From f3020c0acd7585f3a2aca9a956dba757d73c5c58 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Thu, 12 Mar 2026 17:34:54 +0200
Subject: [PATCH 01/28] Set core rules for Claude Code behavior

---
 .claude/CLAUDE.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index d49e6d9..78f9a62 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -1,5 +1,14 @@
 # Project Instructions
 
+## Core Rules
+
+- When asked to do ONE thing, do exactly that. Do not proactively migrate dependencies, refactor adjacent code, or expand scope. You may suggest further edits, but wait for confirmation before any scope expansion.
+- Prefer the simplest, most localized solution. Changes should target the most-relevant section of code — for example, catch errors in the scope that best handles them rather than injecting data up or down the stack. Take time to think about the best approach rather than quickly jumping to an implementation.
+
+## Tool Usage Preferences
+
+- For simple factual lookups (package versions, release dates), use targeted, purpose-built commands and local CLI tools first before attempting web searches — e.g. `pip index versions <pkg>` for Python, `npm view <pkg> versions` for Node. Prefer fast local approaches over web research.
+
 ## Container Environment (Podman)
 
 This environment runs inside a container with access to a Podman socket shared from the host. There is no `docker` or `podman` CLI available, but you can interact with containers via the Docker-compatible API.

From 48d960878d582db1fdd8915ffcf8cff19475f0d8 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Fri, 27 Mar 2026 15:20:31 +0300
Subject: [PATCH 02/28] Correctly update executable links

---
 .local/share/github-versions/fstar | 2 +-
 .local/share/github-versions/tlapm | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.local/share/github-versions/fstar b/.local/share/github-versions/fstar
index 26499f3..b56a055 100755
--- a/.local/share/github-versions/fstar
+++ b/.local/share/github-versions/fstar
@@ -20,7 +20,7 @@ install_fstar() {
         rm --force --recursive "${INSTALL_DIR}" && \
         mv "${tempdir}"/fstar "$(dirname "${INSTALL_DIR}")" && \
         rm --force --recursive "${tempdir}" && \
-        ln --symbolic "${INSTALL_DIR}"/bin/fstar.exe "$(systemd-path user-binaries)"/fstar.exe
+        ln --force --symbolic "${INSTALL_DIR}"/bin/fstar.exe "$(systemd-path user-binaries)"/fstar.exe
 }
 
 github_update "${package}" "${repo}" fstar_resource install_fstar
diff --git a/.local/share/github-versions/tlapm b/.local/share/github-versions/tlapm
index 2da3899..34e5227 100755
--- a/.local/share/github-versions/tlapm
+++ b/.local/share/github-versions/tlapm
@@ -19,7 +19,7 @@ install_tlapm() {
         rm --force --recursive "${INSTALL_DIR}" && \
         mv "${tempdir}"/tlapm "$(dirname "${INSTALL_DIR}")" && \
         rm --force --recursive "${tempdir}" && \
-        ln --symbolic "${INSTALL_DIR}"/bin/tlapm "$(systemd-path user-binaries)"/tlapm
+        ln --force --symbolic "${INSTALL_DIR}"/bin/tlapm "$(systemd-path user-binaries)"/tlapm
 }
 
 github_update "${package}" "${repo}" tlapm_resource install_tlapm 1.6.0-pre

From aa1b9433db8d01ecc7c2757da276c4227ca7cc65 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Mon, 6 Apr 2026 21:41:34 +0300
Subject: [PATCH 03/28] Provide installation suggestions for missing utilities

---
 .config/setup/04-install-deb-packages.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.config/setup/04-install-deb-packages.sh b/.config/setup/04-install-deb-packages.sh
index b742e59..5e7c900 100755
--- a/.config/setup/04-install-deb-packages.sh
+++ b/.config/setup/04-install-deb-packages.sh
@@ -15,6 +15,7 @@ DEB_PKGS=(
     borgbackup
     build-essential
     catatonit
+    command-not-found
     curl
     default-jdk
     direnv

From 0e1586e6f28469eb356d1c4c29b89b3ce546a3bc Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Mon, 6 Apr 2026 22:44:08 +0300
Subject: [PATCH 04/28] Install a CLI tool for Hetzner Cloud

---
 .config/setup/04-install-deb-packages.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.config/setup/04-install-deb-packages.sh b/.config/setup/04-install-deb-packages.sh
index 5e7c900..6ee1d44 100755
--- a/.config/setup/04-install-deb-packages.sh
+++ b/.config/setup/04-install-deb-packages.sh
@@ -35,6 +35,7 @@ DEB_PKGS=(
     graphviz
     grim
     guile-3.0
+    hcloud-cli
     htop
     imagemagick
     inkscape

From 505e36e868bf64d928307935aee16d8129c2921e Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Tue, 7 Apr 2026 20:39:39 +0300
Subject: [PATCH 05/28] DRY the sync backup script

---
 .local/bin/sync-backup | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.local/bin/sync-backup b/.local/bin/sync-backup
index 97edd7a..cf72348 100755
--- a/.local/bin/sync-backup
+++ b/.local/bin/sync-backup
@@ -6,7 +6,9 @@ IFS=$'\n\t'
 export BORG_REPO="/media/backup/"
 
 if [ "$1" = "service" ]; then
-    rclone sync "${BORG_REPO}" gdrive-backup:hot-repo/
+    extra_args=()
 else
-    rclone sync --progress "${BORG_REPO}" gdrive-backup:hot-repo/
+    extra_args=(--progress)
 fi
+
+rclone sync "${extra_args[@]}" "${BORG_REPO}" gdrive-backup:hot-repo/

From a878cf7683b6b7cba0a9bd98c190c7696127e220 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Tue, 7 Apr 2026 20:42:20 +0300
Subject: [PATCH 06/28] Update the script to work in strict mode

---
 .local/bin/sync-backup | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.local/bin/sync-backup b/.local/bin/sync-backup
index cf72348..4cafc26 100755
--- a/.local/bin/sync-backup
+++ b/.local/bin/sync-backup
@@ -5,7 +5,7 @@ IFS=$'\n\t'
 
 export BORG_REPO="/media/backup/"
 
-if [ "$1" = "service" ]; then
+if [ "${1:-}" = "service" ]; then
     extra_args=()
 else
     extra_args=(--progress)

From 93baa452d5b840375b248406a6b6f815c6fb7f7d Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Tue, 7 Apr 2026 20:40:08 +0300
Subject: [PATCH 07/28] Back up the password databases

---
 .local/bin/sync-backup | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.local/bin/sync-backup b/.local/bin/sync-backup
index 4cafc26..dc3c432 100755
--- a/.local/bin/sync-backup
+++ b/.local/bin/sync-backup
@@ -12,3 +12,4 @@ else
 fi
 
 rclone sync "${extra_args[@]}" "${BORG_REPO}" gdrive-backup:hot-repo/
+rclone copy "${extra_args[@]}" ~/.keys/ --include '*.kdbx' gdrive-backup:keys/

From d6b105d2ec8f5146e583775d27f062497c57fe57 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Fri, 10 Apr 2026 18:54:53 +0300
Subject: [PATCH 08/28] Sort keybindings

---
 .config/emacs/init.el | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.config/emacs/init.el b/.config/emacs/init.el
index 3da0d64..c8748eb 100644
--- a/.config/emacs/init.el
+++ b/.config/emacs/init.el
@@ -30,10 +30,14 @@
 
 (use-package emacs
   :ensure nil
-  :bind (("C-z" . nil)
-         ("C-z i" . find-init-file)
+  :bind (
+         ("C-z" . nil)
+         ;; keep-sorted start
          ("C-z f" . ffap)
-         ("C-z u" . insert-uuid4-at-point))
+         ("C-z i" . find-init-file)
+         ("C-z u" . insert-uuid4-at-point)
+         ;; keep-sorted end
+         )
   :hook (
          ;; keep-sorted start
          (after-save . executable-make-buffer-file-executable-if-script-p)

From 6b27d7e5e285bd14a2e688952bc900868731044c Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Fri, 10 Apr 2026 18:54:15 +0300
Subject: [PATCH 09/28] Use hardened defaults for SSH connections

---
 .ssh/config                             |  1 +
 .ssh/config.d/90-hardened-security.conf | 14 ++++++++++++++
 2 files changed, 15 insertions(+)
 create mode 100644 .ssh/config
 create mode 100644 .ssh/config.d/90-hardened-security.conf

diff --git a/.ssh/config b/.ssh/config
new file mode 100644
index 0000000..51ec533
--- /dev/null
+++ b/.ssh/config
@@ -0,0 +1 @@
+Include ~/.ssh/config.d/*.conf
diff --git a/.ssh/config.d/90-hardened-security.conf b/.ssh/config.d/90-hardened-security.conf
new file mode 100644
index 0000000..47856a4
--- /dev/null
+++ b/.ssh/config.d/90-hardened-security.conf
@@ -0,0 +1,14 @@
+# SSH client algorithm hardening.
+#
+# Require PQ-hybrid KEX, AEAD ciphers, Ed25519 keys.
+# Applied to all outgoing SSH connections from this machine.
+#
+# Requires OpenSSH 9.9+ for mlkem768x25519-sha256.
+
+Host *
+    KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512@openssh.com
+    Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
+    MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
+    HostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com
+    PubkeyAcceptedAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com
+    RekeyLimit 1G 1h

From 34d62d92b2d96ac9db5b9464b2aff5476d16c6d9 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Sat, 11 Apr 2026 00:00:50 +0300
Subject: [PATCH 10/28] Short-circuit installation commands on failure

---
 .local/share/github-versions/dolt          | 4 ++--
 .local/share/github-versions/kingfisher    | 4 ++--
 .local/share/github-versions/minikube      | 8 ++++----
 .local/share/github-versions/rust-analyzer | 8 ++++----
 .local/share/github-versions/uv            | 8 ++++----
 5 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/.local/share/github-versions/dolt b/.local/share/github-versions/dolt
index 24eab50..9254013 100755
--- a/.local/share/github-versions/dolt
+++ b/.local/share/github-versions/dolt
@@ -11,8 +11,8 @@ dolt_resource() {
 }
 
 install_dolt() {
-    tar xz --directory="$(systemd-path user-binaries)" --strip-components=2 dolt-linux-amd64/bin/dolt
-    chmod 550 "$(systemd-path user-binaries)"/dolt
+    tar xz --directory="$(systemd-path user-binaries)" --strip-components=2 dolt-linux-amd64/bin/dolt && \
+        chmod 550 "$(systemd-path user-binaries)"/dolt
 }
 
 github_update "${package}" "${repo}" dolt_resource install_dolt
diff --git a/.local/share/github-versions/kingfisher b/.local/share/github-versions/kingfisher
index 10c7f17..f6903dc 100755
--- a/.local/share/github-versions/kingfisher
+++ b/.local/share/github-versions/kingfisher
@@ -11,8 +11,8 @@ kingfisher_resource() {
 }
 
 install_kingfisher() {
-    tar xz --directory="$(systemd-path user-binaries)" kingfisher
-    chmod 550 "$(systemd-path user-binaries)"/kingfisher
+    tar xz --directory="$(systemd-path user-binaries)" kingfisher && \
+        chmod 550 "$(systemd-path user-binaries)"/kingfisher
 }
 
 github_update "${package}" "${repo}" kingfisher_resource install_kingfisher
diff --git a/.local/share/github-versions/minikube b/.local/share/github-versions/minikube
index 004f74c..8012485 100755
--- a/.local/share/github-versions/minikube
+++ b/.local/share/github-versions/minikube
@@ -11,10 +11,10 @@ minikube_resource() {
 }
 
 install_minikube() {
-    tempfile="$(mktemp)"
-    cat - > "${tempfile}"
-    chmod 550 "${tempfile}"
-    mv "${tempfile}" "$(systemd-path user-binaries)"/minikube
+    tempfile="$(mktemp)" && \
+        cat - > "${tempfile}" && \
+        chmod 550 "${tempfile}" && \
+        mv "${tempfile}" "$(systemd-path user-binaries)"/minikube
 }
 
 github_update "${package}" "${repo}" minikube_resource install_minikube
diff --git a/.local/share/github-versions/rust-analyzer b/.local/share/github-versions/rust-analyzer
index 1add828..bd41614 100755
--- a/.local/share/github-versions/rust-analyzer
+++ b/.local/share/github-versions/rust-analyzer
@@ -11,10 +11,10 @@ rust_analyzer_resource() {
 }
 
 install_rust_analyzer() {
-    tempfile="$(mktemp)"
-    gunzip --to-stdout - > "${tempfile}"
-    chmod 550 "${tempfile}"
-    mv "${tempfile}" "$(systemd-path user-binaries)"/rust-analyzer
+    tempfile="$(mktemp)" && \
+        gunzip --to-stdout - > "${tempfile}" && \
+        chmod 550 "${tempfile}" && \
+        mv "${tempfile}" "$(systemd-path user-binaries)"/rust-analyzer
 }
 
 github_update "${package}" "${repo}" rust_analyzer_resource install_rust_analyzer
diff --git a/.local/share/github-versions/uv b/.local/share/github-versions/uv
index b0c0ad9..389c20d 100755
--- a/.local/share/github-versions/uv
+++ b/.local/share/github-versions/uv
@@ -11,10 +11,10 @@ uv_resource() {
 }
 
 install_uv() {
-    tempdir="$(mktemp --directory)"
-    tar xz --directory="${tempdir}" --strip-components=1 && \
-    chmod 550 "${tempdir}"/uv "${tempdir}"/uvx && \
-    mv --force "${tempdir}"/uv "${tempdir}"/uvx "$(systemd-path user-binaries)"
+    tempdir="$(mktemp --directory)" && \
+        tar xz --directory="${tempdir}" --strip-components=1 && \
+        chmod 550 "${tempdir}"/uv "${tempdir}"/uvx && \
+        mv --force "${tempdir}"/uv "${tempdir}"/uvx "$(systemd-path user-binaries)"
 }
 
 github_update "${package}" "${repo}" uv_resource install_uv

From 6ca9d889957302276790a34371e3a12c0606aa82 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Fri, 10 Apr 2026 23:57:19 +0300
Subject: [PATCH 11/28] Install SimpleX Chat from the GitHub repository

---
 .local/share/github-versions/simplex-chat | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100755 .local/share/github-versions/simplex-chat

diff --git a/.local/share/github-versions/simplex-chat b/.local/share/github-versions/simplex-chat
new file mode 100755
index 0000000..82e7977
--- /dev/null
+++ b/.local/share/github-versions/simplex-chat
@@ -0,0 +1,20 @@
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
+
+package=simplex-chat
+repo=simplex-chat/simplex-chat
+
+sc_resource() {
+    echo "simplex-chat-ubuntu-24_04-x86_64"
+}
+
+install_sc() {
+    tempfile="$(mktemp)" && \
+        cat - > "${tempfile}" && \
+        chmod 550 "${tempfile}" && \
+        mv "${tempfile}" "$(systemd-path user-binaries)"/simplex-chat
+}
+
+github_update "${package}" "${repo}" sc_resource install_sc

From e4b0e731d68b5e6d50ed21301523d415a728d2fd Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Thu, 9 Apr 2026 21:56:06 +0300
Subject: [PATCH 12/28] Restrict service container privileges

---
 .config/containers/systemd/ollama.container   | 2 ++
 .config/containers/systemd/plantuml.container | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/.config/containers/systemd/ollama.container b/.config/containers/systemd/ollama.container
index 98929ac..051de23 100644
--- a/.config/containers/systemd/ollama.container
+++ b/.config/containers/systemd/ollama.container
@@ -5,9 +5,11 @@ Description=A local LLM server
 # keep-sorted start
 AutoUpdate=registry
 ContainerName=ollama
+DropCapability=ALL
 Environment=OLLAMA_KEEP_ALIVE=10m
 Image=docker.io/ollama/ollama:latest
 Network=ollama.network
+NoNewPrivileges=true
 PodmanArgs=--transient-store
 PublishPort=11434:11434
 ReadOnly=true
diff --git a/.config/containers/systemd/plantuml.container b/.config/containers/systemd/plantuml.container
index aa8057d..0648c34 100644
--- a/.config/containers/systemd/plantuml.container
+++ b/.config/containers/systemd/plantuml.container
@@ -5,8 +5,10 @@ Description=A local PlantUML server
 # keep-sorted start
 AutoUpdate=registry
 ContainerName=plantuml
+DropCapability=ALL
 Image=docker.io/plantuml/plantuml-server:jetty
 Network=private
+NoNewPrivileges=true
 PodmanArgs=--transient-store
 PublishPort=8080:8080
 ReadOnly=true

From 8f927221b46ffdbb08d52bb95d4bae952954c7d0 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Thu, 9 Apr 2026 21:58:53 +0300
Subject: [PATCH 13/28] Only expose access ports on the localhost network

---
 .config/containers/systemd/ollama.container       | 2 +-
 .config/containers/systemd/plantuml.container     | 2 +-
 .config/containers/systemd/transmission.container | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.config/containers/systemd/ollama.container b/.config/containers/systemd/ollama.container
index 051de23..a3a4402 100644
--- a/.config/containers/systemd/ollama.container
+++ b/.config/containers/systemd/ollama.container
@@ -11,7 +11,7 @@ Image=docker.io/ollama/ollama:latest
 Network=ollama.network
 NoNewPrivileges=true
 PodmanArgs=--transient-store
-PublishPort=11434:11434
+PublishPort=127.0.0.1:11434:11434
 ReadOnly=true
 Volume=%h/.local/share/ollama:/root/.ollama:ro,z
 # keep-sorted end
diff --git a/.config/containers/systemd/plantuml.container b/.config/containers/systemd/plantuml.container
index 0648c34..7a1b266 100644
--- a/.config/containers/systemd/plantuml.container
+++ b/.config/containers/systemd/plantuml.container
@@ -10,7 +10,7 @@ Image=docker.io/plantuml/plantuml-server:jetty
 Network=private
 NoNewPrivileges=true
 PodmanArgs=--transient-store
-PublishPort=8080:8080
+PublishPort=127.0.0.1:8080:8080
 ReadOnly=true
 # keep-sorted end
 
diff --git a/.config/containers/systemd/transmission.container b/.config/containers/systemd/transmission.container
index 6d83357..210cd62 100644
--- a/.config/containers/systemd/transmission.container
+++ b/.config/containers/systemd/transmission.container
@@ -10,9 +10,9 @@ Environment=PUID=1000
 Image=lscr.io/linuxserver/transmission:latest
 Network=private
 PodmanArgs=--transient-store
+PublishPort=127.0.0.1:9091:9091
 PublishPort=51413:51413
 PublishPort=51413:51413/udp
-PublishPort=9091:9091
 ReadOnly=true
 UserNS=keep-id
 Volume=%h/.config/transmission:/config:Z

From 203e6656dac74e01afb204284d00250640b4e8cd Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Thu, 9 Apr 2026 21:59:52 +0300
Subject: [PATCH 14/28] Check for image updates on startup

---
 .config/containers/systemd/ollama.container       | 2 +-
 .config/containers/systemd/plantuml.container     | 2 +-
 .config/containers/systemd/transmission.container | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.config/containers/systemd/ollama.container b/.config/containers/systemd/ollama.container
index a3a4402..b44121d 100644
--- a/.config/containers/systemd/ollama.container
+++ b/.config/containers/systemd/ollama.container
@@ -10,7 +10,7 @@ Environment=OLLAMA_KEEP_ALIVE=10m
 Image=docker.io/ollama/ollama:latest
 Network=ollama.network
 NoNewPrivileges=true
-PodmanArgs=--transient-store
+PodmanArgs=--pull=newer --transient-store
 PublishPort=127.0.0.1:11434:11434
 ReadOnly=true
 Volume=%h/.local/share/ollama:/root/.ollama:ro,z
diff --git a/.config/containers/systemd/plantuml.container b/.config/containers/systemd/plantuml.container
index 7a1b266..47e0f49 100644
--- a/.config/containers/systemd/plantuml.container
+++ b/.config/containers/systemd/plantuml.container
@@ -9,7 +9,7 @@ DropCapability=ALL
 Image=docker.io/plantuml/plantuml-server:jetty
 Network=private
 NoNewPrivileges=true
-PodmanArgs=--transient-store
+PodmanArgs=--pull=newer --transient-store
 PublishPort=127.0.0.1:8080:8080
 ReadOnly=true
 # keep-sorted end
diff --git a/.config/containers/systemd/transmission.container b/.config/containers/systemd/transmission.container
index 210cd62..1f2ec07 100644
--- a/.config/containers/systemd/transmission.container
+++ b/.config/containers/systemd/transmission.container
@@ -9,7 +9,7 @@ Environment=PGID=1000
 Environment=PUID=1000
 Image=lscr.io/linuxserver/transmission:latest
 Network=private
-PodmanArgs=--transient-store
+PodmanArgs=--pull=newer --transient-store
 PublishPort=127.0.0.1:9091:9091
 PublishPort=51413:51413
 PublishPort=51413:51413/udp

From c852857583708ce5b598958778a0800d143bf8e5 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Thu, 9 Apr 2026 22:02:30 +0300
Subject: [PATCH 15/28] Support health checks for the services

---
 .config/containers/systemd/ollama.container       | 3 +++
 .config/containers/systemd/transmission.container | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/.config/containers/systemd/ollama.container b/.config/containers/systemd/ollama.container
index b44121d..d47f626 100644
--- a/.config/containers/systemd/ollama.container
+++ b/.config/containers/systemd/ollama.container
@@ -7,6 +7,9 @@ AutoUpdate=registry
 ContainerName=ollama
 DropCapability=ALL
 Environment=OLLAMA_KEEP_ALIVE=10m
+HealthCmd=ollama list
+# HealthInterval=30s
+# HealthStartPeriod=15s
 Image=docker.io/ollama/ollama:latest
 Network=ollama.network
 NoNewPrivileges=true
diff --git a/.config/containers/systemd/transmission.container b/.config/containers/systemd/transmission.container
index 1f2ec07..01f0446 100644
--- a/.config/containers/systemd/transmission.container
+++ b/.config/containers/systemd/transmission.container
@@ -7,6 +7,9 @@ AutoUpdate=registry
 ContainerName=transmission
 Environment=PGID=1000
 Environment=PUID=1000
+HealthCmd=curl --fail --silent http://localhost:9091/
+# HealthInterval=30s
+# HealthStartPeriod=30s
 Image=lscr.io/linuxserver/transmission:latest
 Network=private
 PodmanArgs=--pull=newer --transient-store

From c18017eef43232994e07357790bfdb3c507408b5 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Thu, 9 Apr 2026 23:17:56 +0300
Subject: [PATCH 16/28] Create periodic healthcheck units for the transient
 store

---
 .config/setup/14-install-cron-jobs.sh            |  2 ++
 .config/systemd/user/podman-healthcheck@.service |  6 ++++++
 .config/systemd/user/podman-healthcheck@.timer   | 11 +++++++++++
 3 files changed, 19 insertions(+)
 create mode 100644 .config/systemd/user/podman-healthcheck@.service
 create mode 100644 .config/systemd/user/podman-healthcheck@.timer

diff --git a/.config/setup/14-install-cron-jobs.sh b/.config/setup/14-install-cron-jobs.sh
index 22851b8..df7b93d 100755
--- a/.config/setup/14-install-cron-jobs.sh
+++ b/.config/setup/14-install-cron-jobs.sh
@@ -5,6 +5,8 @@ IFS=$'\n\t'
 
 # keep-sorted start
 systemctl --user enable --now backup.timer
+systemctl --user enable --now podman-healthcheck@ollama.timer
+systemctl --user enable --now podman-healthcheck@transmission.timer
 systemctl --user enable --now sync-backup.timer
 systemctl --user enable --now sync-git-repos.timer
 # keep-sorted end
diff --git a/.config/systemd/user/podman-healthcheck@.service b/.config/systemd/user/podman-healthcheck@.service
new file mode 100644
index 0000000..b521d85
--- /dev/null
+++ b/.config/systemd/user/podman-healthcheck@.service
@@ -0,0 +1,6 @@
+[Unit]
+Description=Podman health check for %i
+
+[Service]
+Type=oneshot
+ExecStart=podman --transient-store healthcheck run %i
diff --git a/.config/systemd/user/podman-healthcheck@.timer b/.config/systemd/user/podman-healthcheck@.timer
new file mode 100644
index 0000000..255104d
--- /dev/null
+++ b/.config/systemd/user/podman-healthcheck@.timer
@@ -0,0 +1,11 @@
+[Unit]
+Description=Podman health check timer for %i
+BindsTo=%i.service
+After=%i.service
+
+[Timer]
+OnActiveSec=30s
+OnUnitActiveSec=30s
+
+[Install]
+WantedBy=%i.service

From b4838af164e7dcec144d05bc7dc7892fd208c369 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Sun, 12 Apr 2026 22:45:39 +0300
Subject: [PATCH 17/28] Use a widely-available terminal config in SSH remotes

---
 .ssh/config.d/90-terminal-emulator.conf | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 .ssh/config.d/90-terminal-emulator.conf

diff --git a/.ssh/config.d/90-terminal-emulator.conf b/.ssh/config.d/90-terminal-emulator.conf
new file mode 100644
index 0000000..a11d57f
--- /dev/null
+++ b/.ssh/config.d/90-terminal-emulator.conf
@@ -0,0 +1,2 @@
+Host *
+     SetEnv TERM=xterm-256color

From 664c187bcfa1f4aaa79c000b1ff4b39e618f7a50 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Mon, 13 Apr 2026 08:13:06 +0300
Subject: [PATCH 18/28] Ignore local Claude Code files globally

---
 .gitconfig        | 2 ++
 .gitignore_global | 3 +++
 2 files changed, 5 insertions(+)
 create mode 100644 .gitignore_global

diff --git a/.gitconfig b/.gitconfig
index d269033..92ad45b 100644
--- a/.gitconfig
+++ b/.gitconfig
@@ -20,3 +20,5 @@
         # keep-sorted end
 [include]
         path = .hostgitconfig
+[core]
+	excludesfile = ~/.gitignore_global
diff --git a/.gitignore_global b/.gitignore_global
new file mode 100644
index 0000000..1a88ff4
--- /dev/null
+++ b/.gitignore_global
@@ -0,0 +1,3 @@
+/conversation-id.txt
+/conversation-id-*.txt
+/.claude/settings.local.json

From b81057e26a33c24c911ec89993e5c2c04a85b90f Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Thu, 9 Apr 2026 22:02:10 +0300
Subject: [PATCH 19/28] Restrict service resource usage

---
 .config/containers/systemd/plantuml.container     | 4 ++++
 .config/containers/systemd/transmission.container | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/.config/containers/systemd/plantuml.container b/.config/containers/systemd/plantuml.container
index 47e0f49..b4fa46a 100644
--- a/.config/containers/systemd/plantuml.container
+++ b/.config/containers/systemd/plantuml.container
@@ -18,4 +18,8 @@ ReadOnly=true
 WantedBy=default.target
 
 [Service]
+# keep-sorted start
+CPUQuota=100%
+MemoryMax=1G
 Restart=always
+# keep-sorted end
diff --git a/.config/containers/systemd/transmission.container b/.config/containers/systemd/transmission.container
index 01f0446..91349ac 100644
--- a/.config/containers/systemd/transmission.container
+++ b/.config/containers/systemd/transmission.container
@@ -28,10 +28,12 @@ WantedBy=default.target
 
 [Service]
 # keep-sorted start
+CPUQuota=200%
 ExecStartPre=mkdir --parents %h/.config/transmission
 ExecStartPre=mkdir --parents %h/Downloads/transmission
 ExecStartPre=mkdir --parents %h/Downloads/transmission/complete
 ExecStartPre=mkdir --parents %h/Downloads/transmission/incomplete
 ExecStartPre=mkdir --parents %h/Downloads/transmission/watch
+MemoryMax=512M
 Restart=always
 # keep-sorted end

From 2084a52b087fe4439f408537a808b8690a44020c Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Fri, 10 Apr 2026 00:25:09 +0300
Subject: [PATCH 20/28] Mirror resource limits in podman as well

---
 .config/containers/systemd/plantuml.container     | 2 +-
 .config/containers/systemd/transmission.container | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.config/containers/systemd/plantuml.container b/.config/containers/systemd/plantuml.container
index b4fa46a..8fa35df 100644
--- a/.config/containers/systemd/plantuml.container
+++ b/.config/containers/systemd/plantuml.container
@@ -9,7 +9,7 @@ DropCapability=ALL
 Image=docker.io/plantuml/plantuml-server:jetty
 Network=private
 NoNewPrivileges=true
-PodmanArgs=--pull=newer --transient-store
+PodmanArgs=--cpus 1 --memory 1g --pull=newer --transient-store
 PublishPort=127.0.0.1:8080:8080
 ReadOnly=true
 # keep-sorted end
diff --git a/.config/containers/systemd/transmission.container b/.config/containers/systemd/transmission.container
index 91349ac..daeee81 100644
--- a/.config/containers/systemd/transmission.container
+++ b/.config/containers/systemd/transmission.container
@@ -12,7 +12,7 @@ HealthCmd=curl --fail --silent http://localhost:9091/
 # HealthStartPeriod=30s
 Image=lscr.io/linuxserver/transmission:latest
 Network=private
-PodmanArgs=--pull=newer --transient-store
+PodmanArgs=--cpus 2 --memory 512m --pull=newer --transient-store
 PublishPort=127.0.0.1:9091:9091
 PublishPort=51413:51413
 PublishPort=51413:51413/udp

From 96090cb604fc8adc7f604b422b61e3a21338a0a0 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Thu, 16 Apr 2026 03:47:59 +0300
Subject: [PATCH 21/28] Increase the cache TTL for loaded models

---
 .config/containers/systemd/ollama.container | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.config/containers/systemd/ollama.container b/.config/containers/systemd/ollama.container
index d47f626..500baad 100644
--- a/.config/containers/systemd/ollama.container
+++ b/.config/containers/systemd/ollama.container
@@ -6,7 +6,7 @@ Description=A local LLM server
 AutoUpdate=registry
 ContainerName=ollama
 DropCapability=ALL
-Environment=OLLAMA_KEEP_ALIVE=10m
+Environment=OLLAMA_KEEP_ALIVE=30m
 HealthCmd=ollama list
 # HealthInterval=30s
 # HealthStartPeriod=15s

From 3340b9196bbb1e7f4bb12a9bd4b468579171455b Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Sat, 18 Apr 2026 11:43:13 +0300
Subject: [PATCH 22/28] Add Gemma 4 to the model library

---
 .config/emacs/site-lisp/local-models.el | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.config/emacs/site-lisp/local-models.el b/.config/emacs/site-lisp/local-models.el
index ac695eb..bc9402d 100644
--- a/.config/emacs/site-lisp/local-models.el
+++ b/.config/emacs/site-lisp/local-models.el
@@ -11,6 +11,14 @@
      :context-window 128
      :cutoff-date "2024-08"
      )
+    (
+     gemma4:latest
+     :description "A model from Google built on Gemini technology"
+     :capabilities (media tool-use cache)
+     :mime-types ("image/bmp" "image/gif" "image/jpeg" "image/png" "image/tiff" "image/webp")
+     :context-window 128
+     :cutoff-date "2025-01"
+     )
     (
      hf.co/Orenguteng/Llama-3.1-8B-Lexi-Uncensored-V2-GGUF:latest
      :description "Uncensored model based on Llama-3.1-8b-Instruct"

From bbff7a68d350c48dfa279a7e7687eeb15c79568c Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Sat, 18 Apr 2026 11:51:36 +0300
Subject: [PATCH 23/28] Elaborate on outlier cases in the testing instructions

---
 .claude/CLAUDE.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 78f9a62..cbfe821 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -55,6 +55,14 @@ Why this matters:
 
 When adding or modifying code, verify that tests cover the new logic. If coverage drops, add tests before merging.
 
+### Coverage Exclusions and Test Quality
+
+**Pure I/O code is excluded from coverage requirements.** Code whose sole purpose is performing I/O (reading files, making network calls, rendering output) cannot be effectively tested without manual interaction. However, this has a direct design implication: keep the I/O layer as thin and trivial as possible. All business logic, validation, transformation, and decision-making must live in testable modules that the I/O layer merely calls into. A fat I/O layer is a design smell, not an excuse for missing tests.
+
+**When business logic is tightly coupled to real I/O**, and separating them would genuinely undermine testability (not just convenience), prefer integration tests against an emulated service dedicated for testing. The emulated service must have reliable compatibility with the real target. For example, S3-dependent code can use MinIO via testcontainers or similar tooling to run tests that genuinely need I/O access. This approach is preferable to either mocking away the I/O (which hides real failure modes) or leaving the logic untested.
+
+**Tests must exercise actual code paths, not reproduce them.** In rare cases, code is so trivial that the only apparent way to test it is to restate it in the test. Such tests verify nothing — they pass by construction and remain passing even when the code changes, which demonstrates that they provide no actual validation. Do not write these. Instead, explicitly exclude the code from coverage. Note that this situation is rare and usually signals a design gap (logic that should be extracted or combined with something more substantive) rather than inherent untestability.
+
 ## CLI Style
 
 **Prefer long option names over short ones** in command-line applications and examples.

From 7b5628b37b5457fe61fe65a47ede32032f915516 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Sat, 18 Apr 2026 11:52:23 +0300
Subject: [PATCH 24/28] Clarify the role of integration testing for code that
 requires I/O

---
 .claude/CLAUDE.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index cbfe821..ef8f482 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -59,7 +59,11 @@ When adding or modifying code, verify that tests cover the new logic. If coverag
 
 **Pure I/O code is excluded from coverage requirements.** Code whose sole purpose is performing I/O (reading files, making network calls, rendering output) cannot be effectively tested without manual interaction. However, this has a direct design implication: keep the I/O layer as thin and trivial as possible. All business logic, validation, transformation, and decision-making must live in testable modules that the I/O layer merely calls into. A fat I/O layer is a design smell, not an excuse for missing tests.
 
-**When business logic is tightly coupled to real I/O**, and separating them would genuinely undermine testability (not just convenience), prefer integration tests against an emulated service dedicated for testing. The emulated service must have reliable compatibility with the real target. For example, S3-dependent code can use MinIO via testcontainers or similar tooling to run tests that genuinely need I/O access. This approach is preferable to either mocking away the I/O (which hides real failure modes) or leaving the logic untested.
+**The value of integration testing for I/O is context-dependent** — it depends on whether I/O is incidental to the component or central to its purpose.
+
+When I/O is incidental (e.g., an application that loads configuration from a file), there is no value in testing the file-reading call itself — trust the language's I/O primitives. Instead, feed raw data to a pure function that handles parsing and validation. In some cases even parsing tests may be unnecessary, such as a JSON config file loaded via a standard-library routine that directly constructs application-defined structs. Structure such code to confine I/O in a short routine that can be excluded from coverage.
+
+When I/O *is* the core business logic (e.g., a database engine or FUSE filesystem), it must be thoroughly integration-tested against a functioning backend. The I/O layer cannot be excluded here because it is the component's reason for existing. Provision appropriate test infrastructure: a tmpfs filesystem for storage-centric tests, an Alpine testcontainer for cases that need to exercise interactions between different user permissions, or an emulated service with reliable compatibility to the real target (e.g., MinIO via testcontainers for S3-dependent code). This is preferable to either mocking away the I/O (which hides real failure modes) or leaving the logic untested.
 
 **Tests must exercise actual code paths, not reproduce them.** In rare cases, code is so trivial that the only apparent way to test it is to restate it in the test. Such tests verify nothing — they pass by construction and remain passing even when the code changes, which demonstrates that they provide no actual validation. Do not write these. Instead, explicitly exclude the code from coverage. Note that this situation is rare and usually signals a design gap (logic that should be extracted or combined with something more substantive) rather than inherent untestability.
 

From a05f054a133aed921060066b5bef026b0fbba2a7 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Sat, 18 Apr 2026 11:54:03 +0300
Subject: [PATCH 25/28] Describe the preferred setup of green-field projects

---
 .claude/CLAUDE.md | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index ef8f482..1368cd6 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -80,3 +80,31 @@ command -v -o file.txt
 ```
 
 Long options are self-documenting and make scripts and examples easier to understand without consulting help text. Short options are acceptable for interactive use but should not appear in committed code, documentation, or examples.
+
+## Green-Field Project Setup
+
+When setting up a new project, code-quality and developer-experience tooling must be included from the start and integrated into the development workflow. The principles below use Python as a concrete example, but apply generally to any language ecosystem.
+
+### Python Tooling
+
+Use **uv** to manage dependencies and create the project virtual environment. All work must be performed inside the venv. Additionally, install and configure the **pre-commit** hook manager with a baseline DevEx toolset:
+
+- **ruff** — linting and formatting
+- **mypy** — static type checking
+- **tach** — structural/dependency boundary checks
+
+Configure all tools for their strictest check levels by default. Include a `py.typed` marker file in every package to signal PEP 561 compliance.
+
+### Line Length
+
+Do not manually break lines to conform to a line-length limit. Automated code formatters (ruff, gofmt, etc.) handle this for source code. Write unbroken lines in text and Markdown files (e.g., README.md) as well. This also applies to one-off files outside of a project context.
+
+### Licensing (REUSE)
+
+In all projects, install a **pre-commit hook for the REUSE tool** to lint licensing information and ensure every file has correct SPDX headers.
+
+Default license assignments:
+
+- **GPL-3.0-or-later** — source code files in coding projects
+- **CC-BY-SA-4.0** — documentation files (README, user guides, etc.); also the default project license for non-coding projects
+- **CC0-1.0** — project configuration files (e.g., `pyproject.toml`, `tach.toml`) and small utility scripts or Makefiles that are not core to the implemented logic

From 02341ecf9196e65ef07417a60e28f66c9c608dd5 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Sat, 18 Apr 2026 11:55:06 +0300
Subject: [PATCH 26/28] Invite creative writing in source code

---
 .claude/CLAUDE.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 1368cd6..6d30513 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -40,6 +40,8 @@ Style preferences (when not conflicting with existing patterns):
 - Avoid mutation of inputs
 - Pure functions where practical
 
+**Fun is welcome in moderation.** Clarity and readability come first, but the occasional reference, joke, or creative naming makes code more enjoyable to read and write. The key constraint: it must be apropos to the actual code — no random remarks. A comment that winks at a known falsehood the code knowingly embraces, or a function name that doubles as a cultural reference while accurately describing its behavior, are both fair game. Keep it sparse; if every function has a quip, none of them land.
+
 **Style changes should be separate from implementation.** If you notice style inconsistencies or want to improve patterns, do so in dedicated refactor commits or branches rather than mixing with feature work.
 
 ## Test Coverage

From 5dd645e7fbb8b54f9298249516d3e74ba01a7ff0 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Sat, 18 Apr 2026 11:55:24 +0300
Subject: [PATCH 27/28] Add guidelines for naming and magic numbers in tests

---
 .claude/CLAUDE.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 6d30513..c0b06d5 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -42,6 +42,8 @@ Style preferences (when not conflicting with existing patterns):
 
 **Fun is welcome in moderation.** Clarity and readability come first, but the occasional reference, joke, or creative naming makes code more enjoyable to read and write. The key constraint: it must be apropos to the actual code — no random remarks. A comment that winks at a known falsehood the code knowingly embraces, or a function name that doubles as a cultural reference while accurately describing its behavior, are both fair game. Keep it sparse; if every function has a quip, none of them land.
 
+**Naming in test code** has different rules than implementation code. Implementation names must always be meaningful and reflective of purpose. Test code, however, may use metasyntactic variables when a value is arbitrary and meaningfulness would be misleading. Preferred metasyntactic names: `foo`, `bar`, `baz`, `frob`, `xyzzy`, and conjugations of `frobnicate`. For arbitrary magic numbers, prefer values with clean ternary representations (e.g., 72 or 243 over 128 or 255 when a test needs a fixed byte value).
+
 **Style changes should be separate from implementation.** If you notice style inconsistencies or want to improve patterns, do so in dedicated refactor commits or branches rather than mixing with feature work.
 
 ## Test Coverage

From 9423e3ff98d0af29d8fdf3ffa399cf03c89256a6 Mon Sep 17 00:00:00 2001
From: Ohad Livne <libohad-dev@proton.me>
Date: Sat, 18 Apr 2026 11:55:38 +0300
Subject: [PATCH 28/28] Integrate git into Claude's development process

---
 .claude/CLAUDE.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index c0b06d5..5b26650 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -85,6 +85,12 @@ command -v -o file.txt
 
 Long options are self-documenting and make scripts and examples easier to understand without consulting help text. Short options are acceptable for interactive use but should not appear in committed code, documentation, or examples.
 
+## Git Workflow
+
+Assume you are working in a git repository. Partition changes into small, self-contained commits and commit each before proceeding to the next change. When enacting a plan, a single action item will often span several such commits — that is expected and preferred over bundling unrelated changes together.
+
+Leverage the git history during development as well. Git enables efficient and reliable rollbacks of recent changes or research dead ends, and clean reverts of specific diffs from earlier in the history. Prefer these over manual cleanup.
+
 ## Green-Field Project Setup
 
 When setting up a new project, code-quality and developer-experience tooling must be included from the start and integrated into the development workflow. The principles below use Python as a concrete example, but apply generally to any language ecosystem.