termux: declarative ~/.ssh/config + termux-api package

- home/termux.nix: programs.ssh.settings with the 7 known hosts
  (replaces hand-copied ~/.ssh/config; ssh aliases z-s/z-st/z-o/z-ot
  removed, lamet/pubray-1 kept since they have no Host entry)
- modules/termux/termux-api.nix: build termux-api 0.59.1 (cmake,
  am resolved from PATH, shebangs fixed); adds termux-battery-status,
  termux-notification, termux-clipboard-*, etc. Needs the Termux:API
  Android app (com.termux.api from F-Droid) as the actual backend
- mobile.nix: enable android-integration.am (termux-am backend for am)

configurations/mobile.nix

@@ -105,6 +105,9 @@ let
       time.timeZone = "Europe/Moscow";
 
       android-integration.termux-setup-storage.enable = true;
+
+      # Provides `am` (termux-am) — required by termux-api's broadcast backend.
+      android-integration.am.enable = true;
     };
 in
 inputs.nix-on-droid.lib.nixOnDroidConfiguration {

home/termux.nix

@@ -116,11 +116,8 @@
         # beets
         beet-ima = "beet im ./ -A";
 
-        # ssh
+        # ssh (hosts live in programs.ssh.settings below)
-        z-s = "ssh sapphira";
+        # NOTE: lamet / pubray-1 have no Host entry yet — kept as aliases.
-        z-st = "ssh sapphira-tailscale";
-        z-o = "ssh otreca";
-        z-ot = "ssh otreca-tailscale";
         z-l = "ssh lamet";
         z-lt = "ssh lamet-tailscale";
         z-p-1 = "ssh pubray-1";
@@ -229,5 +226,58 @@
         };
       };
     };
+
+    # ---- SSH ----
+    # Declarative ~/.ssh/config, same as the one previously copied by hand.
+    # matchBlocks is deprecated in current home-manager; use `settings`
+    # (bare attr names become `Host` headers, keys are upstream directives).
+    ssh = {
+      enable = true;
+      # Reproduce the old enableDefaultConfig values explicitly.
+      enableDefaultConfig = false;
+      settings = {
+        "*" = {
+          ForwardAgent = false;
+          AddKeysToAgent = "no";
+          Compression = false;
+          ServerAliveInterval = 0;
+          ServerAliveCountMax = 3;
+          HashKnownHosts = false;
+          UserKnownHostsFile = "~/.ssh/known_hosts";
+          ControlMaster = "no";
+          ControlPath = "~/.ssh/master-%r@%n:%p";
+          ControlPersist = "no";
+        };
+        sapphira = {
+          HostName = "192.168.1.20";
+          User = "oqyude";
+        };
+        sapphira-tailscale = {
+          HostName = "100.64.0.0";
+          User = "oqyude";
+        };
+        otreca-old = {
+          HostName = "217.60.3.12";
+          User = "oqyude";
+        };
+        otreca = {
+          HostName = "109.248.161.5";
+          User = "oqyude";
+        };
+        otreca-tailscale = {
+          HostName = "100.64.1.0";
+          User = "oqyude";
+        };
+        rydiwo = {
+          HostName = "192.168.1.102";
+          User = "oqyude";
+        };
+        epral = {
+          HostName = "192.168.1.101";
+          User = "oqyude";
+          Port = 8022;
+        };
+      };
+    };
   };
 }

modules/termux/default.nix

@@ -86,5 +86,10 @@ in
       #!${pkgs.runtimeShell}
       exec ${pkgs.openssh}/bin/sshd -f /etc/ssh/sshd_config -D "$@"
     '')
+
+    # termux-battery-status, termux-notification, termux-clipboard-*, ...
+    # Needs the Termux:API Android app (com.termux.api, from F-Droid) as the
+    # actual backend; see termux-api.nix.
+    (pkgs.callPackage ./termux-api.nix { })
   ];
 }

modules/termux/termux-api.nix

@@ -0,0 +1,60 @@
+# termux-api — C binary + scripts that talk to the Termux:API Android app.
+#
+# The Android app (com.termux.api, installed separately from F-Droid) is the
+# actual backend: `termux-api-broadcast` sends an `am broadcast` intent to
+# com.termux.api/.TermuxApiReceiver and pipes stdout/stdin over abstract unix
+# sockets. The nix side only provides the CLI entry points:
+#   termux-battery-status, termux-notification, termux-clipboard-*,
+#   termux-toast, termux-share, termux-dialog, ...
+#
+# Adaptations for nix-on-droid (upstream assumes termux's /data prefix):
+#   - `am` is resolved from PATH (provided by android-integration.am)
+#   - scripts' shebang rewritten from the substituted `#!$out/bin/sh`
+#   - termux-callback referenced by absolute store path
+{
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  runtimeShell,
+  lib,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "termux-api";
+  version = "0.59.1";
+
+  src = fetchFromGitHub {
+    owner = "termux";
+    repo = "termux-api-package";
+    rev = "v${version}";
+    sha256 = "1pkdjxll9x9arrifppl7y37dmni5fi4jng2wfx0dgbgriyjrhxl7";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  # termux-api.c hardcodes PREFIX for `am` and `termux-callback`. On
+  # nix-on-droid `am` comes from android-integration.am (termux-am) via PATH;
+  # termux-callback lives in our own libexec dir.
+  patchPhase = ''
+    substituteInPlace termux-api.c \
+      --replace 'execv(PREFIX "/bin/am", child_argv);' 'execvp("am", child_argv);' \
+      --replace 'execl(PREFIX "/libexec/termux-callback", "termux-callback", NULL);' 'execl("${placeholder "out"}/libexec/termux-callback", "termux-callback", NULL);' \
+      --replace 'execl(PREFIX "/libexec/termux-callback", "termux-callback", fds, NULL);' 'execl("${placeholder "out"}/libexec/termux-callback", "termux-callback", fds, NULL);'
+  '';
+
+  # CMake substitutes @TERMUX_PREFIX@ (= CMAKE_INSTALL_PREFIX = $out) into the
+  # scripts' shebang, producing `#!$out/bin/sh` which does not exist. Rewrite
+  # all shebangs to the nix runtime shell.
+  postInstall = ''
+    for f in $out/bin/termux-* $out/libexec/termux-callback; do
+      sed -i "1s|^#!.*|#!${runtimeShell}|" "$f"
+    done
+  '';
+
+  meta = {
+    description = "Termux API-RPC and companion package to launch API commands";
+    homepage = "https://github.com/termux/termux-api-package";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+  };
+}