rhelmot
/
nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

base: rhelmot:3194d8453fde7e0d4b3c455b9b6267f7cfc524c7
Branches Tags
rhelmot:main
rhelmot:nixbsd-demo
...
compare: rhelmot:70fb574d1bf6362fbc8dcc7c6341c66ce7e9e9bf
Branches Tags
rhelmot:main
rhelmot:nixbsd-demo

2 Commits
3194d8453f ... 70fb574d1b

Author SHA1 Message Date
Audrey 70fb574d1b guh 2026-10-02 13:38:44 -07:00
Audrey a70ec4a976 is this enough 2026-09-26 20:06:31 -07:00
15 changed files with 487 additions and 144 deletions
Show Stats Expand all files Collapse all files

2
dotfiles/zsh-init.sh
View File

@ -170,7 +170,7 @@ export TMP=/tmp
export TEMPDIR=/tmp
export TMPDIR=/tmp
. "$(which cwdcontrol)" hook
CWDCONTROL="$(which cwdcontrol 2>/dev/null)" && . "$CWDCONTROL" hook
# site vars, functions, and aliases
if [ -e ~/.site_aliases.sh ]; then

4
modules/base-desktop.nix
View File

@ -88,6 +88,10 @@
install_url = "file://${pkgs.cwdcontrol}/cwdcontrol.xpi";
installation_mode = "force_installed";
};
"onetab@nonexistenturl.net" = {
install_url = "file://${pkgs.onetab}/onetab.xpi";
installation_mode = "force_installed";
};
};
};
};

3
modules/base.nix
View File

@ -95,6 +95,7 @@ in
btop
file
nettools
lsof
psmisc
p7zip
unzip
@ -112,14 +113,12 @@ in
pciutils
usbutils
nethogs
unar
rhelmot.globalPython
];
rhelmot.globalPythonPackages = [
(
p: with p; [
virtualenvwrapper
pylint
pytest
ipdb

2
modules/workstation.nix
View File

@ -23,6 +23,7 @@
foremost
binwalk
nix-index
nix-diff
nixtamal.nixtamal
cronie
# radicle-node
@ -31,6 +32,7 @@
gcc
bintools
ffmpeg
unar
] ++ lib.optionals stdenv.hostPlatform.isLinux [
rr
qemu-user

272
nix/tamal/darcs_context/nixtamal.txt
View File

@ -2,6 +2,278 @@
Context:
[TAG 2.0.1
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929025731
Ignore-this: 15c782d32c0af5e20894989fcc67cc436f77d4b2decf5a296fcf4ff0a0daaf3d39bd334350148379
• BUG: lock loader syntax errors in the builtin Git fetcher block
(reported by rhelmot)
• “then … then” should be “then … else”
• stray }
]
[tweak CHANGELOG for 2.0.1
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929025518
Ignore-this: e52097ab553464dbf5c5782f0d9db810b49ab5f0b20e5b81152c2bca921335f7cce91ef0258fd9e1
]
[nix as check input
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929025306
Ignore-this: d1ae209393b69c62d9261291c295568f623ca2fb243293bfed1f8a2482f1b0e9afe1c0103d399dbc
]
[lock loader test
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929025135
Ignore-this: 242bc1bce784504f65088ca89843efb3ee1f68bc430c1e54fb68e693c3aba593cf6db6e446b3a45a
]
[add an all_features helper
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929023343
Ignore-this: c3e35723cc85f8c4fc62f3f2518856d6f5e6fa218b6852635b8baa90316f26464e2be16b2e1e8ad
]
[lockfile: rename make → make_lockfile to not name conflict
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929023339
Ignore-this: f0cabec6200c55e8bfe0b5d0ce79265737e90a25e36748b39fbf7b8e115a18cc5c042c802e7a989
]
[lockfile: t defaults to empty maps
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929021108
Ignore-this: 5a1256e87f33f87b86528bd6d1a508a28cbc0b039a90a4567f26104f98dcd4502b95fe29e034161a
]
[verison: 2.0.0 → 2.0.1
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929014353
Ignore-this: d96b576e33d705ff4658cea54eed84b46db002a4b11a7277112b7e460b2cc5c3a8c7d481eaad0603
]
[lock loader: stay } terminator
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929013744
Ignore-this: 2a7ea7b060cae37393cc2952241a2a9887bd409aedfd977bf460cb073466d2b6d5b7356c9c4da76b
]
[lock loader typo: else → then
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929013031
Ignore-this: a8c24e572f6a449ddf0992dae49c59659c27e6135423a8174b30cf1b83244a50b2e570c5ae7c9f13
]
[nixtamal refresh
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260929012826
Ignore-this: 590bd905454b7d02ec7498feef7ed73c6f4b6d4cf51d8dcd7780297c12634f294ae8156d6c2bf09c
]
[finish statement
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927113136
Ignore-this: c05bb6cd5e57e459524b11100a978f7baee407ff286a9cf6da67ce7d6c0b4a2927dd03d92c359b4f
]
[TAG 2.0.0
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927111244
Ignore-this: 1a4859e6ed8720d8a309142732e5f40c04dd8eaf839e6d0f8001a2f60d03cfcf7807412521fd2adb
• Schema upgrade: 1.3.0 → 1.4.0
• BUG: Refresh/lock with --patch does not refresh/lock all inputs
• Lock loader refactored, now using Jingoo & a lot easier to maintain
• Remote patches now allow more complexity like inputs; this includes
frozen, name, & more importantly, their own fresh-cmd (requested by
pogo)
• extension support for Archive kinds give a hint to pkgs.fetchzip which
can be added as a child to archive in the manifest.kdl
• Zstandard support for pkgs.fetchzip by adding pkgs.zstd as a
nativeBuildInput in the lock loader (base gnutar is missing support)
• Nixpkgs Channels use Zstandard (.zst) over LZMA (.xz) which users will
get when running nixtamal set-up --use-channels …
• Add lock --relock alias for lock --force in case the “force”
• lock no longer refreshes patches naming isn’t clear enough to users
• use Eio 1.5 features for performance improvements
• use Eio 1.6 features to eliminate some Unix-only code + security
]
[CHANGELOG: tweaks for 2.0.0
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927101547
Ignore-this: ff87ced13a236b23157a56ebd42da12628694e1746bd5fdf29e7308513f29fdfac0f236117506adf
]
[version: 1.10.1 → 2.0.0
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927080107
Ignore-this: ed046be3ddedfe5e10174ce635b51a2235f6237ce3097dd1a48324184d60125ddabb92a1eebac49d
]
[if a patch is specified, don’t lock/refresh all inputs too
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927075620
Ignore-this: 70c869af67ab3bbfc161cd78a682b360c7fa5344c4bf915196165b1a5bee9ac8b73faeb5c199c6c0
]
[update docs for patches
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927075620
Ignore-this: 62d2fc469dd9d04c4fa974e79ca82a2a6ed9e17d49441d54a1d60e3560910ea5b33451d7ebb834c4
]
[remote patches are now complex
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927075613
Ignore-this: 337805d60643d96f7d24bce41ac4c3f8513e66607c0ba572ea9b2b6ebd4d0d06b27aa0f70197e658
]
[lock no longer refreshes patches
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927062046
Ignore-this: d9a1b89bc81b7c08b682fdb132ec6d4e8c7eeb7d650eca8ff5e304906458ed8b7184cbe56dff4fcf
]
[use new lock loader
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927062046
Ignore-this: e30e048774dcb1e6ba82ab426153e6501a2251ba90236b767dec5e9f885698f8737a8da1d2713442
]
[lock_loader as Jinja
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927062046
Ignore-this: e8098b5e56a0a9f8e4514dbab073123e5d87eae001d128079ed0f5cede422d35cb6251076bec195e
]
[nixtamal refresh
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260927062042
Ignore-this: 1fceab608a59c9168ffe59383bb4b768cf2051d8dca236168c82ed8e667b7d8cd35c400aeeafc5d2
]
[Use Eio.Process.Env from 1.6 to get env vars
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
Ignore-this: c78d0de9d8a6253bebf254c296b4f90678e27f52400db207ae6550b507ad15efc95925654206d3b3
]
[add ppx_blob
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
Ignore-this: f2c36b0992ece38bfaec541679b82db30c6c2b6d56eac75ee6778b4f1c151fb8421310cc1b5941b9
will be used for the Jingoo2 template version of the lock_loader
]
[patches for using topiary in the ocaml-lsp
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
Ignore-this: e8a926e8bc96fa5b2d287765fcb281164112c69e717706d96ddf7040126cf29549d755accbb4bfca
testing my patches
]
[add test
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
Ignore-this: ac5bd2d595bc65a65ee95954386d790788574ff61ad1af0cef827e4d2300a2d6634d2a5ae13c37b6
]
[Eio 1.6 follow: false where reasonable for security
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
Ignore-this: 3d27485b42d97c1ba07cdfea89c1bd9147dcfd4507a0fe14e32bab32c8c7ab6f1d8879ebe1d263fd
]
[eio 1.6 patches
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
Ignore-this: 9684ce372f27403965e1fab4702678925e0d303d26d4708ab40fefd67c2a111fb0c3a86deb2cd026
]
[nixtamal refresh
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
Ignore-this: a24897e657d4584ff7e870b347c94fd205795271a3cb012ab37d7e3868c8dfa9f6d983abf4159cae
]
[Add --relock flag alias to lock + tweak --force definition
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
Ignore-this: 8a5e9e5b730a65941c40a9b15126bd8c877c98d621ab584173ee1251ccc8d46aa415bcd2a6e910ed
]
[matching is more readable + remove duplicate check
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
Ignore-this: 3bec76cfa68998d7214750a0abaf65b415c4529d01a49f7a4af9cb56691357edb861124331bc7957
]
[Use module ADT over polymorphic variant for Fresh_result
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160239
Ignore-this: 4868907dde875712ad4289e3c56a89f204beae8b1a2f67e8763e06e0beba71eb97dfe761b9f8acda
]
[nixtamal upgrade
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260924160231
Ignore-this: 6e181e510f1f9204f4c05795898f960328abe8ea7c3f314b893362e7709effd7ca51d3afb10652cf
]
[lock loader: add zstd to fetchzip
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260921061423
Ignore-this: 44dbda0d3d005848474a45142033b618a586e8b2b8efe8dd504de8eb7687e49aaa05f07a52ffec30
]
[upgrades to tests
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260921054200
Ignore-this: 231ae275672c544590a3194ca2d4db391e022cca3a9f4cddf6e55fdb61c9ae52a7d8da06afe017e
]
[Schema 1.4.0 upgrades
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260921054200
Ignore-this: cdb8cc8307d242b2a695c80b020fcf608cd444628a1599903b39af1f1bb3e64b768910fd9ae9eb00
]
[add extension support to Archive + schema 1.4.0
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260921054154
Ignore-this: e60560522bd29fa2502a1071c614701654e9c39ca7cdd16c535483fad98895d82c9c5900c267984e
]
[nixtamal refresh
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260921032946
Ignore-this: ffda8ab365965caff6e0c915d68adcfd35008489d13dc868c36fb599a4f4bf5b38141385d5d651f6
]
[opt out of unused/new typegist
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260917012234
Ignore-this: c926502cc3f324ae45643f19c9167d7e58a38b64ff24b7dbe86c5ed911c5b94c0427a2a8d734bfab
]
[nixtamal refresh
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260917011031
Ignore-this: c081fc4688e04ea7b1240e1bb5ce4165d0b35d4f9a09b5fb6a83390db748dee5b320dc3800a0357a
]
[update nixfmt-with-tabs patch
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260914232329
Ignore-this: c1d0e4391da2aca62ff7292d071fa36db571678a7e142d175ebdfae229fb6a7d2005318b62a88202
]
[nixtamal refresh
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260914232322
Ignore-this: 9ff920e2f77b6d6707bb51835423555f51511f0c817b36359b56e7fae5a591bc4f6dcd45cc2a9a5b
]
[use Eio 1.5 features for performance improvements
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260910134436
Ignore-this: 8990a90f8f57e51a70bde3113f75e3cc78f1ae661117684f6796439c3e08fb750e5bb0689e30bc8b
]
[nixtamal refresh
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260910044106
Ignore-this: ccf58a4bd461db91f9770b9eae59653bf9d0b71fc2e38b8b5d880fed3b2210de52e160de2373967d
]
[channels cmd docs improved + -c
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260909022227
Ignore-this: 52494ebdbfc2fbf93e7a762f8aa3414e6aa20aeafc8cb2d594fda4fadaf94ead5b2447402eef54b8
]
[nix channels: xz → zstd
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260909021833
Ignore-this: dab2ae3abcc562647fee8cbd602ae3ad8aebfddda73ef84ac30e335b0d47827022c9ebf6f61b18a5
]
[nixtamal refresh
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260909021144
Ignore-this: 23017f0d834ead3a7563ae2098c07f3d4a85e26f8390b992a9f9b6a5a676ac8b7f1dccc78507638a
]
[remove unused release
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260902143345
Ignore-this: d801ef79c32c7813ab5e2ae3e2edb408e3abb51771e91d6c9dfef7265a03e2217eaec661c52f13e7
]
[add posix
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260902013348
Ignore-this: ef91780fe41603ef973004140261138fc20df9072aa5009e474d75b589d32c60beede5a320a835e
]
[TAG 1.10.1
·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260830051636
Ignore-this: 2d48bf5438f5d0b47be18cd7ed281af615047e64dd8367688837145764791fa3c409925dcdb0ff6b

194
nix/tamal/default.nix
View File

@ -3,23 +3,21 @@ SPDX-FileCopyrightText: 2025–2026 toastal
SPDX-FileCopyrightText: 2026 Nixtamal contributors
SPDX-License-Identifier: ISC
Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice & this permission notice appear in all copies.
Permission to use, copy, modify, and/or distribute this software for any purpose
with or without fee is hereby granted, provided that the above copyright notice
& this permission notice appear in all copies.
THE SOFTWARE IS PROVIDED “AS IS” & ISC DISCLAIMS ALL WARRANTIES WITH REGARD
TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY &
FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT,
OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
OF THIS SOFTWARE.
──────────────────────────────────────────────────────────────────────────────
THE SOFTWARE IS PROVIDED “AS IS” & ISC DISCLAIMS ALL WARRANTIES WITH REGARD TO
THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY & FITNESS. IN
NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
────────────────────────────────────────────────────────────────────────────────
┏┓╻+╻ ╱┏┳┓┏┓┏┳┓┏┓╻
┃┃┃┃┗━┓╹┃╹┣┫┃┃┃┣┫┃ This file was generated by Nixtamal.
╹┗┛╹╱ ╹ ╹ ╹╹╹ ╹╹╹┗┛ Do not edit as it will be overwritten.
──────────────────────────────────────────────────────────────────────────────
────────────────────────────────────────────────────────────────────────────────
*/
{
system ? builtins.currentSystem,
@ -29,15 +27,20 @@ OF THIS SOFTWARE.
}:
let lock = builtins.fromJSON (builtins.readFile ./lock.json); in
assert (lock.v == "1.3.0");
assert (lock.v == "1.4.0");
let
local-patches = {};
isNonemptyString = x: builtins.isString x && x != "";
isNonemptyList = xs: builtins.isList xs && xs != [ ];
hash-token = {
"0" = "sha256";
"1" = "sha512";
"2" = "blake3";
};
local-patches = { };
try-fetch = input-name: fetcher:
let
try-fetch' = failed-urls: url: urls:
@ -46,7 +49,7 @@ let
result.value
else
let failed-urls' = [ url ] ++ failed-urls; in
if builtins.length urls <= 0 then
if urls == [ ] then
let fus = builtins.concatStringsSep " " failed-urls'; in
throw "Input 「${input-name}」fetchable @ [ ${fus} ]"
else
@ -54,16 +57,16 @@ let
in
try-fetch' [ ];
builtin-fetch-tarball = {input-name, name, kind, hash}:
builtin-fetch-tarball = { input-name, name, kind, hash }:
try-fetch input-name (url:
builtins.fetchTarball ({
inherit url;
${hash-token.${builtins.toString hash.al}} = hash.vl;
}
// (if name != null then {inherit name;} else {}))
// (if isNonemptyString name then { inherit name; } else { }))
) kind.ur kind.ms;
builtin-fetch-git = {input-name, name, kind}:
builtin-fetch-git = { input-name, name, kind }:
let
ref =
let
@ -85,80 +88,67 @@ let
inherit url ref;
rev = kind.lr;
submodules = kind.sm;
lfs = kind.lf;
shallow = true;
}
// (if name != null then {inherit name;} else {});
args' =
if builtins.compareVersions builtins.nixVersion "2.26" < 0 then
builtins.removeAttrs args [ "lfs" ]
else
args;
// (if builtins.compareVersions builtins.nixVersion "2.26" < 0 then { } else { lfs = kind.lf; })
// (if isNonemptyString name then { inherit name; } else { });
in
builtins.fetchGit args'
builtins.fetchGit args
) kind.rp kind.ms;
builtin-to-input = input-name: input:
let
name = input.sn;
hash = input.ha;
kind = builtins.elemAt input.kd 1;
k = builtins.head input.kd;
in
if k == 1 then
builtin-fetch-tarball {
inherit name;
input-name = input-name;
kind = builtins.elemAt input.kd 1;
hash = input.ha;
}
builtin-fetch-tarball { inherit input-name name hash kind; }
else if k == 2 then
builtin-fetch-git {
inherit name;
input-name = input-name;
kind = builtins.elemAt input.kd 1;
}
else if k == 3 then
fetch-darcs {
inherit name;
input-name = input-name;
kind = builtins.elemAt input.kd 1;
hash = input.ha;
}
builtin-fetch-git { inherit input-name name kind; }
else
throw "Unsupported input kind “${builtins.toString k}”.";
throw "Unsupported builtin fetcher “${builtins.toString k}”";
nixpkgs' =
if builtins.isNull bootstrap-nixpkgs then
builtin-to-input "nixpkgs-for-nixtamal" (
local-bootstrap-nixpkgs =
if builtins.isAttrs bootstrap-nixpkgs then
bootstrap-nixpkgs
else
builtin-to-input "bootstrap-nixpkgs-for-nixtamal" (
if builtins.isString bootstrap-nixpkgs-lock-name then
lock.i.${bootstrap-nixpkgs-lock-name}
else
lock.i.nixpkgs-nixtamal or lock.i.nixpkgs
)
else
bootstrap-nixpkgs;
);
pkgs =
if builtins.isAttrs bootstrap-pkgs then
bootstrap-pkgs
else
import nixpkgs' {inherit system;};
import local-bootstrap-nixpkgs { inherit system; };
inherit (pkgs) lib;
fetch-zip = {input-name, name, kind, hash}: pkgs.fetchzip ({
fetch-zip = { input-name, name, kind, hash }:
pkgs.fetchzip (
{
# base gnutar doesn’t support Zstandard
nativeBuildInputs = [ pkgs.zstd ];
url = kind.ur;
hash = hash.vl;
}
// lib.optionalAttrs (name != null) {inherit name;}
// lib.optionalAttrs (builtins.length kind.ms > 0) {urls = kind.ms;});
// lib.optionalAttrs (isNonemptyString name) { inherit name; }
// lib.optionalAttrs (isNonemptyList kind.ms) { urls = kind.ms; }
// lib.optionalAttrs (isNonemptyString kind.ex) { extension = kind.ex; }
);
fetch-git = {input-name, name, kind, hash}:
fetch-git = { input-name, name, kind, hash }:
let
using-mirrors = kind ? ms && (builtins.length kind.ms) > 0;
mirror-support = pkgs.fetchgit.__functionArgs ? "mirrors";
has-mirrors = isNonemptyList kind.ms;
has-mirror-support = pkgs.fetchgit.__functionArgs ? "mirrors";
in
lib.warnIf (using-mirrors && !mirror-support)
lib.warnIf (has-mirrors && !has-mirror-support)
"Upstream pkgs.fetchgit doesn’t yet support mirrors for 「${input-name}」"
pkgs.fetchgit ({
url = kind.rp;
@ -168,23 +158,22 @@ let
deepClone = false;
hash = hash.vl;
}
// lib.optionalAttrs (name != null) {inherit name;}
// lib.optionalAttrs (using-mirrors && mirror-support) {
mirrors = kind.ms;
});
// lib.optionalAttrs (isNonemptyString name) { inherit name; }
// lib.optionalAttrs (has-mirrors && has-mirror-support) { mirrors = kind.ms; }
);
fetch-darcs = {input-name, name, kind, hash}:
fetch-darcs = { input-name, name, kind, hash }:
let
using-mirrors = kind ? ms && (builtins.length kind.ms) > 0;
mirror-support = pkgs.fetchdarcs.__functionArgs ? "mirrors";
has-mirrors = isNonemptyList kind.ms;
has-mirror-support = pkgs.fetchdarcs.__functionArgs ? "mirrors";
reference =
let
type = builtins.elemAt kind.rf 0;
value = builtins.elemAt kind.rf 1;
in
if type == 0 then
let ctx_path = builtins.elemAt value 1; in
assert (lib.hasSuffix ".txt" ctx_path);
let ctx-path = builtins.elemAt value 1; in
assert (lib.hasSuffix ".txt" ctx-path);
let
txt-files = lib.sourceFilesBySuffices ./. [ ".txt" ];
dir = lib.fileset.toSource {
@ -192,71 +181,66 @@ let
fileset = lib.fileset.fromSource txt-files;
};
in
{context = "${dir}/${ctx_path}";}
{ context = "${dir}/${ctx-path}"; }
else if type == 1 then
{rev = value;}
{ rev = value; }
else
throw "Invalid Darcs reference";
in
lib.warnIf (using-mirrors && !mirror-support)
lib.warnIf (has-mirrors && !has-mirror-support)
"Upstream pkgs.fetchdarcs doesn’t yet support mirrors for 「${input-name}」"
pkgs.fetchdarcs ({
pkgs.fetchdarcs (
{
url = kind.rp;
hash = hash.vl;
}
// lib.optionalAttrs (name != null) {inherit name;}
// reference // lib.optionalAttrs (using-mirrors && mirror-support) {
mirrors = kind.ms;
});
// reference
// lib.optionalAttrs (isNonemptyString name) { inherit name; }
// lib.optionalAttrs (has-mirrors && has-mirror-support) { mirrors = kind.ms; }
);
fetch-patch = patch-name: {ur, ha}:
fetch-patch = patch-name: { ur, ha, sn ? null, ... }:
pkgs.fetchpatch2 {
url = ur;
hash = ha.vl;
name = if isNonemptyString sn then sn else "${patch-name}-patch";
};
to-input = input-name: input:
let
name = input.sn;
hash = input.ha;
kind = builtins.elemAt input.kd 1;
k = builtins.head input.kd;
raw-input =
if k == 1 then
let
kind = builtins.elemAt input.kd 1;
fetch_time = kind.ft;
in
if fetch_time == 0 then
fetch-zip {inherit input-name name kind hash;}
else if fetch_time == 1 then
builtin-fetch-tarball {inherit input-name name kind hash;}
if k == 3 then
fetch-darcs { inherit input-name name kind hash; }
else if k == 1 then
let fetch-time = kind.ft; in
if fetch-time == 0 then
fetch-zip { inherit input-name name kind hash; }
else if fetch-time == 1 then
builtin-fetch-tarball { inherit input-name name kind hash; }
else
throw "Unsupported fetch time ${fetch_time}."
throw "Unsupported fetch time ${fetch-time}."
else if k == 2 then
let
kind = builtins.elemAt input.kd 1;
fetch_time = kind.ft;
in
if fetch_time == 0 then
fetch-git {inherit input-name name kind hash;}
else if fetch_time == 1 then
builtin-fetch-git {inherit input-name name kind;}
let fetch-time = kind.ft; in
if fetch-time == 0 then
fetch-git { inherit input-name name kind hash; }
else if fetch-time == 1 then
builtin-fetch-git { inherit input-name name kind; }
else
throw "Unsupported fetch time ${fetch_time}."
else if k == 3 then
let
kind = builtins.elemAt input.kd 1;
in
fetch-darcs {inherit input-name name kind hash;}
throw "Unsupported fetch time ${fetch-time}."
else
throw "Unsupported input kind “${builtins.toString k}”.";
throw "Unsupported input kind “${builtins.toString k}”";
in
if builtins.length input.ps == 0 then
if input.ps == [ ] then
raw-input
else
pkgs.applyPatches {
src = raw-input;
name = "${if name != null then name else "src"}-patched";
name = "${if isNonemptyString name then name else "src"}-patched";
patches = map (p:
if local-patches ? "${p}" then
local-patches."${p}"

14
nix/tamal/lock.json
View File

@ -1,13 +1,15 @@
{"v":"1.3.0"
{"v":"1.4.0"
,"i":{
"nixpkgs":{"sn":"nixpkgs-src","kd":[1,{"ft":0,"ur":"https://github.com/NixOS/nixpkgs/archive/e94cb152ed51bd6e24eb4a41f1460252beb52cd2.tar.gz","ms":[]}],"ha":{"al":0,"vl":"sha256-VVTPf+Hyd5ebpjBMHmrLMSBIeW6ls48Bqtosj7CNKLA="},"fv":"e94cb152ed51bd6e24eb4a41f1460252beb52cd2","ps":["declarative-kts"]}
,"bingosync":{"sn":"bingosync-src","kd":[2,{"ft":0,"rp":"https://github.com/rhelmot/bingosync","ms":[],"rf":[0,"refs/heads/main"],"dt":"2026-09-25T21:26:10-07:00","sm":false,"lf":false,"lr":"68b178376fe80cdb66a3150e7d7a284219a106eb"}],"ha":{"al":0,"vl":"sha256-77X6EKpJUcMo4UjYwv3upef9HoZZahA9tCGYjMS0kno="},"fv":"68b178376fe80cdb66a3150e7d7a284219a106eb","ps":[]}
"nixpkgs":{"sn":"nixpkgs-src","kd":[1,{"ft":0,"ur":"https://github.com/NixOS/nixpkgs/archive/e94cb152ed51bd6e24eb4a41f1460252beb52cd2.tar.gz","ms":[],"ex":null}],"ha":{"al":0,"vl":"sha256-VVTPf+Hyd5ebpjBMHmrLMSBIeW6ls48Bqtosj7CNKLA="},"fv":"e94cb152ed51bd6e24eb4a41f1460252beb52cd2","ps":["declarative-kts","php-cross","keycloak-cross"]}
,"bingosync":{"sn":"bingosync-src","kd":[2,{"ft":0,"rp":"https://github.com/rhelmot/bingosync","ms":[],"rf":[0,"refs/heads/main"],"dt":"2026-09-28T19:46:15-07:00","sm":false,"lf":false,"lr":"aee0d0927a26c0b2b0df595b81f51ef16a22d32d"}],"ha":{"al":0,"vl":"sha256-2lwEM7HMYi7PnQ2esWIMnw7GShglLJ6YSQg5bhyzt5w="},"fv":"aee0d0927a26c0b2b0df595b81f51ef16a22d32d","ps":[]}
,"blog-rhelmot-io":{"sn":"blog-rhelmot-io-src","kd":[2,{"ft":0,"rp":"https://git.lain.faith/rhelmot/blog.rhelmot.io","ms":[],"rf":[0,"refs/heads/main"],"dt":"2026-09-13T12:36:06-07:00","sm":false,"lf":false,"lr":"59f5e8ddbcd054f45223c0be9dfdd401208de1af"}],"ha":{"al":0,"vl":"sha256-Tte2UlB1UMCcE7YVnpxKic8n8vtigivWJIV3ctTwWB0="},"fv":"59f5e8ddbcd054f45223c0be9dfdd401208de1af","ps":[]}
,"cwdcontrol":{"sn":"cwdcontrol-src","kd":[2,{"ft":0,"rp":"https://git.lain.faith/rhelmot/cwdcontrol","ms":[],"rf":[0,"refs/heads/main"],"dt":"2026-09-25T21:35:06-07:00","sm":false,"lf":false,"lr":"2e2505e5cf55c5944914183577c39049642357c3"}],"ha":{"al":0,"vl":"sha256-EvCdkfTL0DLUApahLVUR8mPabhWEslAho7dKpL2bG4I="},"fv":"2e2505e5cf55c5944914183577c39049642357c3","ps":[]}
,"cwdcontrol":{"sn":"cwdcontrol-src","kd":[2,{"ft":0,"rp":"https://git.lain.faith/rhelmot/cwdcontrol","ms":[],"rf":[0,"refs/heads/main"],"dt":"2026-10-02T13:36:59-07:00","sm":false,"lf":false,"lr":"8640f564373016be045641daab241ced0a2c593a"}],"ha":{"al":0,"vl":"sha256-/Mpmsw/HwVJT50YYxgYaLjPsDbYRBxHx1BNdDEXayM8="},"fv":"8640f564373016be045641daab241ced0a2c593a","ps":[]}
,"home-manager":{"sn":"home-manager-src","kd":[2,{"ft":0,"rp":"https://github.com/nix-community/home-manager","ms":[],"rf":[0,"refs/heads/master"],"dt":"2026-09-25T14:51:25-05:00","sm":false,"lf":false,"lr":"7b4c5ec4bedaf1e062bbc1bcaeddbc6bd242aa1b"}],"ha":{"al":0,"vl":"sha256-iQ0ebhiVo64NktTnwft9hNxlFu4j5cvljVxyJaEVIP4="},"fv":"7b4c5ec4bedaf1e062bbc1bcaeddbc6bd242aa1b","ps":[]}
,"nixtamal":{"sn":"nixtamal-src","kd":[3,{"rp":"https://darcs.toastal.in.th/nixtamal/stable","ms":["https://smeder.ee/~toastal/nixtamal.darcs"],"dt":"2026-08-30T05:16:36Z","rf":[0,[0,"./darcs_context/nixtamal.txt"]],"lw":"c85cce1e776eb12845d8280639ce5bbf12092048"}],"ha":{"al":0,"vl":"sha256-cKYsuwUq2IVr50Tnc7qzMZANkldFAVDaXFWfgx7i8Ks="},"fv":"c85cce1e776eb12845d8280639ce5bbf12092048","ps":[]}
,"nixtamal":{"sn":"nixtamal-src","kd":[3,{"rp":"https://darcs.toastal.in.th/nixtamal/stable","ms":["https://smeder.ee/~toastal/nixtamal.darcs"],"dt":"2026-09-29T02:57:31Z","rf":[0,[0,"./darcs_context/nixtamal.txt"]],"lw":"937878799aa0d47e270be305284099963f40f2d4"}],"ha":{"al":0,"vl":"sha256-KECJUCvlQz6YpDpktlmLSMiBZPn4qZkA0Ye3aaHHi0Q="},"fv":"937878799aa0d47e270be305284099963f40f2d4","ps":[]}
}
,"p":{
"declarative-kts":{"ur":"https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/518336.patch","ha":{"al":0,"vl":"sha256-DmY05efj6QtlBhLfN2Pc/nPWf5E23dyHYIhwSqagUwA="}}
"declarative-kts":{"ur":"https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/518336.patch","ha":{"al":0,"vl":"sha256-DmY05efj6QtlBhLfN2Pc/nPWf5E23dyHYIhwSqagUwA="},"fv":null,"sn":"declarative-kts-patch"}
,"keycloak-cross":{"ur":"https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/567319.patch","ha":{"al":0,"vl":"sha256-GpnRTr6kAYvL88WcgarPN5tMkEblukoYBw2CiJO7k9g="},"fv":null,"sn":"keycloak-cross-patch"}
,"php-cross":{"ur":"https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/567068.patch","ha":{"al":0,"vl":"sha256-JBKr2LN6y/R0/uFV23gWxbdwOY4c+8BFrm4bsY/ZaTE="},"fv":null,"sn":"php-cross-patch"}
}
}

6
nix/tamal/manifest.kdl
View File

@ -1,9 +1,11 @@
// ┏┓╻+╻ ╱┏┳┓┏┓┏┳┓┏┓╻
// ┃┃┃┃┗━┓╹┃╹┣┫┃┃┃┣┫┃ Read the manpage:
// ╹┗┛╹╱ ╹ ╹ ╹╹╹ ╹╹╹┗┛ $ man nixtamal-manifest
version "1.3.0"
version "1.4.0"
patches {
declarative-kts "https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/518336.patch"
php-cross "https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/567068.patch"
keycloak-cross "https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/567319.patch"
}
inputs {
nixpkgs {
@ -15,7 +17,7 @@ inputs {
$ git ls-remote "https://github.com/NixOS/nixpkgs.git" --refs "refs/heads/nixos-unstable"
| cut -f1
}
patches declarative-kts
patches declarative-kts php-cross keycloak-cross
}
home-manager {
git {

10
overlays/packages.nix
View File

@ -49,4 +49,14 @@ final: prev: {
libbs = final'.callPackage ../pkgs/libbs.nix { };
})
];
onetab = final.callPackage ../pkgs/onetab.nix {};
egl-wayland = prev.egl-wayland.overrideAttrs {
version = "1.1.23";
src = final.fetchFromGitHub {
owner = "NVIDIA";
repo = "egl-wayland";
rev = "2a953fc86ca5707466ff28c117b0b72de87d9316";
hash = "sha256-M+s2R0vSDCEN9lMma6RiJTqzUgClnszwS4aKBJeBvFQ=";
};
};
}

28
pkgs/onetab.nix Normal file
View File

@ -0,0 +1,28 @@
{
stdenv,
fetchFromSourcehut,
zip,
}:
stdenv.mkDerivation {
pname = "onetab";
version = "0.1.0";
src = fetchFromSourcehut {
owner = "~rhelmot";
repo = "onetab";
rev = "bf7c09d98a590c8fac62266ecf82962c3c793b5e";
hash = "sha256-AmzUPVcPH11oHRm0RDOiimEY3C54JivADEPbkFVW+nE=";
};
nativeBuildInputs = [
zip
];
postBuild = ''
./build
'';
postInstall = ''
mkdir -p $out
mv ../onetab.zip $out/onetab.xpi
'';
}

14
sites/clove/configuration.nix
View File

@ -49,13 +49,13 @@
# writableDir = "/var/lib/celeste";
#};
boot.binfmt.emulatedSystems = [
"aarch64-linux"
"mips-linux"
"mipsel-linux"
"armv7l-linux"
];
boot.binfmt.preferStaticEmulators = true;
# boot.binfmt.emulatedSystems = [
# "aarch64-linux"
# "mips-linux"
# "mipsel-linux"
# "armv7l-linux"
# ];
# boot.binfmt.preferStaticEmulators = true;
programs.steam.enable = true;
programs.steam.gamescopeSession.enable = true;

24
sites/hydrangea/configuration.nix
View File

@ -326,6 +326,7 @@
];
settings = {
tz = "local";
httpd.cookie_lifetime = "720";
httpd.bindings = [
{
port = 3006;
@ -380,10 +381,12 @@
systemd.services.aria2 = {
wants = [ "openvpn-nordvpn.service" ];
after = [ "openvpn-nordvpn.service" ];
serviceConfig.UMask = lib.mkForce "0002";
};
users.users.audrey.extraGroups = [ "aria2" ];
users.users.audrey.extraGroups = [ "sftpgo" "aria2" ];
users.users.jellyfin.extraGroups = [ "sftpgo" "aria2" ];
users.users.aria2.extraGroups = [ "sftpgo" ];
users.users.sftpgo.extraGroups = [ "aria2" ];
users.users.jellyfin.extraGroups = [ "sftpgo" ];
services.openvpn = {
servers.nordvpn = {
@ -393,6 +396,23 @@
};
};
systemd.network.networks.nordvpn = {
name = "tun0";
address = [ "10.100.0.2" ];
routes = [
{
Gateway = "0.0.0.0";
Table = "10";
}
];
routingPolicyRules = [
{
From = "10.100.0.2";
Table = "10";
}
];
};
services.radicle = {
enable = false;
privateKey = "/var/lib/radicle/keys/radicle";

15
sites/hydrangea/hardware-configuration.nix
View File

@ -25,6 +25,7 @@
"main/jellyfin/cache".mountPoint = "/var/cache/jellyfin";
"main/jellyfin/library".mountPoint = "/var/lib/jellyfin/library";
"main/radicle".mountPoint = "/var/lib/radicle";
"main/aria2".mountPoint = "/var/lib/aria2/Downloads";
};
fileSystems."/boot" = {
@ -35,4 +36,18 @@
"dmask=0022"
];
};
swapDevices = [
# /dev/nvme0n1p3
{ device = "/dev/disk/by-partuuid/1d1f5875-7879-11ee-8f2a-7cc255275618"; priority = 4096; }
# /dev/sd?1
{ device = "/dev/disk/by-partuuid/f24dd684-8201-11ee-b4f3-7cc255275618"; priority = 2048; }
{ device = "/dev/disk/by-partuuid/f230749d-8201-11ee-b4f3-7cc255275618"; priority = 2048; }
{ device = "/dev/disk/by-partuuid/f2282ec5-8201-11ee-b4f3-7cc255275618"; priority = 2048; }
{ device = "/dev/disk/by-partuuid/f23453fa-8201-11ee-b4f3-7cc255275618"; priority = 2048; }
{ device = "/dev/disk/by-partuuid/9caa659b-04fb-11ef-b641-7cc255275618"; priority = 2048; }
{ device = "/dev/disk/by-partuuid/9c825eb4-04fb-11ef-b641-7cc255275618"; priority = 2048; }
{ device = "/dev/disk/by-partuuid/9c889103-04fb-11ef-b641-7cc255275618"; priority = 2048; }
{ device = "/dev/disk/by-partuuid/9c978ead-04fb-11ef-b641-7cc255275618"; priority = 2048; }
];
}

24
sites/tulip/anonsee.nix
View File

@ -6,55 +6,55 @@
let
wp-hestia = pkgs.stdenv.mkDerivation rec {
name = "hestia";
version = "3.3.3";
version = "3.3.6";
src = pkgs.fetchzip {
url = "https://downloads.wordpress.org/theme/${name}.${version}.zip";
hash = "sha256-hDHG6UdIriF07Uk5hlUuWUriBVtY3XBoma8tl733yrw=";
hash = "sha256-ouFycwkK0Gy/65jD4qwm0iHG1PXSEDUnJQztNUMWu3o=";
};
installPhase = "mkdir -p $out; cp -R * $out/";
};
wp-lightning = pkgs.stdenv.mkDerivation rec {
name = "lightning";
version = "15.32.1";
version = "15.42.0";
src = pkgs.fetchzip {
url = "https://downloads.wordpress.org/theme/${name}.${version}.zip";
hash = "sha256-yiA3PDxIoyYyZ2CI73Wa4GgRrJ3IlaJa45je8H95oY8=";
hash = "sha256-VaRLeJTgsTSlRBIqTS1aGMjIjA8AMY2eLHETI1ihoaI=";
};
installPhase = "mkdir -p $out; cp -R * $out/";
};
wp-fresh-bakers-shop = pkgs.stdenv.mkDerivation rec {
name = "fresh-bakers-shop";
version = "1.0";
version = "2.0.5";
src = pkgs.fetchzip {
url = "https://downloads.wordpress.org/theme/${name}.${version}.zip";
hash = "sha256-MJI6uwRfSFAiYMVhJ3nG4MG6Xw1wZVT47AbLRSJel9M=";
hash = "sha256-s7MajZ44iQ0+NgH0487I6MCO7dJiyl5bUtppcONU9Q0=";
};
installPhase = "mkdir -p $out; cp -R * $out/";
};
wp-blocksy = pkgs.stdenv.mkDerivation rec {
name = "blocksy";
version = "2.1.20";
version = "2.1.57";
src = pkgs.fetchzip {
url = "https://downloads.wordpress.org/theme/${name}.${version}.zip";
hash = "sha256-KVAkPBa3G8D55ltmybW8rdVd0mRmdcG/ZthpOd1aLGM=";
hash = "sha256-odTfwnsnIJVG6jffwoAbmEyqWVt+5fa48UGgefJC18c=";
};
installPhase = "mkdir -p $out; cp -R * $out/";
};
wp-blocksy-companion = pkgs.stdenv.mkDerivation rec {
name = "blocksy-companion";
version = "2.1.20";
version = "2.1.57";
src = pkgs.fetchzip {
url = "https://downloads.wordpress.org/plugin/${name}.${version}.zip";
hash = "sha256-QctNCyxARX/SDjJVf9q96lanXnC9vKAC0a6UAGhM//Q=";
hash = "sha256-MvPHnBDwnhAC41j12PvDfLBRindLBGUm/B8DH17rcJs=";
};
installPhase = "mkdir -p $out; cp -R * $out/";
};
wp-wordpress-importer = pkgs.stdenv.mkDerivation rec {
name = "wordpress-importer";
version = "0.9.5";
version = "0.9.6";
src = pkgs.fetchzip {
url = "https://downloads.wordpress.org/plugin/${name}.${version}.zip";
hash = "sha256-X/jB6DdUZH0CVrfv0NhrvisOTDK5mF9qJA96oOWSRhY=";
hash = "sha256-rc/Ut0HYmqTsP2Yc3tcqVRXU3zq7H9wf80SmGqQSYF4=";
};
installPhase = "mkdir -p $out; cp -R * $out/";
};

7
sites/tulip/configuration.nix
View File

@ -251,7 +251,12 @@
privateNetwork = true;
hostAddress = "192.168.100.10";
localAddress = "192.168.100.11";
config.imports = [ ./anonsee.nix ];
config.imports = [
./anonsee.nix
{
nixpkgs.buildPlatform = config.nixpkgs.buildPlatform;
}
];
};
services.nginx.logError = "stderr info";