feat(pdf2zh): pdf2zh podman definition and config

nixcfgs/secrets/secrets.yaml

@@ -1,4 +1,5 @@
 openrouter_api: ENC[AES256_GCM,data:ceu+FlTNrNoS56rHL9bdGjODfPBYnBd1GL97BgpmLvHz8q2KMXMvGofMTyZVGsLs1BEq4scjr+HN9r52tozLxeVWzkVfumcUMA==,iv:zT2vT94zAoKoutl58pbeOVqHm5nPmoMrA7wlZQcYVLs=,tag:+gS9EPcmfANCUipbeiAi0Q==,type:str]
+tavily_api: ENC[AES256_GCM,data:blrxGOW/kcTbR2taeWeadhrzdtZK5ete4+0KE6yrJi3ibaMkkCGa05M=,iv:v4oh8/lA2q6l60By3H6RDXqbmBUya2W5sYxX8vDkz1c=,tag:8vwSl1zQnG5/fWDOhp9eHQ==,type:str]
 sops:
     age:
         - recipient: age1mcvqpg39t32ll684r4m2l8j0l9zag6endg0h6zjw8svkgdwc4pjqkk5fvj
@@ -19,7 +20,7 @@ sops:
             c3ZZQlRrZDhtT2NFM0lnZTUxWmptQjgK5lZBkR5oSpb90oa+LWinEnvcmdPTF6wP
             Q1gJoVoT/krUu22VSTOj/ojKEzS6uamZnJkMBhH31f1w2j4TEtY5Lw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-03T09:13:13Z"
-    mac: ENC[AES256_GCM,data:1bZT8E/M7CQgfshQV1LKJAqWcyoYomG29y7zSp7THZ9lwA4+FVpBNXV1HLQru4CMs3N1pq8g1ww6KxtGZ92pUo+JxtRdT9GxzqJenCp2qzSo5d2ws5fFvvjLnOtoPcqXlMTchECeA3K/emwbmIfjCH63D5STZmBz7+dNbx5PY20=,iv:Wcv6PNwroQawHkjJpspN5mM0b+PZG5BQTP9jOKH0OTQ=,tag:N/d/O/zbVkkH8kZdlkZErQ==,type:str]
+    lastmodified: "2025-11-08T13:02:24Z"
+    mac: ENC[AES256_GCM,data:QtK4Eg9DLb2TK1M1kzIsyJs4p7pUBeslGTjDxjdzatXcst2AyCKV3f0vc3bPPyE7WkSx51B9I9YGaRq/GNMIH5o16AcVwd1VNTTI5kEO5p+4RJywO1eR+DXidsCIFPAA5Rgh3lJIxdUCcDucZ5o/bPWzbDelrb+/RD4X1VozPD4=,iv:TOmgT3EyAENFIA7JxgkZMk7ZYUKnWrVEH7WL9Dg3fnw=,tag:po0WBC5dze20F5x/f47WqQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0

nixcfgs/users/js0ny/programs/fzf.nix

@@ -1,14 +1,13 @@
 {...}: let
   editFzfPosix = ''
     edit-fzf() {
-        # 1. Declare a variable that is local to the function.
         local _file
 
         if command -v fd >/dev/null 2>&1; then
-            _file=$(fd --type f | fzf --height 40% --reverse -1 -q "$1")
+            _file=$(fd --type f --exclude '*.lock' | fzf --height 40% --reverse -1 -q "$1")
         else
             # Fallback to 'find'
-            _file=$(find . -type f | fzf --height 40% --reverse -1 -q "$1")
+            _file=$(find . -type f ! -name '*.lock' | fzf --height 40% --reverse -1 -q "$1")
         fi
 
         # In POSIX shell, if fzf is cancelled (Esc/Ctrl-C),
@@ -34,9 +33,9 @@ in {
         set -l file
 
         if command -q fd
-            set file (fd --type f | fzf --height 40% --reverse -1 -q "$argv[1]")
+            set file (fd --type f --exclude '*.lock' | fzf --height 40% --reverse -1 -q "$argv[1]")
         else
-            set file (find . -type f | fzf --height 40% --reverse -1 -q "$argv[1]")
+            set file (find . -type f ! -name '*.lock' | fzf --height 40% --reverse -1 -q "$argv[1]")
         end
 
         set -l fzf_status $status

nixcfgs/users/js0ny/programs/libreoffice.nix

@@ -1,6 +1,8 @@
 {pkgs, ...}: {
   home.packages = [pkgs.libreoffice];
   home.file.".local/share/kio/servicemenus/office2pdf.desktop" = {
+    enable = true;
+    executable = true;
     text = ''
       [Desktop Entry]
       Type=Service

nixcfgs/users/js0ny/programs/pdf2zh.nix

@@ -0,0 +1,52 @@
+{pkgs, ...}: let
+  imageTag = "ghcr.io/pdfmathtranslate/pdfmathtranslate-next";
+  # version = "2.6.4";
+  pdf2zhRunner = pkgs.writeShellScriptBin "pdf2zh" ''
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    IMAGE_TAG="${imageTag}"
+
+    if ! podman image exists "$IMAGE_TAG"; then
+      echo "[pdf2zh] Pulling image $IMAGE_TAG ..."
+      podman pull "$IMAGE_TAG"
+    fi
+
+    podman run --rm -it \
+      -p 7860:7860 \
+      -v "$(pwd):/data" \
+      -w /data \
+      "$IMAGE_TAG" "pdf2zh" "$@"
+  '';
+  descEn = "PDF scientific paper translation with preserved formats";
+  descZh = "基于 AI 完整保留排版的 PDF 文档全文双语翻译";
+in {
+  services.podman.enable = true;
+
+  # Declare an image, do not instantiate as a container
+  services.podman.images.pdf2zh = {
+    image = imageTag;
+    description = " ${descEn} - ${descZh}，支持 Google/DeepL/Ollama/OpenAI 等服务，提供 CLI/GUI/Docker";
+  };
+
+  home.packages = [pdf2zhRunner];
+
+  home.file.".local/share/kio/servicemenus/pdf2zh.desktop" = {
+    enable = true;
+    executable = true;
+    text = ''
+      [Desktop Entry]
+      Type=Service
+      MimeType=application/pdf;
+      Actions=translateToZh
+      Icon=translate
+      X-KDE-Priority=TopLevel
+      X-KDE-StartupNotify=false
+
+      [Desktop Action translateToZh]
+      Name=翻译为中文
+      Icon=translate
+      Exec=pdf2zh --openaicompatible "%f"
+    '';
+  };
+}

nixcfgs/users/js0ny/programs/sops.nix

@@ -1,27 +1,28 @@
-{config, ...}: {
+{
+  pkgs,
+  config,
+  ...
+}: {
+  home.packages = with pkgs; [
+    sops
+  ];
   sops = {
     # enable = true;
-    defaultSopsFile = ../../secrets/secrets.yaml;
+    defaultSopsFile = ../../../secrets/secrets.yaml;
     age.keyFile = "${config.xdg.configHome}/sops/age/keys.txt";
     age.generateKey = true;
     secrets = {
       "OPENROUTER_API_KEY" = {
         key = "openrouter_api";
       };
+      "TAVILY_API_KEY" = {
+        key = "tavily_api";
+      };
     };
   };
 
-  # home.sessionVariables = {
-  #   OPENROUTER_API_KEY = config.sops.secrets."OPENROUTER_API_KEY".path;
-  # };
-
-  systemd.user.services.sops-envvar = {
-    Unit.Description = "[sops-envvar] Auto-source environment variables defined via sops-nix";
-    Service = {
-      ExecStart = pkgs.writeShellScript "start" ''
-        export OPENROUTER_API_KEY=$(cat ${config.sops.secrets."OPENROUTER_API_KEY".path})
-      '';
-    };
-    Install.WantedBy = ["default.target"];
+  home.sessionVariables = {
+    OPENROUTER_API_KEY = "$(cat ${config.sops.secrets."OPENROUTER_API_KEY".path})";
+    TAVILY_API_KEY = "$(cat ${config.sops.secrets."TAVILY_API_KEY".path})";
   };
 }

nixcfgs/users/js0ny/zephyrus.nix

@@ -37,6 +37,8 @@
     ./programs/libreoffice.nix
     ./programs/nvim.nix
     ./programs/ollama.nix
+    ./programs/sops.nix
+    ./programs/pdf2zh.nix
 
     # Desktop Linux
     ./programs/desktop/plasma.nix
@@ -64,21 +66,5 @@
     rose-pine-cursor
   ];
 
-  sops = {
-    # enable = true;
-    defaultSopsFile = ../../secrets/secrets.yaml;
-    age.keyFile = "${config.xdg.configHome}/sops/age/keys.txt";
-    age.generateKey = true;
-    secrets = {
-      "OPENROUTER_API_KEY" = {
-        key = "openrouter_api";
-      };
-    };
-  };
-
-  home.sessionVariables = {
-    OPENROUTER_API_KEY = "$(cat ${config.sops.secrets."OPENROUTER_API_KEY".path})";
-  };
-
   home.stateVersion = "25.05";
 }