guh

dotfiles/zsh-init.sh

@@ -170,7 +170,7 @@ export TMP=/tmp
 export TEMPDIR=/tmp
 export TMPDIR=/tmp
 
-. "$(which cwdcontrol)" hook
+CWDCONTROL="$(which cwdcontrol 2>/dev/null)" && . "$CWDCONTROL" hook
 
 # site vars, functions, and aliases
 if [ -e ~/.site_aliases.sh ]; then

modules/base-desktop.nix

@@ -88,6 +88,10 @@
             install_url = "file://${pkgs.cwdcontrol}/cwdcontrol.xpi";
             installation_mode = "force_installed";
           };
+          "onetab@nonexistenturl.net" = {
+            install_url = "file://${pkgs.onetab}/onetab.xpi";
+            installation_mode = "force_installed";
+          };
         };
       };
     };

modules/base.nix

@@ -95,6 +95,7 @@ in
       btop
       file
       nettools
+      lsof
       psmisc
       p7zip
       unzip
@@ -112,14 +113,12 @@ in
       pciutils
       usbutils
       nethogs
-      unar
       rhelmot.globalPython
     ];
 
     rhelmot.globalPythonPackages = [
       (
         p: with p; [
-          virtualenvwrapper
           pylint
           pytest
           ipdb

modules/workstation.nix

@@ -23,6 +23,7 @@
       foremost
       binwalk
       nix-index
+      nix-diff
       nixtamal.nixtamal
       cronie
       # radicle-node
@@ -31,6 +32,7 @@
       gcc
       bintools
       ffmpeg
+      unar
     ] ++ lib.optionals stdenv.hostPlatform.isLinux [
       rr
       qemu-user

nix/tamal/darcs_context/nixtamal.txt

@@ -2,6 +2,278 @@
 Context:
 
 
+[TAG 2.0.1
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929025731
+ Ignore-this: 15c782d32c0af5e20894989fcc67cc436f77d4b2decf5a296fcf4ff0a0daaf3d39bd334350148379
+ 
+ • BUG: lock loader syntax errors in the builtin Git fetcher block
+   (reported by rhelmot)
+ 
+   • “then … then” should be “then … else”
+   • stray }
+] 
+
+[tweak CHANGELOG for 2.0.1
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929025518
+ Ignore-this: e52097ab553464dbf5c5782f0d9db810b49ab5f0b20e5b81152c2bca921335f7cce91ef0258fd9e1
+] 
+
+[nix as check input
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929025306
+ Ignore-this: d1ae209393b69c62d9261291c295568f623ca2fb243293bfed1f8a2482f1b0e9afe1c0103d399dbc
+] 
+
+[lock loader test
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929025135
+ Ignore-this: 242bc1bce784504f65088ca89843efb3ee1f68bc430c1e54fb68e693c3aba593cf6db6e446b3a45a
+] 
+
+[add an all_features helper
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929023343
+ Ignore-this: c3e35723cc85f8c4fc62f3f2518856d6f5e6fa218b6852635b8baa90316f26464e2be16b2e1e8ad
+] 
+
+[lockfile: rename make → make_lockfile to not name conflict
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929023339
+ Ignore-this: f0cabec6200c55e8bfe0b5d0ce79265737e90a25e36748b39fbf7b8e115a18cc5c042c802e7a989
+] 
+
+[lockfile: t defaults to empty maps
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929021108
+ Ignore-this: 5a1256e87f33f87b86528bd6d1a508a28cbc0b039a90a4567f26104f98dcd4502b95fe29e034161a
+] 
+
+[verison: 2.0.0 → 2.0.1
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929014353
+ Ignore-this: d96b576e33d705ff4658cea54eed84b46db002a4b11a7277112b7e460b2cc5c3a8c7d481eaad0603
+] 
+
+[lock loader: stay } terminator
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929013744
+ Ignore-this: 2a7ea7b060cae37393cc2952241a2a9887bd409aedfd977bf460cb073466d2b6d5b7356c9c4da76b
+] 
+
+[lock loader typo: else → then
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929013031
+ Ignore-this: a8c24e572f6a449ddf0992dae49c59659c27e6135423a8174b30cf1b83244a50b2e570c5ae7c9f13
+] 
+
+[nixtamal refresh
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929012826
+ Ignore-this: 590bd905454b7d02ec7498feef7ed73c6f4b6d4cf51d8dcd7780297c12634f294ae8156d6c2bf09c
+] 
+
+[finish statement
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927113136
+ Ignore-this: c05bb6cd5e57e459524b11100a978f7baee407ff286a9cf6da67ce7d6c0b4a2927dd03d92c359b4f
+] 
+
+[TAG 2.0.0
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927111244
+ Ignore-this: 1a4859e6ed8720d8a309142732e5f40c04dd8eaf839e6d0f8001a2f60d03cfcf7807412521fd2adb
+ 
+ • Schema upgrade: 1.3.0 → 1.4.0
+ • BUG: Refresh/lock with --patch does not refresh/lock all inputs
+ • Lock loader refactored, now using Jingoo & a lot easier to maintain
+ • Remote patches now allow more complexity like inputs; this includes
+   frozen, name, & more importantly, their own fresh-cmd (requested by
+   pogo)
+ • extension support for Archive kinds give a hint to pkgs.fetchzip which
+   can be added as a child to archive in the manifest.kdl
+ • Zstandard support for pkgs.fetchzip by adding pkgs.zstd as a
+   nativeBuildInput in the lock loader (base gnutar is missing support)
+ • Nixpkgs Channels use Zstandard (.zst) over LZMA (.xz) which users will
+   get when running nixtamal set-up --use-channels …
+ • Add lock --relock alias for lock --force in case the “force”
+ • lock no longer refreshes patches naming isn’t clear enough to users
+ • use Eio 1.5 features for performance improvements
+ • use Eio 1.6 features to eliminate some Unix-only code + security
+] 
+
+[CHANGELOG: tweaks for 2.0.0
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927101547
+ Ignore-this: ff87ced13a236b23157a56ebd42da12628694e1746bd5fdf29e7308513f29fdfac0f236117506adf
+] 
+
+[version: 1.10.1 → 2.0.0
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927080107
+ Ignore-this: ed046be3ddedfe5e10174ce635b51a2235f6237ce3097dd1a48324184d60125ddabb92a1eebac49d
+] 
+
+[if a patch is specified, don’t lock/refresh all inputs too
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927075620
+ Ignore-this: 70c869af67ab3bbfc161cd78a682b360c7fa5344c4bf915196165b1a5bee9ac8b73faeb5c199c6c0
+] 
+
+[update docs for patches
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927075620
+ Ignore-this: 62d2fc469dd9d04c4fa974e79ca82a2a6ed9e17d49441d54a1d60e3560910ea5b33451d7ebb834c4
+] 
+
+[remote patches are now complex
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927075613
+ Ignore-this: 337805d60643d96f7d24bce41ac4c3f8513e66607c0ba572ea9b2b6ebd4d0d06b27aa0f70197e658
+] 
+
+[lock no longer refreshes patches
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927062046
+ Ignore-this: d9a1b89bc81b7c08b682fdb132ec6d4e8c7eeb7d650eca8ff5e304906458ed8b7184cbe56dff4fcf
+] 
+
+[use new lock loader
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927062046
+ Ignore-this: e30e048774dcb1e6ba82ab426153e6501a2251ba90236b767dec5e9f885698f8737a8da1d2713442
+] 
+
+[lock_loader as Jinja
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927062046
+ Ignore-this: e8098b5e56a0a9f8e4514dbab073123e5d87eae001d128079ed0f5cede422d35cb6251076bec195e
+] 
+
+[nixtamal refresh
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927062042
+ Ignore-this: 1fceab608a59c9168ffe59383bb4b768cf2051d8dca236168c82ed8e667b7d8cd35c400aeeafc5d2
+] 
+
+[Use Eio.Process.Env from 1.6 to get env vars
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
+ Ignore-this: c78d0de9d8a6253bebf254c296b4f90678e27f52400db207ae6550b507ad15efc95925654206d3b3
+] 
+
+[add ppx_blob
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
+ Ignore-this: f2c36b0992ece38bfaec541679b82db30c6c2b6d56eac75ee6778b4f1c151fb8421310cc1b5941b9
+ 
+ will be used for the Jingoo2 template version of the lock_loader
+] 
+
+[patches for using topiary in the ocaml-lsp
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
+ Ignore-this: e8a926e8bc96fa5b2d287765fcb281164112c69e717706d96ddf7040126cf29549d755accbb4bfca
+ 
+ testing my patches
+] 
+
+[add test
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
+ Ignore-this: ac5bd2d595bc65a65ee95954386d790788574ff61ad1af0cef827e4d2300a2d6634d2a5ae13c37b6
+] 
+
+[Eio 1.6 follow: false where reasonable for security
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
+ Ignore-this: 3d27485b42d97c1ba07cdfea89c1bd9147dcfd4507a0fe14e32bab32c8c7ab6f1d8879ebe1d263fd
+] 
+
+[eio 1.6 patches
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
+ Ignore-this: 9684ce372f27403965e1fab4702678925e0d303d26d4708ab40fefd67c2a111fb0c3a86deb2cd026
+] 
+
+[nixtamal refresh
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
+ Ignore-this: a24897e657d4584ff7e870b347c94fd205795271a3cb012ab37d7e3868c8dfa9f6d983abf4159cae
+] 
+
+[Add --relock flag alias to lock + tweak --force definition
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
+ Ignore-this: 8a5e9e5b730a65941c40a9b15126bd8c877c98d621ab584173ee1251ccc8d46aa415bcd2a6e910ed
+] 
+
+[matching is more readable + remove duplicate check
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
+ Ignore-this: 3bec76cfa68998d7214750a0abaf65b415c4529d01a49f7a4af9cb56691357edb861124331bc7957
+] 
+
+[Use module ADT over polymorphic variant for Fresh_result
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
+ Ignore-this: 4868907dde875712ad4289e3c56a89f204beae8b1a2f67e8763e06e0beba71eb97dfe761b9f8acda
+] 
+
+[nixtamal upgrade
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160231
+ Ignore-this: 6e181e510f1f9204f4c05795898f960328abe8ea7c3f314b893362e7709effd7ca51d3afb10652cf
+] 
+
+[lock loader: add zstd to fetchzip
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260921061423
+ Ignore-this: 44dbda0d3d005848474a45142033b618a586e8b2b8efe8dd504de8eb7687e49aaa05f07a52ffec30
+] 
+
+[upgrades to tests
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260921054200
+ Ignore-this: 231ae275672c544590a3194ca2d4db391e022cca3a9f4cddf6e55fdb61c9ae52a7d8da06afe017e
+] 
+
+[Schema 1.4.0 upgrades
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260921054200
+ Ignore-this: cdb8cc8307d242b2a695c80b020fcf608cd444628a1599903b39af1f1bb3e64b768910fd9ae9eb00
+] 
+
+[add extension support to Archive + schema 1.4.0
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260921054154
+ Ignore-this: e60560522bd29fa2502a1071c614701654e9c39ca7cdd16c535483fad98895d82c9c5900c267984e
+] 
+
+[nixtamal refresh
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260921032946
+ Ignore-this: ffda8ab365965caff6e0c915d68adcfd35008489d13dc868c36fb599a4f4bf5b38141385d5d651f6
+] 
+
+[opt out of unused/new typegist
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260917012234
+ Ignore-this: c926502cc3f324ae45643f19c9167d7e58a38b64ff24b7dbe86c5ed911c5b94c0427a2a8d734bfab
+] 
+
+[nixtamal refresh
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260917011031
+ Ignore-this: c081fc4688e04ea7b1240e1bb5ce4165d0b35d4f9a09b5fb6a83390db748dee5b320dc3800a0357a
+] 
+
+[update nixfmt-with-tabs patch
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260914232329
+ Ignore-this: c1d0e4391da2aca62ff7292d071fa36db571678a7e142d175ebdfae229fb6a7d2005318b62a88202
+] 
+
+[nixtamal refresh
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260914232322
+ Ignore-this: 9ff920e2f77b6d6707bb51835423555f51511f0c817b36359b56e7fae5a591bc4f6dcd45cc2a9a5b
+] 
+
+[use Eio 1.5 features for performance improvements
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260910134436
+ Ignore-this: 8990a90f8f57e51a70bde3113f75e3cc78f1ae661117684f6796439c3e08fb750e5bb0689e30bc8b
+] 
+
+[nixtamal refresh
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260910044106
+ Ignore-this: ccf58a4bd461db91f9770b9eae59653bf9d0b71fc2e38b8b5d880fed3b2210de52e160de2373967d
+] 
+
+[channels cmd docs improved + -c
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260909022227
+ Ignore-this: 52494ebdbfc2fbf93e7a762f8aa3414e6aa20aeafc8cb2d594fda4fadaf94ead5b2447402eef54b8
+] 
+
+[nix channels: xz → zstd
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260909021833
+ Ignore-this: dab2ae3abcc562647fee8cbd602ae3ad8aebfddda73ef84ac30e335b0d47827022c9ebf6f61b18a5
+] 
+
+[nixtamal refresh
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260909021144
+ Ignore-this: 23017f0d834ead3a7563ae2098c07f3d4a85e26f8390b992a9f9b6a5a676ac8b7f1dccc78507638a
+] 
+
+[remove unused release
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260902143345
+ Ignore-this: d801ef79c32c7813ab5e2ae3e2edb408e3abb51771e91d6c9dfef7265a03e2217eaec661c52f13e7
+] 
+
+[add posix
+·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260902013348
+ Ignore-this: ef91780fe41603ef973004140261138fc20df9072aa5009e474d75b589d32c60beede5a320a835e
+] 
+
 [TAG 1.10.1
 ·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260830051636
  Ignore-this: 2d48bf5438f5d0b47be18cd7ed281af615047e64dd8367688837145764791fa3c409925dcdb0ff6b

nix/tamal/default.nix

@@ -3,23 +3,21 @@ SPDX-FileCopyrightText: 2025–2026 toastal
 SPDX-FileCopyrightText: 2026 Nixtamal contributors
 SPDX-License-Identifier: ISC
 
-Permission to use, copy, modify, and/or distribute this software for any
+Permission to use, copy, modify, and/or distribute this software for any purpose
-purpose with or without fee is hereby granted, provided that the above
+with or without fee is hereby granted, provided that the above copyright notice
-copyright notice & this permission notice appear in all copies.
+& this permission notice appear in all copies.
 
-THE SOFTWARE IS PROVIDED “AS IS” & ISC DISCLAIMS ALL WARRANTIES WITH REGARD
+THE SOFTWARE IS PROVIDED “AS IS” & ISC DISCLAIMS ALL WARRANTIES WITH REGARD TO
-TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY &
+THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY & FITNESS. IN
-FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT,
+NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
-OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
+DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
-USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
-TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
+OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-OF THIS SOFTWARE.
+────────────────────────────────────────────────────────────────────────────────
-
-──────────────────────────────────────────────────────────────────────────────
 ┏┓╻+╻ ╱┏┳┓┏┓┏┳┓┏┓╻
 ┃┃┃┃┗━┓╹┃╹┣┫┃┃┃┣┫┃   This file was generated by Nixtamal.
 ╹┗┛╹╱ ╹ ╹ ╹╹╹ ╹╹╹┗┛  Do not edit as it will be overwritten.
-──────────────────────────────────────────────────────────────────────────────
+────────────────────────────────────────────────────────────────────────────────
 */
 {
 	system ? builtins.currentSystem,
@@ -29,15 +27,20 @@ OF THIS SOFTWARE.
 }:
 
 let lock = builtins.fromJSON (builtins.readFile ./lock.json); in
-assert (lock.v == "1.3.0");
+assert (lock.v == "1.4.0");
 let
-	local-patches = {};
+	isNonemptyString = x: builtins.isString x && x != "";
+
+	isNonemptyList = xs: builtins.isList xs && xs != [ ];
+
 	hash-token = {
 		"0" = "sha256";
 		"1" = "sha512";
 		"2" = "blake3";
 	};
 
+	local-patches = { };
+
 	try-fetch = input-name: fetcher:
 		let
 			try-fetch' = failed-urls: url: urls:
@@ -46,7 +49,7 @@ let
 					result.value
 				else
 					let failed-urls' = [ url ] ++ failed-urls; in
-					if builtins.length urls <= 0 then
+					if urls == [ ] then
 						let fus = builtins.concatStringsSep " " failed-urls'; in
 						throw "Input 「${input-name}」fetchable @ [ ${fus} ]"
 					else
@@ -54,16 +57,16 @@ let
 		in
 		try-fetch' [ ];
 
-	builtin-fetch-tarball = {input-name, name, kind, hash}:
+	builtin-fetch-tarball = { input-name, name, kind, hash }:
 		try-fetch input-name (url:
 			builtins.fetchTarball ({
 				inherit url;
 				${hash-token.${builtins.toString hash.al}} = hash.vl;
 			}
-			// (if name != null then {inherit name;} else {}))
+			// (if isNonemptyString name then { inherit name; } else { }))
 		) kind.ur kind.ms;
 
-	builtin-fetch-git = {input-name, name, kind}:
+	builtin-fetch-git = { input-name, name, kind }:
 		let
 			ref =
 				let
@@ -85,80 +88,67 @@ let
 					inherit url ref;
 					rev = kind.lr;
 					submodules = kind.sm;
-					lfs = kind.lf;
 					shallow = true;
 				}
-				// (if name != null then {inherit name;} else {});
+				// (if builtins.compareVersions builtins.nixVersion "2.26" < 0 then { } else { lfs = kind.lf; })
-				args' =
+				// (if isNonemptyString name then { inherit name; } else { });
-					if builtins.compareVersions builtins.nixVersion "2.26" < 0 then
-						builtins.removeAttrs args [ "lfs" ]
-					else
-						args;
 			in
-			builtins.fetchGit args'
+			builtins.fetchGit args
 		) kind.rp kind.ms;
 
 	builtin-to-input = input-name: input:
 		let
 			name = input.sn;
 			hash = input.ha;
+			kind = builtins.elemAt input.kd 1;
 			k = builtins.head input.kd;
 		in
 		if k == 1 then
-			builtin-fetch-tarball {
+			builtin-fetch-tarball { inherit input-name name hash kind; }
-				inherit name;
-				input-name = input-name;
-				kind = builtins.elemAt input.kd 1;
-				hash = input.ha;
-			}
 		else if k == 2 then
-			builtin-fetch-git {
+			builtin-fetch-git { inherit input-name name kind; }
-				inherit name;
-				input-name = input-name;
-				kind = builtins.elemAt input.kd 1;
-			}
-		else if k == 3 then
-			fetch-darcs {
-				inherit name;
-				input-name = input-name;
-				kind = builtins.elemAt input.kd 1;
-				hash = input.ha;
-			}
 		else
-			throw "Unsupported input kind “${builtins.toString k}”.";
+			throw "Unsupported builtin fetcher “${builtins.toString k}”";
 
-	nixpkgs' =
+	local-bootstrap-nixpkgs =
-		if builtins.isNull bootstrap-nixpkgs then
+		if builtins.isAttrs bootstrap-nixpkgs then
-			builtin-to-input "nixpkgs-for-nixtamal" (
+			bootstrap-nixpkgs
+		else
+			builtin-to-input "bootstrap-nixpkgs-for-nixtamal" (
 				if builtins.isString bootstrap-nixpkgs-lock-name then
 					lock.i.${bootstrap-nixpkgs-lock-name}
 				else
 					lock.i.nixpkgs-nixtamal or lock.i.nixpkgs
-			)
+			);
-		else
-			bootstrap-nixpkgs;
 
 	pkgs =
 		if builtins.isAttrs bootstrap-pkgs then
 			bootstrap-pkgs
 		else
-			import nixpkgs' {inherit system;};
+			import local-bootstrap-nixpkgs { inherit system; };
 
 	inherit (pkgs) lib;
 
-	fetch-zip = {input-name, name, kind, hash}: pkgs.fetchzip ({
-		url = kind.ur;
-		hash = hash.vl;
-	}
-	// lib.optionalAttrs (name != null) {inherit name;}
-	// lib.optionalAttrs (builtins.length kind.ms > 0) {urls = kind.ms;});
 
-	fetch-git = {input-name, name, kind, hash}:
+	fetch-zip = { input-name, name, kind, hash }:
+		pkgs.fetchzip (
+			{
+				# base gnutar doesn’t support Zstandard
+				nativeBuildInputs = [ pkgs.zstd ];
+				url = kind.ur;
+				hash = hash.vl;
+			}
+			// lib.optionalAttrs (isNonemptyString name) { inherit name; }
+			// lib.optionalAttrs (isNonemptyList kind.ms) { urls = kind.ms; }
+			// lib.optionalAttrs (isNonemptyString kind.ex) { extension = kind.ex; }
+		);
+
+	fetch-git = { input-name, name, kind, hash }:
 		let
-			using-mirrors = kind ? ms && (builtins.length kind.ms) > 0;
+			has-mirrors = isNonemptyList kind.ms;
-			mirror-support = pkgs.fetchgit.__functionArgs ? "mirrors";
+			has-mirror-support = pkgs.fetchgit.__functionArgs ? "mirrors";
 		in
-		lib.warnIf (using-mirrors && !mirror-support)
+		lib.warnIf (has-mirrors && !has-mirror-support)
 			"Upstream pkgs.fetchgit doesn’t yet support mirrors for 「${input-name}」"
 			pkgs.fetchgit ({
 				url = kind.rp;
@@ -168,23 +158,22 @@ let
 				deepClone = false;
 				hash = hash.vl;
 			}
-			// lib.optionalAttrs (name != null) {inherit name;}
+			// lib.optionalAttrs (isNonemptyString name) { inherit name; }
-			// lib.optionalAttrs (using-mirrors && mirror-support) {
+			// lib.optionalAttrs (has-mirrors && has-mirror-support) { mirrors = kind.ms; }
-				mirrors = kind.ms;
+		);
-			});
 
-	fetch-darcs = {input-name, name, kind, hash}:
+	fetch-darcs = { input-name, name, kind, hash }:
 		let
-			using-mirrors = kind ? ms && (builtins.length kind.ms) > 0;
+			has-mirrors = isNonemptyList kind.ms;
-			mirror-support = pkgs.fetchdarcs.__functionArgs ? "mirrors";
+			has-mirror-support = pkgs.fetchdarcs.__functionArgs ? "mirrors";
 			reference =
 				let
 					type = builtins.elemAt kind.rf 0;
 					value = builtins.elemAt kind.rf 1;
 				in
 				if type == 0 then
-					let ctx_path = builtins.elemAt value 1; in
+					let ctx-path = builtins.elemAt value 1; in
-					assert (lib.hasSuffix ".txt" ctx_path);
+					assert (lib.hasSuffix ".txt" ctx-path);
 					let
 						txt-files = lib.sourceFilesBySuffices ./. [ ".txt" ];
 						dir = lib.fileset.toSource {
@@ -192,71 +181,66 @@ let
 							fileset = lib.fileset.fromSource txt-files;
 						};
 					in
-					{context = "${dir}/${ctx_path}";}
+					{ context = "${dir}/${ctx-path}"; }
 				else if type == 1 then
-					{rev = value;}
+					{ rev = value; }
 				else
 					throw "Invalid Darcs reference";
 		in
-		lib.warnIf (using-mirrors && !mirror-support)
+		lib.warnIf (has-mirrors && !has-mirror-support)
 			"Upstream pkgs.fetchdarcs doesn’t yet support mirrors for 「${input-name}」"
-			pkgs.fetchdarcs ({
+			pkgs.fetchdarcs (
-				url = kind.rp;
+				{
-				hash = hash.vl;
+					url = kind.rp;
-			}
+					hash = hash.vl;
-			// lib.optionalAttrs (name != null) {inherit name;}
+				}
-			// reference // lib.optionalAttrs (using-mirrors && mirror-support) {
+				// reference
-				mirrors = kind.ms;
+				// lib.optionalAttrs (isNonemptyString name) { inherit name; }
-			});
+				// lib.optionalAttrs (has-mirrors && has-mirror-support) { mirrors = kind.ms; }
+			);
 
-	fetch-patch = patch-name: {ur, ha}:
+
+	fetch-patch = patch-name: { ur, ha, sn ? null, ... }:
 		pkgs.fetchpatch2 {
 			url = ur;
 			hash = ha.vl;
+			name = if isNonemptyString sn then sn else "${patch-name}-patch";
 		};
 
 	to-input = input-name: input:
 		let
 			name = input.sn;
 			hash = input.ha;
+			kind = builtins.elemAt input.kd 1;
 			k = builtins.head input.kd;
 			raw-input =
-				if k == 1 then
+				if k == 3 then
-					let
+					fetch-darcs { inherit input-name name kind hash; }
-						kind = builtins.elemAt input.kd 1;
+				else if k == 1 then
-						fetch_time = kind.ft;
+					let fetch-time = kind.ft; in
-					in
+					if fetch-time == 0 then
-					if fetch_time == 0 then
+						fetch-zip { inherit input-name name kind hash; }
-						fetch-zip {inherit input-name name kind hash;}
+					else if fetch-time == 1 then
-					else if fetch_time == 1 then
+						builtin-fetch-tarball { inherit input-name name kind hash; }
-						builtin-fetch-tarball {inherit input-name name kind hash;}
 					else
-						throw "Unsupported fetch time ${fetch_time}."
+						throw "Unsupported fetch time ${fetch-time}."
 				else if k == 2 then
-					let
+					let fetch-time = kind.ft; in
-						kind = builtins.elemAt input.kd 1;
+					if fetch-time == 0 then
-						fetch_time = kind.ft;
+						fetch-git { inherit input-name name kind hash; }
-					in
+					else if fetch-time == 1 then
-					if fetch_time == 0 then
+						builtin-fetch-git { inherit input-name name kind; }
-						fetch-git {inherit input-name name kind hash;}
-					else if fetch_time == 1 then
-						builtin-fetch-git {inherit input-name name kind;}
 					else
-						throw "Unsupported fetch time ${fetch_time}."
+						throw "Unsupported fetch time ${fetch-time}."
-				else if k == 3 then
-					let
-						kind = builtins.elemAt input.kd 1;
-					in
-					fetch-darcs {inherit input-name name kind hash;}
 				else
-					throw "Unsupported input kind “${builtins.toString k}”.";
+					throw "Unsupported input kind “${builtins.toString k}”";
 		in
-		if builtins.length input.ps == 0 then
+		if input.ps == [ ] then
 			raw-input
 		else
 			pkgs.applyPatches {
 				src = raw-input;
-				name = "${if name != null then name else "src"}-patched";
+				name = "${if isNonemptyString name then name else "src"}-patched";
 				patches = map (p:
 					if local-patches ? "${p}" then
 						local-patches."${p}"

nix/tamal/lock.json

@@ -1,13 +1,15 @@
-{"v":"1.3.0"
+{"v":"1.4.0"
 ,"i":{
-"nixpkgs":{"sn":"nixpkgs-src","kd":[1,{"ft":0,"ur":"https://github.com/NixOS/nixpkgs/archive/e94cb152ed51bd6e24eb4a41f1460252beb52cd2.tar.gz","ms":[]}],"ha":{"al":0,"vl":"sha256-VVTPf+Hyd5ebpjBMHmrLMSBIeW6ls48Bqtosj7CNKLA="},"fv":"e94cb152ed51bd6e24eb4a41f1460252beb52cd2","ps":["declarative-kts"]}
+"nixpkgs":{"sn":"nixpkgs-src","kd":[1,{"ft":0,"ur":"https://github.com/NixOS/nixpkgs/archive/e94cb152ed51bd6e24eb4a41f1460252beb52cd2.tar.gz","ms":[],"ex":null}],"ha":{"al":0,"vl":"sha256-VVTPf+Hyd5ebpjBMHmrLMSBIeW6ls48Bqtosj7CNKLA="},"fv":"e94cb152ed51bd6e24eb4a41f1460252beb52cd2","ps":["declarative-kts","php-cross","keycloak-cross"]}
-,"bingosync":{"sn":"bingosync-src","kd":[2,{"ft":0,"rp":"https://github.com/rhelmot/bingosync","ms":[],"rf":[0,"refs/heads/main"],"dt":"2026-09-25T21:26:10-07:00","sm":false,"lf":false,"lr":"68b178376fe80cdb66a3150e7d7a284219a106eb"}],"ha":{"al":0,"vl":"sha256-77X6EKpJUcMo4UjYwv3upef9HoZZahA9tCGYjMS0kno="},"fv":"68b178376fe80cdb66a3150e7d7a284219a106eb","ps":[]}
+,"bingosync":{"sn":"bingosync-src","kd":[2,{"ft":0,"rp":"https://github.com/rhelmot/bingosync","ms":[],"rf":[0,"refs/heads/main"],"dt":"2026-09-28T19:46:15-07:00","sm":false,"lf":false,"lr":"aee0d0927a26c0b2b0df595b81f51ef16a22d32d"}],"ha":{"al":0,"vl":"sha256-2lwEM7HMYi7PnQ2esWIMnw7GShglLJ6YSQg5bhyzt5w="},"fv":"aee0d0927a26c0b2b0df595b81f51ef16a22d32d","ps":[]}
 ,"blog-rhelmot-io":{"sn":"blog-rhelmot-io-src","kd":[2,{"ft":0,"rp":"https://git.lain.faith/rhelmot/blog.rhelmot.io","ms":[],"rf":[0,"refs/heads/main"],"dt":"2026-09-13T12:36:06-07:00","sm":false,"lf":false,"lr":"59f5e8ddbcd054f45223c0be9dfdd401208de1af"}],"ha":{"al":0,"vl":"sha256-Tte2UlB1UMCcE7YVnpxKic8n8vtigivWJIV3ctTwWB0="},"fv":"59f5e8ddbcd054f45223c0be9dfdd401208de1af","ps":[]}
-,"cwdcontrol":{"sn":"cwdcontrol-src","kd":[2,{"ft":0,"rp":"https://git.lain.faith/rhelmot/cwdcontrol","ms":[],"rf":[0,"refs/heads/main"],"dt":"2026-09-25T21:35:06-07:00","sm":false,"lf":false,"lr":"2e2505e5cf55c5944914183577c39049642357c3"}],"ha":{"al":0,"vl":"sha256-EvCdkfTL0DLUApahLVUR8mPabhWEslAho7dKpL2bG4I="},"fv":"2e2505e5cf55c5944914183577c39049642357c3","ps":[]}
+,"cwdcontrol":{"sn":"cwdcontrol-src","kd":[2,{"ft":0,"rp":"https://git.lain.faith/rhelmot/cwdcontrol","ms":[],"rf":[0,"refs/heads/main"],"dt":"2026-10-02T13:36:59-07:00","sm":false,"lf":false,"lr":"8640f564373016be045641daab241ced0a2c593a"}],"ha":{"al":0,"vl":"sha256-/Mpmsw/HwVJT50YYxgYaLjPsDbYRBxHx1BNdDEXayM8="},"fv":"8640f564373016be045641daab241ced0a2c593a","ps":[]}
 ,"home-manager":{"sn":"home-manager-src","kd":[2,{"ft":0,"rp":"https://github.com/nix-community/home-manager","ms":[],"rf":[0,"refs/heads/master"],"dt":"2026-09-25T14:51:25-05:00","sm":false,"lf":false,"lr":"7b4c5ec4bedaf1e062bbc1bcaeddbc6bd242aa1b"}],"ha":{"al":0,"vl":"sha256-iQ0ebhiVo64NktTnwft9hNxlFu4j5cvljVxyJaEVIP4="},"fv":"7b4c5ec4bedaf1e062bbc1bcaeddbc6bd242aa1b","ps":[]}
-,"nixtamal":{"sn":"nixtamal-src","kd":[3,{"rp":"https://darcs.toastal.in.th/nixtamal/stable","ms":["https://smeder.ee/~toastal/nixtamal.darcs"],"dt":"2026-08-30T05:16:36Z","rf":[0,[0,"./darcs_context/nixtamal.txt"]],"lw":"c85cce1e776eb12845d8280639ce5bbf12092048"}],"ha":{"al":0,"vl":"sha256-cKYsuwUq2IVr50Tnc7qzMZANkldFAVDaXFWfgx7i8Ks="},"fv":"c85cce1e776eb12845d8280639ce5bbf12092048","ps":[]}
+,"nixtamal":{"sn":"nixtamal-src","kd":[3,{"rp":"https://darcs.toastal.in.th/nixtamal/stable","ms":["https://smeder.ee/~toastal/nixtamal.darcs"],"dt":"2026-09-29T02:57:31Z","rf":[0,[0,"./darcs_context/nixtamal.txt"]],"lw":"937878799aa0d47e270be305284099963f40f2d4"}],"ha":{"al":0,"vl":"sha256-KECJUCvlQz6YpDpktlmLSMiBZPn4qZkA0Ye3aaHHi0Q="},"fv":"937878799aa0d47e270be305284099963f40f2d4","ps":[]}
 }
 ,"p":{
-"declarative-kts":{"ur":"https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/518336.patch","ha":{"al":0,"vl":"sha256-DmY05efj6QtlBhLfN2Pc/nPWf5E23dyHYIhwSqagUwA="}}
+"declarative-kts":{"ur":"https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/518336.patch","ha":{"al":0,"vl":"sha256-DmY05efj6QtlBhLfN2Pc/nPWf5E23dyHYIhwSqagUwA="},"fv":null,"sn":"declarative-kts-patch"}
+,"keycloak-cross":{"ur":"https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/567319.patch","ha":{"al":0,"vl":"sha256-GpnRTr6kAYvL88WcgarPN5tMkEblukoYBw2CiJO7k9g="},"fv":null,"sn":"keycloak-cross-patch"}
+,"php-cross":{"ur":"https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/567068.patch","ha":{"al":0,"vl":"sha256-JBKr2LN6y/R0/uFV23gWxbdwOY4c+8BFrm4bsY/ZaTE="},"fv":null,"sn":"php-cross-patch"}
 }
 }

nix/tamal/manifest.kdl

@@ -1,9 +1,11 @@
 // ┏┓╻+╻ ╱┏┳┓┏┓┏┳┓┏┓╻
 // ┃┃┃┃┗━┓╹┃╹┣┫┃┃┃┣┫┃   Read the manpage:
 // ╹┗┛╹╱ ╹ ╹ ╹╹╹ ╹╹╹┗┛  $ man nixtamal-manifest
-version "1.3.0"
+version "1.4.0"
 patches {
 	declarative-kts "https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/518336.patch"
+	php-cross "https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/567068.patch"
+	keycloak-cross "https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/567319.patch"
 }
 inputs {
 	nixpkgs {
@@ -15,7 +17,7 @@ inputs {
 			$ git ls-remote "https://github.com/NixOS/nixpkgs.git" --refs "refs/heads/nixos-unstable"
 			| cut -f1
 		}
-		patches declarative-kts
+		patches declarative-kts php-cross keycloak-cross
 	}
 	home-manager {
 		git {

overlays/packages.nix

@@ -49,4 +49,14 @@ final: prev: {
       libbs = final'.callPackage ../pkgs/libbs.nix { };
     })
   ];
+  onetab = final.callPackage ../pkgs/onetab.nix {};
+  egl-wayland = prev.egl-wayland.overrideAttrs {
+    version = "1.1.23";
+    src = final.fetchFromGitHub {
+      owner = "NVIDIA";
+      repo = "egl-wayland";
+      rev = "2a953fc86ca5707466ff28c117b0b72de87d9316";
+      hash = "sha256-M+s2R0vSDCEN9lMma6RiJTqzUgClnszwS4aKBJeBvFQ=";
+    };
+  };
 }

pkgs/onetab.nix

@@ -0,0 +1,28 @@
+{
+    stdenv,
+    fetchFromSourcehut,
+    zip,
+}:
+stdenv.mkDerivation {
+    pname = "onetab";
+    version = "0.1.0";
+    src = fetchFromSourcehut {
+        owner = "~rhelmot";
+        repo = "onetab";
+        rev = "bf7c09d98a590c8fac62266ecf82962c3c793b5e";
+        hash = "sha256-AmzUPVcPH11oHRm0RDOiimEY3C54JivADEPbkFVW+nE=";
+    };
+
+    nativeBuildInputs = [
+      zip
+    ];
+
+    postBuild = ''
+      ./build
+    '';
+
+    postInstall = ''
+      mkdir -p $out
+      mv ../onetab.zip $out/onetab.xpi
+    '';
+}

sites/clove/configuration.nix

@@ -49,13 +49,13 @@
   #  writableDir = "/var/lib/celeste";
   #};
 
-  boot.binfmt.emulatedSystems = [
+  # boot.binfmt.emulatedSystems = [
-    "aarch64-linux"
+  #   "aarch64-linux"
-    "mips-linux"
+  #   "mips-linux"
-    "mipsel-linux"
+  #   "mipsel-linux"
-    "armv7l-linux"
+  #   "armv7l-linux"
-  ];
+  # ];
-  boot.binfmt.preferStaticEmulators = true;
+  # boot.binfmt.preferStaticEmulators = true;
 
   programs.steam.enable = true;
   programs.steam.gamescopeSession.enable = true;

sites/hydrangea/configuration.nix

@@ -326,6 +326,7 @@
     ];
     settings = {
       tz = "local";
+      httpd.cookie_lifetime = "720";
       httpd.bindings = [
         {
           port = 3006;
@@ -380,10 +381,12 @@
   systemd.services.aria2 = {
     wants = [ "openvpn-nordvpn.service" ];
     after = [ "openvpn-nordvpn.service" ];
+    serviceConfig.UMask = lib.mkForce "0002";
   };
-  users.users.audrey.extraGroups = [ "aria2" ];
+  users.users.audrey.extraGroups = [ "sftpgo" "aria2" ];
+  users.users.jellyfin.extraGroups = [ "sftpgo" "aria2" ];
+  users.users.aria2.extraGroups = [ "sftpgo" ];
   users.users.sftpgo.extraGroups = [ "aria2" ];
-  users.users.jellyfin.extraGroups = [ "sftpgo" ];
 
   services.openvpn = {
     servers.nordvpn = {
@@ -393,6 +396,23 @@
     };
   };
 
+  systemd.network.networks.nordvpn = {
+    name = "tun0";
+    address = [ "10.100.0.2" ];
+    routes = [
+      {
+        Gateway = "0.0.0.0";
+        Table = "10";
+      }
+    ];
+    routingPolicyRules = [
+      {
+        From = "10.100.0.2";
+        Table = "10";
+      }
+    ];
+  };
+
   services.radicle = {
     enable = false;
     privateKey = "/var/lib/radicle/keys/radicle";

sites/hydrangea/hardware-configuration.nix

@@ -25,6 +25,7 @@
     "main/jellyfin/cache".mountPoint = "/var/cache/jellyfin";
     "main/jellyfin/library".mountPoint = "/var/lib/jellyfin/library";
     "main/radicle".mountPoint = "/var/lib/radicle";
+    "main/aria2".mountPoint = "/var/lib/aria2/Downloads";
   };
 
   fileSystems."/boot" = {
@@ -35,4 +36,18 @@
       "dmask=0022"
     ];
   };
+
+  swapDevices = [
+    # /dev/nvme0n1p3
+    { device = "/dev/disk/by-partuuid/1d1f5875-7879-11ee-8f2a-7cc255275618"; priority = 4096; }
+    # /dev/sd?1
+    { device = "/dev/disk/by-partuuid/f24dd684-8201-11ee-b4f3-7cc255275618"; priority = 2048; }
+    { device = "/dev/disk/by-partuuid/f230749d-8201-11ee-b4f3-7cc255275618"; priority = 2048; }
+    { device = "/dev/disk/by-partuuid/f2282ec5-8201-11ee-b4f3-7cc255275618"; priority = 2048; }
+    { device = "/dev/disk/by-partuuid/f23453fa-8201-11ee-b4f3-7cc255275618"; priority = 2048; }
+    { device = "/dev/disk/by-partuuid/9caa659b-04fb-11ef-b641-7cc255275618"; priority = 2048; }
+    { device = "/dev/disk/by-partuuid/9c825eb4-04fb-11ef-b641-7cc255275618"; priority = 2048; }
+    { device = "/dev/disk/by-partuuid/9c889103-04fb-11ef-b641-7cc255275618"; priority = 2048; }
+    { device = "/dev/disk/by-partuuid/9c978ead-04fb-11ef-b641-7cc255275618"; priority = 2048; }
+  ];
 }

sites/tulip/anonsee.nix

@@ -6,55 +6,55 @@
 let
   wp-hestia = pkgs.stdenv.mkDerivation rec {
     name = "hestia";
-    version = "3.3.3";
+    version = "3.3.6";
     src = pkgs.fetchzip {
       url = "https://downloads.wordpress.org/theme/${name}.${version}.zip";
-      hash = "sha256-hDHG6UdIriF07Uk5hlUuWUriBVtY3XBoma8tl733yrw=";
+      hash = "sha256-ouFycwkK0Gy/65jD4qwm0iHG1PXSEDUnJQztNUMWu3o=";
     };
     installPhase = "mkdir -p $out; cp -R * $out/";
   };
   wp-lightning = pkgs.stdenv.mkDerivation rec {
     name = "lightning";
-    version = "15.32.1";
+    version = "15.42.0";
     src = pkgs.fetchzip {
       url = "https://downloads.wordpress.org/theme/${name}.${version}.zip";
-      hash = "sha256-yiA3PDxIoyYyZ2CI73Wa4GgRrJ3IlaJa45je8H95oY8=";
+      hash = "sha256-VaRLeJTgsTSlRBIqTS1aGMjIjA8AMY2eLHETI1ihoaI=";
     };
     installPhase = "mkdir -p $out; cp -R * $out/";
   };
   wp-fresh-bakers-shop = pkgs.stdenv.mkDerivation rec {
     name = "fresh-bakers-shop";
-    version = "1.0";
+    version = "2.0.5";
     src = pkgs.fetchzip {
       url = "https://downloads.wordpress.org/theme/${name}.${version}.zip";
-      hash = "sha256-MJI6uwRfSFAiYMVhJ3nG4MG6Xw1wZVT47AbLRSJel9M=";
+      hash = "sha256-s7MajZ44iQ0+NgH0487I6MCO7dJiyl5bUtppcONU9Q0=";
     };
     installPhase = "mkdir -p $out; cp -R * $out/";
   };
   wp-blocksy = pkgs.stdenv.mkDerivation rec {
     name = "blocksy";
-    version = "2.1.20";
+    version = "2.1.57";
     src = pkgs.fetchzip {
       url = "https://downloads.wordpress.org/theme/${name}.${version}.zip";
-      hash = "sha256-KVAkPBa3G8D55ltmybW8rdVd0mRmdcG/ZthpOd1aLGM=";
+      hash = "sha256-odTfwnsnIJVG6jffwoAbmEyqWVt+5fa48UGgefJC18c=";
     };
     installPhase = "mkdir -p $out; cp -R * $out/";
   };
   wp-blocksy-companion = pkgs.stdenv.mkDerivation rec {
     name = "blocksy-companion";
-    version = "2.1.20";
+    version = "2.1.57";
     src = pkgs.fetchzip {
       url = "https://downloads.wordpress.org/plugin/${name}.${version}.zip";
-      hash = "sha256-QctNCyxARX/SDjJVf9q96lanXnC9vKAC0a6UAGhM//Q=";
+      hash = "sha256-MvPHnBDwnhAC41j12PvDfLBRindLBGUm/B8DH17rcJs=";
     };
     installPhase = "mkdir -p $out; cp -R * $out/";
   };
   wp-wordpress-importer = pkgs.stdenv.mkDerivation rec {
     name = "wordpress-importer";
-    version = "0.9.5";
+    version = "0.9.6";
     src = pkgs.fetchzip {
       url = "https://downloads.wordpress.org/plugin/${name}.${version}.zip";
-      hash = "sha256-X/jB6DdUZH0CVrfv0NhrvisOTDK5mF9qJA96oOWSRhY=";
+      hash = "sha256-rc/Ut0HYmqTsP2Yc3tcqVRXU3zq7H9wf80SmGqQSYF4=";
     };
     installPhase = "mkdir -p $out; cp -R * $out/";
   };

sites/tulip/configuration.nix

@@ -251,7 +251,12 @@
     privateNetwork = true;
     hostAddress = "192.168.100.10";
     localAddress = "192.168.100.11";
-    config.imports = [ ./anonsee.nix ];
+    config.imports = [
+      ./anonsee.nix
+      {
+        nixpkgs.buildPlatform = config.nixpkgs.buildPlatform;
+      }
+    ];
   };
   services.nginx.logError = "stderr info";