nixos-mailserver mkForces the virtualMail user without homeMode,
causing NixOS activation to reset /var/vmail to 0700 on every deploy.
Override at the same priority to set homeMode=2770, replacing the
chmod workaround in ExecStartPost.

SnappyMail PHP webmail served via nginx + php-fpm.
Data stored in /var/lib/snappymail.
Admin panel at mail.lassul.us/?admin after first deploy.

- Enable posixacl on zroot ZFS pool for /var/vmail
- Set POSIX ACL default granting lass rwX on mail dir (new files inherit)
- Fix /var/vmail permissions after dovecot pre-start resets to 0700
- Fix dovecot-acl-sync to skip cur/new/tmp/.notmuch subdirs
- Change recursive tmpfiles rule to non-recursive to avoid setgid on files

- Add autoconfig XML endpoint on autoconfig.lassul.us via nginx
- Add DNS SRV records for IMAPS and SMTP submission (RFC 6186)
- Fix vmail tmpfiles rules to use 2770 to match dovecot pre-start

mutt:
- Fix notmuch folder queries to use Maildir++ dot prefix
- INBOX opens by default via explicit notmuch spoolfile
- Unread shows all unread across all folders
- Archive (A) tags messages, hidden from INBOX on sync
- Show mailbox counts in sidebar at startup
- Set mbox_type=Maildir, auto-confirm append/create/delete

muchsync:
- Move archived messages from INBOX to archive folder before sync

Enable mail_check_stats so sidebar shows counts without opening
each mailbox first. Change archive (A) to move messages to an
archive folder on disk instead of just tagging.

notmuch indexes Maildir++ folders with the dot prefix, so queries
need folder:.to.steam not folder:to.steam. INBOX is the root
maildir, queried as folder:"".

Use tmpfiles z/Z rules to set group permissions on /var/vmail
so the virtualMail group (which lass is in) can access mail
directories for muchsync/notmuch.

Symlink ~lass/Maildir to vmail, add lass to virtualMail group,
install notmuch + muchsync for remote sync.

- notmuch: remove hardcoded mailboxes, use folder: queries instead of tags
- mutt: auto-discover sieve folders from Maildir at startup
- muchsync: connect to neoprism.lassul.us:45621 instead of green

- Remove declarative sieveScript, manage rules dynamically via ManageSieve (port 4190)
- Replace krebs.iptables with networking.firewall.allowedTCPPorts
- Add /var/sieve to borg backup paths

IMAPS, SMTP submission, sieve filtering, DKIM, full-text search.
Remove dead code internet-gateway.nix and hackerfleet exim router.
Add mail and DKIM dirs to borg backup.

Use `nix build --print-out-paths` + PYTHONPATH instead of `nix shell`
for the websocket-client bootstrap. Caches the store path in /tmp.
Goes from 30s+ to under 1s.

- Disable spurious PCIe wakeup sources via udev rule
- Add 64GB swapfile and resume config for hibernation
- Enable suspend-then-hibernate (15min s2idle, then hibernate)
- Load amdgpu in initrd for reliable resume
- Add amdgpu.gpu_recovery=1 kernel param
- Pre-evict VRAM before sleep via systemd service

- Switch flake input to github:Lassulus/opencrow/tool_n_stop
- Enable OPENCROW_SHOW_TOOL_CALLS to relay tool calls to Matrix chat
- !stop command aborts running agent turns mid-execution

Replace GTK :tooltip property with custom hover-tip widget using
eventbox onhover/onhoverlost and in-bar overlay revealer, since GTK
native tooltip popups don't work on layer-shell surfaces.

Replace FOD npm install with fetchurl tarballs + manual assembly.
npm install is non-deterministic across systems, causing hash mismatches.

fetchurl downloads exact versioned tarballs from npm registry (always
identical), then we unpack them into the node_modules structure directly.

- Add version and deps options to package schema
- Fetch tarballs with fetchurl (deterministic per version)
- Assemble node_modules tree without npm
- Strip version/deps from settings.json (only needed for nix fetching)