feat(github): add auto-conventional-commit hook with opencode integration

- Add prepare-commit-msg git hook that generates conventional commit messages
- Modularize fish configuration with separate conf.d files
- Convert configuration files from .text to .source format for structured data
- Add sops-nix SOPS configuration with explicit secret definitions
- Upgrade age identity to single key file management approach
- Add system activation script for age key management
- Generate .sops.yaml for SOPS creation rules
- Restructure README.md with improved table and cleaner formatting
- Refactor config files to use pkgs.formats.json/toml generators
- Implement YAML format for ashell and walker service configurations
- Update SSH config source to use sops secrets
- Convert zed and other config files to use structured .source format

hosts/aesthetic/default.nix

@@ -143,6 +143,10 @@
     };
   };
 
+  # Workaround: aa-remove-unknown references missing rc.apparmor.functions in apparmor-parser 5.0.0
+  # Reload via restart instead (stop → start, reloads all profiles)
+  systemd.services.apparmor.reloadIfChanged = lib.mkForce false;
+
   services = {
     # for SSD/NVME
     fstrim.enable = true;
@@ -156,52 +160,48 @@
 
   # Additional systemd hardening
   systemd = {
-    coredump.extraConfig = ''
-      Storage=none
-      ProcessSizeMax=0
-    '';
-  };
-
-  environment.systemPackages = [pkgs.cryptsetup pkgs.age inputs.agenix.packages.${pkgs.stdenv.hostPlatform.system}.default];
-
-  age.identityPaths = ["/etc/ssh/ssh_host_ed25519_key"];
-
-  age.secrets = {
-    gitea_laptop = {
-      file = ../../secrets/gitea_laptop.age;
-      mode = "600";
-      owner = "someone";
-      group = "users";
-    };
-    hetzner_server = {
-      file = ../../secrets/hetzner_server.age;
-      mode = "600";
-      owner = "someone";
-      group = "users";
-    };
-    aur = {
-      file = ../../secrets/aur.age;
-      mode = "600";
-      owner = "someone";
-      group = "users";
-    };
-    ssh_config = {
-      file = ../../secrets/ssh_config.age;
-      mode = "600";
-      owner = "someone";
-      group = "users";
-    };
-    github_key = {
-      file = ../../secrets/github_key.age;
-      mode = "600";
-      owner = "someone";
-      group = "users";
-    };
-    sporestack_server = {
-      file = ../../secrets/sporestack_server.age;
-      mode = "600";
-      owner = "someone";
-      group = "users";
+    coredump.settings = {
+      Coredump.Storage = "none";
+      Coredump.ProcessSizeMax = 0;
     };
   };
+
+  boot.loader.limine.bootMode = lib.mkDefault "bios";
+
+  # sops-nix configuration
+  sops = {
+    defaultSopsFile = ./../../secrets/secrets.yaml;
+    age.keyFile = "/etc/age/keys.txt";
+    # Explicitly define secrets to ensure they're generated
+    secrets = {
+      discordo = { owner = "someone"; group = "users"; mode = "0440"; };
+      openrouter = { owner = "someone"; group = "users"; mode = "0440"; };
+      github = { owner = "someone"; group = "users"; mode = "0440"; };
+      twt = { owner = "someone"; group = "users"; mode = "0440"; };
+      gemini = { owner = "someone"; group = "users"; mode = "0440"; };
+      context7 = { owner = "someone"; group = "users"; mode = "0440"; };
+      exa = { owner = "someone"; group = "users"; mode = "0440"; };
+      ssh_config = { owner = "someone"; group = "users"; mode = "0440"; };
+      gitea_laptop = { owner = "someone"; group = "users"; mode = "0400"; };
+      hetzner_server = { owner = "someone"; group = "users"; mode = "0400"; };
+    };
+  };
+
+  environment.systemPackages = [pkgs.cryptsetup pkgs.age pkgs.nixd pkgs.apparmor-parser pkgs.xdg-desktop-portal-wlr];
+
+  # Provide age private key for sops decryption at activation time
+  systemd.tmpfiles.rules = [
+    "d /etc/age 0700 root root -"
+    "w /etc/age/keys.txt 0600 root root - # created by activation script"
+  ];
+
+  # Activation script to write age key
+  system.activationScripts.write-age-key = ''
+        cat > /etc/age/keys.txt << 'AGEEOF'
+    # created: 2026-07-12T10:20:38+02:00
+    # public key: age1n2kvnwdzrd5vw70wwmm90a4lg6wj3665egzpnz72r98epr0rhc0q3yp356
+    AGE-SECRET-KEY-1A49GYAG5AJWGW0XM7HWC8QFE6UUF0S3Z99T252SKX2JHW6NM0HDQESWAQC
+    AGEEOF
+        chmod 600 /etc/age/keys.txt
+  '';
 }