feat: obsidian headless sync on glyph

flake.nix

@@ -199,12 +199,16 @@
       }: {
         _module.args.pkgs = import inputs.nixpkgs {
           inherit system;
+          overlays = import ./overlays;
           config.allowUnfreePredicate = pkg:
             builtins.elem (inputs.nixpkgs.lib.getName pkg) [
               "graphite-cli"
+              "obsidian-headless"
             ];
         };
 
+        packages.obsidian-headless = pkgs.obsidian-headless;
+
         devShells = {
           default = pkgs.mkShell {
             packages =

hosts/glyph/home.nix

@@ -5,7 +5,7 @@
   pkgs-stable-25-11,
   ...
 }: {
-  home.packages = [pkgs.mktorrent];
+  home.packages = [pkgs.mktorrent pkgs.obsidian-headless];
 
   programs.opencode = {
     enable = true;

hosts/glyph/secrets/obsidian-auth-token.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 rSr+rA WFx9YaVud0DZYD7AFe6rSCOnxOphuLsAKfRe7BWGZV8
+SkS4vqO4fcwZQEB9F5EymSbtA620j7atpsZdOoBDDEk
+-> ssh-ed25519 3EWhnQ A/jn3iBzQpSzVoNMevIk1YA7k3KKl/K/HFENRMmGmWM
+gGGXV22Hm6vKR7MPaqPP9XLuHi4Tt2Pmi5ogd9D+fb0
+--- JqQ/Rd1FSCfGGWoo+kt33nijCYCqSLbF7PTMei8BTSA
+°7}¹>Û/ˆ4YÄdQ+š
L²ÔÔÞ»RÔB[Ñœe«D{γë`ÝØã¿Ú¾׎û«0h›íç^7XÑ”,¾`ug¦ªäHkÖT‚îŠm)Ë

hosts/glyph/services/default.nix

@@ -68,6 +68,18 @@
     extraUpFlags = ["--ssh"];
   };
 
+  age.secrets.obsidian-auth-token = {
+    file = ./../secrets/obsidian-auth-token.age;
+    mode = "400";
+    owner = "mu";
+    group = "users";
+  };
+
+  rc.obsidian-sync = {
+    enable = true;
+    authTokenFile = config.age.secrets.obsidian-auth-token.path;
+  };
+
   age.secrets.kagi-api-key = {
     file = ./../secrets/kagi-api-key.age;
     mode = "440";

lib/secrets/glyph.nix

@@ -12,4 +12,5 @@ in {
   "hosts/glyph/secrets/graphite-auth-token.age".publicKeys = keys;
   "hosts/glyph/secrets/attic-credentials.age".publicKeys = keys;
   "hosts/glyph/secrets/user-password.age".publicKeys = keys;
+  "hosts/glyph/secrets/obsidian-auth-token.age".publicKeys = keys;
 }

modules/base/unfree-packages.nix

@@ -12,6 +12,7 @@
       "fastscripts"
       "graphite-cli"
       "mochi"
+      "obsidian-headless"
       "open-webui"
       "roon-server"
       "soundsource"

modules/nixos/default.nix

@@ -5,6 +5,7 @@
     ./web
     ./boot.nix
     ./filebrowser-quantum.nix
+    ./obsidian-sync.nix
     ./restic-backup.nix
     ./users.nix
     ./ssh.nix

modules/nixos/obsidian-sync.nix

@@ -0,0 +1,60 @@
+{
+  config,
+  lib,
+  pkgs,
+  username,
+  ...
+}: let
+  cfg = config.rc.obsidian-sync;
+  homeDir = config.users.users.${username}.home;
+in {
+  options.rc.obsidian-sync = {
+    enable = lib.mkEnableOption "Obsidian headless vault sync";
+
+    vaultPath = lib.mkOption {
+      type = lib.types.str;
+      default = "${homeDir}/vault";
+      description = "Local path to the vault directory.";
+    };
+
+    authTokenFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Path to a file containing OBSIDIAN_AUTH_TOKEN=<token>.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.tmpfiles.rules = [
+      "d ${cfg.vaultPath} 0755 ${username} users -"
+      "d ${homeDir}/.config/obsidian-headless 0700 ${username} users -"
+    ];
+
+    systemd.services.obsidian-sync = {
+      description = "Obsidian headless vault sync";
+      wantedBy = ["multi-user.target"];
+      after = ["network-online.target"];
+      wants = ["network-online.target"];
+
+      serviceConfig = {
+        User = username;
+        Group = "users";
+        WorkingDirectory = homeDir;
+
+        EnvironmentFile = cfg.authTokenFile;
+
+        # Skip (not fail) if vault hasn't been configured via `ob sync-setup` yet
+        ExecCondition = "${pkgs.obsidian-headless}/bin/ob sync-status --path ${cfg.vaultPath}";
+
+        ExecStart = "${pkgs.obsidian-headless}/bin/ob sync --continuous --path ${cfg.vaultPath}";
+
+        Restart = "on-failure";
+        RestartSec = "30s";
+
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectSystem = "strict";
+        ReadWritePaths = [cfg.vaultPath "${homeDir}/.config/obsidian-headless"];
+      };
+    };
+  };
+}

overlays/custom-packages.nix

@@ -19,6 +19,9 @@ self: super: {
   # MCP Gateway
   mcpjungle = super.callPackage ./../packages/mcpjungle/package.nix {};
 
+  # Obsidian headless sync client
+  obsidian-headless = super.callPackage ./../packages/obsidian-headless/package.nix {};
+
   # Mochi spaced repetition software
   mochi = super.callPackage ./../packages/mochi/package.nix {};