Big update

nix/module.nix

@@ -22,10 +22,6 @@ let
           host = cfg.host;
           port = cfg.port;
           auth-dir = "${statePath}/auths";
-          plugins = {
-            enabled = true;
-            dir = "${statePath}/plugins";
-          };
         }
         // cfg.settings
       )
@@ -107,58 +103,9 @@ in
       default = [ ];
       description = "Environment files containing secrets such as MANAGEMENT_PASSWORD.";
     };
-
-    localModel = mkOption {
-      type = types.bool;
-      default = false;
-      description = "Disable remote model catalog updates.";
-    };
-
-    extraArgs = mkOption {
-      type = types.listOf types.str;
-      default = [ ];
-      description = "Additional command-line arguments passed to the server.";
-    };
-
-    openOAuthCallbackPorts = mkOption {
-      type = types.bool;
-      default = false;
-      description = "Open the built-in OAuth callback ports 1455, 54545, and 51121.";
-    };
-
-    liveMediaRelay = {
-      openFirewall = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Open the configured UDP range for the live-media relay.";
-      };
-      portRange = mkOption {
-        type = types.submodule {
-          options = {
-            from = mkOption {
-              type = types.port;
-              default = 50000;
-            };
-            to = mkOption {
-              type = types.port;
-              default = 50100;
-            };
-          };
-        };
-        default = { };
-        description = "UDP firewall range used by the live-media relay.";
-      };
-    };
   };
 
   config = mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = cfg.liveMediaRelay.portRange.from <= cfg.liveMediaRelay.portRange.to;
-        message = "services.vibe-proxy.liveMediaRelay.portRange.from must not exceed .to";
-      }
-    ];
-
     users.groups = mkIf (cfg.group == "vibe-proxy") {
       vibe-proxy = { };
     };
@@ -170,16 +117,7 @@ in
       };
     };
 
-    networking.firewall.allowedTCPPorts =
-      lib.optional cfg.openFirewall cfg.port
-      ++ lib.optionals cfg.openOAuthCallbackPorts [
-        1455
-        51121
-        54545
-      ];
-    networking.firewall.allowedUDPPortRanges = lib.optional cfg.liveMediaRelay.openFirewall {
-      inherit (cfg.liveMediaRelay.portRange) from to;
-    };
+    networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.port;
 
     systemd.services.vibe-proxy = {
       description = "Vibe Proxy API";
@@ -207,15 +145,7 @@ in
         StateDirectoryMode = "0700";
         WorkingDirectory = statePath;
         EnvironmentFile = cfg.environmentFiles;
-        ExecStart = lib.concatStringsSep " " (
-          [
-            (lib.getExe cfg.package)
-            "--config"
-            (lib.escapeShellArg runtimeConfig)
-          ]
-          ++ lib.optional cfg.localModel "--local-model"
-          ++ map lib.escapeShellArg cfg.extraArgs
-        );
+        ExecStart = "${lib.getExe cfg.package} --config ${lib.escapeShellArg runtimeConfig}";
         Restart = "on-failure";
         RestartSec = "5s";
         UMask = "0077";

nix/package.nix

@@ -34,7 +34,7 @@ let
     pnpmDeps = fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
       fetcherVersion = 4;
-      hash = "sha256-vpiGYrLY5B+irYJf4lAs3SM9RrmEb9t+BJHBVXQGP+I=";
+      hash = "sha256-vWBgw08KLHoih2DE/o9e8G4JQMjJBnFEwsCaiag8FNc=";
     };
 
     nativeBuildInputs = [
@@ -88,7 +88,6 @@ let
       vendorHash = "sha256-CrDp7MOr+AwJUhTovklXx3F1yaktQlvD7VYhYSY6VvY=";
       subPackages = [ "cmd/server" ];
       tags = lib.optional embedFrontend "frontend";
-      env.CGO_ENABLED = "1";
 
       preBuild = lib.optionalString embedFrontend ''
         rm -rf internal/managementasset/dist