homehub: rsync-based home-drive sync via Synology hub

DESIGN.md is the rationale; README.md the operations half.
Four data classes: files (mtime-arbitrated two-way), git repos (manifest +
clone, never byte-synced), the browser link bar (union merge), and everything
else denied by default.

config

@@ -0,0 +1,64 @@
+# homehub configuration — sourced by bin/homehub (also readable by systemd units)
+# All paths are for user `bl` on the Synology hub `nas.lue.dk`.
+
+HUB_HOST=nas.lue.dk
+
+# NEVER point this at your Synology home directory. /volume1/homes/bl already
+# holds 178 G of unrelated legacy data (Documents, Photos, OneDrive, CloudStation,
+# home_backup, x1c_backup, wg-bo.conf, certs, ...) — pulling from it would merge
+# years of NAS files into ~/, and a tombstone could reap unrelated files by name
+# accident. The sync root is a dedicated subtree; .hub/ metadata lives inside it.
+HUB_BASE=/volume1/homes/bl
+HUB_PATH=$HUB_BASE/homehub
+
+# Dedicated, PASSPHRASE-LESS deploy key.  Your id_rsa is passphrase-protected and a
+# systemd *user* unit has no SSH_AUTH_SOCK, so using ~/.ssh/id_rsa here would make
+# every background sync fail with "Permission denied (publickey)" — forever, and
+# silently.  Run `homehub setup-key` and install the printed pubkey.
+HH_KEY=${HH_KEY:-$HOME/.ssh/homehub_ed25519}
+
+# Where this machine keeps homehub's OWN private state (generated filters, markers
+# cache, inventories, rsync logs, alert spool). NEVER SYNCED — hard-blocked in the
+# denylist, because syncing it makes machines overwrite each other's filters.
+STATE_ROOT=$HOME/.local/state/homehub
+
+# The SHARED state root: the one tree whose contents are shared verbatim between
+# machines, and the anchor that survives the NixOS migration unchanged (§8).
+# App state you want everywhere lives in $SHARED_ROOT/<name>/ and is symlinked
+# to wherever the app expects it.  Keep it distinct from STATE_ROOT above: sharing
+# homehub's own machinery between machines just makes them fight over it.
+SHARED_ROOT=$HOME/.local/state/shared
+
+# --- policy knobs -------------------------------------------------------------
+GRACE_DAYS=30           # tombstone age before the hub copy is reaped (§5)
+FRESH_MAX_AGE=86400     # alert if a live machine has not synced in 24 h
+ALIVE_FRESH=10800       # "machine is on" = heartbeat younger than 3 h
+REALERT_AGE=604800      # at most one alert per host per week
+TOMB_LIMIT=100          # refuse to apply more deletions than this in one run
+WARN_FILES=20000        # dry run warns above this many pending changes
+
+# Where to look for git repos for the class B manifest (DESIGN.md §6).
+GIT_DIRS="git src"
+
+# rc values treated as "machine is simply off the LAN" -> silent forever (§10)
+NET_RC="5 10 11 12 30 35 255"
+
+# --- alerting ----------------------------------------------------------------
+ALERT_TO=bl@lue.dk
+ALERT_FROM=homehub@lue.dk
+# Empty => auto-detect msmtp, then sendmail, else append to $STATE_ROOT/alerts.out
+ALERT_CMD=
+
+# --- class C: the bookmark bar ----------------------------------------------
+# NOTE the quotes: "Profile 5" contains a space, and an unquoted value here
+# silently breaks `. config` in every subshell.
+BOOKMARK_SRC="$HOME/.config/chromium/Profile 5/Bookmarks"
+BOOKMARK_PGREP='/usr/lib/chromium/chromium'
+
+# Absolute interpreter: PATH python3 here is /home/bl/.venv/bin/python3.
+PY=/usr/bin/python3
+[ -x "$PY" ] || PY=$(command -v python3)
+
+# rsync 3.1.2 on the NAS: do NOT add --ignore-older (needs >=3.2.3 on both ends).
+RSYNC_BIN=rsync
+SSH_TIMEOUT=10