is not needed
for self-hosted setups.

Add ULA prefix fd42:7d6a::/64 on int0 with IPv6 Router Advertisement
so clients get IPv6 via SLAAC. Enable IPv6 forwarding and NAT66
masquerade for the ULA prefix. This fixes Jitsi (and other IPv6-only
services) not working from the internal network.

Uses self-contained pactl/ffmpeg commands so completions work without
record being in PATH (e.g. when completing through `s record <TAB>`).

Add virtual.All mailbox (all messages across all folders) so attachments
can be opened reliably (virtual.Unread loses messages when marked read).
Bump imapMemoryLimit to 1GB for virtual mailbox sync.
Also increase snappymail PHP/nginx timeouts.

Move virtual mailbox config from nix store (read-only) to
/var/vmail/virtual-config via systemd.tmpfiles, fixing ACL plugin
errors. Exclude notmuch and fts-flatcurve from virtual search.

Adds a deploy wrapper around `clan machines update` that:
- Syncs the password store (pull/push) around deploys
- Extracts the bulk age key into a secure tmpdir for fast decryption
- Cleans up key material on exit

Co-Authored-By: Claude (claude-opus-4-6) <noreply@anthropic.com>

Add usage.kdl (https://usage.jdx.dev/spec/) files for all 32 tools
describing their CLI interface. Each tool exposes its spec as a string
via passthru.usage (builtins.readFile ./usage.kdl).

The s wrapper now includes a zsh completion function that:
- Instantly completes package names (baked in at build time)
- Lazily fetches per-tool usage specs via nix eval on first use
- Caches specs keyed by flake narHash for invalidation

- systemd service running as dedicated kanban user on SSD (zroot)
- nginx reverse proxy at kanban.lassul.us with basic auth via clan vars
- DNS record for kanban.lassul.us
- binary-patch claude-code version for claude 4.6 support
- backup of vibe-kanban state

nixos-mailserver mkForces the virtualMail user without homeMode,
causing NixOS activation to reset /var/vmail to 0700 on every deploy.
Override at the same priority to set homeMode=2770, replacing the
chmod workaround in ExecStartPost.

SnappyMail PHP webmail served via nginx + php-fpm.
Data stored in /var/lib/snappymail.
Admin panel at mail.lassul.us/?admin after first deploy.

- Enable posixacl on zroot ZFS pool for /var/vmail
- Set POSIX ACL default granting lass rwX on mail dir (new files inherit)
- Fix /var/vmail permissions after dovecot pre-start resets to 0700
- Fix dovecot-acl-sync to skip cur/new/tmp/.notmuch subdirs
- Change recursive tmpfiles rule to non-recursive to avoid setgid on files

- Add autoconfig XML endpoint on autoconfig.lassul.us via nginx
- Add DNS SRV records for IMAPS and SMTP submission (RFC 6186)
- Fix vmail tmpfiles rules to use 2770 to match dovecot pre-start

mutt:
- Fix notmuch folder queries to use Maildir++ dot prefix
- INBOX opens by default via explicit notmuch spoolfile
- Unread shows all unread across all folders
- Archive (A) tags messages, hidden from INBOX on sync
- Show mailbox counts in sidebar at startup
- Set mbox_type=Maildir, auto-confirm append/create/delete

muchsync:
- Move archived messages from INBOX to archive folder before sync