[cleo] stuff

cleo.darwin.nix

@@ -3,11 +3,29 @@
 , ...
 }:
 let
+  # Managed block in /etc/hosts. Same markers the ansible blockinfile uses, so
+  # an existing block is rewritten in place rather than duplicated.
+  cleoHosts = [
+    "dev.wellthy.com"
+    "www.dev.wellthy.com"
+    "app.dev.wellthy.com"
+    "www.app.dev.wellthy.com"
+    "auth.dev.wellthy.com"
+    "internal-api.dev.wellthy.com"
+    "local-api.hicleo.com"
+    "local-identity.hicleo.com"
+    "local-file-ingestion.hicleo.com"
+    "local-eligibility.hicleo.com"
+  ];
+  cleoHostsBlock = pkgs.writeText "cleo-local-dev-hosts" (
+    lib.concatMapStrings (h: "127.0.0.1 ${h}\n") cleoHosts
+  );
   ansibleRequired = {
     taps = [
       "fwdcloudsec/granted" # aws sso utility
       "felipeelias/tap" # claude-statusline
       "oven-sh/bun" # bun
+      "schpet/tap"
 
       ## Excluded intentionally
       # "sst/tap" # opencode
@@ -17,18 +35,20 @@ let
       "aws-sso-util"
       "awscli"
       "ccusage"
+      "doppler"
       "fd"
       "felipeelias/tap/claude-statusline"
       "oven-sh/bun/bun"
       "fwdcloudsec/granted/granted"
+      "schpet/tap/linear"
       "gh"
       "jq"
       "maven"
-      "rg"
       "snyk-cli"
       "ldcli"
 
       ## Excluded intentionally
+      # "rg"
       # "gdal"
       # "sst/tap/opencode"
       # "libpq@17"
@@ -60,6 +80,15 @@ in
   environment.variables.GIT_EDITOR = "vim";
   environment.variables.HOMEBREW_NO_ANALYTICS = "1";
 
+  # GUI apps (Android Studio, Dock-launched tools) don't see home-manager session
+  # vars, so mirror the XDG-relocated ones here with absolute paths.
+  launchd.user.envVariables = {
+    CLAUDE_CONFIG_DIR = "/Users/matthew.bessette/.config/claude";
+    GRADLE_USER_HOME = "/Users/matthew.bessette/.local/share/gradle";
+    ANDROID_USER_HOME = "/Users/matthew.bessette/.local/share/android";
+    CP_HOME_DIR = "/Users/matthew.bessette/.local/share/cocoapods";
+  };
+
   environment.systemPackages = with pkgs; [
     vim
     git
@@ -67,6 +96,18 @@ in
     curl
     python3
     postgresql_17
+    # valkey-cli for the ~/Projects/redis-proxy ElastiCache proxy
+    valkey
+    # wellthy.com: psycopg2 builds from source (needs pg_config + libpq headers)
+    postgresql_17.pg_config
+    postgresql_17.dev
+    # wellthy.com: python-magic loads libmagic; gettext for compilemessages
+    file
+    gettext
+    openssl
+    openssl.dev
+    # default outputs are bin+man only; the shared libs live in `out`
+    openssl.out
     home-manager
     ttyd
     xcodes
@@ -80,6 +121,42 @@ in
     act
   ];
 
+  # Link lib/ and include/ into /run/current-system/sw so native builds (psycopg2)
+  # and runtime lookups (python-magic -> libmagic) have a stable path.
+  environment.pathsToLink = [ "/lib" "/include" ];
+
+  # python-magic only searches /opt/local/lib, /usr/local/lib and /opt/homebrew/lib
+  # (DYLD_* variables don't survive macOS system binaries). Point the last one at the
+  # nix libmagic through the stable system profile path. Only touches the path when
+  # it is free or already our own link, so a Homebrew libmagic is never overwritten.
+  system.activationScripts.postActivation.text = ''
+    dest=/opt/homebrew/lib/libmagic.dylib
+    ours=/run/current-system/sw/lib/libmagic.dylib
+    if [ -d /opt/homebrew/lib ] && { { [ ! -e "$dest" ] && [ ! -L "$dest" ]; } || [ "$(readlink "$dest")" = "$ours" ]; }; then
+      ln -sfn "$ours" "$dest"
+    fi
+
+    # /etc/hosts is owned by macOS (and holds hand-written entries), so manage only
+    # the CLEO LOCAL DEV HOSTS block: replace it in place, or append it if missing.
+    hosts=/etc/hosts
+    begin="# BEGIN CLEO LOCAL DEV HOSTS"
+    end="# END CLEO LOCAL DEV HOSTS"
+    tmp=$(mktemp)
+    if grep -qxF "$begin" "$hosts"; then
+      awk -v begin="$begin" -v end="$end" -v blk="${cleoHostsBlock}" '
+        $0 == begin { print; while ((getline l < blk) > 0) print l; skip = 1; next }
+        $0 == end { skip = 0 }
+        !skip { print }
+      ' "$hosts" > "$tmp"
+    else
+      { cat "$hosts"; printf '\n%s\n' "$begin"; cat ${cleoHostsBlock}; printf '%s\n' "$end"; } > "$tmp"
+    fi
+    if ! cmp -s "$tmp" "$hosts"; then
+      cat "$tmp" > "$hosts"
+    fi
+    rm -f "$tmp"
+  '';
+
   # Add Homebrew to PATH
   environment.systemPath = [
     "/opt/homebrew/bin"