update secrets

hosts/nb/modules/development/mcp-chromium.nix

@@ -0,0 +1,57 @@
+{ config, pkgs, lib, ... }:
+
+let
+  # Wrapper to launch Chromium on Wayland, scale=1, DevTools debugging on 127.0.0.1:9222
+  chromiumWaylandWrapper = pkgs.writeShellScriptBin "chromium-mcp" ''
+    exec ${pkgs.chromium}/bin/chromium \
+      --ozone-platform=wayland \
+      --enable-features=UseOzonePlatform \
+      --force-device-scale-factor=1 \
+      --remote-debugging-address=127.0.0.1 \
+      --remote-debugging-port=9222 \
+      "$@"
+  '';
+
+  # Desktop entry that uses our wrapper. The filename will be chromium.desktop
+  chromiumDesktopOverride = pkgs.makeDesktopItem {
+    name = "chromium";  # ← important: must match stock filename to override
+    desktopName = "Chromium";
+    genericName  = "Web Browser";
+    comment      = "Chromium on Wayland (scale=1) with DevTools remote debugging for MCP";
+    icon         = "chromium";
+    exec         = "${chromiumWaylandWrapper}/bin/chromium-mcp %U";
+    terminal     = false;
+    categories   = [ "Network" "WebBrowser" ];
+    mimeTypes = [
+      "text/html" "text/xml" "application/xhtml+xml"
+      "x-scheme-handler/http" "x-scheme-handler/https"
+      "x-scheme-handler/ftp"  "x-scheme-handler/chrome"
+    ];
+    # If you want extra desktop keys, you can add them as a raw block:
+  };
+in
+{
+  # Tools: Chromium, Node (for MCP server), our wrapper, and the desktop override
+  environment.systemPackages = [
+    pkgs.chromium
+    pkgs.nodejs_22   # 25.05 ships Node 22 LTS; works great for MCP servers
+    chromiumWaylandWrapper
+    chromiumDesktopOverride  # ← keep AFTER pkgs.chromium so our .desktop wins
+  ];
+
+  # Where Codex CLI reads config; we make it system-wide
+  environment.variables.CODEX_HOME = "/etc/codex";
+
+  # Codex CLI MCP config: wires Chrome DevTools MCP to the local DevTools port
+  environment.etc."codex/config.toml".text = ''
+    [mcp_servers.chrome-devtools]
+    command = "npx"
+    args = ["-y", "chrome-devtools-mcp@latest", "--browserUrl=http://127.0.0.1:9222"]
+    startup_timeout_sec = 30
+    tool_timeout_sec = 120
+  '';
+
+  # No firewall opening: binding to 127.0.0.1 only
+  # networking.firewall.allowedTCPPorts = [ 9222 ];
+}
+