Get beads working again

hosts/liminal/configuration.nix

@@ -282,6 +282,7 @@
       clipse
       plex-desktop
       signal-desktop
+      telegram-desktop
       flyctl
       dtach
       gromit-mpx
@@ -295,7 +296,7 @@
       socat
       #plover-flake.packages.${pkgs.stdenv.hostPlatform.system}.plover-full
       pkgs.unstable.zoom-us
-      # beads-flake.packages.${pkgs.stdenv.hostPlatform.system}.default
+      pkgs.beads
       awww.packages.${pkgs.stdenv.hostPlatform.system}.awww
       nix-index # for nix-locate
       sops

hosts/ruil/configuration.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, modulesPath, ... }:
+{ config, pkgs, modulesPath, openclaw-flake, ... }:
 
 {
   imports = [
@@ -19,6 +19,10 @@
   sops.secrets.hashedPassword-hunner.neededForUsers = true;
   sops.secrets.hashedPassword-ruil.neededForUsers = true;
   sops.secrets.hashedPassword-root.neededForUsers = true;
+  sops.secrets.openclaw-env = {
+    owner = "ruil";
+    mode = "0400";
+  };
 
   # SSH key from DO metadata, shared across all users
   users.users.root = {
@@ -41,12 +45,41 @@
   users.users.ruil = {
     uid = 1001;
     isNormalUser = true;
+    linger = true;
     hashedPasswordFile = config.sops.secrets.hashedPassword-ruil.path;
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5+cFZ52qQft4ionKvdHkNM7lmj3x7vSiG/KqGvZ9JP hunter@haugens.org"
     ];
   };
 
+  home-manager.useGlobalPkgs = true;
+  home-manager.useUserPackages = true;
+  home-manager.users.ruil = { ... }: {
+    imports = [ openclaw-flake.homeManagerModules.openclaw ];
+
+    home.stateVersion = "25.11";
+
+    # Keep credentials in ruil-owned files to avoid root-only bot access.
+    programs.openclaw = {
+      enable = true;
+      config = {
+        gateway.mode = "local";
+        channels.discord.enabled = true;
+        agents.defaults.model.primary = "zai/glm-4.7";
+      };
+    };
+
+    # openclaw onboarding can exceed Node's default old-space limit on 1 GiB hosts.
+    home.sessionVariables.NODE_OPTIONS = "--max-old-space-size=1536";
+
+    # Environment file is provisioned by sops-nix (`sops.secrets.openclaw-env`).
+    systemd.user.services.openclaw-gateway = {
+      Install.WantedBy = [ "default.target" ];
+      Service.Environment = [ "NODE_OPTIONS=--max-old-space-size=1536" ];
+      Service.EnvironmentFile = [ config.sops.secrets.openclaw-env.path ];
+    };
+  };
+
   # Packages
   environment.systemPackages = with pkgs; [
     vim
@@ -63,6 +96,26 @@
   services.openssh.settings.PasswordAuthentication = false;
   services.openssh.settings.KbdInteractiveAuthentication = false;
 
+  # Tailscale
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "client";
+    extraUpFlags = [
+      "--accept-dns"
+      "--accept-routes"
+    ];
+  };
+
+  programs.zsh.enable = true;
+
+  # Add swap on small VPS instances to avoid OOM-kill loops.
+  swapDevices = [
+    {
+      device = "/var/lib/swapfile";
+      size = 4096; # MiB
+    }
+  ];
+
   # Firewall
   networking.firewall = {
     enable = true;

hosts/ruil/secrets/config.yaml

@@ -1,6 +1,7 @@
 hashedPassword-hunner: ENC[AES256_GCM,data:fvgYWStE5XyHF1b9lntEfnml9cFbwaz5YCJRiPglDnLvWCPUY/95WsPAod/+1wYDW/LZl3tcBi9B0jF3OqiPZ8yeiu2DR85IKA==,iv:M0mu3m65L7ObZ9Mv97fvr9Z6qZk268h7AZSuW+ecrEk=,tag:pQKMKdJXToLJ188gkJMuCA==,type:str]
 hashedPassword-ruil: ENC[AES256_GCM,data:fwBU+24byBOTKljdABTvk2VxR5PGR18R3oozB/wSlORz12oQwjqAtdVBLSR2JZqA7yOWM5V//Ig60GCE4XmYc5pwVsEWqdY8JA==,iv:yuMNzQc+YfPyCFNYgNsh+xEJyLIFRUj0Er5TtYdcG18=,tag:dQpTM937EHEcEDJto4BVog==,type:str]
 hashedPassword-root: ENC[AES256_GCM,data:E/T3LBreiSZaC/qZ2QNxz3prGHoj47zS3ILsa7lmPzJDfLQ5yALxjWo4GyPHT9+kAU7uGOBG5/Ab5VqWxw+1cyk/YwT2dyMB+Q==,iv:eMav5Lnrm9SmQgHSDFiTKP6n9mADSsunlWyrSrIgA4E=,tag:fcMt6wiOClb30Vfkd9Dxmw==,type:str]
+openclaw-env: ENC[AES256_GCM,data:pJq+HdqlNjx0qeVHhPcnZk9FNm7/eMWm8vZ3ROnQ00qR4lXo3f86wL3vH9UQjVtdKSGDQj171b88nCVWqLY/h9YP2ld/1AwI7K06bzCRTjAYXzcpCfLyDEc0x3olSNTwsyKN4avI1x+9xciE36b53VVFpLNhGsRz9pT+jWx1jeVIUNbh6OGu4CGA1I2L4TaAiGEfEh29mDrAzqPLzIkyaSvay3+fun4X0SbpbE0bLnd6NnVUjff0HCgiDDDckc/O33G/k6OcLaN04hDnnCVIfGxPkRQKB02QC33mb35T5N4T,iv:DNNbwHGfQjY9Uvw4QXUz6IqtNQWZKLDD0GtvnoowxB0=,tag:+cu3ZVjo2xUg/wyIlUvD0Q==,type:str]
 sops:
     age:
         - recipient: age17sdp0gguexd88qel74fa4zeckxh93gqpkayz366fz6yvjauw7vcq7w6y45
@@ -21,7 +22,7 @@ sops:
             VHorQzNrMFJLaFpSalZZdjNraXhlSVUKwWLesTzMxsEB45hWWzhZGWc1cDm/gmvF
             MAytSLiBcieAkRKZoklyk/llbnq7kycvpZCU/sQrjKqmoHkC+TF3BQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-12T04:52:00Z"
-    mac: ENC[AES256_GCM,data:nl2ALcLsI0eQJjfZniRxeKl6XV9IMGiSJOlv7fadsaTfE+tFRDZY9WyXTsdnyGXq+wH1jb7quesPQ2cv060A1COCa5cdbxfqPDRj2AacmSQ4YhBfz+SdfJznhpWDupeMyn0LBF7ffHVOqq+dkcWVOVQR/AzBuEPIdJdzs3/ya1k=,iv:PDnfRMBjQMXbB2Upycqqp/TYCC6fPYsh6GQAt9hf4qE=,tag:8riFvSKCx3Hisdxz3HgKdA==,type:str]
+    lastmodified: "2026-02-14T08:58:11Z"
+    mac: ENC[AES256_GCM,data:7OTjKMqKjHqJUA67dafkr/Vo2Bvetla10ZSjie1ZL+UXUINEOczop9YY/tTONboZYn0Ihqe1fYapPHied/+q2a2jp9DUSMlvnUj4oDj6IigAzwlOsARPNmtk7p+gV+ROmoAudBalB/M/AI4kfj7h9o+vYfaSpcfBLPYTPVpS8GQ=,iv:sQiBQU0V4oAOxo4UdEkehLJBYhu/kmjOMM+6X/hkWIg=,tag:XYRpDeVpr2MQadKpD62nFA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0