deps: update to NixOS 25.11

For headscale I'm now setting override_local_dns to false because starting it was failing with:

  loading configuration: Fatal config error: dns.nameservers.global must be set when dns.override_local_dns is true

I'm enabling the postgres user to connect to all databases in order to run:

  sudo su postgres -c "psql miniflux -c 'drop extension hstore'"

which was necessary for the miniflux update (couldn't run it
as the miniflux user since it's a systemd dynamic user).

For hamac:

  android-tools: 35.0.1 -> 35.0.2
  bash-interactive: 5.2p37 -> 5.3p3
  bcache-tools: 1.0.8 -> 1.1
  bluez: 5.80 -> 5.84
  chromium: 142.0.7444.162 -> 142.0.7444.175
  coreutils-full: 9.7 -> 9.8
  cryptsetup(bin): 2.7.5 -> 2.8.1
  curl(bin): 8.14.1 -> 8.17.0
  dconf: 0.40.0 -> 0.49.0
  direnv: 2.36.0 -> 2.37.1
  docker-compose: 2.36.0 -> 2.39.4
  e2fsprogs(bin): 1.47.2 -> 1.47.3
  firefox: 145.0 -> 145.0.2
  fontconfig(bin): 2.16.0 -> 2.17.1
  foot: 1.22.3 -> 1.25.0
  fuse(bin): 2.9.9, 3.16.2 -> 2.9.9, 3.17.4
  gimp: 2.10.38 -> 3.0.4
  git: 2.50.1 -> 2.51.2
  gnugrep: 3.11 -> 3.12
  go: 1.24.9 -> 1.25.4
  grim: 1.4.1 -> 1.5.0
  hugo: 0.147.3 -> 0.152.2
  i3status-rust: 0.33.2 -> 0.34.0
  imv: 4.5.0 -> 5.0.1
  iproute2: 6.14.0 -> 6.17.0
  jq(bin): 1.7.1 -> 1.8.1
  just: 1.40.0 -> 1.43.1
  kbd: 2.7.1 -> 2.9.0
  kexec-tools: 2.0.29 -> 2.0.32
  krita: 5.2.11 -> 5.2.13
  less: 668 -> 679
  libcap: 2.75 -> 2.77
  libnotify: 0.8.6 -> 0.8.7
  libressl(man): 4.1.1 -> 4.2.1
  libressl(nc): 4.1.1 -> 4.2.1
  linux-pam: 1.6.1 -> 1.7.1
  lvm2(bin): 2.03.31 -> 2.03.35
  man-db: 2.13.0 -> 2.13.1
  mkpasswd: 5.6.4 -> 5.6.5
  modemmanager: 1.22.0 -> 1.24.0
  mtools: 4.0.48 -> 4.0.49
  nano: 8.6 -> 8.7
  networkmanager: 1.52.1 -> 1.54.1
  nix: 2.28.5 -> 2.31.2
  nixd: 2.6.4 -> 2.7.0
  nodejs: 22.20.0 -> 22.21.1
  openresolv: 3.13.2 -> 3.17.0
  openssh: 10.0p2 -> 10.2p1
  patch: 2.7.6 -> 2.8
  pciutils: 3.13.0 -> 3.14.0
  pipewire: 1.4.7 -> 1.4.9
  podman: 5.4.1 -> 5.7.0
  python3: 3.12.12, 3.13.5 -> 3.13.9
  python3.13(doc): 3.13.5 -> 3.13.9
  ripgrep: 14.1.1 -> 15.1.0
  rustup: 1.27.1 -> 1.28.2
  shadow: 4.17.4 -> 4.18.0
  skim: 0.20.4 -> 0.20.5
  sqlite-interactive(bin): 3.48.0 -> 3.50.4
  sway: 1.10.1 -> 1.11
  swaylock: 1.8.2 -> 1.8.4
  systemd: 257.10 -> 258.2
  tailscale: 1.82.5 -> 1.90.9
  thunderbird: 144.0.1 -> 145.0
  typst: 0.13.1 -> 0.14.0
  upower: 1.90.6 -> 1.90.10
  util-linux(bin): 2.41.1 -> 2.41.2
  vim: 9.1.1566 -> 9.1.1869
  vim-full: 9.1.1566 -> 9.1.1869
  vscodium: 1.104.16282 -> 1.106.27818
  wireguard-tools: 1.0.20210914 -> 1.0.20250521
  wireplumber: 0.5.10 -> 0.5.12
  wireshark-qt: 4.4.7 -> 4.6.0
  xdg-desktop-portal-wlr: 0.7.1 -> 0.8.0
  zathura-with-plugins: 0.5.11 -> 0.5.13
  zed-editor: 0.189.5 -> 0.214.7

For ev:

  grafana-alloy: 1.8.3 -> 1.11.3
  grafana-loki: 3.4.5 -> 3.5.8
  kodi: 21.2 -> 21.3
  miniflux: 2.2.13 -> 2.2.14
  navidrome: 0.56.1 -> 0.58.0
  node_exporter: 1.9.1 -> 1.10.2
  pipewire: 1.4.7 -> 1.4.9
  postgresql-and-plugins: 16.10 -> 16.11
  qbittorrent-nox: 5.1.0 -> 5.1.4
  tailscale: 1.82.5 -> 1.90.9
  wireguard-tools: 1.0.20210914 -> 1.0.20250521
  wireplumber: 0.5.10 -> 0.5.12
  zigbee2mqtt: 1.42.0 -> 2.6.3

For tente:

  gitolite: 3.6.13 -> 3.6.14
  grafana-alloy: 1.8.3 -> 1.11.3
  grafana-loki: 3.4.5 -> 3.5.8
  grafana: 12.0.6 -> 12.3.0
  headscale: 0.25.1 -> 0.27.1
  node_exporter: 1.9.1 -> 1.10.2
  openresolv: 3.13.2 -> 3.17.0
  openssh: 10.0p2 -> 10.2p1
  postgresql-and-plugins: 16.10 -> 16.11
  tailscale: 1.82.5 -> 1.90.9

7 files changed, 37 insertions, 21 deletions

diff --git a/nixos/hosts/ev/home-automation.nix b/nixos/hosts/ev/home-automation.nix
index 0766e4e..fe123a7 100644
--- a/nixos/hosts/ev/home-automation.nix
+++ b/nixos/hosts/ev/home-automation.nix
@@ -22,6 +22,7 @@ in
         enable = true;
         settings = {
           serial = {
+            adapter = "zstack";
             port = cfg.zigbeeSerialPort;
           };
           frontend = {
diff --git a/nixos/hosts/tente/headscale.nix b/nixos/hosts/tente/headscale.nix
index fe7e12b..7b9544e 100644
--- a/nixos/hosts/tente/headscale.nix
+++ b/nixos/hosts/tente/headscale.nix
@@ -21,7 +21,10 @@ in
         # TODO: make dataDir configurable and set it to /srv/
         settings = {
           server_url = "https://${cfg.domain}";
-          dns = { base_domain = "tailnet"; };
+          dns = {
+            base_domain = "tailnet";
+            override_local_dns = false;
+          };
         };
       };
 
diff --git a/nixos/npins/sources.json b/nixos/npins/sources.json
index 83339b6..b765191 100644
--- a/nixos/npins/sources.json
+++ b/nixos/npins/sources.json
@@ -47,9 +47,9 @@
       },
       "branch": "nix",
       "submodules": false,
-      "revision": "e9eb05fc7d05009bd31fc0c3f9140f3d584ff932",
+      "revision": "3ed2ad1293e1d9c5758999006fbdeb6ec8fae3f3",
       "url": null,
-      "hash": "00cg48azyf5017sdmw34ldbxjzmhvm0pqbv9xgxls6rrcnr409dc"
+      "hash": "0gv3llyav2kwhd73m2qmcd0p094pcrrh9q3c63qpawf5h0d6k0ly"
     },
     "my-lex-surf": {
       "type": "Git",
@@ -71,9 +71,9 @@
       },
       "branch": "master",
       "submodules": false,
-      "revision": "08ef4e3af67bcaed436536221a81aa459c0883a1",
+      "revision": "bd0edb97421398b1491314014c7e0f9d3b01236c",
       "url": null,
-      "hash": "0n8piqgzpmr81vc4im0igri6inimr4ahkqsmwadrgsgma6zlw2h0"
+      "hash": "0n1sx44sfblpls0dh5dy9zwfr4vdf0nz0mprwy3mcv58gb2fgnlp"
     },
     "my-rust-features": {
       "type": "Git",
@@ -113,21 +113,21 @@
     },
     "nixos": {
       "type": "Channel",
-      "name": "nixos-25.05",
-      "url": "https://releases.nixos.org/nixos/25.05/nixos-25.05.812778.3acb677ea67d/nixexprs.tar.xz",
-      "hash": "17w9hlr0nhw4pkdfqzlmk9dlkld6niwrxwhbnzjdhn7kf2dgbm7g"
+      "name": "nixos-25.11",
+      "url": "https://releases.nixos.org/nixos/25.11/nixos-25.11.746.1aab89277eb2/nixexprs.tar.xz",
+      "hash": "0jdlxk2ixq25z8ms2jwg0g3mjm07wa0daa1xf5mlri2vvrwrskav"
     },
     "nixos-small": {
       "type": "Channel",
-      "name": "nixos-25.05-small",
-      "url": "https://releases.nixos.org/nixos/25.05-small/nixos-25.05.812778.3acb677ea67d/nixexprs.tar.xz",
-      "hash": "1vj2qij32pynpw9h0903m8i8fdlf0k3rb7njm92w5m8syy44pzk5"
+      "name": "nixos-25.11-small",
+      "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.896.6707b1809330/nixexprs.tar.xz",
+      "hash": "10ra8cgv95328pixls7bl1h28fd1b3fkcw1gr6m75wyjp4114ka2"
     },
     "nixpkgs-unstable": {
       "type": "Channel",
       "name": "nixpkgs-unstable",
-      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-25.11pre893393.91c9a64ce2a8/nixexprs.tar.xz",
-      "hash": "0k6ldznm7azjxbx0znr7a1mxv6d2lsljvj18acrdi5fg6jiyd5b6"
+      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre906210.ebc94f855ef2/nixexprs.tar.xz",
+      "hash": "1z1vx38czffkryc9nqxpg926xspk4jg86acaa8rkzkzx957lr41n"
     },
     "prometheus-sql-exporter": {
       "type": "GitRelease",
diff --git a/nixos/profiles/common/basics.nix b/nixos/profiles/common/basics.nix
index 3f1859c..62ef258 100644
--- a/nixos/profiles/common/basics.nix
+++ b/nixos/profiles/common/basics.nix
@@ -4,7 +4,7 @@
   environment.systemPackages = with pkgs; [
     git
     # lowPrio because we use vim-full in the workstation profile
-    (lowPrio vim)
+    (lib.lowPrio vim)
 
     file
     htop
@@ -33,7 +33,4 @@
 
       ZDOTDIR = "${config}/zsh";
     };
-
-  # By default installs plugins that pull in GTK.
-  networking.networkmanager.plugins = lib.mkForce [];
 }
diff --git a/nixos/profiles/common/nixpkgs/overlays.nix b/nixos/profiles/common/nixpkgs/overlays.nix
index 40f9041..4709236 100644
--- a/nixos/profiles/common/nixpkgs/overlays.nix
+++ b/nixos/profiles/common/nixpkgs/overlays.nix
@@ -15,6 +15,24 @@
   })
 
   # bug fixes
+  # pinning cage to v0.2.0 because kodi crashes with v0.2.1
+  # (https://github.com/cage-kiosk/cage/issues/456)
+  (final: prev: {
+    cage =
+      (prev.cage.override {
+        wlroots_0_19 = prev.wlroots_0_18;
+      }).overrideAttrs
+        (oldAttrs: {
+          version = "0.2.0";
+          src = final.fetchFromGitHub {
+            owner = "cage-kiosk";
+            repo = "cage";
+            tag = "v0.2.0";
+            hash = "sha256-2SFtz62z0EF8cpFTC6wGi125MD4a5mkXqP/C+7fH+3g=";
+          };
+        });
+  })
+
   (final: prev: {
     sway-unwrapped = prev.sway-unwrapped.overrideAttrs (old: {
       patches = old.patches ++ [
diff --git a/nixos/shared/postgresql.nix b/nixos/shared/postgresql.nix
index 274895b..4cd30a9 100644
--- a/nixos/shared/postgresql.nix
+++ b/nixos/shared/postgresql.nix
@@ -7,6 +7,7 @@
       authentication = pkgs.lib.mkOverride 10 ''
         #type database  DBuser  auth-method
         local sameuser  all     peer
+        local all       postgres peer
         local all       prometheus-sql-exporter peer
       '';
     };
diff --git a/user/zed/settings.json b/user/zed/settings.json
index d2945a4..5961287 100644
--- a/user/zed/settings.json
+++ b/user/zed/settings.json
@@ -72,15 +72,11 @@
   },
   "agent": {
     "enabled": false,
-    "version": "2"
   },
   // The "Sign in" button in the title bar cannot be hidden :/ (https://github.com/zed-industries/zed/discussions/20146)
   "collaboration_panel": {
     "button": false
   },
-  "chat_panel": {
-    "button": "never"
-  },
   "notification_panel": {
     "button": false
   }