caesium: bump

caesium.nixos.nix

@@ -24,6 +24,7 @@
   networking.networkmanager.enable = true;
   networking.interfaces.enp13s0.wakeOnLan.enable = true;
 
+  networking.nftables.enable = true;
   networking.firewall.enable = true;
 
   # Declaratively restrict ports to CIDRs!
@@ -34,6 +35,31 @@
         "192.168.1.0/16"
       ];
     };
+
+    tarkov = {
+      port = 6969;
+
+      allowedCIDRs = [
+        "192.168.1.0/16"
+      ];
+    };
+
+    fika = {
+      # 25565 UDP is correct -- this is Fika's in-game networking port per
+      # the official docs (wiki.project-fika.com/hosting-a-fika-server/
+      # host-using-port-forwarding: "6969 TCP (SPT backend server)" +
+      # "25565 UDP (Fika in-game networking)"), and matches what the SPT
+      # launcher itself reports on start ("starting fika server 25565").
+      # The 6790 seen in fika.jsonc/the client log is natPunchServer.port,
+      # a separate, currently-disabled (enable: false) NAT-punch relay
+      # feature -- unrelated to normal LAN raid traffic. Don't change this
+      # to 6790 again; that was a wrong deduction, reverted.
+      port = 25565;
+      protocol = "udp";
+      allowedCIDRs = [
+        "192.168.1.0/16"
+      ];
+    };
   };
 
   # --- STORAGE & SSD OPTIMIZATION ---
@@ -200,6 +226,7 @@
   };
 
   # --- PROGRAMS ---
+  programs.gamescope.enable = true;
   services.printing = {
     enable = true;
     drivers = [
@@ -209,6 +236,22 @@
 
   programs.zsh.enable = true;
 
+  # SPT's launcher (SPT.Launcher.Linux) is a .NET single-file apphost that
+  # embeds WebKitGTK via Photino. It can't run under an explicit ld.so
+  # (apphosts resolve their bundle through /proc/self/exe), so it needs a
+  # real /lib64/ld-linux — that's nix-ld. Libraries below are exactly what
+  # ldd reports missing for Photino.Native.so.
+  programs.nix-ld = {
+    enable = true;
+    libraries = with pkgs; [
+      webkitgtk_4_1 # also provides libjavascriptcoregtk-4.1
+      gtk3
+      glib
+      libnotify
+      stdenv.cc.cc.lib
+    ];
+  };
+
   programs.steam = {
     enable = true;
     remotePlay.openFirewall = true;
@@ -235,6 +278,12 @@
     curl
     python3
     nodejs_26
+    # umu's bundled Steam Runtime container (pressure-vessel/bwrap) needs a
+    # real FHS to find binaries like `true` during its sandbox setup -- see
+    # umu-steam-run.sh in ~/spt-nix. System-wide so any launcher (SPT, Faugus,
+    # Lutris, Heroic, ...) that shells out to umu-run/proton directly can
+    # find it on PATH without a nix-shell wrapper.
+    steam-run
     home-manager
     glib
   ];