launchd: use user domain for background agents

Move non-graphical Darwin services out of the GUI launchd domain so they can be managed from non-Aqua contexts such as SSH sessions.

modules/programs/atuin.nix

@@ -298,6 +298,7 @@ in
 
           launchd.agents.atuin-daemon = {
             enable = true;
+            domain = lib.mkDefault "user";
             config = {
               ProgramArguments = [ (lib.getExe cfg.package) ] ++ daemonArgs;
               EnvironmentVariables = lib.optionalAttrs (daemonCfg.logLevel != null) {

modules/programs/git.nix

@@ -609,6 +609,7 @@ in
           {
             "git-maintenance-hourly" = {
               enable = true;
+              domain = lib.mkDefault "user";
               config = {
                 ProgramArguments = baseArguments ++ [ "--schedule=hourly" ];
                 StartCalendarInterval = map (hour: {
@@ -619,6 +620,7 @@ in
             };
             "git-maintenance-daily" = {
               enable = true;
+              domain = lib.mkDefault "user";
               config = {
                 ProgramArguments = baseArguments ++ [ "--schedule=daily" ];
                 StartCalendarInterval = map (weekday: {
@@ -630,6 +632,7 @@ in
             };
             "git-maintenance-weekly" = {
               enable = true;
+              domain = lib.mkDefault "user";
               config = {
                 ProgramArguments = baseArguments ++ [ "--schedule=weekly" ];
                 StartCalendarInterval = [

modules/programs/nh.nix

@@ -151,6 +151,7 @@ in
 
     launchd.agents.nh-clean = lib.mkIf cfg.clean.enable {
       enable = true;
+      domain = lib.mkDefault "user";
       config = {
         ProgramArguments = [
           "${lib.getExe cfg.package}"

modules/programs/opencode.nix

@@ -626,6 +626,7 @@ in
     launchd.agents = mkIf webCfg.enable {
       opencode-web = {
         enable = true;
+        domain = lib.mkDefault "user";
         config = {
           ProgramArguments =
             let

modules/programs/rclone.nix

@@ -160,6 +160,7 @@ let
     in
     {
       enable = true;
+      domain = lib.mkDefault "user";
       config = {
         ProgramArguments = [
           (lib.getExe rcloneSidecarWrapper)
@@ -619,6 +620,7 @@ in
       mkLaunchdConfigService = lib.mkIf (cfg.remotes != { }) {
         rclone-config = {
           enable = true;
+          domain = lib.mkDefault "user";
           config = {
             ProgramArguments = [ (lib.getExe rcloneConfigScript) ];
             RunAtLoad = true;

modules/services/borgmatic.nix

@@ -87,6 +87,7 @@ in
 
     launchd.agents.borgmatic = {
       enable = true;
+      domain = lib.mkDefault "user";
       config = {
         ProgramArguments = [
           (lib.getExe programConfig.package)

modules/services/colima.nix

@@ -265,6 +265,7 @@ in
         name: profile:
         lib.nameValuePair "colima-${name}" {
           enable = true;
+          domain = lib.mkDefault "user";
           config = {
             ProgramArguments = [
               "${lib.getExe cfg.package}"

modules/services/emacs.nix

@@ -218,6 +218,7 @@ in
 
     launchd.agents.emacs = {
       enable = true;
+      domain = lib.mkDefault (if cfg.startWithUserSession == "graphical" then "gui" else "user");
       config = {
         ProgramArguments = [
           "${cfg.package}/bin/emacs"

modules/services/exo.nix

@@ -60,6 +60,7 @@ in
 
     launchd.agents.exo = {
       enable = true;
+      domain = lib.mkDefault "user";
       config = {
         ProgramArguments = [ (lib.getExe cfg.package) ] ++ cfg.extraArgs;
         EnvironmentVariables = cfg.environmentVariables;

modules/services/git-sync.nix

@@ -108,6 +108,7 @@ in
     launchd.agents = services (
       _name: repo: {
         enable = true;
+        domain = lib.mkDefault "user";
         config = {
           StartInterval = repo.interval;
           ProcessType = "Background";

modules/services/glance.nix

@@ -78,13 +78,16 @@ in
 
     xdg.configFile."glance/glance.yml" = {
       source = settingsFile;
-      onChange = mkIf pkgs.stdenv.hostPlatform.isDarwin ''
-        /bin/launchctl kickstart -k "gui/$(id -u)/org.nix-community.home.glance" 2>/dev/null || true
+      onChange = mkIf (pkgs.stdenv.hostPlatform.isDarwin && cfg.package != null) ''
+        domain="${config.launchd.agents.glance.domain}/$(id -u)"
+        /bin/launchctl kickstart -k "$domain/org.nix-community.home.glance" \
+          2>/dev/null || true
       '';
     };
 
     launchd.agents.glance = mkIf (cfg.package != null) {
       enable = true;
+      domain = lib.mkDefault "user";
       config = {
         ProgramArguments = [
           (getExe cfg.package)

modules/services/gpg-agent.nix

@@ -454,6 +454,7 @@ in
 
     launchd.agents.gpg-agent = {
       enable = true;
+      domain = lib.mkDefault "user";
       config = {
         ProgramArguments = [
           "${gpgPkg}/bin/gpg-agent"

modules/services/home-manager-auto-expire.nix

@@ -105,6 +105,7 @@ in
 
     launchd.agents.home-manager-auto-expire = {
       enable = true;
+      domain = lib.mkDefault "user";
       config = {
         ProgramArguments = [ (toString script) ];
         ProcessType = "Background";

modules/services/imapnotify/default.nix

@@ -65,6 +65,7 @@ let
       name = "imapnotify-${name}";
       value = {
         enable = true;
+        domain = lib.mkDefault "user";
         config = {
           # Use the nix store path for config to ensure service restarts when it changes
           ProgramArguments = [

modules/services/mpd.nix

@@ -254,6 +254,7 @@ in
 
       launchd.agents.mpd = {
         enable = true;
+        domain = lib.mkDefault "user";
         config = {
           ProgramArguments = [
             (lib.getExe cfg.package)

modules/services/nix-gc.nix

@@ -121,6 +121,7 @@ in
 
     launchd.agents.nix-gc = {
       enable = true;
+      domain = lib.mkDefault "user";
       config = {
         ProgramArguments = [
           "${nixPackage}/bin/nix-collect-garbage"

modules/services/ollama.nix

@@ -107,6 +107,7 @@ in
 
     launchd.agents.ollama = {
       enable = true;
+      domain = lib.mkDefault "user";
       config = {
         ProgramArguments = [
           "${lib.getExe ollamaPackage}"

modules/services/podman/darwin.nix

@@ -311,6 +311,7 @@ in
           name: machine:
           nameValuePair "podman-machine-${name}" {
             enable = true;
+            domain = lib.mkDefault "user";
             config = {
               ProgramArguments = [ "${mkWatchdogScript name machine}" ];
               KeepAlive = {

modules/services/proton-pass-agent.nix

@@ -104,6 +104,7 @@ in
 
       launchd.agents.proton-pass-agent = {
         enable = true;
+        domain = lib.mkDefault "user";
         config = {
           ProgramArguments = [
             (lib.getExe pkgs.bash)

modules/services/pueue.nix

@@ -57,6 +57,7 @@ in
 
     launchd.agents.pueued = lib.mkIf (cfg.package != null) {
       enable = true;
+      domain = lib.mkDefault "user";
 
       config = {
         ProgramArguments = [

modules/services/ssh-agent.nix

@@ -105,6 +105,7 @@ in
 
     launchd.agents.ssh-agent = {
       enable = true;
+      domain = lib.mkDefault "user";
       config = {
         ProgramArguments = [
           (lib.getExe pkgs.bash)

modules/services/syncthing.nix

@@ -912,6 +912,7 @@ in
       launchd.agents = {
         syncthing = {
           enable = true;
+          domain = lib.mkDefault "user";
           config = {
             ProgramArguments = [
               "${pkgs.writers.writeBash "syncthing-wrapper" ''

modules/services/tldr-update.nix

@@ -62,6 +62,7 @@ in
 
     launchd.agents.tldr-update = {
       enable = true;
+      domain = lib.mkDefault "user";
       config = {
         ProgramArguments = [
           (lib.getExe cfg.package)

modules/services/yubikey-agent.nix

@@ -82,6 +82,7 @@ in
 
     launchd.agents.yubikey-agent = {
       enable = true;
+      domain = lib.mkDefault "user";
       config = {
         ProgramArguments = [
           "${cfg.package}/bin/yubikey-agent"

tests/modules/services/glance/default-settings.nix

@@ -18,6 +18,11 @@
       serviceFile=$(normalizeStorePaths $serviceFile)
       assertFileExists "$serviceFile"
       assertFileContent "$serviceFile" ${./glance.plist}
+
+      domainFile=LaunchAgentDomains/org.nix-community.home.glance.domain
+      assertFileContent "$domainFile" ${builtins.toFile "expected-domain" "user\n"}
+      assertFileContains activate 'domain="user/$(id -u)"'
+      assertFileContains activate 'launchctl kickstart -k "$domain/org.nix-community.home.glance"'
     '')
   ];
 }

tests/modules/services/glance/default.nix

@@ -1,4 +1,5 @@
 {
+  glance-domain-override = ./domain-override.nix;
   glance-default-settings = ./default-settings.nix;
   glance-example-settings = ./example-settings.nix;
 }

tests/modules/services/glance/domain-override.nix

@@ -0,0 +1,14 @@
+{ lib, pkgs, ... }:
+
+{
+  services.glance.enable = true;
+  launchd.agents.glance.domain = "gui";
+
+  nmt.script = lib.mkIf pkgs.stdenv.hostPlatform.isDarwin ''
+    domainFile=LaunchAgentDomains/org.nix-community.home.glance.domain
+    assertFileExists "$domainFile"
+    assertFileContent "$domainFile" ${builtins.toFile "expected-domain" "gui\n"}
+    assertFileContains activate 'domain="gui/$(id -u)"'
+    assertFileContains activate 'launchctl kickstart -k "$domain/org.nix-community.home.glance"'
+  '';
+}