feat: add adaptive pinentry module (rofi on TTY, curses on SSH)

Adds a new home-manager module `ntfy-notify` that delivers kanban state changes as Linux desktop notifications via **ntfy.sh** + `notify-send` → SwayNC.

**What it does:**
- Installs `ntfy` package
- Creates `~/.config/ntfy/client.yml` with subscription to the `joao-kanban` topic
- Sets up `ntfy-notify.service` (systemd --user) as a persistent subscriber
- Each incoming message fires `notify-send -u critical` → picked up by SwayNC
- Configurable: `server` URL, `subscriptions` list, per-topic priority

**Usage:**
After deploy, start the service once:
```bash
systemctl --user daemon-reload
systemctl --user start ntfy-notify
```

**Companion:** A cron job on the VPS will be needed to push kanban events to the ntfy topic (separate task).

Closes kanban task t_322419fa on ndots board.

---------

Co-authored-by: hermes-bot <hermes@srv1239749>
Reviewed-on: #1

.gitignore

@@ -1 +0,0 @@
-.worktrees/

hosts/jpporta-nixos/home.nix

@@ -36,6 +36,7 @@ Warning: Identity file /home/jpporta/.ssh/id_rsa not accessible: No such file or
     ../../modules/home-manager/openspec
     ../../modules/home-manager/power-profiles
     ../../modules/home-manager/ntfy-notify
+    ../../modules/home-manager/pinentry
 
     inputs.zen-browser.homeModules.beta
   ];
@@ -150,13 +151,7 @@ Warning: Identity file /home/jpporta/.ssh/id_rsa not accessible: No such file or
     gpg.enable = true;
   };
 
-  services.gpg-agent = {
+  custom.pinentry.enable = true;
-    enable = true;
-    pinentry.package = pkgs.pinentry-rofi;
-    enableSshSupport = true; # only if you use gpg keys as ssh keys
-    defaultCacheTtl = 3600;
-    maxCacheTtl = 86400;
-  };
 
   services.swaync.enable = true;
 }

modules/home-manager/ntfy-notify/default.nix

@@ -6,6 +6,15 @@
 }:
 let
   cfg = config.custom.ntfy-notify;
+
+  # Escape the whole command string for the YAML config. Since ntfy reads this
+  # from client.yml directly (not from systemd), we pass notify-send arguments
+  # as a shell command string — ntfy will spawn a shell to run it.
+  mkSubscription = topic: priority:
+    lib.generators.toYaml { } [{
+      topic = "${cfg.server}/${topic}";
+      command = ''notify-send -a "Kanban" -u "${priority}" "Kanban Update" "''${m}"'';
+    }];
 in
 {
   options.custom.ntfy-notify = {
@@ -45,21 +54,19 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    home.packages = [ pkgs.ntfy-sh ];
+    home.packages = [ pkgs.ntfy ];
 
-    # Client config with subscription → notify-send command mappings.
+    # Client config with subscription → notify-send mappings.
-    # ntfy subscribe (without args) reads subscriptions from client.yml.
+    # ntfy subscribe (without args) reads subscriptions from here.
     xdg.configFile."ntfy/client.yml" = {
       text = ''
         # Generated by ndots ntfy-notify module.
-        # Each message spawns notify-send → your notification daemon.
+        # Each incoming message spawns a notify-send → your notification daemon.
         subscribe:
       '' + lib.concatMapStringsSep "\n" (sub:
-        let
-          cmd = "notify-send -a Kanban -u ${sub.priority} \"Kanban Update\" \"$m\"";
-        in
         "  - topic: ${cfg.server}/${sub.topic}\n"
-        + "    command: ${cmd}"
+        + "    command: >-\n"
+        + ''      notify-send -a "Kanban" -u "${sub.priority}" "Kanban Update" "$m"''
       ) cfg.subscriptions;
     };
 
@@ -71,7 +78,9 @@ in
       };
       Service = {
         Type = "simple";
-        ExecStart = "${pkgs.ntfy-sh}/bin/ntfy subscribe";
+        ExecStart = ''
+          ${pkgs.ntfy}/bin/ntfy subscribe
+        '';
         Restart = "on-failure";
         RestartSec = 10;
       };

modules/home-manager/pinentry/default.nix

@@ -0,0 +1,32 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  pinentry-wrapper = pkgs.writeShellScriptBin "pinentry-wrapper" ''
+    if [ -n "''${SSH_CONNECTION:-}" ] || [ -n "''${SSH_TTY:-}" ]; then
+      exec ${pkgs.pinentry-curses}/bin/pinentry-curses "$@"
+    else
+      exec ${pkgs.pinentry-rofi}/bin/pinentry-rofi "$@"
+    fi
+  '';
+in {
+  options.custom.pinentry = {
+    enable = lib.mkEnableOption "adaptive pinentry: rofi on TTY, curses on SSH";
+  };
+
+  config = lib.mkIf config.custom.pinentry.enable {
+    home.packages = [ pinentry-wrapper ];
+
+    services.gpg-agent = {
+      enable = true;
+      pinentry.package = pinentry-wrapper;
+      enableSshSupport = true;
+      defaultCacheTtl = 3600;
+      maxCacheTtl = 86400;
+    };
+  };
+}