feat: add yolo host

New NixOS VM on proxmox, replacing the Ubuntu box. Reuses the existing
Hyprland config; remote access is Sunshine/Moonlight rather than xrdp,
since xrdp cannot drive a wayland compositor.

Two fixes here are not yolo-specific and affect any fresh install:
git at system level (nix needs it for the type = "git" hyprland input,
but git only came from home-manager, so neither rebuild could run), and
dropping the yogurt input, whose private repo made home-manager
un-evaluatable without GitHub auth.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

hosts/common/features/remote-desktop.nix

@@ -0,0 +1,31 @@
+_:
+# Sunshine as a remote desktop. Same wlr-screencopy capture as
+# features/gaming/sunshine.nix, minus its NVIDIA workarounds: no cudaSupport
+# (virtio-gpu has no NVENC, so this software-encodes) and no uhid rule.
+#
+# First run: https://<host>:47990 to set web-UI credentials, then pair Moonlight.
+{
+  services.sunshine = {
+    enable = true;
+    autoStart = true;
+    openFirewall = true;
+    capSysAdmin = false; # wlr-screencopy needs no CAP_SYS_ADMIN
+
+    settings = {
+      # MUST be set. Auto-probe tries portalgrab first, and
+      # xdg-desktop-portal-hyprland implements no RemoteDesktop interface — the
+      # probe then hangs forever instead of falling back, so sunshine never
+      # binds its ports and the unit sits "active" doing nothing.
+      capture = "wlgrab";
+
+      # The web UI is only reachable over the network here — there is no local
+      # browser — and sunshine CSRF-rejects any origin but localhost unless it
+      # is listed. Both addresses: .250.1 now, .10.2 after the IP handover.
+      #
+      # Bare comma-separated, NOT a JSON array: sunshine splits this on commas
+      # and never strips brackets or quotes, so "[...]" makes every entry fail
+      # its starts_with("https://") check.
+      csrf_allowed_origins = "https://10.7.250.1:47990,https://10.7.10.2:47990";
+    };
+  };
+}

hosts/yolo/default.nix

@@ -0,0 +1,77 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../common/global
+    ../common/features/user.nix
+    ../common/features/networking.nix
+    ../common/features/display
+    ../common/features/pipewire.nix
+    ../common/features/remote-desktop.nix
+    ../common/features/docker.nix
+    ../common/features/fonts.nix
+    ../common/features/nix-ld.nix
+    ../common/features/appimage.nix
+    ../common/features/home
+  ];
+
+  networking.hostName = "yolo";
+
+  # Lets the Proxmox host drive clean shutdowns/reboots and report the guest's
+  # IP. The qemu-guest profile in hardware-configuration.nix only sets up the
+  # virtio drivers; the agent itself is a separate service.
+  services.qemuGuest.enable = true;
+
+  # Not a security downgrade: naps62 is in `docker`, which is already
+  # root-equivalent, and sshd is key-only — so the prompt guards nothing while
+  # blocking unattended rebuilds (nh shells out to sudo and needs a TTY).
+  security.sudo.wheelNeedsPassword = false;
+
+  # Nix shells out to git for the `type = "git"` flake inputs (hyprland).
+  # Without it at system level, a fresh install cannot build the home config
+  # that would have provided git — so neither rebuild works.
+  environment.systemPackages = [ pkgs.git ];
+
+  # This clone lives under ~/tea, not the ~/projects path global/nix.nix assumes.
+  programs.nh.flake = lib.mkForce "/home/naps62/tea/naps62/nixos-config";
+
+  # No physical seat: Sunshine is a user service and cannot capture until a
+  # graphical session exists, so a cold boot must reach one unattended. No
+  # hyprlock on start (unlike konishi) — nobody could type the password in.
+  services.displayManager = {
+    autoLogin = {
+      enable = true;
+      user = "naps62";
+    };
+    defaultSession = "hyprland";
+  };
+
+  # A Proxmox guest has no emulated sound card, so PipeWire starts with no sink
+  # and Sunshine has nothing to capture — the stream is silent. This sink is the
+  # only one, so it wins the default and Sunshine records its monitor.
+  services.pipewire.extraConfig.pipewire."10-null-sink" = {
+    "context.objects" = [
+      {
+        factory = "adapter";
+        args = {
+          "factory.name" = "support.null-audio-sink";
+          "node.name" = "sunshine-sink";
+          "node.description" = "Sunshine";
+          "media.class" = "Audio/Sink";
+          "audio.position" = "FL,FR";
+        };
+      }
+    ];
+  };
+
+  # Pinned to 16 to match the cluster being migrated off Ubuntu; restoring that
+  # dump into a newer default would need a pg_upgrade first.
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_16;
+  };
+}

hosts/yolo/hardware-configuration.nix

@@ -0,0 +1,52 @@
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+
+# Proxmox guest (VM 132), q35 + OVMF. Hand-written rather than generated:
+# filesystems are matched by label, set when the disk is partitioned, so this
+# stays valid if the VM is ever rebuilt from scratch.
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot = {
+    initrd.availableKernelModules = [
+      "ahci"
+      "xhci_pci"
+      "virtio_pci"
+      "virtio_scsi"
+      "sd_mod"
+      "sr_mod"
+    ];
+    # In the initrd, not kernelModules: otherwise there is no DRM device until
+    # late boot and SDDM races it.
+    initrd.kernelModules = [ "virtio_gpu" ];
+    kernelModules = [ "kvm-intel" ];
+    extraModulePackages = [ ];
+  };
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/BOOT";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ { device = "/dev/disk/by-label/swap"; } ];
+
+  networking.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}