feat(services): add podman, flatpak (+ Flathub) and pika backup

Extend nomarchy.services.* with three more opt-in toggles:
- podman: rootless containers, `docker` aliased to it, container DNS, and a
  subuid/subgid range for the login user.
- flatpak: services.flatpak + a oneshot that adds the Flathub remote
  system-wide (idempotent, retries when online).
- pika: ships pika-backup, the GUI for scheduled Borg backups.
Commented examples in the downstream system.nix template, per convention.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -221,6 +221,9 @@ examples: **[docs/OVERRIDES.md](docs/OVERRIDES.md)**.
 | `nomarchy.system.power.batteryChargeLimit` | `null` | Stop charging at this % (e.g. `80`) where the hardware supports it; needs `power.laptop` |
 | `nomarchy.services.tailscale.enable` | `false` | Opt-in: Tailscale mesh VPN (then `sudo tailscale up`) |
 | `nomarchy.services.syncthing.enable` | `false` | Opt-in: Syncthing file sync as the login user (GUI at `127.0.0.1:8384`) |
+| `nomarchy.services.podman.enable` | `false` | Opt-in: rootless Podman (`docker` aliased to it) |
+| `nomarchy.services.flatpak.enable` | `false` | Opt-in: Flatpak + the Flathub remote |
+| `nomarchy.services.pika.enable` | `false` | Opt-in: Pika Backup (GUI Borg backups) |
 
 Beyond the `nomarchy.*` surface, the system layer turns on the usual
 desktop services with `lib.mkDefault` (override natively). One worth

docs/ROADMAP.md

@@ -261,21 +261,25 @@ how to override it. Items marked ✓ are shipped.
   application suite above — heavier or more personal integrations shipped
   **off by default**, each a `nomarchy.services.<name>.enable` toggle a
   downstream flips on in one line. Keeps the base lean while making common
-  additions trivial. **✓ First two shipped** — `nomarchy.services.tailscale`
-  and `nomarchy.services.syncthing` (`modules/nixos/services.nix`, system-side;
-  Syncthing runs as the login user with its GUI on 127.0.0.1:8384), with
-  commented examples in the downstream `system.nix` template. More candidates
-  by area:
+  additions trivial. **✓ Five shipped** in `modules/nixos/services.nix`
+  (system-side), each with a commented example in the downstream `system.nix`
+  template: `tailscale`, `syncthing` (runs as the login user, GUI on
+  127.0.0.1:8384), `podman` (rootless, `docker` aliased, user subuid/subgid),
+  `flatpak` (+ Flathub remote added by a oneshot), `pika` (Pika Backup GUI).
+  More candidates by area:
   - ✓ **cloud/sync:** Syncthing (`services.syncthing`); Nextcloud client (todo)
   - **local AI:** LM Studio (`lmstudio`); Ollama (`services.ollama`, optional
     GPU accel) — pairs with the menu's Ask-Claude philosophy
-  - **containers/VMs:** Docker/Podman; libvirt + virt-manager
+  - ✓ **containers/VMs:** Podman (`virtualisation.podman`); Docker / libvirt +
+    virt-manager (todo)
   - ✓ **networking:** Tailscale (`services.tailscale`); WireGuard (todo)
   - **gaming/media:** Steam (`programs.steam`); OBS Studio
   - **devices:** printing (CUPS + Avahi); KDE Connect / phone integration;
     OpenRGB
-  - **backup:** restic/borg (`services.restic`)
-  - **escape hatch:** Flatpak (`services.flatpak`) for apps outside nixpkgs
+  - ✓ **backup:** Pika Backup (`pika-backup`, GUI over Borg); restic/borg
+    services (todo)
+  - ✓ **escape hatch:** Flatpak (`services.flatpak`) + Flathub, for apps
+    outside nixpkgs
 
   Surface decided: `nomarchy.services.*`, system-side for system services
   (home-side ones can extend the same prefix later). Remaining: curate the

modules/nixos/services.nix

@@ -1,10 +1,9 @@
 # Opt-in services & integrations — off by default, one toggle each, enabled
 # in system.nix (see the commented examples in the downstream template).
-# These are system services: Tailscale is system-only, and Syncthing runs as
-# the login user. Their own `nomarchy.services.*` namespace, distinct from the
-# distro's core `nomarchy.system.*` toggles. `username` (from specialArgs) is
-# read lazily, only when Syncthing is enabled.
-{ config, lib, ... }@args:
+# These are system-side: their own `nomarchy.services.*` namespace, distinct
+# from the distro's core `nomarchy.system.*` toggles. `username` (from
+# specialArgs) is read lazily, only where a service needs it.
+{ config, lib, pkgs, ... }@args:
 
 let
   cfg = config.nomarchy.services;
@@ -18,6 +17,18 @@ in
     syncthing.enable = lib.mkEnableOption ''
       Syncthing continuous file sync, running as the login user — add
       folders and devices in the web UI at http://127.0.0.1:8384'';
+
+    podman.enable = lib.mkEnableOption ''
+      Podman for rootless containers, with `docker` aliased to it and DNS on
+      the default network; the login user gets a subuid/subgid range'';
+
+    flatpak.enable = lib.mkEnableOption ''
+      Flatpak, with the Flathub remote added system-wide — install apps with
+      `flatpak install flathub <app>`'';
+
+    pika.enable = lib.mkEnableOption ''
+      Pika Backup, a friendly GUI for scheduled Borg backups (the app;
+      configure repositories and schedules inside it)'';
   };
 
   config = lib.mkMerge [
@@ -36,5 +47,38 @@ in
         guiAddress = "127.0.0.1:8384";
       };
     })
+
+    (lib.mkIf cfg.podman.enable {
+      virtualisation.podman = {
+        enable = true;
+        dockerCompat = lib.mkDefault true; # `docker` → podman (off if you run real docker)
+        defaultNetwork.settings.dns_enabled = true; # DNS for rootless containers
+      };
+      # Rootless podman needs a subuid/subgid range for the user.
+      users.users.${args.username}.autoSubUidGidRange = lib.mkDefault true;
+    })
+
+    (lib.mkIf cfg.flatpak.enable {
+      services.flatpak.enable = true;
+      # Flatpak ships no remotes; add Flathub system-wide. Idempotent
+      # (--if-not-exists), and it reads the .flatpakrepo over the network, so
+      # it waits for connectivity and simply retries next boot if offline.
+      systemd.services.nomarchy-flathub = {
+        description = "Add the Flathub Flatpak remote";
+        wantedBy = [ "multi-user.target" ];
+        wants = [ "network-online.target" ];
+        after = [ "network-online.target" ];
+        path = [ pkgs.flatpak ];
+        serviceConfig.Type = "oneshot";
+        script = ''
+          flatpak remote-add --system --if-not-exists flathub \
+            https://dl.flathub.org/repo/flathub.flatpakrepo
+        '';
+      };
+    })
+
+    (lib.mkIf cfg.pika.enable {
+      environment.systemPackages = [ pkgs.pika-backup ];
+    })
   ];
 }

templates/downstream/system.nix

@@ -33,6 +33,9 @@
   #
   # nomarchy.services.tailscale.enable = true; # mesh VPN — then `sudo tailscale up`
   # nomarchy.services.syncthing.enable = true; # file sync — GUI at http://127.0.0.1:8384
+  # nomarchy.services.podman.enable = true;    # rootless containers (docker → podman)
+  # nomarchy.services.flatpak.enable = true;   # Flatpak + the Flathub remote
+  # nomarchy.services.pika.enable = true;      # Pika Backup (GUI Borg backups)
 
   system.stateVersion = "26.05";
 }