bump

configuration-cross.nix

@@ -1,16 +1,11 @@
+{ config, pkgs, lib, ... }:
 {
-  lib,
+  config = lib.mkMerge [(lib.mkIf (pkgs.stdenv.buildPlatform == pkgs.stdenv.hostPlatform) {
-  pkgs,
-  ...
-}:
-{
-  config = lib.mkIf (pkgs.stdenv.buildPlatform == pkgs.stdenv.hostPlatform) {
     environment.systemPackages = with pkgs; [
       meld
-      nixfmt
+      nixfmt-rfc-style
       stdenv.cc
-      stdenv.cc.bintools # bins but not manpages included in stdenv.cc
+      stdenv.cc.bintools  # bins but not manpages included in stdenv.cc
-      cached-nix-shell
     ];
 
     programs.git.config.merge.tool = "meld";
@@ -18,16 +13,16 @@
 
     programs.neovim = {
       enable = true;
-      # defaultEditor = true;
+      defaultEditor = true;
       vimAlias = true;
       viAlias = true;
       configure = {
         # lmao
         customRC = ''
-          ${builtins.readFile ../dotfiles/nvim-init.vim}
+        ${builtins.readFile ./dotfiles/nvim-init.vim}
-          lua << EOF
+        lua << EOF
-          ${builtins.readFile ../dotfiles/nvim-init.lua}
+        ${builtins.readFile ./dotfiles/nvim-init.lua}
-          EOF
+        EOF
         '';
         packages.myVimPackage = with pkgs.vimPlugins; {
           start = [
@@ -54,31 +49,28 @@
             vim-nix
             csharpls-extended-lsp-nvim
           ];
-          opt = [ ];
+          opt = [];
         };
       };
     };
 
-    systemd.services.nvim-server = {
+  }) (lib.mkIf (pkgs.stdenv.buildPlatform != pkgs.stdenv.hostPlatform) {
-      enable = false;
+      programs.vim = {
-      wantedBy = [ "multi-user.target" ];
+        enable = true;
-      description = "Neovim Server";
+        defaultEditor = true;
-      script = ''
+        package = pkgs.vim.customize {
-        export PATH="/run/current-system/sw/bin:/run/wrappers/bin:$PATH"
+          vimrcConfig.customRC = ''
-        nvim --listen /tmp/nvim.sock --headless
+            set mouse=
-      '';
+            set hlsearch
-      serviceConfig = {
+            nnoremap <CR> :noh<CR><CR>
-        User = "audrey";
+          '';
-        Type = "simple";
+        };
-        Restart = "always";
       };
-      environment = {
+      programs.git.config.core.editor = "vim";
-        LOG_CHANNEL_ID = "532689319350108160";
+      environment.systemPackages = with pkgs; [
-        CHANNEL_COUNT = "4";
+        clang
-        DELAY_SECONDS = "5";
+        bintools
-        DEBUG = "0";
+      ];
-      };
+  }) ];
-    };
 
-  };
 }

configuration-desktop.nix

@@ -0,0 +1,104 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  #networking.networkmanager.enable = true;
+
+  fonts.packages = builtins.filter lib.attrsets.isDerivation (builtins.attrValues pkgs.nerd-fonts);
+
+  services = {
+    xserver.enable = true;
+
+    printing = {
+      enable = true;
+      drivers = with pkgs; [ cnijfilter2 ];
+    };
+    avahi = {
+      enable = true;
+      nssmdns4 = true;
+      openFirewall = true;
+    };
+
+    pipewire = {
+      enable = true;
+      pulse.enable = true;
+    };
+
+    libinput.enable = true;
+
+    #blueman.enable = true;
+  };
+
+  audrey-sway = {
+    enable = true;
+  };
+
+  programs.ydotool.enable = true;
+  users.users.audrey.extraGroups = [ "ydotool" ];
+
+  virtualisation.docker = {
+    enable = true;
+    storageDriver = "zfs";
+    logDriver = "journald";
+    daemon.settings = {
+      insecure-registries = [ "docker.shell.phish" "registry.finals.2025.nautilus.institute:5000" ];
+    };
+  };
+
+  programs = {
+    chromium.enable = true;
+    firefox.enable = true;
+    kdeconnect.enable = true;
+    partition-manager.enable = true;
+    wireshark.enable = true;
+    wireshark.package = pkgs.wireshark;
+    foot.enable = true;
+    obs-studio = {
+      enable = true;
+      plugins = with pkgs.obs-studio-plugins; [
+        obs-livesplit-one
+      ];
+    };
+  };
+  environment.sessionVariables.TERMINAL = "footclient";
+
+  environment.systemPackages = with pkgs; [
+    dino
+    discord
+    element-desktop
+    signal-desktop
+    slack
+    zotero
+    via
+    libimobiledevice
+
+    dwarfdump
+    ffmpeg
+    gimp
+
+    kdePackages.plasma-thunderbolt
+  ];
+
+  services.usbmuxd.enable = true;
+
+  systemd.tmpfiles.settings.usersetup."/home/audrey/Downloads"."e!" = {
+    user = "audrey";
+    group = "users";
+    mode = "0700";
+    age = "1d";
+  };
+  #systemd.services.sysfs-settings = {
+  #  description = "Set desktop sysfs tunables";
+  #  script = ''
+  #    # https://bugzilla.kernel.org/show_bug.cgi?id=219112
+  #    test "$(cat /sys/module/kvm/parameters/nx_huge_pages)" = "never" && exit 0 || true
+  #    echo "never" | tee /sys/module/kvm/parameters/nx_huge_pages
+  #  '';
+  #  before = [ "boot-complete.target" ];
+  #};
+
+  hardware.keyboard.qmk.enable = true;
+  services.udev.packages = [ pkgs.via ];
+}

configuration-nixbsd.nix

@@ -0,0 +1,20 @@
+{ config, lib, pkgs, ... }:
+let
+  nixKey = "/var/lib/nix/binary-cache-key" ;
+in {
+  init.services.nix-key-setup = {
+    description = "Generate a nix build signing key";
+    startType = "oneshot";
+    startCommand = [ (pkgs.writeScript "nix-key-setup" ''
+      test -f ${nixKey} && test -f ${nixKey}.pub && exit 0 || true
+      mkdir -p "$(dirname "${nixKey}")"
+      ${config.nix.package}/bin/nix-store --generate-binary-cache-key ${config.networking.hostName} ${nixKey} ${nixKey}.pub
+    '') ];
+    dependencies = [ "FILESYSTEMS" ];
+    before = [ "nix-daemon" ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    freebsd.truss
+  ];
+}

configuration-nixos.nix

@@ -1,15 +1,9 @@
-{
+{ config, lib, pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 let
   nixKey = "/var/lib/nix/binary-cache-key";
   # just using the filepath interacts poorly with typechecking under diverted stores
   toStore = path: pkgs.writeText (builtins.baseNameOf path) (builtins.readFile path);
-in
+in {
-lib.optionalAttrs (!(lib ? nixbsdSystem)) {
   # Use the systemd-boot EFI boot loader.
   boot.loader.systemd-boot.enable = true;
   boot.loader.systemd-boot.memtest86.enable = lib.mkIf (pkgs.stdenv.hostPlatform.isx86) true;
@@ -28,20 +22,36 @@ lib.optionalAttrs (!(lib ? nixbsdSystem)) {
 
   console = {
     font = "Lat2-Terminus16";
-    #keyMap = "us";
+    keyMap = "us";
     useXkbConfig = true; # use xkb.options in tty.
   };
 
   environment.systemPackages = with pkgs; [
     strace
+    rr
+    qemu-user
+
+    # language servers
+    nil
+    #rust-analyzer  # misbehaves unless it's in a dev shell with other environment variables... see shelld
+    lua-language-server
+    clang-tools
+    bash-language-server
+    pyright
+    csharp-ls
+    dotnet-sdk_9
+    gopls
+    typescript-language-server
+    #ocamllsp
+
+    pre-commit
   ];
 
   programs = {
-    zoxide.enable = true;
+    firejail.enable = true;
-    firejail.enable = config.rhelmot.isWorkstation;
+    virt-manager.enable = true;
-    virt-manager.enable = config.rhelmot.isWorkstation;
     nix-ld = {
-      enable = config.rhelmot.isWorkstation;
+      enable = true;
       libraries = with pkgs; [
         glib
         libGL
@@ -52,48 +62,43 @@ lib.optionalAttrs (!(lib ? nixbsdSystem)) {
         zlib
         wayland
         krb5
-        fuse
+        xorg.libX11
-        sdl3
+        xorg.libxcb
-        sdl2-compat
+        xorg.xcbutilimage
-        libx11
+        xorg.xcbutilkeysyms
-        libxcb
+        xorg.xcbutilrenderutil
-        libxcb-image
+        xorg.xcbutilwm
-        libxcb-keysyms
+        xorg.libXrandr
-        libxcb-render-util
+        xorg.libXxf86vm
-        libxcb-wm
+        xorg.libXi
-        libxrandr
+        xorg.libXcursor
-        libxxf86vm
+        xorg.libXinerama
-        libxi
-        libxcursor
-        libxinerama
       ];
     };
   };
 
   services.zfs.zed = {
     settings = {
-      PATH = lib.mkForce (
+      PATH = lib.mkForce (lib.makeBinPath [
-        lib.makeBinPath [
+        config.boot.zfs.package
-          config.boot.zfs.package
+        pkgs.coreutils
-          pkgs.coreutils
+        pkgs.curl
-          pkgs.curl
+        pkgs.gawk
-          pkgs.gawk
+        pkgs.gnugrep
-          pkgs.gnugrep
+        pkgs.gnused
-          pkgs.gnused
+        pkgs.nettools
-          pkgs.nettools
+        pkgs.util-linux
-          pkgs.util-linux
 
-          config.systemd.package
+        config.systemd.package
-        ]
+      ]);
-      );
 
       ZED_USE_DBUS = "1";
     };
   };
 
   security.pam.u2f = {
-    enable = config.rhelmot.isWorkstation;
+    enable = true;
-    settings.authfile = toStore ../keys/u2f;
+    settings.authfile = toStore ./dotfiles/u2f-keys;
     settings.cue = true;
   };
 

configuration.nix

@@ -0,0 +1,174 @@
+{ config, lib, pkgs, ... }:
+let rhelmot = config.rhelmot;
+in {
+  options.rhelmot = {
+    globalPythonPackages = lib.mkOption {
+      type = with lib.types; listOf (functionTo (listOf package));
+      default = [];
+      description = "python packages (p: with p; [ x ]) to include in the global python environment";
+    };
+  };
+  imports = [ ./overlays/packages.nix ./configuration-cross.nix ];
+  config = {
+    nixpkgs.config.allowUnfree = true;
+
+    nix.settings.extra-experimental-features = "nix-command flakes pipe-operators";
+    nix.settings.trusted-users = [ "audrey" ];
+    nix.settings.max-jobs = 1;
+    nix.settings.cores = 0;
+    nix.settings.secret-key-files = [ "/var/lib/nix/binary-cache-key" ];
+    nix.settings.trusted-public-keys = builtins.filter (f: f != "") <| lib.strings.splitString "\n" <| builtins.readFile ./keys/nix;
+
+    # Select internationalisation properties.
+    i18n.defaultLocale = "en_US.UTF-8";
+
+    # Configure keymap in X11
+    services.xserver.xkb.layout = "us";
+    services.xserver.xkb.options = "caps:escape";
+
+    users.defaultUserShell = pkgs.zsh;
+    # Define a user account. Don't forget to set a password with ‘passwd’.
+    users.users.audrey = {
+      uid = 1000;
+      description = "Audrey Dutcher";
+      isNormalUser = true;
+      extraGroups = [ "wheel" "docker" "video" "networkmanager" "libvirtd" ];
+      openssh.authorizedKeys.keyFiles = [ ./keys/ssh ];
+    };
+
+    environment.systemPackages = with pkgs; [
+      man-pages
+      man-pages-posix
+      gnumake
+      wget
+      #moor
+      ripgrep
+      fd
+      curl
+      #btop
+      file
+      nettools
+      psmisc
+      units
+      units-desktop
+      patchelf
+      gdb
+      #kubectl
+      p7zip
+      unzip
+      zip
+      #foremost
+      #binwalk
+      jq
+      socat
+      #nix-index
+      openssl
+      #wireguard-tools
+      #cached-nix-shell
+      tcpdump
+      sqlite
+      #cronie
+      editorconfig-core-c
+      (python3.withPackages (p: lib.concatMap (pl: pl p) rhelmot.globalPythonPackages))
+    ];
+
+    rhelmot.globalPythonPackages = [ (p: with p; [
+      #virtualenvwrapper
+      pylint
+      pytest
+      ipdb
+      ipython
+      nclib
+      pyyaml
+      snakeviz
+      requests
+      pysocks
+      aiohttp
+    ]) ];
+
+    documentation.dev.enable = true;
+
+    programs = {
+      kakoune = {
+        enable = true;
+        plugins = with pkgs.kakounePlugins; [
+          kak-fzf
+          smarttab-kak
+        ];
+        configFiles = lib.filesystem.listFilesRecursive ./dotfiles/kakoune/config;
+        colorSchemes = [ ./dotfiles/kakoune/colors ];
+        extraPackages = with pkgs; [
+          kak-tree-sitter
+          kakoune-lsp
+        ];
+      };
+      zsh = {
+        enable = true;
+        enableCompletion = true;
+        syntaxHighlighting.enable = true;
+        vteIntegration = true;
+        histSize = 10000;
+        promptInit = builtins.readFile ./dotfiles/zsh-prompt.sh;
+        shellInit = builtins.readFile ./dotfiles/zsh-init.sh;
+        shellAliases = {
+          ls = null;
+          ll = null;
+          l = null;
+          grep = "grep --color=auto";
+          egrep = "egrep --color=auto";
+          objdump = "objdump -M intel";
+          gits = "git status";
+          pag = "ps aux | grep -v grep | grep -i";
+          hd = "hexdump -C";
+          hdc = "hexdump -ve '\"\\\x\" 1/1 \"%02x\"'";
+          nose = "pytest -v --capture=no --pdbcls=IPython.terminal.debugger:TerminalPdb";
+          mkvirtualenv = "mkvirtualenv -r /etc/venv-default.txt";
+        };
+      };
+      tmux = {
+        enable = true;
+        extraConfig = builtins.readFile ./dotfiles/tmux.conf;
+      };
+      direnv.enable = true;
+      htop.enable = true;
+      git = {
+        enable = true;
+        #lfs.enable = true;
+        config = {
+          user.email = "audrey@rhelmot.io";
+          user.name = "Audrey Dutcher";
+          init.defaultBranch = "main";
+          blame.markUnblamableLines = true;
+          credential.helper = "store";
+          url."ssh://git@".insteadOf = "git://";
+        };
+      };
+      #bat = {
+      #  enable = true;
+      #  extraPackages = with pkgs.bat-extras; [
+      #    batdiff
+      #    batman
+      #    prettybat
+      #  ];
+      #  settings = {
+      #    italic-text = "always";
+      #    wrap = "never";
+      #    style = "plain";
+      #  };
+      #};
+    };
+    environment.etc."zshrc.local".source = ./dotfiles/zsh-final.sh;
+
+    #environment.variables.PAGER = "moor";
+    environment.etc.zinputrc.text = lib.mkForce (builtins.readFile ./dotfiles/zsh-input.sh);
+
+    environment.etc."gdb/gdbinit".source = ./dotfiles/gdb-init.gdb;
+    environment.etc."venv-default.txt".source = ./dotfiles/venv-default.txt;
+
+    # Enable the OpenSSH daemon.
+    services.openssh.enable = true;
+
+    
+  };
+}
+

default.nix

@@ -1,82 +0,0 @@
-{
-  inputs ? import ./nix/tamal { },
-  nixpkgs ? inputs.nixpkgs,
-  nixbsd ? inputs.nixbsd,
-  bingosync ? inputs.bingosync,
-  blog-rhelmot-io ? inputs.blog-rhelmot-io,
-  nixtamal ? inputs.nixtamal,
-}:
-let
-  nixpkgsLib = import "${nixpkgs}/lib";
-  nixbsdLib = import "${nixbsd}/lib";
-  mkSystem =
-    name:
-    let
-      basicConf = import ./sites/${name}/hardware-configuration.nix {
-        pkgs = null;
-        config = null;
-        options = null;
-        lib = {
-          mkDefault = x: x;
-        };
-        modulesPath = null;
-      };
-      platform = basicConf.nixpkgs.hostPlatform;
-      systemTypes = {
-        linux = import "${nixpkgs}/nixos/lib/eval-config.nix";
-        freebsd = nixbsdLib.nixbsdSystem;
-      };
-      systemName = builtins.elemAt (nixpkgsLib.strings.splitString "-" platform) 1;
-      evaluated = systemTypes.${systemName} {
-        system = null;
-        modules = [
-          ./sites/${name}/configuration.nix
-          (import "${bingosync}/module.nix")
-          {
-            nixpkgs.buildPlatform = builtins.currentSystem;
-            _module.args.inputs = inputs // {
-              inherit
-                nixpkgs
-                nixbsd
-                bingosync
-                blog-rhelmot-io
-                nixtamal
-                ;
-            };
-          }
-        ]
-        ++ (builtins.attrValues modules);
-      };
-      result = evaluated // {
-        system = evaluated.config.system.build.toplevel;
-        deploy = evaluated.config.rhelmot.deployScript;
-      };
-    in
-    result;
-  sites =
-    let
-      sitesFiles = builtins.readDir ./sites;
-      sitesNames = builtins.filter (name: builtins.pathExists ./sites/${name}/configuration.nix) (
-        builtins.attrNames sitesFiles
-      );
-      toSitesList = name: {
-        inherit name;
-        value = mkSystem name;
-      };
-      sitesList = builtins.map toSitesList sitesNames;
-    in
-    builtins.listToAttrs sitesList;
-  modules =
-    let
-      modulesFiles = builtins.attrNames (builtins.readDir ./modules);
-      toModulesList = filename: {
-        name = nixpkgsLib.strings.removeSuffix ".nix" filename;
-        value = ./modules/${filename};
-      };
-      modulesList = builtins.map toModulesList modulesFiles;
-    in
-    builtins.listToAttrs modulesList;
-in
-{
-  inherit modules sites;
-}

deploy.nix

@@ -0,0 +1,43 @@
+{
+  flakeInputs,
+  platform,
+  site,
+}:
+let
+  pkgs = flakeInputs.nixpkgs.legacyPackages.${platform};
+  lib = pkgs.lib;
+  mkDeploy = { site, targetPkg, profileName, extraCommands ? "" }: pkgs.substituteAll {
+    name = "deploy-${profileName}";
+    dir = "bin";
+    src = builtins.toFile "deploy-template" ''
+      #!@runtimeShell@
+      set -ex
+      nix-copy-closure --to @site@ @targetPkg@
+      ssh @site@ sudo nix-env --set -p /nix/var/nix/profiles/@profileName@ @targetPkg@
+      @extraCommands@
+    '';
+    env = {
+      inherit site targetPkg profileName extraCommands;
+      inherit (pkgs) runtimeShell;
+    };
+    isExecutable = true;
+    passthru.site = site;
+  };
+  deployments = builtins.map mkDeploy [
+    {
+      profileName = "blog-rhelmot-io";
+      site = "sunflower";
+      targetPkg = flakeInputs."blog-rhelmot-io".packages.${platform}.blog;
+    }
+  ];
+  filteredDeployments = builtins.filter (deployment: deployment.site == site) deployments;
+  filteredDeploymentsAttrs = builtins.listToAttrs (builtins.map (value: { name = value.profileName; inherit value; }) filteredDeployments);
+  targetSystem = flakeInputs.self.packages.${platform}.${site}.system;
+  deployAll = pkgs.writeShellScriptBin "deploy-all-${site}" (''
+    set -ex
+    # TODO take advantage of the nixos-rebuild infrastructure
+    nix-copy-closure --to ${site} ${targetSystem}
+    ssh ${site} 'sudo nix-env --set -p /nix/var/nix/profiles/system ${targetSystem} && sudo ${targetSystem}/bin/switch-to-configuration switch'
+    set +e
+  '' + lib.concatStringsSep "\n" filteredDeployments);
+in deployAll // filteredDeploymentsAttrs

dotfiles/kakoune/config/10-appearance.kak

@@ -4,7 +4,7 @@ hook global BufCreate .* %{
 }
 set-option -add global ui_options terminal_assistant=cat
 set-option -add global ui_options terminal_enable_mouse=false
-set-option global modelinefmt '%opt{lsp_modeline} %val{bufname} %val{cursor_line}:%val{cursor_char_column} {{context_info}} {{mode_info}}'
+set-option global modelinefmt '%val{bufname} %val{cursor_line}:%val{cursor_char_column} {{context_info}} {{mode_info}}'
 add-highlighter global/ wrap -word
 add-highlighter global/ number-lines -hlcursor -min-digits 3
 add-highlighter global/ show-matching -previous

dotfiles/kakoune/config/20-bindings.kak

@@ -8,10 +8,7 @@ map global normal <a-j> '<a-s-j>'
 map global normal <a-s-j> '<a-j>'
 map -docstring "Reset all selections" global normal '<ret>' '<a-:>:nohl<ret>;,'
 
-map global goto d <esc>:lsp-definition<ret> -docstring 'LSP definition'
+map -docstring "error listing" global goto e '<a-;> le'
-map global goto r <esc>:lsp-references<ret> -docstring 'LSP references'
-map global goto y <esc>:lsp-type-definition<ret> -docstring 'LSP type definition'
-map global goto e <esc>:lsp-diagnostics<ret> -docstring 'LSP error listing'
 
 map global normal '<a-v>' %{
     :tree-sitter-nav '"parent"'<ret>

dotfiles/kakoune/config/30-fzf.kak

@@ -8,11 +8,6 @@ set-option global fzf_grep_command 'rg'
 set-option global fzf_grep_preview_command 'bat'
 set-option global fzf_window_map 'ctrl-n'
 
-#require-module 'wayland'
-require-module 'kitty'
-#set-option global termcmd "kitty --single-instance sh -c"
-set-option global kitty_window_type 'os-window'
-
 map -docstring "filename search (current dir)" global goto n '<a-;>:filename-search<ret>'
 map -docstring "filename search (file dir)" global goto N '<a-;>:filename-search buffile-dir<ret>'
 map -docstring "full-text search (current dir)" global goto f '<a-;> fg'
@@ -29,10 +24,10 @@ define-command -docstring "terminal but floating" terminal-floating -params .. %
 }
 
 set-option global fzf_terminal_command 'terminal-floating'
-
+define-command sway-terminal-floating -params .. %{
-define-command kitty-terminal-floating -params .. %{
+    nop %sh{ sway fullscreen disable }
-    set-option local kitty_window_type 'os-panel'
+    set-option local termcmd "footclient --title=fzf.kak.picker sh -c"
-    kitty-terminal-window --os-panel edge=center --os-panel layer=overlay --os-panel focus-policy=exclusive --cwd current %arg{@}
+    wayland-terminal-window %arg{@}
 }
 
 define-command -override -hidden -docstring "wrapper command to create new terminal" \

dotfiles/kakoune/config/40-lsp.kak

@@ -19,8 +19,8 @@ map global object a '<a-semicolon>lsp-object<ret>' -docstring 'LSP any symbol'
 map global object <a-a> '<a-semicolon>lsp-object<ret>' -docstring 'LSP any symbol'
 map global object f '<a-semicolon>lsp-object Function Method<ret>' -docstring 'LSP function or method'
 map global object t '<a-semicolon>lsp-object Class Interface Struct<ret>' -docstring 'LSP class interface or struct'
-map global object d '<a-semicolon>lsp-diagnostic-object error<ret>' -docstring 'LSP errors'
+map global object d '<a-semicolon>lsp-diagnostic-object --include-warnings<ret>' -docstring 'LSP errors and warnings'
-map global object D '<a-semicolon>lsp-diagnostic-object error warning<ret>' -docstring 'LSP errors and warnings'
+map global object D '<a-semicolon>lsp-diagnostic-object<ret>' -docstring 'LSP errors'
 
 hook -group lsp-diagnostic-autohover global NormalIdle .* %{
     lsp-check-auto-hover %{ try lsp-hover-if-error }

dotfiles/nvim-init.lua

@@ -10,6 +10,7 @@ end
 
 --local rt = require("rust-tools")
 local lint = require('lint')
+local lspconfig = require('lspconfig')
 tb = require("telescope.builtin")
 
 require('telescope').setup({
@@ -85,15 +86,22 @@ require("telescope.pickers.layout_strategies").buffer_window = function(self)
   return layout
 end
 
-require("nvim-treesitter").setup {
+require("nvim-treesitter.configs").setup {
+  auto_install = false,
+  highlight = {
+    enable = true,
+    disable = function(lang, buf)
+      local max_filesize = 100 * 1024 * 1024 -- 100 MB
+      local ok, stats = pcall(vim.loop.fs_stat, vim.api.nvim_buf_get_name(buf))
+      if ok and stats and stats.size > max_filesize then
+        return true
+      end
+    end,
+  },
+  indent = {
+    enable = true
+  }
 }
-vim.api.nvim_create_autocmd('FileType', {
-  pattern = { '<filetype>' },
-  callback = function()
-     vim.treesitter.start()
-     vim.bo.indentexpr = "v:lua.require'nvim-treesitter'.indentexpr()"
-  end
-})
 
 -- completion
 local cmp = require('cmp')
@@ -328,10 +336,9 @@ function show_preview_diagnostic(diag)
   vim.api.nvim_echo({{message}}, false, {})
 end
 
-lspconfig_util = require("lspconfig.util")
 rust_root_dir = function(fname)
-  local primary = lspconfig_util.root_pattern('rust-toolchain')(fname)
+  local primary = lspconfig.util.root_pattern('rust-toolchain')(fname)
-  local fallback = lspconfig_util.root_pattern('Cargo.toml')(fname)
+  local fallback = lspconfig.util.root_pattern('Cargo.toml')(fname)
   return primary or fallback
 end
 
@@ -361,7 +368,7 @@ if rust_analyzer ~= nil then
   --    cmd = {rust_analyzer},
   --  },
   --})
-  vim.lsp.config("rust_analyzer", {
+  lspconfig.rust_analyzer.setup{
     on_attach = lsp_keybinds,
     capabilities = capabilities,
     settings = {
@@ -371,11 +378,10 @@ if rust_analyzer ~= nil then
         },
       },
     },
-  })
+  }
-  vim.lsp.enable("rust_analyzer")
 end
 if pyright ~= nil then
-  vim.lsp.config("pyright", {
+  lspconfig.pyright.setup{
     on_attach = lsp_keybinds,
     capabilities = capabilities,
     cmd = {pyright, '--stdio'},
@@ -388,11 +394,10 @@ if pyright ~= nil then
         },
       },
     },
-  })
+  }
-  vim.lsp.enable("pyright")
 end
 if clangd ~= nil then
-  vim.lsp.config("clangd", {
+  lspconfig.clangd.setup{
     on_attach = lsp_keybinds,
     capabilities = capabilities,
     cmd = {clangd, "--limit-references=1000000" },
@@ -401,38 +406,32 @@ if clangd ~= nil then
       clangdFileStatus = true
     },
     single_file_support = false,
-  })
+  }
-  vim.lsp.enable("clangd")
 end
-vim.lsp.config("nil_ls", {
+lspconfig.nil_ls.setup{
   on_attach = lsp_keybinds,
   capabilities = capabilities,
-})
+}
-vim.lsp.enable("nil_ls")
+lspconfig.csharp_ls.setup{
-vim.lsp.config("csharp_ls", {
   on_attach = lsp_keybinds,
   capabilities = capabilities,
-})
+}
-vim.lsp.enable("csharp_ls")
 if bashls ~= nil then
-  vim.lsp.config("bashls", {
+  lspconfig.bashls.setup{
     on_attach = lsp_keybinds,
     capabilities = capabilities,
     cmd = {bashls, "start" },
-  })
+  }
-   vim.lsp.enable("bashls")
 end
-vim.lsp.config("gopls", {
+lspconfig.gopls.setup{
   on_attach = lsp_keybinds,
   capabilities = capabilities,
-})
+}
-vim.lsp.enable("gopls")
+lspconfig.ts_ls.setup{
-vim.lsp.config("ts_ls", {
   on_attach = lsp_keybinds,
   capabilities = capabilities,
-})
+}
-vim.lsp.enable("ts_ls")
+lspconfig.lua_ls.setup{
-vim.lsp.config("lua_ls", {
   on_attach = lsp_keybinds,
   capabilities = capabilities,
   settings = {
@@ -442,12 +441,11 @@ vim.lsp.config("lua_ls", {
       },
     },
   },
-})
+}
-vim.lsp.enable("lua_ts")
+--lspconfig.ocamllsp.setup{
---vim.lsp.config("ocamllsp", {
 --  on_attach = lsp_keybinds,
 --  capabilities = capabilities,
---})
+--}
 
 --vim.api.nvim_create_autocmd({ "BufWritePost", "BufReadPost" }, {
 --  callback = function()
@@ -459,7 +457,6 @@ vim.lsp.enable("lua_ts")
 --  python = {'ruff'},
 --  rust = {},
 --}
---vim.lsp.enable("ocamllsp")
 
 -- LSP Diagnostics Options Setup
 local sign = function(opts)

dotfiles/ssh-config

@@ -1 +0,0 @@
-

dotfiles/sway/config

@@ -8,8 +8,12 @@
 ## Environment sync with uwsm and restart daemons
 #
 
-exec_always 'UWSM_FINALIZE_VARNAMES="${UWSM_FINALIZE_VARNAMES}${UWSM_FINALIZE_VARNAMES:+ }PAM_KWALLET5_LOGIN" uwsm finalize && systemctl --user restart graphical-environment.target'
+#exec_always 'UWSM_FINALIZE_VARNAMES="${UWSM_FINALIZE_VARNAMES}${UWSM_FINALIZE_VARNAMES:+ }PAM_KWALLET5_LOGIN" uwsm finalize'
 exec_always '/etc/sway/generate_palette >~/.cache/sway_palette.json'
+exec waybar
+exec swaync
+exec foot --server
+exec kanshi
 
 #
 ## Variables
@@ -21,10 +25,8 @@ set $left h
 set $down j
 set $up k
 set $right l
-set $term kitty --single-instance
+set $term footclient
-set $browser firefox
+set $menu fuzzel
-set $prelaunch uwsm app --
-set $menu fuzzel "--launch-prefix=$prelaunch"
 set $swaylock swaylock -c 1a1b26
 
 #
@@ -32,7 +34,7 @@ set $swaylock swaylock -c 1a1b26
 #
 
 # Support legacy X11 apps
-xwayland enable
+#xwayland enable
 # Move containers to scratchpad when they try to minimize
 scratchpad_minimize enable
 # Move the mouse to a container when it focuses
@@ -80,9 +82,7 @@ bindsym $mod+Return exec $menu
 ### Command Palette
 bindsym $mod+Ctrl+Return exec /etc/sway/palette
 ### Terminal
-bindsym $mod+t exec $prelaunch $term
+bindsym $mod+t exec $term    
-### Browser
-bindsym $mod+Shift+t exec $prelaunch $browser
 
 #
 ## Special keys
@@ -102,16 +102,16 @@ bindsym --locked XF86AudioNext exec playerctl next
 bindsym --locked XF86AudioStop exec playerctl stop
 
 # Brightness
-bindsym --locked XF86MonBrightnessDown exec brightnessctl set 10%-
+bindsym --locked XF86MonBrightnessDown exec light -U 10
-bindsym --locked XF86MonBrightnessUp exec brightnessctl set 10%+
+bindsym --locked XF86MonBrightnessUp exec light -A 10
 
 # Screenshot
 bindsym Print exec "FILEPATH=$(xdg-user-dir PICTURES)/Screenshots/$(date +'%Y-%m-%h-%H:%M:%S').png; slurp | grim -g - \"$FILEPATH\" && wl-copy <\"$FILEPATH\""
 
 bindsym Alt+tab exec /etc/sway/sws next
 bindsym Alt+Shift+tab exec /etc/sway/sws prev
-# bindsym $mod+tab exec "swayr next-window all-workspaces"
+bindsym $mod+tab exec "swayr next-window all-workspaces"
-# bindsym $mod+Shift+tab exec "swayr prev-window all-workspaces"
+bindsym $mod+Shift+tab exec "swayr prev-window all-workspaces"
 
 ### Open notification tray
 bindsym $mod+n exec swaync-client -t -sw
@@ -136,31 +136,17 @@ bindsym $mod+Shift+e exec swaynag -t warning -m 'You pressed the exit shortcut.
 #
 
 ### Focus window left
-bindsym $mod+$left exec sway-overfocus split-lt float-lt output-ls
+bindsym $mod+$left focus left
-# bindsym $mod+$left focus left
 ### Focus window down
-bindsym $mod+$down exec sway-overfocus split-dt float-dt output-ds
+bindsym $mod+$down focus down
-# bindsym $mod+$down focus down
 ### Focus window up
-bindsym $mod+$up exec sway-overfocus split-ut float-ut output-us
+bindsym $mod+$up focus up
-# bindsym $mod+$up focus up
 ### Focus window right
-bindsym $mod+$right exec sway-overfocus split-rt float-rt output-rs
+bindsym $mod+$right focus right         
-# bindsym $mod+$right focus right
+bindsym $mod+Left focus left
-
+bindsym $mod+Down focus down
-bindsym $mod+Left exec sway-overfocus split-lt float-lt output-ls
+bindsym $mod+Up focus up
-# bindsym $mod+Left focus left
+bindsym $mod+Right focus right
-bindsym $mod+Down exec sway-overfocus split-dt float-dt output-ds
-# bindsym $mod+Down focus down
-bindsym $mod+Up exec sway-overfocus split-ut float-ut output-us
-# bindsym $mod+Up focus up
-bindsym $mod+Right exec sway-overfocus split-rt float-rt output-rs
-# bindsym $mod+Right focus right
-
-### Focus next tab
-bindsym $mod+Tab exec sway-overfocus group-rw group-dw
-### Focus previous tab
-bindsym $mod+Shift+Tab exec sway-overfocus group-lw group-uw
 
 # Move the focused window with the same, but add Shift
 ### Move focused window left
@@ -176,6 +162,20 @@ bindsym $mod+Shift+Down move down
 bindsym $mod+Shift+Up move up
 bindsym $mod+Shift+Right move right
 
+# Move the focused window across entire workspaces
+### Move focused window to workspace left
+bindsym $mod+Ctrl+$left move to workspace left
+### Move focused window to workspace down
+bindsym $mod+Ctrl+$down move to workspace down
+### Move focused window to workspace up
+bindsym $mod+Ctrl+$up move to workspace up
+### Move focused window to workspace right
+bindsym $mod+Ctrl+$right move to workspace right    
+bindsym $mod+Ctrl+Left move to workspace left
+bindsym $mod+Ctrl+Down move to workspace down
+bindsym $mod+Ctrl+Up move to workspace up
+bindsym $mod+Ctrl+Right move to workspace right
+
 # Move entire workspace to different output
 ### Move focused workspace to monitor left
 bindsym $mod+Shift+Ctrl+$left move workspace to output left
@@ -233,11 +233,11 @@ bindsym $mod+Shift+9 move container to workspace number 9; workspace number 9
 bindsym $mod+Shift+0 move container to workspace number 10; workspace number 10     
 
 ### Rename current workspace
-bindsym $mod+Shift+r exec "NUM=$(swaymsg -t get_workspaces | jq '.[] | select(.focused) | .num'); read -r NEWNAME rest < <(fuzzel --dmenu --prompt-only 'Rename: '); REGEX='^[0-9]+:?'; [[ $NEWNAME =~ $REGEX ]] || NEWNAME=$NUM:$NEWNAME; sway rename workspace to $NEWNAME"
+bindsym $mod+Shift+r exec "sway rename workspace to $(swaymsg -t get_workspaces | jq '.[] | select(.focused) | .num'):$(fuzzel --dmenu --prompt-only 'Rename: ')"
 ### Focus new workspace
-bindsym $mod+grave exec "NUM=$(swaymsg -t get_workspaces | jq '[range(1; 100)] - map(.num) | min'); sway workspace number $NUM"
+bindsym $mod+grave exec "NUM=$(swaymsg -t get_workspaces | jq 'map(.num) | max + 1'); sway workspace number $NUM"
 ### Move focused window to new workspace
-bindsym $mod+Shift+grave exec "NUM=$(swaymsg -t get_workspaces | jq '[range(1; 100)] - map(.num) | min'); sway move container to workspace number $NUM; sway workspace number $NUM"
+bindsym $mod+Shift+grave exec "NUM=$(swaymsg -t get_workspaces | jq 'map(.num) | max + 1'); sway move container to workspace number $NUM; sway workspace number $NUM"   
 
 #
 ## Tiling & Layout
@@ -303,20 +303,15 @@ mode "resize" {
 #
 
 # TokyoNight theme
-font "pango:sans 10"
 # Property Name             Border  BG      Text    Indicator Child-border
 client.focused              #0a0b16 #2f343f #4477ff #4477ff   #4477ff
-client.focused_inactive     #102020 #2f343f #d8dee8 #2f343f   #2f343f
+client.focused_inactive     #2f343f #2f343f #d8dee8 #2f343f   #2f343f
-client.focused_tab_title    #102020 #2f343f #4477ff
+client.unfocused            #2f343f #2f343f #d8dee8 #2f343f   #2f343f
-client.unfocused            #04050c #2f343f #d8dee8 #2f343f   #2f343f
 client.urgent               #ff80c0 #2f343f #d8dee8 #2f343f   #2f343f
+client.placeholder          #2f343f #2f343f #d8dee8 #2f343f   #2f343f
 
 default_border pixel 1
 gaps inner 5
-smart_borders on
-smart_gaps on
-
-for_window [title="."] title_format "%title <i>(%app_id)</i>"
 
 # fx
 blur enable
@@ -328,7 +323,7 @@ shadow_blur_radius 8
 # Automation
 #
 
-for_window [app_id="^fzf.kak.picker$"] {
+for_window [title="^fzf.kak.picker$"] {
     floating enable
     resize set width 90ppt height 90ppt
     move position center

dotfiles/waybar/config.jsonc

@@ -10,7 +10,7 @@
     "custom/launcher": {
         "format": "",
         "tooltip-format": "",
-        "on-click": "fuzzel --launch-prefix=\"uwsm app --\" --no-exit-on-keyboard-focus-loss",
+        "on-click": "fuzzel --no-exit-on-keyboard-focus-loss",
     },
     "systemd-failed-units": {
         "format": "󱗗",
@@ -24,8 +24,6 @@
             "class<firefox>":      "<span letter_spacing='10040'>󰈹</span>",
             "class<discord>":      "<span letter_spacing='10240' size='9pt'></span>",
             "class<footclient>":   "<span letter_spacing='10240'></span>",
-            "class<foot>":         "<span letter_spacing='10240'></span>",
-            "class<kitty>":        "<span letter_spacing='10240'></span>",
             "class<Zotero>":       "<span letter_spacing='10240'>󱉟</span>",
             "class<Element>":      "<span letter_spacing='10480'>󰭹</span>",
             "class<im.dino.Dino>": "<span letter_spacing='10480'>󰭹</span>",

dotfiles/zsh-init.sh

@@ -2,12 +2,13 @@
 
 setopt appendhistory notify
 unsetopt beep nomatch
-setopt completealiases
 
 #
 # Aliases
 #
 
+#eval "$(batman --export-env)"
+
 # standard functions
 
 function nixos-edit() {
@@ -15,31 +16,7 @@ function nixos-edit() {
 }
 
 function nixos-apply() {
-    flags=("--sudo" "--use-substitutes")
+    sudo nixos-rebuild switch --flake ~/nixos-config#$HOST "$@"
-    host="$HOST"
-    action="switch"
-    while [[ "$#" != 0 ]]; do
-        case "$1" in
-            --host)
-                host="$2"
-                shift
-                shift
-                ;;
-            --boot)
-                action="boot"
-                shift
-                ;;
-            *)
-                flags+=("$1")
-                shift
-                ;;
-        esac
-    done
-    flags+=("--file" "$HOME/nixos-config" "--attr" "sites.$host")
-    if [[ "$host" != "$HOST" ]]; then
-        flags+=("--target-host" "$host")
-    fi
-    nixos-rebuild "$action" "${flags[@]}"
 }
 
 lsflags=()
@@ -47,10 +24,6 @@ if ls --group-directories-first &>/dev/null; then
     lsflags+=("--group-directories-first")
 fi
 
-if [[ "$TERM" == "xterm-kitty" ]]; then
-    alias ssh="kitten ssh"
-fi
-
 alias ls="ls ${lsflags[@]} --color=auto";
 alias ll="ls -lh";
 alias lh="ll -ab";
@@ -72,7 +45,7 @@ function rmida () {
     rm -f *.idb *.i64 *.id0 *.id1 *.id2 *.id3 *.nam *.til
 }
 
-function rustc() { $(/bin/which rustc) "$@" && echo "Good girl."; }
+function rustc() { $(/bin/which rustc) "$@" && echo "Good girl." }
 
 function scale () {
     INP=$1
@@ -131,7 +104,7 @@ function preexec-osc-title() {
 }
 
 autoload -Uz add-zsh-hook
-add-zsh-hook -Uz precmd chpwd-osc7-pwd
+add-zsh-hook -Uz chpwd chpwd-osc7-pwd
 add-zsh-hook -Uz precmd precmd-osc133-marker
 add-zsh-hook -Uz precmd precmd-osc-title
 add-zsh-hook -Uz preexec preexec-osc133-marker
@@ -164,11 +137,6 @@ export SHELL=$(which zsh)
 export npm_config_prefix=~/.local
 export HISTSIZE=100000
 export SAVEHIST=100000
-export CARGO_TARGET_DIR=~/.cache/cargo/obj
-export TEMP=/tmp
-export TMP=/tmp
-export TEMPDIR=/tmp
-export TMPDIR=/tmp
 
 # site vars, functions, and aliases
 if [ -e ~/.site_aliases.sh ]; then

dotfiles/zsh-prompt.sh

@@ -2,7 +2,6 @@
 
 NOCOLOR=""
 PURPLE=""
-RED=""
 YELLOW=""
 GREEN=""
 BOLDYELLOW=""
@@ -29,12 +28,11 @@ function update-prompt-color {
     [ "$MODE" = "main" ] && INDICATOR='+' || INDICATOR=' '
     PS1="%{$COLOR%}[$INDICATOR] %~%# %{$NOCOLOR%}"
  
-    [[ -n "$VIRTUAL_ENV" && ! "${VIRTUAL_ENV##*/}" = "default" ]] && VENV_STRING="%{$GREEN%}(${VIRTUAL_ENV##*/})" || VENV_STRING=
+    [ -n "$VIRTUAL_ENV" -a ! "${VIRTUAL_ENV##*/}" = "default" ] && VENV_STRING="%{$GREEN%}(${VIRTUAL_ENV##*/})" || VENV_STRING=
-    [[ -n "$ZMX_SESSION" ]] && ZMX_STRING="%{$RED%}($ZMX_SESSION)" || ZMX_STRING=
     USER_STRING="%{$PURPLE%}%n@%m"
     TIME_STRING="%{$PURPLE%}[%{$YELLOW%}%D{%r}%{$PURPLE%}]"
 
-    RPS1="$VENV_STRING$ZMX_STRING $USER_STRING $TIME_STRING%{$NOCOLOR%}"
+    RPS1="$VENV_STRING $USER_STRING $TIME_STRING%{$NOCOLOR%}"
     zle && zle reset-prompt
 }
 

flake.lock

@@ -0,0 +1,312 @@
+{
+  "nodes": {
+    "bingosync": {
+      "locked": {
+        "lastModified": 1769710902,
+        "narHash": "sha256-cNkfwDSPOew7CPnkEBfVxZl8tMZDAhD7MQP5AKSCEKE=",
+        "owner": "rhelmot",
+        "repo": "bingosync",
+        "rev": "7fd458dfb54ff88bc1744223bd6b6f3576bd85da",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rhelmot",
+        "repo": "bingosync",
+        "type": "github"
+      }
+    },
+    "blog-rhelmot-io": {
+      "inputs": {
+        "coricamu": "coricamu",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1759863336,
+        "narHash": "sha256-H8NRd03xQVKVunTYsd95pMzZS5nfYTDUw6R78dJESrs=",
+        "ref": "refs/heads/main",
+        "rev": "bc6337d8f649f5afdc281b64fad2891bb2067a51",
+        "revCount": 11,
+        "type": "git",
+        "url": "https://git.lain.faith/rhelmot/blog.rhelmot.io"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.lain.faith/rhelmot/blog.rhelmot.io"
+      }
+    },
+    "coricamu": {
+      "inputs": {
+        "nixpkgs": [
+          "blog-rhelmot-io",
+          "nixpkgs"
+        ],
+        "utils": "utils"
+      },
+      "locked": {
+        "lastModified": 1759863318,
+        "narHash": "sha256-6yXyEllmvAFgSg4KzFqJ3bx6K1+ZBsqOOdX08F29k08=",
+        "owner": "rhelmot",
+        "repo": "coricamu",
+        "rev": "f109bad2add146f3001805a8600b198473b3c9c2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rhelmot",
+        "repo": "coricamu",
+        "type": "github"
+      }
+    },
+    "cppnix": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "flake-parts": "flake-parts",
+        "git-hooks-nix": "git-hooks-nix",
+        "nixpkgs": [
+          "nixbsd",
+          "nixpkgs"
+        ],
+        "nixpkgs-23-11": "nixpkgs-23-11",
+        "nixpkgs-regression": "nixpkgs-regression"
+      },
+      "locked": {
+        "lastModified": 1772745693,
+        "narHash": "sha256-4d0xSh/Vy2xI5jqCKmw/Yuo18uAUtnqvBrllNcmXvqU=",
+        "owner": "rhelmot",
+        "repo": "nix",
+        "rev": "38517c6967041d60e469383bc4ce3c0b4adf00ae",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rhelmot",
+        "ref": "freebsd-safe",
+        "repo": "nix",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
+      "locked": {
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "revCount": 69,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.1.0/01948eb7-9cba-704f-bbf3-3fa956735b52/source.tar.gz?rev=ff81ac966bb2cae68946d5ed5fc4994f96d0ffec&revCount=69"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
+      }
+    },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nixbsd",
+          "cppnix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "git-hooks-nix": {
+      "inputs": {
+        "flake-compat": [
+          "nixbsd",
+          "cppnix"
+        ],
+        "gitignore": [
+          "nixbsd",
+          "cppnix"
+        ],
+        "nixpkgs": [
+          "nixbsd",
+          "cppnix",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": [
+          "nixbsd",
+          "cppnix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1734279981,
+        "narHash": "sha256-NdaCraHPp8iYMWzdXAt5Nv6sA3MUzlCiGiR586TCwo0=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "aa9f40c906904ebd83da78e7f328cd8aeaeae785",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "mini-tmpfiles": {
+      "inputs": {
+        "nixpkgs": [
+          "nixbsd",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1742754557,
+        "narHash": "sha256-nGxgiNhA94eSl8jcQwCboJ5Ed132z8yrFdOoT+rf8bE=",
+        "owner": "nixos-bsd",
+        "repo": "mini-tmpfiles",
+        "rev": "534ee577692c7092fdcd035f89bc29b663c6f9ca",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos-bsd",
+        "repo": "mini-tmpfiles",
+        "type": "github"
+      }
+    },
+    "nixbsd": {
+      "inputs": {
+        "cppnix": "cppnix",
+        "flake-compat": "flake-compat_2",
+        "mini-tmpfiles": "mini-tmpfiles",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772769953,
+        "narHash": "sha256-3NRnNY5L8dm3bc12nr3wk4sMOWbvO1m5s7/wWXXwx2Q=",
+        "owner": "nixos-bsd",
+        "repo": "nixbsd",
+        "rev": "87787927615d57969df3faf3cdeeb1bf1f3e1576",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos-bsd",
+        "ref": "nixbsd-demo",
+        "repo": "nixbsd",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1772828289,
+        "narHash": "sha256-rNKF1bFtrV+1Lable7vVxw53W0EM0qCOXW+TfL6wwQs=",
+        "owner": "rhelmot",
+        "repo": "nixpkgs",
+        "rev": "c6b65605b4caf622440e7287e0394a789def6729",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rhelmot",
+        "ref": "freebsd-graphical-wip",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-23-11": {
+      "locked": {
+        "lastModified": 1717159533,
+        "narHash": "sha256-oamiKNfr2MS6yH64rUn99mIZjc45nGJlj9eGth/3Xuw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
+        "type": "github"
+      }
+    },
+    "nixpkgs-regression": {
+      "locked": {
+        "lastModified": 1643052045,
+        "narHash": "sha256-uGJ0VXIhWKGXxkeNnq4TvV3CIOkUJ3PAoLZ3HMzNVMw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "bingosync": "bingosync",
+        "blog-rhelmot-io": "blog-rhelmot-io",
+        "nixbsd": "nixbsd",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,67 @@
+{
+  inputs = {
+    nixpkgs.url = "github:rhelmot/nixpkgs/freebsd-graphical-wip";
+    #nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixbsd.url = "github:nixos-bsd/nixbsd/nixbsd-demo";
+    nixbsd.inputs.nixpkgs.follows = "nixpkgs";
+
+    bingosync.url = "github:rhelmot/bingosync";
+    blog-rhelmot-io.url = "git+https://git.lain.faith/rhelmot/blog.rhelmot.io";
+    blog-rhelmot-io.inputs.nixpkgs.follows = "nixpkgs";
+
+    #nixos-defcon.url = "path:/home/audrey/nixos-defcon";
+    #nixos-defcon.inputs.nixpkgs.follows = "nixpkgs";
+  };
+  outputs = { self, nixpkgs, nixbsd, bingosync, ... }@flakeInputs: let
+    sitesFiles = builtins.readDir ./sites;
+    sitesNames = builtins.filter (name: builtins.pathExists ./sites/${name}/configuration.nix) (builtins.attrNames sitesFiles);
+    systemTypes = {
+      nixos = nixpkgs.lib.nixosSystem;
+      nixbsd = nixbsd.lib.nixbsdSystem;
+    };
+    systemName = name: builtins.replaceStrings ["\n"] [""] (builtins.readFile ./sites/${name}/system);
+    nixosConfigurations = platform: builtins.listToAttrs (builtins.map (name: {
+      inherit name;
+      value = let evaluated = systemTypes.${systemName name} {
+        modules = [
+          ./configuration.nix
+          ./configuration-${systemName name}.nix
+          ./sites/${name}/configuration.nix
+          { nixpkgs.buildPlatform = platform; }
+          self.modules.audrey-sway
+          #self.modules.mobile-timezone
+          self.modules.kakoune
+          self.modules.zfs-module
+          #self.modules.syncthing-cluster
+          #{
+          #  services.syncthing-cluster.deviceIds = ./keys/syncthing;
+          #  services.syncthing-cluster.coordinator = "hydrangea";
+          #}
+          #bingosync.nixosModules.default
+          #nixos-defcon.nixosModules.pkgsOverlay
+          #nixos-defcon.nixosModules.tulip
+          #nixos-defcon.nixosModules.noscope
+        ];
+        specialArgs = {
+          inherit nixpkgs;
+          #pkgs-unstable = nixpkgs-unstable.legacyPackages.${platform};
+        };
+      }; in {
+        inherit (evaluated) config options;
+        system = evaluated.config.system.build.toplevel;
+        deploy = import ./deploy.nix { inherit flakeInputs platform; site = name; };
+      };
+    }) sitesNames);
+  in {
+    packages = let
+      buildPlatforms = [ "x86_64-linux" "aarch64-linux" "x86_64-freebsd" "aarch64-freebsd" ];
+      toPackagesList = platform: { name = platform; value = let base = nixosConfigurations platform; in base // { nixosConfigurations = base; }; };
+      packagesList = builtins.map toPackagesList buildPlatforms;
+    in builtins.listToAttrs packagesList;
+    modules = let
+      modulesFiles = builtins.attrNames (builtins.readDir ./modules);
+      toModulesList = filename: { name = nixpkgs.lib.strings.removeSuffix ".nix" filename; value = ./modules/${filename}; };
+      modulesList = builtins.map toModulesList modulesFiles;
+    in builtins.listToAttrs modulesList;
+  };
+}

keys/nix

@@ -1,4 +1,2 @@
 clove:WbMoKN9/WvTS/tCNa2+75MImjZuqX8X094i5vT0dKTU=
 daisy:HU3mg1KY/sGYVZk243dgJRDLKHASRmu8/IXeGI/sdE8=
-tulip:Q08HY4C1H1YB4d6ObReFS7Ohqb5xWW3Ei6lGkldkojU=
-hydrangea:D6wG8lviPwODmq1ZdQzPL4AGt1ZsboUQKwSNyGPKOhk=

keys/ssh

@@ -1,2 +1,3 @@
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDeeSDW2s8awLKVsdqalGrSWJ0zHdLXP8PE6MyFglGITyrjm5SKnyCEYL1wS6W/egJT2trNPwWl22D3UKYgWyzi6HLZAvJwT+eoyo1Ya3V+k2Do3AU0/LeJ0xjx9kO6E0IL++ozqpFPoT+OAmw6cZ3Eyir3VjTOdbsUz7QTPFHhuwJ37GAshpc6C5I/cralFs5NwRFpI2j9j6pu0RJFm2QBqG1zY6qIjFt5l9LuY5aOQBYSaFfmMa8BVJo6ZFQxySv+Xo51zEch2Nv/efXmiuJoCyUcrb9fTYRmtFchl/XAd+8SyvuxTIOYAhWpBgK8pK7i7wTxDcz4Lbi7iJKHYTX4hqw0qKPjF+K+XGVYqw2Cz38W861dx5bUqBwQP+4OsE/+/ThTZDe1dfwJumJgaUWU6Mnr1EYwEefGQZlU4lxvy6DyCYd6Y5s9KmPNSlxXQsArrhWymmfKELN+aRGMys/KnWwFAHnhGC6J1uBQjT/jsTXFXtsqHuICBTsCo5JhiIk= audrey@dandelion
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDA0UbgxW37GCUcU9mkV9tGbFk+4v5+F4Raa0ZIMKmJuCg4I05v6YdKu+gkRyl25TgNto1se4kxUalma46/olw6IRglP0iNb4kiXMqFw3WhpMwZJiZ6+1FiebD3HNEEZisaA+Gef3Ae2n9jtOr/x17Vp2P5iUtFhyZHJUzbTOuRcNWHH2OME45d2AvlUAO13uDXhTXEbW4J9ubpXr87YHc4w0ealbW8Itkzl0prWcFHlkzTrGFX3b7UW5dhlvGxYgwbpSifu4LUkiSxgADbtP2LkRiUQYq3VMaZTc1arg6kygznqNS6SoybUHyVADS2z5GKY3l8fJhFUhQk2IVoKBCD audrey@violet
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDA0UbgxW37GCUcU9mkV9tGbFk+4v5+F4Raa0ZIMKmJuCg4I05v6YdKu+gkRyl25TgNto1se4kxUalma46/olw6IRglP0iNb4kiXMqFw3WhpMwZJiZ6+1FiebD3HNEEZisaA+Gef3Ae2n9jtOr/x17Vp2P5iUtFhyZHJUzbTOuRcNWHH2OME45d2AvlUAO13uDXhTXEbW4J9ubpXr87YHc4w0ealbW8Itkzl0prWcFHlkzTrGFX3b7UW5dhlvGxYgwbpSifu4LUkiSxgADbtP2LkRiUQYq3VMaZTc1arg6kygznqNS6SoybUHyVADS2z5GKY3l8fJhFUhQk2IVoKBCD audrey@rhododendron

keys/syncthing/clove

@@ -1 +0,0 @@
-WB3OPFM-5S7CLM4-PN7JIWE-H66YCFD-7UKW7PE-7KM4CMT-WPQ5BK5-ZFPMQAM

modules/audrey-sway.nix

@@ -1,288 +1,248 @@
 {
-  lib,
+    lib,
-  config,
+    config,
-  pkgs,
+    pkgs,
-  ...
+    ...
 }:
 let
   cfg = config.audrey-sway;
   swaylockCmd = "swaylock -c 1a1b26";
 in
 {
-  options.audrey-sway = {
+    options.audrey-sway = {
-    enable = lib.mkEnableOption "Audrey's sway desktop for girls";
+        enable = lib.mkEnableOption "Audrey's sway desktop for girls";
-    background = lib.mkOption {
+        background = lib.mkOption {
-      type = lib.types.path;
+            type = lib.types.pathInStore;
-      default = ../dotfiles/smotsgamed.jpg;
+            default = ../dotfiles/smotsgamed.jpg;
-      description = "Background image file";
+            description = "Background image file";
+        };
+        extraPaletteEntries = lib.mkOption {
+            type = lib.types.listOf (lib.types.module {
+                name = lib.mkOption {
+                    type = lib.types.str;
+                    description = "The name or description to show";
+                };
+                icon = lib.mkOption {
+                    type = lib.types.nullOr lib.types.str;
+                    description = "The icon to show";
+                    default = null;
+                };
+                command = lib.mkOption {
+                    type = lib.types.nullOr lib.types.str;
+                    default = null;
+                    description = ''
+                        The shell command to run on invocation. If null, will inherit the command from your sway configuration based on the name.
+                        The name must be present in the config on the same line as the bindsym command after "###".
+                    '';
+                };
+            });
+            default = [];
+            description = "Extra entries to add to the command palette";
+        };
     };
-    extraPaletteEntries = lib.mkOption {
-      type = lib.types.listOf (
-        lib.types.module {
-          name = lib.mkOption {
-            type = lib.types.str;
-            description = "The name or description to show";
-          };
-          icon = lib.mkOption {
-            type = lib.types.nullOr lib.types.str;
-            description = "The icon to show";
-            default = null;
-          };
-          command = lib.mkOption {
-            type = lib.types.nullOr lib.types.str;
-            default = null;
-            description = ''
-              The shell command to run on invocation. If null, will inherit the command from your sway configuration based on the name.
-              The name must be present in the config on the same line as the bindsym command after "###".
-            '';
-          };
-        }
-      );
-      default = [ ];
-      description = "Extra entries to add to the command palette";
-    };
-    extraSwayArgs = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      description = "Extra command line arguments with which to launch sway";
-    };
-    blankTimeout = lib.mkOption {
-      type = lib.types.nullOr lib.types.int;
-      default = 300;
-      description = "After how long in seconds idle should the system blank its screens";
-    };
-    lockTimeout = lib.mkOption {
-      type = lib.types.nullOr lib.types.int;
-      default = 360;
-      description = "After how long in seconds idle should the system lock the desktop";
-    };
-    suspendTimeout = lib.mkOption {
-      type = lib.types.nullOr lib.types.int;
-      default = 600;
-      description = "After how long in seconds idle should the system suspend";
-    };
-  };
 
-  config = lib.mkIf cfg.enable {
+    config = lib.mkIf cfg.enable {
-    programs.regreet.enable = true;
+      #programs.regreet.enable = true;
-    services.greetd.settings = {
+      #services.greetd.settings = {
-      default_session.command = "${pkgs.dbus}/bin/dbus-run-session ${lib.getExe config.programs.sway.package} -c /etc/sway/greeter-config ${builtins.toString cfg.extraSwayArgs}";
+      #  default_session.command = "${pkgs.dbus}/bin/dbus-run-session ${lib.getExe config.programs.sway.package} -c /etc/sway/greeter-config";
-    };
+      #};
-    programs.regreet.settings = {
+      #programs.regreet.settings = {
-      background.fit = "Fill";
+      #  background.fit = "Fill";
-      GTK.application_prefer_dark_theme = true;
+      #  GTK.application_prefer_dark_theme = true;
-    };
+      #};
-    environment.etc."sway/config".source = lib.mkForce ../dotfiles/sway/config;
+      environment.etc."sway/config".source = lib.mkForce ../dotfiles/sway/config;
-    environment.etc."sway/sws".source = ../dotfiles/sway/sws.sh;
+      environment.etc."sway/sws".source = ../dotfiles/sway/sws.sh;
-    environment.etc."sway/generate_palette".source = ../dotfiles/sway/generate_palette.sh;
+      environment.etc."sway/generate_palette".source = ../dotfiles/sway/generate_palette.sh;
-    environment.etc."sway/palette".source = ../dotfiles/sway/palette.sh;
+      environment.etc."sway/palette".source = ../dotfiles/sway/palette.sh;
-    environment.etc."sway/bg".source = cfg.background;
+      environment.etc."sway/bg".source = cfg.background;
-    environment.etc."sway/greeter-config".source = lib.mkForce (
+      #environment.etc."sway/greeter-config".source = lib.mkForce (pkgs.writeText "sway-greeter-config" ''
-      pkgs.writeText "sway-greeter-config" ''
+      #  exec "${lib.getExe config.programs.regreet.package}; swaymsg exit"
-        exec "${lib.getExe config.programs.regreet.package}; swaymsg exit"
+      #  output * scale 2
-        output * scale 2
+      #  input type:keyboard {
-        input type:keyboard {
+      #      xkb_options "caps:escape"
-            xkb_options "caps:escape"
+      #  }
-        }
+      #  input type:touchpad {
-        input type:touchpad {
+      #      dwt enabled
-            dwt enabled
+      #      dwtp enabled
-            dwtp enabled
+      #      tap enabled
-            tap enabled
+      #      tap_button_map lrm
-            tap_button_map lrm
+      #      natural_scroll enabled
-            natural_scroll enabled
+      #  }
-        }
 
-        # Brightness
+      #  # Brightness
-        bindsym --locked XF86MonBrightnessDown exec brightnessctl set 10%-
+      #  bindsym --locked XF86MonBrightnessDown exec light -U 10
-        bindsym --locked XF86MonBrightnessUp exec brightnessctl set 10%+
+      #  bindsym --locked XF86MonBrightnessUp exec light -A 10
 
-        blur enable
+      #  blur enable
-        corner_radius 8
+      #  corner_radius 8
-        shadows enable
+      #  shadows enable
-        shadow_blur_radius 8
+      #  shadow_blur_radius 8
-      ''
+      #'');
-    );
+      environment.etc."xdg/waybar".source = ../dotfiles/waybar;
-    environment.etc."xdg/waybar".source = ../dotfiles/waybar;
+      environment.etc."xdg/swayr".source = ../dotfiles/swayr;
-    environment.etc."xdg/swayr".source = ../dotfiles/swayr;
+      environment.etc."xdg/fuzzel".source = ../dotfiles/fuzzel;
-    environment.etc."xdg/fuzzel".source = ../dotfiles/fuzzel;
+      environment.etc."xdg/foot".source = ../dotfiles/foot;
-    environment.etc."xdg/foot".source = ../dotfiles/foot;
+      environment.etc."xdg/xdg-desktop-portal-wlr/config".source = ../dotfiles/xdg-desktop-portal-wlr;
-    environment.etc."xdg/xdg-desktop-portal-wlr/config".source = ../dotfiles/xdg-desktop-portal-wlr;
 
-    programs.fuse.enable = true;
+      #programs.uwsm = {
-    programs.uwsm = {
+      #  enable = true;
-      enable = true;
+      #  waylandCompositors.sway = {
-      waylandCompositors.sway = {
+      #    prettyName = "Sway";
-        prettyName = "Sway";
+      #    binPath = "/run/current-system/sw/bin/sway";
-        binPath = "/run/current-system/sw/bin/sway";
+      #  };
-        extraArgs = cfg.extraSwayArgs;
+      #};
-      };
+      programs.sway = {
-    };
-    programs.sway = {
-      enable = true;
-      package = pkgs.swayfx;
-      wrapperFeatures.gtk = true;
-      xwayland.enable = true;
-      extraPackages = with pkgs; [
-        swaylock
-        swaynotificationcenter
-        swayr
-        sway-overfocus
-        brightnessctl
-        pavucontrol
-        pulseaudio
-        libnotify
-        wdisplays
-        playerctl
-        grim
-        slurp
-        swayidle
-        waybar
-        wl-clipboard
-        wl-mirror
-        wlogout
-        fuzzel
-        gsettings-desktop-schemas
-        glib
-        kdePackages.kwallet
-        networkmanagerapplet
-        adwaita-icon-theme
-        reversal-icon-theme
-        whitesur-icon-theme
-        xdg-user-dirs
-      ];
-      extraSessionCommands = ''
-        export ELECTRON_OZONE_PLATFORM_HINT=wayland
-        export SDL_VIDEODRIVER=wayland
-        export QT_QPA_PLATFORM=wayland-egl
-        export QT_WAYLAND_DISABLE_WINDOWDECORATION=1
-      '';
-    };
-    environment.pathsToLink = [ "/share/gsettings-schemas" ];
-    #environment.sessionVariables.XDG_DATA_DIRS = [ "/run/current-system/sw/share/gsettings-schemas/${pkgs.gsettings-desktop-schemas.name}" ];
-    security.pam.services.swaylock = { };
-    security.pam.loginLimits = [
-      {
-        domain = "@users";
-        item = "rtprio";
-        type = "-";
-        value = 1;
-      }
-    ];
-    security.pam.services = {
-      greetd.kwallet = {
         enable = true;
-        package = pkgs.kdePackages.kwallet-pam;
+        package = pkgs.swayfx;
-        forceRun = true;
+        wrapperFeatures.gtk = true;
-      };
+        #xwayland.enable = true;
-      greetd.rules.session.kwallet.settings.auto_start = true;
+        extraPackages = with pkgs; [
-    };
+          swaylock
-    security.polkit.enable = true;
+          swaynotificationcenter
-    programs.dconf.enable = true;
+          #swayr
-    services.power-profiles-daemon.enable = true;
+          #pavucontrol
-    systemd.user.targets.graphical-environment = { };
+          #pulseaudio
-    systemd.user.services.kanshi = {
+          libnotify
-      description = "Monitor hotswap daemon";
+          wdisplays
-      serviceConfig = {
+          #playerctl
-        Type = "simple";
+          grim
-        ExecStart = lib.getExe pkgs.kanshi;
+          slurp
-      };
+          swayidle
-      partOf = [ "graphical-environment.target" ];
+          waybar
-      wantedBy = [ "graphical-environment.target" ];
+          wl-clipboard
-    };
+          wl-mirror
-    systemd.user.services.swayidle = {
+          wlogout
-      description = "Idle lock + sleep manager";
+          fuzzel
-      serviceConfig = {
+          gsettings-desktop-schemas
-        Type = "simple";
+          glib
-        ExecStart = ''
+          kanshi
-          ${lib.getExe pkgs.swayidle} -w \
+          #kdePackages.kwallet
-          ${
+          #networkmanagerapplet
-            lib.optionalString (cfg.blankTimeout != null) ''
+          adwaita-icon-theme
-              timeout ${builtins.toString cfg.blankTimeout} 'swaymsg "output * power off"' \
+          #reversal-icon-theme
-                  resume 'swaymsg "output * power on"' \
+          whitesur-icon-theme
-            ''
+          xdg-user-dirs
-          } ${
+        ];
-            lib.optionalString (cfg.lockTimeout != null) ''
+        extraSessionCommands = ''
-              timeout ${builtins.toString cfg.lockTimeout} '${swaylockCmd} -f' \
+          export ELECTRON_OZONE_PLATFORM_HINT=wayland
-              before-sleep '${swaylockCmd} -f' \
+          export SDL_VIDEODRIVER=wayland
-            ''
+          export QT_QPA_PLATFORM=wayland-egl
-          } ${
+          export QT_WAYLAND_DISABLE_WINDOWDECORATION=1
-            lib.optionalString (cfg.suspendTimeout != null) ''
-              timeout ${builtins.toString cfg.suspendTimeout} 'systemctl suspend' \
-            ''
-          }
         '';
       };
-      path = [ "/run/current-system/sw" ];
+      environment.pathsToLink = [ "/share/gsettings-schemas" ];
-      partOf = [ "graphical-environment.target" ];
+      #environment.sessionVariables.XDG_DATA_DIRS = [ "/run/current-system/sw/share/gsettings-schemas/${pkgs.gsettings-desktop-schemas.name}" ];
-      wantedBy = [ "graphical-environment.target" ];
+      #programs.light.enable = true;
-    };
+      security.pam.services.swaylock = {};
-    systemd.user.services.waybar = {
+      security.pam.loginLimits = [
-      description = "Desktop status bar";
+        { domain = "@users"; item = "rtprio"; type = "-"; value = 1; }
-      serviceConfig = {
+      ];
-        Type = "simple";
+      security.pam.services = {
-        ExecStart = lib.getExe pkgs.waybar;
+        #greetd.kwallet = {
+        #  enable = true;
+        #  package = pkgs.kdePackages.kwallet-pam;
+        #  forceRun = true;
+        #};
+        #greetd.rules.session.kwallet.settings.auto_start = true;
       };
-      path = [ "/run/current-system/sw" ];
+      security.polkit.enable = lib.mkForce false;
-      partOf = [ "graphical-environment.target" ];
+      programs.xwayland.enable = false;
-      wantedBy = [ "graphical-environment.target" ];
+      programs.dconf.enable = true;
-    };
+      #services.power-profiles-daemon.enable = true;
-    systemd.user.services.networkmanagerapplet = {
+      #systemd.user.targets.graphical-environment = { };
-      description = "Networkmanager applet";
+      #systemd.user.services.kanshi = {
-      serviceConfig = {
+      #  description = "Monitor hotswap daemon";
-        Type = "simple";
+      #  serviceConfig = {
-        ExecStart = lib.getExe pkgs.networkmanagerapplet;
+      #    Type = "simple";
-      };
+      #    ExecStart = lib.getExe pkgs.kanshi;
-      path = [ "/run/current-system/sw" ];
+      #  };
-      partOf = [ "graphical-environment.target" ];
+      #  partOf = [ "graphical-environment.target" ];
-      wantedBy = [ "graphical-environment.target" ];
+      #  wantedBy = [ "graphical-environment.target" ];
-    };
+      #};
-    systemd.user.services.pasystray = {
+      #systemd.user.services.swayidle = {
-      description = "Pulseaudio system tray icon";
+      #  description = "Idle lock + sleep manager";
-      serviceConfig = {
+      #  serviceConfig = {
-        Type = "simple";
+      #    Type = "simple";
-        ExecStart = "${lib.getExe pkgs.pasystray} --notify source --notify sink -m 100";
+      #    ExecStart = ''
-      };
+      #      ${lib.getExe pkgs.swayidle} -w \
-      path = [ "/run/current-system/sw" ];
+      #        timeout 300 'swaymsg "output * power off"' \
-      partOf = [ "graphical-environment.target" ];
+      #            resume 'swaymsg "output * power on"' \
-      wantedBy = [ "graphical-environment.target" ];
+      #        timeout 360 '${swaylockCmd} -f' \
-    };
+      #        timeout 600 'systemctl suspend' \
-    systemd.user.services.kdeconnect-indicator = {
+      #        before-sleep '${swaylockCmd} -f'
-      description = "KDE connect indicator";
+      #    '';
-      serviceConfig = {
+      #  };
-        Type = "simple";
+      #  path = [ "/run/current-system/sw" ];
-        ExecStart = "${lib.getBin pkgs.kdePackages.kdeconnect-kde}/bin/kdeconnect-indicator";
+      #  partOf = [ "graphical-environment.target" ];
-      };
+      #  wantedBy = [ "graphical-environment.target" ];
-      path = [ "/run/current-system/sw" ];
+      #};
-      partOf = [ "graphical-environment.target" ];
+      #systemd.user.services.waybar = {
-      wantedBy = [ "graphical-environment.target" ];
+      #  description = "Desktop status bar";
-    };
+      #  serviceConfig = {
-    systemd.user.services.swayr = {
+      #    Type = "simple";
-      description = "Sway MRU window switcher";
+      #    ExecStart = lib.getExe pkgs.waybar;
-      serviceConfig = {
+      #  };
-        Type = "simple";
+      #  path = [ "/run/current-system/sw" ];
-        ExecStart = "${lib.getBin pkgs.swayr}/bin/swayrd";
+      #  partOf = [ "graphical-environment.target" ];
-      };
+      #  wantedBy = [ "graphical-environment.target" ];
-      path = [ "/run/current-system/sw" ];
+      #};
-      partOf = [ "graphical-environment.target" ];
+      #systemd.user.services.networkmanagerapplet = {
-      wantedBy = [ "graphical-environment.target" ];
+      #  description = "Networkmanager applet";
-    };
+      #  serviceConfig = {
-    systemd.user.services.polkit-gnome-authentication-agent-1 = {
+      #    Type = "simple";
-      description = "polkit-gnome-authentication-agent-1";
+      #    ExecStart = lib.getExe pkgs.networkmanagerapplet;
-      partOf = [ "graphical-environment.target" ];
+      #  };
-      wantedBy = [ "graphical-environment.target" ];
+      #  path = [ "/run/current-system/sw" ];
-      serviceConfig = {
+      #  partOf = [ "graphical-environment.target" ];
-        Type = "simple";
+      #  wantedBy = [ "graphical-environment.target" ];
-        ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
+      #};
-        Restart = "on-failure";
+      #systemd.user.services.pasystray = {
-        RestartSec = 1;
+      #  description = "Pulseaudio system tray icon";
-        TimeoutStopSec = 10;
+      #  serviceConfig = {
-      };
+      #    Type = "simple";
-    };
+      #    ExecStart = "${lib.getExe pkgs.pasystray} --notify source --notify sink -m 100";
-    systemd.packages = [ pkgs.foot ];
+      #  };
-    systemd.user.sockets.foot-server.wantedBy = [ "graphical-environment.target" ];
+      #  path = [ "/run/current-system/sw" ];
+      #  partOf = [ "graphical-environment.target" ];
+      #  wantedBy = [ "graphical-environment.target" ];
+      #};
+      #systemd.user.services.kdeconnect-indicator = {
+      #  description = "KDE connect indicator";
+      #  serviceConfig = {
+      #    Type = "simple";
+      #    ExecStart = "${lib.getBin pkgs.kdePackages.kdeconnect-kde}/bin/kdeconnect-indicator";
+      #  };
+      #  path = [ "/run/current-system/sw" ];
+      #  partOf = [ "graphical-environment.target" ];
+      #  wantedBy = [ "graphical-environment.target" ];
+      #};
+      #systemd.user.services.swayr = {
+      #  description = "Sway MRU window switcher";
+      #  serviceConfig = {
+      #    Type = "simple";
+      #    ExecStart = "${lib.getBin pkgs.swayr}/bin/swayrd";
+      #  };
+      #  path = [ "/run/current-system/sw" ];
+      #  partOf = [ "graphical-environment.target" ];
+      #  wantedBy = [ "graphical-environment.target" ];
+      #};
+      #systemd.user.services.polkit-gnome-authentication-agent-1 = {
+      #  description = "polkit-gnome-authentication-agent-1";
+      #  partOf = [ "graphical-environment.target" ];
+      #  wantedBy = [ "graphical-environment.target" ];
+      #  serviceConfig = {
+      #    Type = "simple";
+      #    ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
+      #    Restart = "on-failure";
+      #    RestartSec = 1;
+      #    TimeoutStopSec = 10;
+      #  };
+      #};
+      #systemd.packages = [ pkgs.foot ];
+      #systemd.user.sockets.foot-server.wantedBy = [ "graphical-environment.target" ];
 
-    audrey-sway.extraPaletteEntries = [
+      audrey-sway.extraPaletteEntries = [
-      { name = "Command Palette"; }
+          { name = "Command Palette"; }
-    ];
+      ];
-  };
+    };
 }

modules/base-cross.nix

@@ -1,25 +0,0 @@
-{
-  lib,
-  pkgs,
-  ...
-}:
-{
-  config = lib.mkIf (pkgs.stdenv.buildPlatform != pkgs.stdenv.hostPlatform) {
-    programs.vim = {
-      enable = true;
-      # defaultEditor = true;
-      package = pkgs.vim.customize {
-        vimrcConfig.customRC = ''
-          set mouse=
-          set hlsearch
-          nnoremap <CR> :noh<CR><CR>
-        '';
-      };
-    };
-    programs.git.config.core.editor = "vim";
-    environment.systemPackages = with pkgs; [
-      clang
-      bintools
-    ];
-  };
-}

modules/base-desktop.nix

@@ -1,168 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-{
-  config = lib.mkIf config.rhelmot.isDesktop {
-    rhelmot.isWorkstation = true;
-    networking.networkmanager = {
-      enable = true;
-      plugins = with pkgs; [
-        networkmanager-openvpn
-        networkmanager-iodine
-        networkmanager-ssh
-      ];
-    };
-
-    fonts.packages = with pkgs; [
-      nerd-fonts.fira-code
-      noto-fonts
-      noto-fonts-cjk-sans
-      noto-fonts-color-emoji
-      liberation_ttf
-      fira-code
-      fira-code-symbols
-      mplus-outline-fonts.githubRelease
-      dina-font
-      proggyfonts
-    ];
-
-    services = {
-      xserver.enable = true;
-
-      printing = {
-        enable = true;
-        drivers = with pkgs; [ cnijfilter2 ];
-      };
-      avahi = {
-        enable = true;
-        nssmdns4 = true;
-        openFirewall = true;
-      };
-
-      pipewire = {
-        enable = true;
-        pulse.enable = true;
-      };
-
-      libinput.enable = true;
-
-      blueman.enable = true;
-    };
-
-    audrey-sway = {
-      enable = true;
-    };
-
-    programs.ydotool.enable = true;
-    users.users.audrey.extraGroups = [ "ydotool" ];
-
-    virtualisation.docker = {
-      enable = true;
-      storageDriver = "zfs";
-      logDriver = "journald";
-      daemon.settings = {
-        insecure-registries = [
-          "docker.shell.phish"
-          "registry.finals.2025.nautilus.institute:5000"
-        ];
-      };
-    };
-
-    programs = {
-      chromium.enable = true;
-      firefox = {
-        enable = true;
-        nativeMessagingHosts.packages = [
-          pkgs.fx-cast-bridge
-        ];
-        preferences = {
-          "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
-        };
-      };
-      thunderbird.enable = true;
-      kdeconnect.enable = true;
-      partition-manager.enable = true;
-      wireshark.enable = true;
-      wireshark.package = pkgs.wireshark;
-      foot.enable = true;
-      obs-studio = {
-        enable = true;
-        plugins = with pkgs.obs-studio-plugins; [
-          obs-livesplit-one
-        ];
-      };
-      thunar.enable = true;
-    };
-    environment.sessionVariables.TERMINAL = "kitty --single-instance";
-
-    environment.systemPackages = with pkgs; [
-      dino
-      discord
-      # legcord
-      element-desktop
-      signal-desktop
-      slack
-      zotero
-      via
-      libimobiledevice
-      gnome-disk-utility
-      kitty
-
-      gimp
-      feh
-      vlc
-      mpv
-      zathura
-      losslesscut-bin
-      file-roller
-
-      kdePackages.plasma-thunderbolt
-
-      (pkgs.idapro9.override {
-        pythonWithPackages = config.rhelmot.globalPython;
-      })
-    ];
-
-    environment.wordlist.enable = true;
-
-    # rhelmot.globalPythonPackages = [ (p: [(p.binsync)]) ];
-
-    services.usbmuxd.enable = true;
-
-    systemd.tmpfiles.settings.usersetup."/home/audrey/Downloads"."e!" = {
-      user = "audrey";
-      group = "users";
-      mode = "0700";
-      age = "1d";
-    };
-    systemd.services.sysfs-settings = {
-      description = "Set desktop sysfs tunables";
-      script = ''
-        # https://bugzilla.kernel.org/show_bug.cgi?id=219112
-        test "$(cat /sys/module/kvm/parameters/nx_huge_pages)" = "never" && exit 0 || true
-        echo "never" | tee /sys/module/kvm/parameters/nx_huge_pages
-      '';
-      before = [ "boot-complete.target" ];
-    };
-
-    hardware.sane.enable = true; # scanners
-    hardware.keyboard.qmk.enable = true;
-    hardware.acpilight.enable = true;
-    services.udev.packages = [ pkgs.via ];
-    services.udev.extraRules = ''
-      # Disable DS4 touchpad acting as mouse
-      # USB
-      ATTRS{name}=="Sony Interactive Entertainment Wireless Controller Touchpad", ENV{LIBINPUT_IGNORE_DEVICE}="1"
-      # Bluetooth
-      ATTRS{name}=="Wireless Controller Touchpad", ENV{LIBINPUT_IGNORE_DEVICE}="1"
-    '';
-  };
-  options.rhelmot.isDesktop = lib.mkOption {
-    type = lib.types.bool;
-    default = false;
-    description = "Install a graphical desktop";
-  };
-}

modules/base-nixbsd.nix

@@ -1,30 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  nixKey = "/var/lib/nix/binary-cache-key";
-in
-lib.optionalAttrs (lib ? nixbsdSystem) {
-  # it's already default
-  lix.enable = false;
-  init.services.nix-key-setup = {
-    description = "Generate a nix build signing key";
-    startType = "oneshot";
-    startCommand = [
-      (pkgs.writeScript "nix-key-setup" ''
-        test -f ${nixKey} && test -f ${nixKey}.pub && exit 0 || true
-        mkdir -p "$(dirname "${nixKey}")"
-        ${config.nix.package}/bin/nix-store --generate-binary-cache-key ${config.networking.hostName} ${nixKey} ${nixKey}.pub
-      '')
-    ];
-    dependencies = [ "FILESYSTEMS" ];
-    before = [ "nix-daemon" ];
-  };
-
-  environment.systemPackages = with pkgs; [
-    freebsd.truss
-  ];
-}

modules/base.nix

@@ -1,275 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  ...
-}:
-let
-  rhelmot = config.rhelmot;
-in
-{
-  options.rhelmot = {
-    globalPythonPackages = lib.mkOption {
-      type = with lib.types; listOf (functionTo (listOf package));
-      default = [ ];
-      description = "python packages (p: with p; [ x ]) to include in the global python environment";
-    };
-    globalPython = lib.mkOption {
-      type = lib.types.package;
-      description = "The python that will be used globally";
-    };
-  };
-  config = {
-    nixpkgs.config.allowUnfree = true;
-    nixpkgs.overlays = [
-      (import ../overlays/packages.nix)
-      (import "${inputs.nixtamal}/nix/overlay")
-      # lix overlay
-      (final: prev: {
-        inherit (prev.lixPackageSets.latest)
-          nixpkgs-review
-          nix-eval-jobs
-          nix-fast-build
-          colmena
-          ;
-      })
-    ];
-    nix.registry.nixpkgs.to = {
-      type = "path";
-      path = inputs.nixpkgs;
-      lastModified = 1;
-      narHash =
-        inputs.nixpkgs.hash or (builtins.readFile (
-          pkgs.runCommand "hash.nix" {
-            nativeBuildInputs = [ pkgs.nix ];
-          } "nix --extra-experimental-features nix-command hash path ${inputs.nixpkgs} >$out"
-        ));
-    };
-    nix.nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
-
-    nix.package = pkgs.lixPackageSets.latest.lix;
-    nix.settings.extra-experimental-features = "nix-command flakes pipe-operator";
-    nix.settings.trusted-users = [ "audrey" ];
-    nix.settings.max-jobs = 1;
-    nix.settings.cores = 0;
-    nix.settings.secret-key-files = [ "/var/lib/nix/binary-cache-key" ];
-    nix.settings.trusted-public-keys =
-      builtins.filter (f: f != "") <| lib.strings.splitString "\n" <| builtins.readFile ../keys/nix;
-
-    # Select internationalisation properties.
-    i18n.defaultLocale = "en_US.UTF-8";
-
-    # Configure keymap in X11
-    services.xserver.xkb.layout = "us";
-    services.xserver.xkb.options = "caps:escape";
-
-    users.defaultUserShell = pkgs.zsh;
-    users.users.audrey = {
-      uid = 1000;
-      description = "Audrey Dutcher";
-      isNormalUser = true;
-      extraGroups = [
-        "wheel"
-        "docker"
-        "video"
-        "networkmanager"
-        "libvirtd"
-        "scanner"
-        "lp"
-      ];
-      openssh.authorizedKeys.keyFiles = [ ../keys/ssh ];
-    };
-
-    environment.systemPackages = with pkgs; [
-      man-pages
-      man-pages-posix
-      wget
-      moor
-      ripgrep
-      fd
-      curl
-      btop
-      file
-      nettools
-      psmisc
-      p7zip
-      unzip
-      zip
-      jq
-      yq
-      socat
-      nix-run
-      openssl
-      wireguard-tools
-      tcpdump
-      sqlite
-      smartmontools
-      pciutils
-      usbutils
-      nethogs
-      rhelmot.globalPython
-    ];
-
-    rhelmot.globalPythonPackages = [
-      (
-        p: with p; [
-          virtualenvwrapper
-          pylint
-          pytest
-          ipdb
-          ipython
-          nclib
-          pyyaml
-          requests
-        ]
-      )
-    ];
-
-    programs = {
-      zsh = {
-        enable = true;
-        enableCompletion = true;
-        syntaxHighlighting.enable = true;
-        vteIntegration = true;
-        histSize = 10000;
-        promptInit = builtins.readFile ../dotfiles/zsh-prompt.sh;
-        shellInit = builtins.readFile ../dotfiles/zsh-init.sh;
-        shellAliases = {
-          ls = null;
-          ll = null;
-          l = null;
-          grep = "grep --color=auto";
-          egrep = "egrep --color=auto";
-          objdump = "objdump -M intel";
-          gits = "git status";
-          pag = "ps aux | grep -v grep | grep -i";
-          hd = "hexdump -C";
-          hdc = "hexdump -ve '\"\\\\x\" 1/1 \"%02x\"'";
-          nose = "pytest -v --capture=no --pdbcls=IPython.terminal.debugger:TerminalPdb";
-          mkvirtualenv = "mkvirtualenv -r /etc/venv-default.txt";
-          woman = "man";
-        };
-      };
-      tmux = {
-        enable = true;
-        extraConfig = builtins.readFile ../dotfiles/tmux.conf;
-      };
-      ssh.extraConfig = builtins.readFile ../dotfiles/ssh-config;
-      direnv.enable = true;
-      htop.enable = true;
-      git = {
-        enable = true;
-        config = {
-          user.email = "audrey@rhelmot.io";
-          user.name = "Audrey Dutcher";
-          init.defaultBranch = "main";
-          blame.markUnblamableLines = true;
-          credential.helper = "store";
-          url."ssh://git@".insteadOf = "git://";
-          core.excludesFile = pkgs.writeText "gitignore" ''
-            .stignore
-            .stignore-sync
-            .direnv
-            .envrc
-          '';
-        };
-      };
-      bat = {
-        enable = true;
-        extraPackages = with pkgs.bat-extras; [
-          batdiff
-          batman
-        ];
-        settings = {
-          italic-text = "always";
-          wrap = "never";
-          style = "plain";
-        };
-      };
-      mosh.enable = true;
-    };
-    environment.etc."zshrc.local".source = ../dotfiles/zsh-final.sh;
-    environment.etc."zinputrc".text = lib.mkForce (builtins.readFile ../dotfiles/zsh-input.sh);
-
-    environment.etc."gdb/gdbinit".source = ../dotfiles/gdb-init.gdb;
-    environment.etc."venv-default.txt".source = ../dotfiles/venv-default.txt;
-
-    services.openssh.enable = true;
-
-    boot.zfs.forceImportRoot = false;
-    services.sanoid = lib.mkIf config.boot.zfs.enabled {
-      enable = true;
-      datasets."system/home" = {
-        autosnap = true;
-        autoprune = true;
-        recursive = true;
-        processChildrenOnly = false;
-        yearly = 0;
-        monthly = 2;
-        daily = 7;
-        hourly = 24;
-      };
-      datasets."system/local/var" = {
-        autosnap = true;
-        autoprune = true;
-        recursive = true;
-        processChildrenOnly = false;
-        yearly = 0;
-        monthly = 2;
-        daily = 7;
-        hourly = 24;
-      };
-      datasets."system/local/root" = {
-        autosnap = true;
-        autoprune = true;
-        recursive = true;
-        processChildrenOnly = false;
-        yearly = 0;
-        monthly = 2;
-        daily = 7;
-        hourly = 24;
-      };
-      datasets."system/local/var/lib_docker" = {
-        autosnap = false;
-        recursive = true;
-      };
-    };
-
-    services.syncoid =
-      let
-        rootName = builtins.elemAt (lib.strings.splitString "/" config.fileSystems."/".device) 0;
-      in
-      lib.mkIf config.boot.zfs.enabled {
-        enable = true;
-        # offset 30min from sanoid to reduce I/O spikes and give sanoid a chance to snapshot before we
-        # back up
-        interval = "00/1:30";
-        service = {
-          serviceConfig = {
-            ExecCondition = "+${lib.getExe pkgs.condition-unmetered-network}";
-          };
-        };
-        sshKey = "/var/lib/syncoid/.ssh/id_ed25519";
-        commands."system" = {
-          source = rootName;
-          target = "buser@home.rhelmot.io:main/backup/${config.networking.hostName}/${rootName}";
-          # xeni note - option w is weeeeeeeird but the only consequnce is a lack of encryption
-          #sendOptions = "w";
-          recursive = true;
-          extraArgs = [
-            "--skip-parent"
-            "--sshport"
-            "2252"
-          ];
-        };
-      };
-    services.syncthing-cluster = {
-      deviceIds = ../keys/syncthing;
-      coordinator = "hydrangea";
-    };
-    rhelmot.globalPython = (
-      pkgs.python3.withPackages (p: lib.concatMap (pl: pl p) rhelmot.globalPythonPackages)
-    );
-  };
-}

modules/deployment.nix

@@ -1,73 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-let
-  hostname = config.networking.hostName;
-in
-{
-  options.rhelmot.deployments = lib.mkOption {
-    default = { };
-    description = "Any deployments to establish as profiles on this system";
-    type = lib.types.attrsOf (
-      lib.types.submodule (
-        {
-          name,
-          config,
-          ...
-        }:
-        {
-          options = {
-            profileName = lib.mkOption {
-              type = lib.types.str;
-              default = name;
-              description = "The profile name at which to find the resulting package";
-            };
-            target = lib.mkOption {
-              type = lib.types.pathInStore;
-              description = "The derivation to link into the specified profile.";
-            };
-            extraCommands = lib.mkOption {
-              type = lib.types.str;
-              default = "";
-              description = "Any extra commands to run when deploying this deployment";
-            };
-            deployScript = lib.mkOption {
-              internal = true;
-            };
-          };
-          config.deployScript = pkgs.replaceVarsWith rec {
-            name = "deploy-${config.profileName}";
-            dir = "bin";
-            src = builtins.toFile "deploy-template" ''
-              #!@runtimeShell@
-              set -ex
-              nix-copy-closure --to @site@ @target@
-              ssh @site@ sudo nix-env --set -p /nix/var/nix/profiles/@profileName@ @target@
-              @extraCommands@
-            '';
-            replacements = {
-              site = hostname;
-              inherit (config) target profileName extraCommands;
-              inherit (pkgs.buildPackages) runtimeShell;
-            };
-            isExecutable = true;
-            meta.mainProgram = name;
-          };
-        }
-      )
-    );
-  };
-  options.rhelmot.deployScript = lib.mkOption {
-    internal = true;
-  };
-  config.rhelmot.deployScript =
-    (pkgs.buildPackages.writeShellScriptBin "deploy" (
-      lib.concatMapStrings (x: "${lib.getExe x.deployScript}\n") (
-        builtins.attrValues config.rhelmot.deployments
-      )
-    ))
-    // builtins.mapAttrs (k: v: v.deployScript) config.rhelmot.deployments;
-}

modules/kakoune.nix

@@ -1,89 +1,79 @@
 {
-  lib,
+    lib,
-  pkgs,
+    pkgs,
-  config,
+    config,
-  ...
+    ...
 }:
-let
+let cfg = config.programs.kakoune;
-  cfg = config.programs.kakoune;
+in {
-in
+    options.programs.kakoune = {
-{
+        enable = lib.mkEnableOption "kakoune";
-  options.programs.kakoune = {
+        plugins = lib.mkOption {
-    enable = lib.mkEnableOption "kakoune";
+          type = lib.types.listOf lib.types.package;
-    plugins = lib.mkOption {
+          default = [];
-      type = lib.types.listOf lib.types.package;
+          description = "kakoune packages to include in the global editor";
-      default = [ ];
+        };
-      description = "kakoune packages to include in the global editor";
+        package = lib.mkPackageOption pkgs "kakoune" {};
-    };
+        finalPackage = lib.mkOption {
-    package = lib.mkPackageOption pkgs "kakoune" { };
+            type = lib.types.package;
-    finalPackage = lib.mkOption {
+            description = "The package that will be linked into the global environment if enabled";
-      type = lib.types.package;
+            default = cfg.package.override { plugins = cfg.plugins; };
-      description = "The package that will be linked into the global environment if enabled";
+        };
-      default = cfg.package.override { plugins = cfg.plugins; };
+        extraPackages = lib.mkOption {
-      internal = true;
+            type = lib.types.listOf lib.types.package;
-    };
+            default = [];
-    defaultEditor = lib.mkOption {
+            description = "Extra packages that should be linked into the system if Kakoune is enabled";
-      type = lib.types.bool;
+            example = ''
-      default = false;
+                with pkgs; [ kak-tree-sitter kakoune-lsp ]
-      description = "Whether to set EDITOR=kak globally";
+            '';
-    };
+        };
-    extraPackages = lib.mkOption {
+        configFiles = lib.mkOption {
-      type = lib.types.listOf lib.types.package;
+            type = lib.types.listOf lib.types.path;
-      default = [ ];
+            default = [];
-      description = "Extra packages that should be linked into the system if Kakoune is enabled";
+            description = "Files to link into the auto-loaded configuration";
-      example = ''
+            example = ''
-        with pkgs; [ kak-tree-sitter kakoune-lsp ]
+                lib.filesystem.listFilesRecursive ./dotfiles/kakoune/config
-      '';
+            '';
-    };
+        };
-    configFiles = lib.mkOption {
+        extraConfig = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
+            type = lib.types.lines;
-      default = [ ];
+            default = "";
-      description = "Files to link into the auto-loaded configuration";
+            description = "Extra configuration to load after the configFiles";
-      example = ''
+            example = ''
-        lib.filesystem.listFilesRecursive ./dotfiles/kakoune/config
+                "colorscheme silly-color-scheme"
-      '';
+            '';
-    };
+        };
-    extraConfig = lib.mkOption {
+        colorSchemes = lib.mkOption {
-      type = lib.types.lines;
+            type = lib.types.listOf lib.types.path;
-      default = "";
+            default = [];
-      description = "Extra configuration to load after the configFiles";
+            description = ''
-      example = ''
+                Files to link into the auto-loaded color schemes.
-        "colorscheme silly-color-scheme"
-      '';
-    };
-    colorSchemes = lib.mkOption {
-      type = lib.types.listOf lib.types.path;
-      default = [ ];
-      description = ''
-        Files to link into the auto-loaded color schemes.
 
-        NOTE: You probably want to populate this with a directory path
+                NOTE: You probably want to populate this with a directory path
-        rather than a file path, since if a file is copied to the nix
+                rather than a file path, since if a file is copied to the nix
-        store its name will be mangled, and you must refer to color
+                store its name will be mangled, and you must refer to color
-        schemes by their filename.
+                schemes by their filename.
-      '';
+            '';
-      example = "[ ./dotfiles/kakoune/colors ]";
+            example = "[ ./dotfiles/kakoune/colors ]";
+        };
+    };
+    config = lib.mkIf cfg.enable {
+        environment.systemPackages = [
+            cfg.finalPackage
+        ] ++ cfg.extraPackages;
+        programs.kakoune.configFiles = lib.mkAfter [
+            (pkgs.writeText "kakoune-extra-config.kak" cfg.extraConfig)
+        ];
+        programs.kakoune.plugins = lib.mkAfter [
+            (pkgs.runCommand "kakoune-colorschemes" {} ''
+                mkdir -p $out/share/kak/colors
+                ${lib.strings.concatMapStringsSep "\n" (p: "ln -s ${p} $out/share/kak/colors/") cfg.colorSchemes}
+            '')
+            (pkgs.writeTextFile {
+                name = "kakrc.local";
+                text = lib.strings.concatMapStrings (f: "source ${f}\n") cfg.configFiles;
+                destination = "/share/kak/kakrc.local";
+            })
+        ];
     };
-  };
-  config = lib.mkIf cfg.enable {
-    environment.systemPackages = [
-      cfg.finalPackage
-    ]
-    ++ cfg.extraPackages;
-    programs.kakoune.configFiles = lib.mkAfter [
-      (pkgs.writeText "kakoune-extra-config.kak" cfg.extraConfig)
-    ];
-    programs.kakoune.plugins = lib.mkAfter [
-      (pkgs.runCommand "kakoune-colorschemes" { } ''
-        mkdir -p $out/share/kak/colors
-        ${lib.strings.concatMapStringsSep "\n" (p: "ln -s ${p} $out/share/kak/colors/") cfg.colorSchemes}
-      '')
-      (pkgs.writeTextFile {
-        name = "kakrc.local";
-        text = lib.strings.concatMapStrings (f: "source ${f}\n") cfg.configFiles;
-        destination = "/share/kak/kakrc.local";
-      })
-    ];
-    environment.variables.EDITOR = lib.mkIf cfg.defaultEditor "kak";
-  };
 }

modules/mobile-timezone/default.nix

@@ -1,60 +1,37 @@
 {
-  config,
+    config,
-  pkgs,
+    pkgs,
-  lib,
+    lib,
-  ...
+    ...
 }:
-let
+let cfg = config.services.mobileTimezone;
-  cfg = config.services.mobileTimezone;
+in {
-in
+    options.services.mobileTimezone = {
-{
+        enable = lib.mkEnableOption "automatic mobile timezone configuration";
-  options.services.mobileTimezone = {
+        interface = lib.mkOption {
-    enable = lib.mkEnableOption "automatic mobile timezone configuration";
+            description = "Interface to use to fetch a public IP";
-    interface = lib.mkOption {
+            type = lib.types.str;
-      description = "Interface to use to fetch a public IP";
+        };
-      type = lib.types.str;
     };
-  };
+    config = lib.mkIf cfg.enable {
-  config = lib.mkIf cfg.enable {
+        assertions = [
-    assertions = [
+            { assertion = config.time.timeZone == null;
-      {
+              message = "mobileTimezone requires mutable time zone configuration";
-        assertion = config.time.timeZone == null;
+            }
-        message = "mobileTimezone requires mutable time zone configuration";
+            {
-      }
+              assertion = config.networking.networkmanager.enable;
-      {
+              message = "mobileTimezone requires use of NetworkManager";
-        assertion = config.networking.networkmanager.enable;
+            }
-        message = "mobileTimezone requires use of NetworkManager";
+        ];
-      }
-    ];
 
-    networking.networkmanager.dispatcherScripts = [
+        networking.networkmanager.dispatcherScripts = [{
-      {
+            source = pkgs.writeShellScript "mobile-timezone" ''
-        source = pkgs.writeShellScript "mobile-timezone" ''
+              export WIRELESS_INTERFACE="${cfg.interface}"
-          export WIRELESS_INTERFACE="${cfg.interface}"
+              export PATH="${lib.strings.makeBinPath (with pkgs; [ config.systemd.package bash geoipWithDatabase sudo curl gnugrep gnused coreutils libnotify procps gawk libc ])}"
-          export PATH="${
+              if [[ "$2" == "connectivity-change" && "$CONNECTIVITY_STATE" == "FULL" ]]; then
-            lib.strings.makeBinPath (
+                  ${./mobile-timezone.sh}
-              with pkgs;
+              fi
-              [
+            '';
-                config.systemd.package
+        }];
-                bash
+    };
-                geoipWithDatabase
-                sudo
-                curl
-                gnugrep
-                gnused
-                coreutils
-                libnotify
-                procps
-                gawk
-                libc
-              ]
-            )
-          }"
-          if [[ "$2" == "connectivity-change" && "$CONNECTIVITY_STATE" == "FULL" ]]; then
-              ${./mobile-timezone.sh}
-          fi
-        '';
-      }
-    ];
-  };
 }

modules/syncthing-cluster/default.nix

@@ -7,15 +7,11 @@ let
   cfg = config.services.syncthing-cluster;
   hostname = config.networking.hostName;
   deviceFiles = builtins.attrNames (builtins.readDir cfg.deviceIds);
-  toDeviceInfo = filename: {
+  toDeviceInfo = filename: { name = filename; value = lib.strings.trim (builtins.readFile "${cfg.deviceIds}/${filename}"); };
-    name = filename;
-    value = lib.strings.trim (builtins.readFile "${cfg.deviceIds}/${filename}");
-  };
   allDevices = builtins.listToAttrs (builtins.map toDeviceInfo deviceFiles);
   otherDevices = lib.attrsets.removeAttrs allDevices [ hostname ];
   myDeviceIdAgain = allDevices.${hostname} or "";
-in
+in {
-{
   options.services.syncthing-cluster = {
     enable = lib.mkEnableOption "syncthing cluster";
     device = lib.mkOption {
@@ -43,33 +39,22 @@ in
       description = "The hostname of the device which should be the coordinator for the cluster and should auto-accept all folders";
     };
   };
-  config = lib.mkIf cfg.enable (
+  config = lib.mkIf cfg.enable (lib.mkMerge [{
-    lib.mkMerge [
+    assertions = [{
-      {
+      assertion = cfg.device == myDeviceIdAgain;
-        assertions = [
+      message = "Your device ID (${cfg.device}) is not listed in the device ID directory under your hostname (${hostname})";
-          {
+    }];
-            assertion = cfg.device == myDeviceIdAgain;
+    services.syncthing = {
-            message = "Your device ID (${cfg.device}) is not listed in the device ID directory under your hostname (${hostname})";
+      enable = true;
-          }
+      inherit (cfg) configDir dataDir user;
-        ];
+      openDefaultPorts = true;
-        services.syncthing = {
+      overrideDevices = true;
-          enable = true;
+      settings.devices = builtins.mapAttrs (_: value: { id = value; autoAcceptFolders = hostname == cfg.coordinator; }) otherDevices;
-          inherit (cfg) configDir dataDir user;
+    };
-          openDefaultPorts = true;
+  } (lib.mkIf (cfg.user != "syncthing") {
-          overrideDevices = true;
+    services.syncthing = {
-          overrideFolders = false;
+      inherit (cfg) user;
-          settings.devices = builtins.mapAttrs (_: value: {
+      group = config.users.users.${cfg.user}.group;
-            id = value;
+    };
-            autoAcceptFolders = hostname == cfg.coordinator;
+  })]);
-          }) otherDevices;
-        };
-      }
-      (lib.mkIf (cfg.user != "syncthing") {
-        services.syncthing = {
-          inherit (cfg) user;
-          group = config.users.users.${cfg.user}.group;
-        };
-      })
-    ]
-  );
 }

modules/workstation.nix

@@ -1,88 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.rhelmot.isWorkstation = lib.mkOption {
-    default = false;
-    type = lib.types.bool;
-    description = "Whether to install workstation tools on this machine";
-  };
-  config = lib.mkIf config.rhelmot.isWorkstation {
-    environment.systemPackages = with pkgs; [
-      gnumake
-      units
-      units-desktop
-      patchelf
-      dwarfdump
-      gdb
-      kubectl
-      kubernetes-helm
-      foremost
-      binwalk
-      nix-index
-      nixtamal.nixtamal
-      cronie
-      radicle-node
-      editorconfig-core-c
-      clang
-      gcc
-      bintools
-      ffmpeg
-    ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-      rr
-      qemu-user
-
-      nixd
-      lua-language-server
-      clang-tools
-      bash-language-server
-      pyright
-      csharp-ls
-      dotnet-sdk_9
-      gopls
-      typescript-language-server
-      ocamlPackages.ocaml-lsp
-
-      pre-commit
-    ];
-
-    rhelmot.globalPythonPackages = [
-      (
-        p: with p; [
-          aiohttp
-          snakeviz
-          pysocks
-          pudb
-        ]
-      )
-    ];
-
-    documentation.dev.enable = true;
-    documentation.man.enable = true;
-    documentation.doc.enable = true;
-
-    programs = {
-      kakoune = {
-        enable = pkgs.stdenv.hostPlatform.system == pkgs.stdenv.buildPlatform.system;
-        defaultEditor = true;
-        plugins = with pkgs.kakounePlugins; [
-          kak-fzf
-          smarttab-kak
-        ];
-        configFiles = lib.filesystem.listFilesRecursive ../dotfiles/kakoune/config;
-        colorSchemes = [ ../dotfiles/kakoune/colors ];
-        extraPackages = with pkgs; [
-          kak-tree-sitter-complete
-          kakoune-lsp
-        ];
-      };
-      git.lfs.enable = true;
-      bat.extraPackages = with pkgs.bat-extras; [
-          prettybat
-      ];
-    };
-  };
-}

modules/zfs-module/default.nix

@@ -1,13 +1,5 @@
-{
+{ config, pkgs, lib, ... }: let
-  config,
+  withDefaultPool = defaultPool: dataset: if lib.strings.hasPrefix "/" dataset then "${defaultPool}${dataset}" else dataset;
-  pkgs,
-  lib,
-  ...
-}:
-let
-  withDefaultPool =
-    defaultPool: dataset:
-    if lib.strings.hasPrefix "/" dataset then "${defaultPool}${dataset}" else dataset;
   cfg = config.zfs;
 
   zfsPermsOptions = {
@@ -19,7 +11,7 @@ let
           Corresponds to `zfs allow -l`.
         '';
         type = with lib.types; listOf str;
-        default = [ ];
+        default = [];
         example = lib.literalExpression "[\"@mypermset\" \"create\" \"destroy\"]";
       };
 
@@ -30,7 +22,7 @@ let
           Corresponds to `zfs allow -d`.
         '';
         type = with lib.types; listOf str;
-        default = [ ];
+        default = [];
         example = lib.literalExpression "[\"@mypermset\" \"create\" \"destroy\"]";
       };
     };
@@ -38,9 +30,7 @@ let
 
   zfsDatasetOptions = {
     options = {
-      enable = (lib.mkEnableOption "ZFS dataset") // {
+      enable = (lib.mkEnableOption "ZFS dataset") // { default = true; };
-        default = true;
-      };
 
       name = lib.mkOption {
         description = ''
@@ -68,14 +58,8 @@ let
 
           Corresponds to `zfs create -o property=value`.
         '';
-        type =
+        type = with lib.types; attrsOf (oneOf [str int bool]);
-          with lib.types;
+        default = {};
-          attrsOf (oneOf [
-            str
-            int
-            bool
-          ]);
-        default = { };
         example = lib.literalExpression ''
           {
             "mycustom:prop" = "test";
@@ -99,7 +83,7 @@ let
           This corresponds to the `zfs allow -u` command.
         '';
         type = with lib.types; attrsOf (submodule zfsPermsOptions);
-        default = { };
+        default = {};
         example = lib.literalExpression ''
           {
             "myuser" = {
@@ -117,7 +101,7 @@ let
           This corresponds to the `zfs allow -g` command.
         '';
         type = with lib.types; attrsOf (submodule zfsPermsOptions);
-        default = { };
+        default = {};
         example = lib.literalExpression ''
           {
             "mygroup" = {
@@ -135,7 +119,7 @@ let
           This corresponds to the `zfs allow -e` command.
         '';
         type = with lib.types; submodule zfsPermsOptions;
-        default = { };
+        default = {};
         example = lib.literalExpression ''
           {
             local = ["create"];
@@ -146,8 +130,7 @@ let
     };
   };
 
-  makeFileSystem =
+  makeFileSystem = parent: name: value:
-    parent: name: value:
     lib.nameValuePair value.mountPoint {
       device = withDefaultPool parent name;
       fsType = "zfs";
@@ -155,24 +138,21 @@ let
       neededForBoot = true;
     };
 
-  makeTmpfiles =
+  makeTmpfiles = _: value:
-    _: value:
     lib.nameValuePair value.mountPoint {
       z = {
         inherit (value) user group mode;
       };
     };
 
-  normalizeProp =
+  normalizeProp = prop:
-    prop:
     if lib.isInt prop then
       builtins.toString prop
     else if lib.isBool prop then
       if prop then "on" else "off"
     else
       prop;
-in
+in {
-{
   options.zfs = {
     systemPool = {
       name = lib.mkOption {
@@ -191,14 +171,8 @@ in
 
           Corresponds to `zpool create -o property=value`.
         '';
-        type =
+        type = with lib.types; attrsOf (oneOf [str int bool]);
-          with lib.types;
+        default = {};
-          attrsOf (oneOf [
-            str
-            int
-            bool
-          ]);
-        default = { };
         example = lib.literalExpression ''
           {
             compression = "lz4";
@@ -213,14 +187,8 @@ in
 
           Corresponds to `zpool create -O property=value`.
         '';
-        type =
+        type = with lib.types; attrsOf (oneOf [str int bool]);
-          with lib.types;
+        default = {};
-          attrsOf (oneOf [
-            str
-            int
-            bool
-          ]);
-        default = { };
         example = lib.literalExpression ''
           {
             "mycustom:prop" = "test";
@@ -230,20 +198,13 @@ in
     };
 
     reserved = {
-      enable = (lib.mkEnableOption "ZFS reservation") // {
+      enable = (lib.mkEnableOption "ZFS reservation") // { default = true; };
-        default = true;
-      };
 
       size = lib.mkOption {
         description = ''
           Size of the ZFS reservation.
         '';
-        type =
+        type = with lib.types; oneOf [ str int ];
-          with lib.types;
-          oneOf [
-            str
-            int
-          ];
         default = "5G";
         example = lib.literalExpression "\"10G\"";
       };
@@ -252,7 +213,7 @@ in
     datasets = lib.mkOption {
       description = "ZFS datasets";
       type = with lib.types; attrsOf (submodule zfsDatasetOptions);
-      default = { };
+      default = {};
       example = lib.literalExpression ''
         {
           "mydataset" = {
@@ -268,7 +229,7 @@ in
     users = lib.mkOption {
       description = "List of users to process zfs.perUser for.";
       type = with lib.types; listOf str;
-      default = [ ];
+      default = [];
       example = lib.literalExpression "[ \"someuser\" ]";
     };
 
@@ -280,7 +241,7 @@ in
         being created in the format `{name, ...}`.
       '';
       type = with lib.types; functionTo (attrsOf (submodule zfsDatasetOptions));
-      default = { };
+      default = {};
       example = lib.literalExpression ''
         {name, ...}: {
           "mydataset" = {
@@ -301,116 +262,108 @@ in
     };
   };
 
-  config =
+  config = let
-    let
+    datasetsToSort =
-      datasetsToSort = lib.mapAttrsToList (name: value: {
+      lib.mapAttrsToList (name: value: {
         inherit name;
         inherit (value) mountPoint;
       }) cfg._allDatasets;
-      sortFunc = a: b: (lib.hasPrefix a.name b.name) || (lib.hasPrefix a.mountPoint b.mountPoint);
+    sortFunc = a: b: 
-      sortedDatasets = lib.toposort sortFunc datasetsToSort;
+      (lib.hasPrefix a.name b.name) || (lib.hasPrefix a.mountPoint b.mountPoint);
-    in
+    sortedDatasets = lib.toposort sortFunc datasetsToSort;
-    {
+  in {
-      assertions = [
+    assertions = [
-        {
+      {
-          assertion = !(lib.hasAttr "cycle" sortedDatasets);
+        assertion = !(lib.hasAttr "cycle" sortedDatasets);
-          message =
+        message = let
-            let
+          cycleItems =
-              cycleItems = lib.map (x: "\n    - " + x.name + " (" + x.mountPoint + ")") sortedDatasets.cycle;
+            lib.map (x:
-            in
+              "\n    - " + x.name + " (" + x.mountPoint + ")"
-            "ZFS datasets have a cycle!" + (lib.concatStrings cycleItems);
+            ) sortedDatasets.cycle;
-        }
+        in "ZFS datasets have a cycle!" + (lib.concatStrings cycleItems);
-      ];
+      }
+    ];
 
-      zfs._allDatasets =
+    zfs._allDatasets = let
-        let
+      fixupDatasets = user: group: datasets:
-          fixupDatasets =
+        (lib.mapAttrs'
-            user: group: datasets:
+          (name: value:
-            (lib.mapAttrs' (
+            lib.nameValuePair
-              name: value:
+              (if value.name == null then name else value.name)
-              lib.nameValuePair (if value.name == null then name else value.name) (
+              ((lib.removeAttrs value ["name"]) // {
-                (lib.removeAttrs value [ "name" ])
+                inherit user group;
-                // {
+              }))
-                  inherit user group;
+          datasets)
-                }
+        |> (lib.filterAttrs (_: value: value.enable))
-              )
+        |> (lib.mapAttrs (_: value: lib.removeAttrs value ["enable"]));
-            ) datasets)
+    in
-            |> (lib.filterAttrs (_: value: value.enable))
+      (fixupDatasets "root" "root" cfg.datasets) //
-            |> (lib.mapAttrs (_: value: lib.removeAttrs value [ "enable" ]));
+      (lib.mergeAttrsList
-        in
+        (lib.map
-        (fixupDatasets "root" "root" cfg.datasets)
+          (name:
-        // (lib.mergeAttrsList (
-          lib.map (
-            name:
             # XXX: passing in "users" verbatim here is kind of a hack
             # unfortunately due to infinite recursion we can't actually query for the user's
             # main group, and it seems clunky to expect it to be passed from the outside
-            fixupDatasets name "users" (cfg.perUser { inherit name; })
+            fixupDatasets name "users" (cfg.perUser { inherit name; }))
-          ) cfg.users
+          cfg.users));
-        ));
 
-      fileSystems = lib.mapAttrs' (makeFileSystem "${cfg.systemPool.name}") cfg._allDatasets;
+    fileSystems =
+      lib.mapAttrs'
+        (makeFileSystem "${cfg.systemPool.name}")
+        cfg._allDatasets;
 
-      systemd.tmpfiles.settings."zfs-datasets" = lib.mapAttrs' makeTmpfiles cfg._allDatasets;
+    systemd.tmpfiles.settings."zfs-datasets" =
+      lib.mapAttrs' makeTmpfiles cfg._allDatasets;
 
-      # provide some recommended config
+    # provide some recommended config
-      zfs = {
+    zfs = {
-        systemPool = {
+      systemPool = {
-          properties = {
+        properties = {
-            # user must set ashift
+          # user must set ashift
-            autotrim = lib.mkDefault true;
+          autotrim = lib.mkDefault true;
-          };
+        };
 
-          fsProperties = {
+        fsProperties = {
-            acltype = lib.mkDefault "posix";
+          acltype = lib.mkDefault "posix";
-            compression = lib.mkDefault "lz4";
+          compression = lib.mkDefault "lz4";
 
-            mountpoint = lib.mkDefault "none";
+          mountpoint = lib.mkDefault "none";
-            canmount = lib.mkDefault false;
+          canmount = lib.mkDefault false;
-            atime = lib.mkDefault false;
+          atime = lib.mkDefault false;
-            relatime = lib.mkDefault true;
+          relatime = lib.mkDefault true;
-            recordsize = lib.mkDefault "16k";
+          recordsize = lib.mkDefault "16k";
-            dnodesize = lib.mkDefault "auto";
+          dnodesize = lib.mkDefault "auto";
-            xattr = lib.mkDefault "sa";
+          xattr = lib.mkDefault "sa";
-            normalization = lib.mkDefault "formD";
+          normalization = lib.mkDefault "formD";
-          };
         };
       };
-
-      # TODO: apply ZFS properties and permissions
-
-      system.build.zfsConfig = (pkgs.formats.json { }).generate "zfs.json" rec {
-        inherit (cfg) reserved;
-        systemPool = {
-          properties = lib.mapAttrs (_: v: normalizeProp v) cfg.systemPool.properties;
-          fsProperties = lib.mapAttrs (_: v: normalizeProp v) cfg.systemPool.fsProperties;
-        }
-        // lib.removeAttrs cfg.systemPool [
-          "properties"
-          "fsProperties"
-        ];
-
-        datasets =
-          cfg._allDatasets
-          |> (lib.mapAttrs' (
-            name: value:
-            lib.nameValuePair (withDefaultPool cfg.systemPool.name name) (
-              {
-                properties = lib.mapAttrs (_: v: normalizeProp v) value.properties;
-              }
-              // (lib.removeAttrs value [ "properties" ])
-            )
-          ));
-
-        installOrder = lib.map (x: withDefaultPool cfg.systemPool.name x.name) sortedDatasets.result;
-      };
-
-      system.build.zfsProvisionScript = pkgs.writeShellScriptBin "zfs-provision" ''
-        bash ${./zfs-provision.sh} ${config.system.build.zfsConfig}
-      '';
-
-      system.systemBuilderCommands = ''
-        cp "${config.system.build.zfsConfig}" $out/zfs.json
-      '';
     };
+
+    # TODO: apply ZFS properties and permissions
+
+    system.build.zfsConfig = (pkgs.formats.json {}).generate "zfs.json" rec {
+      inherit (cfg) reserved;
+      systemPool = {
+        properties = lib.mapAttrs (_: v: normalizeProp v) cfg.systemPool.properties;
+        fsProperties = lib.mapAttrs (_: v: normalizeProp v) cfg.systemPool.fsProperties;
+      } // lib.removeAttrs cfg.systemPool ["properties" "fsProperties"];
+
+      datasets = cfg._allDatasets
+        |> (lib.mapAttrs'
+          (name: value: lib.nameValuePair (withDefaultPool cfg.systemPool.name name)
+            ({
+              properties = lib.mapAttrs (_: v: normalizeProp v) value.properties;
+            } // (lib.removeAttrs value ["properties"]))));
+
+      installOrder = lib.map (x: withDefaultPool cfg.systemPool.name x.name) sortedDatasets.result;
+    };
+
+    system.build.zfsProvisionScript = pkgs.writeShellScriptBin "zfs-provision" ''
+      bash ${./zfs-provision.sh} ${config.system.build.zfsConfig}
+    '';
+
+    system.systemBuilderCommands = ''
+      cp "${config.system.build.zfsConfig}" $out/zfs.json
+    '';
+  };
 }

nix/tamal/.editorconfig

@@ -1,8 +0,0 @@
-root = true
-
-[*]
-charset = utf-8
-end_of_line = lf
-indent_style = tab
-insert_final_newline = true
-trim_trailing_whitespace = true

nix/tamal/.ignore

@@ -1,2 +0,0 @@
-darcs_context
-.silo

nix/tamal/darcs_context/.editorconfig

@@ -1 +0,0 @@
-root = true

nix/tamal/darcs_context/nixtamal.txt

@@ -1,210 +0,0 @@
-
-Context:
-
-
-[TAG 1.9.1
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260718191007
- Ignore-this: a61244ca0d379e0c2b68fe88cd362399bfac5dd16c87077e1888b5770e6167f44564b2dcadad6dc8
- 
- • BUG: fix tag collision in Fossil flow
- • Upgrade flow happens early at the command level & prompts [Y/n]
-   instead of making the user run nixtamal upgrade
- • Old upgrade flow moved to asserts
- • Asserts disabled for release builds for performance
- • Blueprints add strictDeps = true
- • Nix code fixups based on the Nixpkgs review
-] 
-
-[CHANGELOG: tweak for 1.9.1
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260718190213
- Ignore-this: 6600b7ac615ca1abda403c51a460bfe317bcaefda202a73a68d0522ed351b625d1a17079a8e4af80
-] 
-
-[properly scan between `""` for version
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260718190113
- Ignore-this: 5f98bd962ca0e951c4f2bbbd8c97d929eb181b95637318fbae70204f6a0b7875105e5a16883be41a
-] 
-
-[set lockfile so it can be reused
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260718184638
- Ignore-this: f6183f1f3e3f91851d1278a1ccb0b5b712a294cd46b99df43ac8fd7cc776095e17cb9eca912ac877
-] 
-
-[Manifest ∨ lockfile
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260718184457
- Ignore-this: 5f21a80de9c600bef373ac38a4ef35df1696c4c8926d0f123ab7044acea7bdbd72abbe68d3e9652e
-] 
-
-[version: 1.9.0 → 1.9.1
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260718184457
- Ignore-this: 2b714201d707659a0add532a0c59f29bd753a1a4e67c8e65c3f73604c8893bcb8b854e05046c3dc6
-] 
-
-[assert the hash value was set
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260718184457
- Ignore-this: 3d9e9813a2233e8e560371bae6b474095d3b115473bf55d004877ed20f6d50a18b9d1341cfce6fe2
-] 
-
-[Fossil tag number collision
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260718184457
- Ignore-this: 2c5b722e2d4dcf207fcf7bb6a89a0d0542169f624a1b1a4fc8c178379fe8d28d5e6fbc35fb142220
-] 
-
-[don’t assert in release
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260718184457
- Ignore-this: fb6c50d364bb8d5683aaa51f7536c951c53c93bfee654ff679e71484238e837922d1958c96423eed
-] 
-
-[with upgrade tested at the cmd level, move version checking to asserts
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260718184452
- Ignore-this: fb1506f223385a854948b13e9ffda126d2310dc5ccc3df37467d6fada9bcd42c1b2ba3c61e3cdbf8
-] 
-
-[ask to upgrade on outdated commands over showing erros
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260718175747
- Ignore-this: c0e75caba64f7ded8cfab6b334bbf54a21e49e08f05bc0b27fa45a927f6e39255e12484697d087f9
- 
- It’s annoying to be told to upgrade manually (+ the error was off).
- As well, minor refactor around exit codes using begin blocks.
-] 
-
-[nixtamal refresh
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260718161415
- Ignore-this: e0e75b27dca3783aed8d671c7917c05f02e2a40c4f83e4a1bdfffa7b7692e6f340ad6a9fe8e47e02
-] 
-
-[blueprint: add strictDeps = true to demo
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260716045609
- Ignore-this: b463d42b3ba3325e0b5427c174f3808d93c6233f73c84a8aed817790bdc7192486e75d05969f58a
-] 
-
-[find-less globbing for directory is simpler
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260714093057
- Ignore-this: c954601f6ad107b8c315c590a98446aac2f1a55de0923a2a04fba8802c4010c9947836ea962b7de3
- 
- result of Nixpkgs review process
-] 
-
-[remove feature that was removed before release
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710180919
- Ignore-this: 7f7e0ea450b652e2fab2317f0ac6340f23491eb831620b9b9e25c534220523a314a9038e670e4e4e
-] 
-
-[TAG 1.9.0
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710171431
- Ignore-this: 5d45a9a9454133918d25517a7649738b6e1d50957d70f6761b57b13e677c170e88dc84751e52b5c2
- 
- • Change how resources are ‘located’ by switching from URI. to new
-   Locator.t; this is now a Newtype-like wrapper around non-empty strings
-   where only empty strings are rejected — not limiting user to just URIs
-   but allowing SCP-like strings, file system paths (thanks
-   cybolic for reporting)
- 
-   IMPORTANT: If you were relying on the prior percent-encoding behavior,
-   you will now need to manually encode (or pipe to a tool that can for
-   `fresh-cmd`)
- • Use indented/smart/magic strings in the lock loader to handle weirder
-   input
- • Escape patch prefetch Nix code
- • Rename `Cmd_empty → `Cmd_output_empty to be just a tiny bit clearer as
-   well as adding a Logs.err (thanks Jacek Galowicz)
-] 
-
-[refresh the nixfmt patch for tabs
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710164210
- Ignore-this: 8920ef38ff7073c440342a91be1c497fdb3fa4d679162b9052213b63532c48bd2fd993ba2c0ca8af
-] 
-
-[peers casing
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710162835
- Ignore-this: 915f08b3b7cd913228e479f2b8caad341ccd92be2745bcff7de357faa0b89d4bd015b44c168d978b
-] 
-
-[include meta nickel dirs
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710162835
- Ignore-this: 7004fdffbe669a8951827808a0c67f36ade3c7ac0541108cb61215b718f3fd7a350dc492fbcdbbf6
-] 
-
-[CHANGELOG: fix capitalization
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710162835
- Ignore-this: e0200148eed0b00439ba7fbf5ba917549a65ce3983fefa70a69492e8351df1d4fd0036ee75b1293b
-] 
-
-[add meta check
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710162835
- Ignore-this: 9f2c5e681798441e656791a7829e84e3cde20f9260b7f5b72093c2bccec1b6cb7167bca659c2d0e8
-] 
-
-[split “hackmates” from “bug finders”
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710162835
- Ignore-this: 5c953fca03dc4be86fa077c8db1a355cedd1c6625d6d0337016e4b4237678cf91b006ec7b9c3597
-] 
-
-[hackmates: add Jacek Galowicz
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710162835
- Ignore-this: 1e48c299a77b437a1786e3958562f28e7c692b5bf7067bf084e61a2811ead4b07eb0e037cedcbfd9
-] 
-
-[label Cmd_empty → Cmd_output_empty; Logs.err as well
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710162835
- Ignore-this: d837819366256b164ddb9cf7266f6a0e2fb4fa094b8426fe309e5aa8a336e65ea5dd45b224ddf251
-] 
-
-[CHANGELOG: tweak for 1.9.0
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710162835
- Ignore-this: d56b7299a6d501344476bdee98666193cdc39bd6ace2f3091938e825f89d8bde33fa55d44361676
-] 
-
-[hackmates: add cybolic
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710162835
- Ignore-this: 1a2f06741cf501926b6b87773c1ec0c16c3b21c37e177a2142027732a08dc43135faf39cf47411d7
-] 
-
-[escape Nix for patch prefetch
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710162835
- Ignore-this: 3804b19db73d53f6a709c09f51af4d62ad6a28b22e337f7c87680cdd842ed4fe756886e3e44642f9
-] 
-
-[version: 1.8.2 → 1.9.0
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710162835
- Ignore-this: fb1f3634689c57f3f1f6a73cac6793a419d0e78f3b611e08743b5b47b1600a7e536d3febb3ceba62
-] 
-
-[bubble up invalid locator errors
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710162835
- Ignore-this: f873566a357ab610a1f7b4e70be864be79225ec43c5ca835bfc7e298b68a75db55b02c53a3426ad9
-] 
-
-[URI → Locators to handle SCP-style locations
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710162835
- Ignore-this: eac941cca290b8f92f2b181ecadaf656f41414a20776e381ccfc52c407d4001050400b5aac7ee6f
- 
- Loses some “type safety” but not any safety that’s really that useful to
- users.
-] 
-
-[don’t allow the flake.lock to be used
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710162835
- Ignore-this: 905d6ae36e583e344846af14a1b2bdffa0d898038e0e02295c844731fb37555d4f7a4b5db91e5fc8
- 
- Not that flakes are used, but this is a signal
-] 
-
-[nixtamal refresh
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260710162822
- Ignore-this: b470fc84ca1721f9611a6904ed264c1980a48958e7c54d7e6ceba6381dfc59a9b0cb35fd75b3a566
-] 
-
-[TAG 1.8.2
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260705190705
- Ignore-this: b3c0f577644cf6efa4a96705c59e1e276efa7ecc44f493f6e14e8d5042b243573eea93e595ca8498
- 
- • clean up Nix code by putting more inputs in the correct buckets
-] 
-
-[TAG 1.8.2
-·𐑑𐑴𐑕𐑑𐑩𐑤 <toastal@posteo.net>**20260626200055
- Ignore-this: 9a19076b975ebaf5f0b478a8cb825a5a77013fda8faf52d3c69a02bd400fc939b7cf39d97d5141eb
- 
- • clean up Nix code by putting more inputs in the correct buckets
-] 

nix/tamal/default.nix

@@ -1,263 +0,0 @@
-/*
-SPDX-FileCopyrightText: 2025–2026 toastal
-SPDX-FileCopyrightText: 2026 Nixtamal contributors
-SPDX-License-Identifier: ISC
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice & this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED “AS IS” & ISC DISCLAIMS ALL WARRANTIES WITH REGARD
-TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY &
-FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT,
-OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
-USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
-TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
-OF THIS SOFTWARE.
-
-──────────────────────────────────────────────────────────────────────────────
-┏┓╻+╻ ╱┏┳┓┏┓┏┳┓┏┓╻
-┃┃┃┃┗━┓╹┃╹┣┫┃┃┃┣┫┃   This file was generated by Nixtamal.
-╹┗┛╹╱ ╹ ╹ ╹╹╹ ╹╹╹┗┛  Do not edit as it will be overwritten.
-──────────────────────────────────────────────────────────────────────────────
-*/
-{
-	system ? builtins.currentSystem,
-	bootstrap-nixpkgs ? null,
-	bootstrap-nixpkgs-lock-name ? null,
-}:
-
-let lock = builtins.fromJSON (builtins.readFile ./lock.json); in
-assert (lock.v == "1.2.0");
-let
-	local-patches = {};
-	hash-token = {
-		"0" = "sha256";
-		"1" = "sha512";
-		"2" = "blake3";
-	};
-
-	try-fetch = input-name: fetcher:
-		let
-			try-fetch' = failed-urls: url: urls:
-				let result = builtins.tryEval (fetcher url); in
-				if result.success then
-					result.value
-				else
-					let failed-urls' = [ url ] ++ failed-urls; in
-					if builtins.length urls <= 0 then
-						let fus = builtins.concatStringsSep " " failed-urls'; in
-						throw "Input 「${input-name}」fetchable @ [ ${fus} ]"
-					else
-						try-fetch' failed-urls' (builtins.head urls) (builtins.tail urls);
-		in
-		try-fetch' [ ];
-
-	builtin-fetch-tarball = {input-name, name, kind, hash}:
-		try-fetch input-name (url:
-			builtins.fetchTarball ({
-				inherit url;
-				${hash-token.${builtins.toString hash.al}} = hash.vl;
-			}
-			// (if name != null then {inherit name;} else {}))
-		) kind.ur kind.ms;
-
-	builtin-fetch-git = {input-name, name, kind}:
-		let
-			ref =
-				let
-					type = builtins.elemAt kind.rf 0;
-					valu = builtins.elemAt kind.rf 1;
-				in
-				if type == 0 then # ref
-					valu
-				else if type == 1 then # branch
-					"refs/heads/${valu}"
-				else if type == 2 then # tag
-					"refs/tags/${valu}"
-				else
-					throw "Unsupported reference type “${builtins.toString type}”.";
-		in
-		try-fetch input-name (url:
-			let
-				args = {
-					inherit url ref;
-					rev = kind.lr;
-					submodules = kind.sm;
-					lfs = kind.lf;
-					shallow = true;
-				}
-				// (if name != null then {inherit name;} else {});
-				args' =
-					if builtins.compareVersions builtins.nixVersion "2.26" < 0 then
-						builtins.removeAttrs args [ "lfs" ]
-					else
-						args;
-			in
-			builtins.fetchGit args'
-		) kind.rp kind.ms;
-
-	builtin-to-input = input-name: input:
-		let
-			name = input.sn;
-			hash = input.ha;
-			k = builtins.head input.kd;
-		in
-		if k == 1 then
-			builtin-fetch-tarball {
-				inherit name;
-				input-name = input-name;
-				kind = builtins.elemAt input.kd 1;
-				hash = input.ha;
-			}
-		else if k == 2 then
-			builtin-fetch-git {
-				inherit name;
-				input-name = input-name;
-				kind = builtins.elemAt input.kd 1;
-			}
-		else if k == 3 then
-			fetch-darcs {
-				inherit name;
-				input-name = input-name;
-				kind = builtins.elemAt input.kd 1;
-				hash = input.ha;
-			}
-		else
-			throw "Unsupported input kind “${builtins.toString k}”.";
-
-	nixpkgs' =
-		if builtins.isNull bootstrap-nixpkgs then
-			builtin-to-input "nixpkgs-for-nixtamal" (
-				if builtins.isString bootstrap-nixpkgs-lock-name then
-					lock.i.${bootstrap-nixpkgs-lock-name}
-				else
-					lock.i.nixpkgs-nixtamal or lock.i.nixpkgs
-			)
-		else
-			bootstrap-nixpkgs;
-
-	pkgs = import nixpkgs' {inherit system;};
-
-	inherit (pkgs) lib;
-
-	fetch-zip = {input-name, name, kind, hash}: pkgs.fetchzip ({
-		url = kind.ur;
-		hash = hash.vl;
-	}
-	// lib.optionalAttrs (name != null) {inherit name;}
-	// lib.optionalAttrs (builtins.length kind.ms > 0) {urls = kind.ms;});
-
-	fetch-git = {input-name, name, kind, hash}:
-		let
-			using-mirrors = kind ? ms && (builtins.length kind.ms) > 0;
-			mirror-support = pkgs.fetchgit.__functionArgs ? "mirrors";
-		in
-		lib.warnIf (using-mirrors && !mirror-support)
-			"Upstream pkgs.fetchgit doesn’t yet support mirrors for 「${input-name}」"
-			pkgs.fetchgit ({
-				url = kind.rp;
-				rev = kind.lr;
-				fetchSubmodules = kind.sm;
-				fetchLFS = kind.lf;
-				deepClone = false;
-				hash = hash.vl;
-			}
-			// lib.optionalAttrs (name != null) {inherit name;}
-			// lib.optionalAttrs (using-mirrors && mirror-support) {
-				mirrors = kind.ms;
-			});
-
-	fetch-darcs = {input-name, name, kind, hash}:
-		let
-			using-mirrors = kind ? ms && (builtins.length kind.ms) > 0;
-			mirror-support = pkgs.fetchdarcs.__functionArgs ? "mirrors";
-			reference =
-				let
-					type = builtins.elemAt kind.rf 0;
-					value = builtins.elemAt kind.rf 1;
-				in
-				if type == 0 then
-					let ctx_path = builtins.elemAt value 1; in
-					assert (lib.hasSuffix ".txt" ctx_path);
-					let
-						txt-files = lib.sourceFilesBySuffices ./. [ ".txt" ];
-						dir = lib.fileset.toSource {
-							root = ./.;
-							fileset = lib.fileset.fromSource txt-files;
-						};
-					in
-					{context = "${dir}/${ctx_path}";}
-				else if type == 1 then
-					{rev = value;}
-				else
-					throw "Invalid Darcs reference";
-		in
-		lib.warnIf (using-mirrors && !mirror-support)
-			"Upstream pkgs.fetchdarcs doesn’t yet support mirrors for 「${input-name}」"
-			pkgs.fetchdarcs ({
-				url = kind.rp;
-				hash = hash.vl;
-			}
-			// lib.optionalAttrs (name != null) {inherit name;}
-			// reference // lib.optionalAttrs (using-mirrors && mirror-support) {
-				mirrors = kind.ms;
-			});
-
-	fetch-patch = patch-name: {ur, ha}:
-		pkgs.fetchpatch2 {
-			url = ur;
-			hash = ha.vl;
-		};
-
-	to-input = input-name: input:
-		let
-			name = input.sn;
-			hash = input.ha;
-			k = builtins.head input.kd;
-			raw-input =
-				if k == 1 then
-					let
-						kind = builtins.elemAt input.kd 1;
-						fetch_time = kind.ft;
-					in
-					if fetch_time == 0 then
-						fetch-zip {inherit input-name name kind hash;}
-					else if fetch_time == 1 then
-						builtin-fetch-tarball {inherit input-name name kind hash;}
-					else
-						throw "Unsupported fetch time ${fetch_time}."
-				else if k == 2 then
-					let
-						kind = builtins.elemAt input.kd 1;
-						fetch_time = kind.ft;
-					in
-					if fetch_time == 0 then
-						fetch-git {inherit input-name name kind hash;}
-					else if fetch_time == 1 then
-						builtin-fetch-git {inherit input-name name kind;}
-					else
-						throw "Unsupported fetch time ${fetch_time}."
-				else if k == 3 then
-					let
-						kind = builtins.elemAt input.kd 1;
-					in
-					fetch-darcs {inherit input-name name kind hash;}
-				else
-					throw "Unsupported input kind “${builtins.toString k}”.";
-		in
-		if builtins.length input.ps == 0 then
-			raw-input
-		else
-			pkgs.applyPatches {
-				src = raw-input;
-				name = "${if name != null then name else "src"}-patched";
-				patches = map (p:
-					if local-patches ? "${p}" then
-						local-patches."${p}"
-					else
-						fetch-patch p lock.p."${p}"
-				) input.ps;
-			};
-in
-builtins.mapAttrs to-input lock.i

nix/tamal/lock.json

@@ -1,11 +0,0 @@
-{"v":"1.2.0"
-,"i":{
-"nixpkgs":{"sn":"nixpkgs-src","kd":[1,{"ft":0,"ur":"https://github.com/NixOS/nixpkgs/archive/a9e6d84f9c2f9012f5fe7d964a7851352300e61a.tar.gz","ms":[]}],"ha":{"al":0,"vl":"sha256-WncT27+3BOkgTaJZLnCsf3LcYf9RXMuR9ONSN4rzQ7s="},"fv":"a9e6d84f9c2f9012f5fe7d964a7851352300e61a","ps":["declarative-kts"]}
-,"bingosync":{"sn":"bingosync-src","kd":[2,{"ft":0,"rp":"https://github.com/rhelmot/bingosync","ms":[],"rf":[0,"refs/heads/main"],"dt":"2026-07-18T09:30:48-07:00","sm":false,"lf":false,"lr":"c95833a74fc21a5c858b58f1ccc2d99de5bc1661"}],"ha":{"al":0,"vl":"sha256-XLfjlGCLOCf8KFVTtc0ecpySbYT9JEvi6giGZwd3vF4="},"fv":"c95833a74fc21a5c858b58f1ccc2d99de5bc1661","ps":[]}
-,"blog-rhelmot-io":{"sn":"blog-rhelmot-io-src","kd":[2,{"ft":0,"rp":"https://git.lain.faith/rhelmot/blog.rhelmot.io","ms":[],"rf":[0,"refs/heads/main"],"dt":"2026-08-29T17:31:26-07:00","sm":false,"lf":false,"lr":"fa828dff9bf8215a56921b8bd3e9fb47999dcaab"}],"ha":{"al":0,"vl":"sha256-efp0LFYmIjFC92wSJMNso1mTgRqsFEsV3w0zci8nbtw="},"fv":"fa828dff9bf8215a56921b8bd3e9fb47999dcaab","ps":[]}
-,"nixtamal":{"sn":"nixtamal-src","kd":[3,{"rp":"https://darcs.toastal.in.th/nixtamal/stable","ms":["https://smeder.ee/~toastal/nixtamal.darcs"],"dt":"2026-07-18T19:10:07Z","rf":[0,[0,"./darcs_context/nixtamal.txt"]],"lw":"ff863faf5c3ac02dae5ff01348b6a85c0ea5cc4a"}],"ha":{"al":0,"vl":"sha256-Fadyi8BbGnQe/r84ZHXtuOEs+aZVwuQ/eTVlqLVN/KE="},"fv":"ff863faf5c3ac02dae5ff01348b6a85c0ea5cc4a","ps":[]}
-}
-,"p":{
-"declarative-kts":{"ur":"https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/518336.patch","ha":{"al":0,"vl":"sha256-nqryFYVV37kJgr/XT2A+sX5YrN1QGYZbk+22ySqVloc="}}
-}
-}

nix/tamal/manifest.kdl

@@ -1,41 +0,0 @@
-// ┏┓╻+╻ ╱┏┳┓┏┓┏┳┓┏┓╻
-// ┃┃┃┃┗━┓╹┃╹┣┫┃┃┃┣┫┃   Read the manpage:
-// ╹┗┛╹╱ ╹ ╹ ╹╹╹ ╹╹╹┗┛  $ man nixtamal-manifest
-version "1.2.0"
-patches {
-	declarative-kts "https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/518336.patch"
-}
-inputs {
-	nixpkgs {
-		archive {
-			url "https://github.com/NixOS/nixpkgs/archive/{{fresh_value}}.tar.gz"
-		}
-		hash algorithm=SHA-256
-		fresh-cmd {
-			$ git ls-remote "https://github.com/NixOS/nixpkgs.git" --refs "refs/heads/nixos-26.05"
-			| cut -f1
-		}
-		patches declarative-kts
-	}
-	blog-rhelmot-io {
-		git {
-			repository "https://git.lain.faith/rhelmot/blog.rhelmot.io";
-			ref "refs/heads/main";
-		}
-	}
-	bingosync {
-		git {
-			repository "https://github.com/rhelmot/bingosync";
-			ref "refs/heads/main";
-		}
-	}
-	nixtamal {
-		darcs {
-			repository "https://darcs.toastal.in.th/nixtamal/stable"
-			mirrors "https://smeder.ee/~toastal/nixtamal.darcs"
-		}
-		fresh-cmd {
-			$ curl -sL "https://darcs.toastal.in.th/nixtamal/stable/_darcs/weak_hash"
-		}
-	}
-}

overlays/lix.nix

@@ -0,0 +1,15 @@
+{
+    pkgs,
+    ...
+}:
+{
+  nixpkgs.overlays = [ (final: prev: {
+    inherit (prev.lixPackageSets.latest)
+      nixpkgs-review
+      nix-eval-jobs
+      nix-fast-build
+      colmena;
+  }) ];
+
+  nix.package = pkgs.lixPackageSets.latest.lix;
+}

overlays/packages.nix

@@ -1,52 +1,20 @@
-final: prev: {
+{ config, lib, pkgs, ... }:
-  vimPlugins = prev.vimPlugins.extend (
-    final': prev': {
-      sweetie-nvim = final.callPackage ../pkgs/sweetie.nix { };
-    }
-  );
-  zfs_2_2 = prev.zfs_2_2.overrideAttrs (
-    final': prev': {
-      patches = prev'.patches ++ [
-        (final.fetchpatch {
-          url = "https://git.lain.faith/haskal/dragnpkgs/raw/commit/f4348768df564166762793aed43803675e251926/pkgs/zfs/0001-ZED-add-support-for-desktop-notifications-D-Bus.patch";
-          hash = "sha256-vwGHiLKSjJor4A+r599DlvSHXkDuuLSSQ4/tWFALMKU=";
-        })
-      ];
-    }
-  );
-  sftpgo = prev.sftpgo.overrideAttrs (prev: {
-    # killing and tearing and ripping and maiming
-    postPatch = (prev.postPatch or "") + ''
-      sed -E -i -e '/func preserveUserProfile/a newUser.Groups = user.Groups;' internal/common/eventmanager.go
-    '';
-  });
-  fx-cast-bridge = prev.fx-cast-bridge.overrideAttrs (prev: {
-    postConfigure = (prev.postConfigure or "") + ''
-      substituteInPlace node_modules/mdns/lib/resolver_sequence_tasks.js --replace-fail \
-        'cares.getaddrinfo(req, host, family, 0, false)' \
-        'cares.getaddrinfo(req, host, family, 0, 0)'
-    '';
-  });
-  idapro9 = final.callPackage ../pkgs/idapro9.nix { };
-  condition-unmetered-network = final.callPackage ../pkgs/condition-unmetered-network { };
-  units-desktop = final.callPackage ../pkgs/units-desktop.nix { };
 
-  aria2 = prev.aria2.overrideAttrs (
+let overlay = final: prev: {
-    final': prev': {
+  vimPlugins = prev.vimPlugins.extend (final': prev': {
-      patches = (prev'.patches or [ ]) ++ [ ./patches/aria2-retry-codes.patch ];
+    sweetie-nvim = final.callPackage ../pkgs/sweetie.nix {};
-    }
+  });
-  );
+  zfs_2_2 = prev.zfs_2_2.overrideAttrs (final': prev': {
-  nixos-render-docs = prev.nixos-render-docs.overrideAttrs (
+    patches = prev'.patches ++ [(final.fetchpatch {
-    final': prev': {
+      url = "https://git.lain.faith/haskal/dragnpkgs/raw/commit/f4348768df564166762793aed43803675e251926/pkgs/zfs/0001-ZED-add-support-for-desktop-notifications-D-Bus.patch";
-      patches = (prev'.patches or [ ]) ++ [
+      hash = "sha256-vwGHiLKSjJor4A+r599DlvSHXkDuuLSSQ4/tWFALMKU=";
-        ./patches/nixos-render-docs-flush.patch
+    })];
-      ];
+  });
-    }
+  idapro9 = pkgs.callPackage ../pkgs/idapro9.nix {};
-  );
+  condition-unmetered-network = pkgs.callPackage ../pkgs/condition-unmetered-network {};
-  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+  units-desktop = pkgs.callPackage ../pkgs/units-desktop.nix {};
-    (final': prev': {
+};
-      binsync = final'.callPackage ../pkgs/binsync.nix { };
+
-      libbs = final'.callPackage ../pkgs/libbs.nix { };
+in {
-    })
+  nixpkgs.overlays = [ overlay ];
-  ];
 }

overlays/patches/aria2-retry-codes.patch

@@ -1,17 +0,0 @@
-diff --git a/src/HttpSkipResponseCommand.cc b/src/HttpSkipResponseCommand.cc
-index a722d774..d6f76c85 100644
---- a/src/HttpSkipResponseCommand.cc
-+++ b/src/HttpSkipResponseCommand.cc
-@@ -220,8 +220,12 @@ bool HttpSkipResponseCommand::processResponse()
-       }
-       throw DL_RETRY_EX2(MSG_RESOURCE_NOT_FOUND,
-                          error_code::RESOURCE_NOT_FOUND);
-+    case 429:
-+    case 500:
-     case 502:
-     case 503:
-+    case 520:
-+    case 521:
-       // Only retry if pretry-wait > 0. Hammering 'busy' server is not
-       // a good idea.
-       if (getOption()->getAsInt(PREF_RETRY_WAIT) > 0) {

overlays/patches/nixos-render-docs-flush.patch

@@ -1,16 +0,0 @@
-diff --git a/nixos_render_docs/options.py b/nixos_render_docs/options.py
-index 9e337e6b1082..64808e5a4ba5 100644
---- a/nixos_render_docs/options.py
-+++ b/nixos_render_docs/options.py
-@@ -268,6 +268,11 @@ class ManpageConverter(BaseConverter[OptionsManpageRenderer]):
-                 r'''.ad l''',
-                 r'''.\" enable line breaks after slashes''',
-                 r'''.cflags 4 /''',
-+                r'''.\" if rendering in continuous mode (default for man-db), flush pages periodically''',
-+                r'''.if \\\\n[cR] \\{\\''',
-+                r'''.wh 10000v an*real-bp''',
-+                r'''.pl 10000v''',
-+                r'''.\\}''',
-                 r'''.SH "NAME"''',
-                 self._render('{file}`configuration.nix` - NixOS system configuration specification'),
-                 r'''.SH "DESCRIPTION"''',

pkgs/binsync.nix

@@ -1,82 +1,131 @@
 {
   lib,
-  callPackage,
+  fetchPypi,
-  buildPythonPackage,
   fetchFromGitHub,
+  buildPythonPackage,
+  buildPythonApplication,
+  hatchling,
+  flask,
 
-  setuptools,
+  httpx,
+  pydantic,
+  python-dotenv,
+  poetry-core,
 
-  libbs,
+  filelock,
+  gitpython,
+  prompt-toolkit,
+  pycparser,
   sortedcontainers,
   toml,
-  gitpython,
-  filelock,
-  ply,
-  prompt-toolkit,
   tqdm,
-  wordfreq,
+  setuptools,
   pyside6,
-  flask,
-  requests,
-
-  pytest-qt,
   pytestCheckHook,
+  pytest-qt,
+  ply,
+  wordfreq,
+  ghidra-bridge,
+  jfx-bridge,
+  networkx,
+  platformdirs,
+  psutil,
+  pyhidra,
+  writableTmpDirAsHomeHook,
+}: let
+  libbs_latest = buildPythonPackage {
+    pname = "libbs";
+    version = "2.15.5+dev";
+    pyproject = true;
 
-  withGhidra ? false,
+    src = fetchFromGitHub {
-}:
+      owner = "binsync";
+      repo = "libbs";
+      rev = "c7f3b7e16a44affd446b392a89ed343d356885af";
+      hash = "sha256-AzsOok38JG2pjNzeWQVHhi9Iw266TAOxavQEDu+JcyQ=";
+    };
 
-buildPythonPackage rec {
+    build-system = [ setuptools ];
-  pname = "binsync";
+
-  version = "5.15.0+dev";
+    dependencies = [
-  pyproject = true;
+      filelock
+      ghidra-bridge
+      jfx-bridge
+      networkx
+      platformdirs
+      prompt-toolkit
+      psutil
+      pycparser
+      pyhidra
+      toml
+      tqdm
+      ply
+    ];
+
+    nativeCheckInputs = [
+      pytestCheckHook
+      writableTmpDirAsHomeHook
+    ];
+
+    pythonImportsCheck = [ "libbs" ];
+
+    disabledTests = [
+      "test_change_watcher_plugin_cli"
+      "test_ghidra_artifact_watchers"
+      "TestHeadlessInterfaces"
+    ];
+
+
+    disabledTestPaths = [
+      "tests/test_decompilers.py"
+      "tests/test_remote_ghidra.py"
+    ];
 
-  src = fetchFromGitHub {
-    owner = "binsync";
-    repo = "binsync";
-    rev = "667ba599b79766339820f57dab8f8ce01b05808b";
-    hash = "sha256-v8hxcoMFe8DJovJD1FAC8NIov7EGVn4L8isWg4sxxik=";
   };
 
-  build-system = [ setuptools ];
+  binsync_latest = buildPythonPackage {
+    pname = "binsync";
+    version = "5.5.1+dev";
+    pyproject = true;
 
-  dependencies = [
+    src = fetchFromGitHub {
-    libbs
+      owner = "binsync";
-    # (libbs.override { inherit withGhidra; })
+      repo = "binsync";
-    sortedcontainers
+      rev = "f46c576338a0cd74b8aeb46b09467ca3862d4e52";
-    toml
+      hash = "sha256-C3i969oA+jHjFz9fWYuzJZ0pz1O4Wvi9QU8PjHnL1Kk=";
-    gitpython
+    };
-    filelock
-    ply
-    prompt-toolkit
-    tqdm
-    wordfreq
-    flask
-    requests
-  ]
-  ++ lib.optionals withGhidra [ pyside6 ];
 
-  nativeCheckInputs = [
+    build-system = [ setuptools ];
-    pytestCheckHook
-  ]
-  ++ lib.optionals withGhidra [
-    pytest-qt
-    pyside6
-  ];
 
-  disabledTestPaths = [
+    dependencies = [
-    # Test tries to import angr-management
+      libbs_latest
-    "tests/test_angr_gui.py"
-    # uses GUI stuff
-    "tests/test_auxiliary_server.py"
-  ];
 
-  pythonImportsCheck = [ "binsync" ];
+      filelock
+      gitpython
+      prompt-toolkit
+      pycparser
+      sortedcontainers
+      toml
+      tqdm
+      ply
+      wordfreq
+    ];
 
-  meta = {
+    optional-dependencies = {
-    description = "Reversing plugin for cross-decompiler collaboration, built on git";
+      ghidra = [ pyside6 ];
-    homepage = "https://github.com/binsync/binsync";
+    };
-    changelog = "https://github.com/binsync/binsync/releases/tag/${src.tag}";
+
-    license = lib.licenses.bsd2;
+    nativeCheckInputs = [
-    maintainers = with lib.maintainers; [ scoder12 ];
+      pytestCheckHook
+      pytest-qt
+      pyside6
+    ];
+
+    disabledTestPaths = [
+      # Test tries to import angrmanagement
+      "tests/test_angr_gui.py"
+    ];
+
+    pythonImportsCheck = [ "binsync" ];
   };
-}
+in binsync_latest

pkgs/condition-unmetered-network/default.nix

@@ -1,8 +1,7 @@
 {
   rustPlatform,
   lib,
-}:
+}: rustPlatform.buildRustPackage rec {
-rustPlatform.buildRustPackage rec {
   pname = "condition-unmetered-network";
   version = "0.1.0";
   src = ./.;

pkgs/idapro9.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   requireFile,
+  fetchurl,
   autoPatchelfHook,
   copyDesktopItems,
   python3,
@@ -12,7 +13,6 @@
   freetype,
   glib,
   gtk3,
-  libxcrypt-legacy,
   libdrm,
   libGL,
   libkrb5,
@@ -22,38 +22,31 @@
   openssl,
   gcc,
   clang,
+  xorg,
   zlib,
   curl,
   gnutar,
   makeDesktopItem,
   makeWrapper,
   runCommand,
-  libice,
-  libsm,
-  libx11,
-  libXau,
-  libxcb,
-  libxext,
-  libxi,
-  libXrender,
-  xcbutilimage,
-  xcbutilkeysyms,
-  xcbutilrenderutil,
-  xcbutilwm,
-
-  pythonWithPackages ? python3,
 }:
 
+let
+  pythonForIDA = python3.withPackages (ps: with ps; [
+    rpyc
+    (ps.callPackage ./binsync.nix {})
+  ]);
+in
 # https://github.com/msanft/ida-pro-overlay/blob/main/packages/ida-pro.nix
 stdenv.mkDerivation (self: {
   pname = "idapro";
-  version = "9.3.260421";
+  version = "9.2.250908";
   src = requireFile {
-    name = "idapro-x64linux-9.3.260421.tar.xz";
+    name = "idapro-linux-9.2.250908.tar.xz";
-    hash = "sha256-8fxZ4fOgOFdSd/H/Jd4MX9fCX7TwWACmH9I4rnIMKdQ=";
+    hash = "sha256-daQtHbJxCuKzfGiBzkmy7FOTCMEJX3WL7IwuuvwIi+Y=";
     message = ''
-      Please run nix store add-file idapro-x64linux-9.3.260421.tar.xz
+      Please run nix store add-file idapro-linux-9.2.250908.tar.xz
-      Its sha256sum should be f1fc59e1f3a038575277f1ff25de0c5fd7c25fb4f05800a61fd238ae720c29d4
+      Its sha256sum should be 75a42d1db2710ae2b37c6881ce49b2ec539308c1095f758bec8c2ebafc088be6
     '';
   };
 
@@ -71,7 +64,6 @@ stdenv.mkDerivation (self: {
     freetype
     glib
     gtk3
-    libxcrypt-legacy
     libdrm
     libGL
     libkrb5
@@ -80,21 +72,21 @@ stdenv.mkDerivation (self: {
     libxkbcommon
     openssl.out
     (if stdenv.cc.isGNU then gcc else clang).cc
-    libice
+    xorg.libICE
-    libsm
+    xorg.libSM
-    libx11
+    xorg.libX11
-    libXau
+    xorg.libXau
-    libxcb
+    xorg.libxcb
-    libxext
+    xorg.libXext
-    libxi
+    xorg.libXi
-    libXrender
+    xorg.libXrender
-    xcbutilimage
+    xorg.xcbutilimage
-    xcbutilkeysyms
+    xorg.xcbutilkeysyms
-    xcbutilrenderutil
+    xorg.xcbutilrenderutil
-    xcbutilwm
+    xorg.xcbutilwm
     zlib
     curl.out
-    pythonWithPackages
+    pythonForIDA
     qt6.qtwayland
   ];
   buildInputs = self.runtimeDependencies;
@@ -116,6 +108,8 @@ stdenv.mkDerivation (self: {
     ln -s $out/opt/ida $out/bin/ida64
     ln -s $out/opt/ida $out/bin/ida
 
+    ln -s ${pythonForIDA}/bin/binsync $out/bin/binsync
+
     runHook postInstall
   '';
 
@@ -124,30 +118,23 @@ stdenv.mkDerivation (self: {
     addAutoPatchelfSearchPath $out/opt
 
     # Manually patch libraries that dlopen stuff.
-    patchelf --add-needed libpython${pythonWithPackages.pythonVersion}.so $out/lib/libida.so
+    patchelf --add-needed libpython${pythonForIDA.pythonVersion}.so $out/lib/libida.so
-    patchelf --add-needed libpython${pythonWithPackages.pythonVersion}.so $out/opt/plugins/idapython3.so
+    patchelf --add-needed libpython${pythonForIDA.pythonVersion}.so $out/opt/plugins/idapython3.so
     patchelf --add-needed libcrypto.so $out/lib/libida.so
     patchelf --add-needed libcrypto.so $out/opt/plugins/idapython3.so
 
     wrapProgram "$out/opt/ida" \
       --prefix PYTHONPATH : $out/opt/idalib/python \
-      --prefix PATH : ${pythonWithPackages}/bin \
+      --prefix PATH : ${pythonForIDA}/bin
-      --prefix LD_LIBRARY_PATH : ${lib.getLib libsecret}/lib
   '';
   dontWrapQtApps = true;
 
   desktopItem = makeDesktopItem {
     name = "ida-pro";
     exec = "ida";
-    icon =
+    icon = runCommand "appico.png" {nativeBuildInputs = [gnutar]; strictDeps = true;} ''
-      runCommand "appico.png"
+      tar --to-command cat -xf ${self.src} 'idapro-linux-9.2.250908/appico.png' > "$out"
-        {
+    '';
-          nativeBuildInputs = [ gnutar ];
-          strictDeps = true;
-        }
-        ''
-          tar --to-command cat -xf ${self.src} 'ida/appico.png' > "$out"
-        '';
     comment = self.meta.description;
     desktopName = "IDA Pro";
     genericName = "Interactive Disassembler";
@@ -157,10 +144,10 @@ stdenv.mkDerivation (self: {
   desktopItems = [ self.desktopItem ];
 
   passthru = {
-    python = pythonWithPackages;
+    inherit pythonForIDA;
   };
 
-  meta = with lib; {
+ meta = with lib; {
     description = "The world's smartest and most feature-full disassembler";
     homepage = "https://hex-rays.com/ida-pro/";
     mainProgram = "ida";

pkgs/libbs.nix

@@ -1,103 +0,0 @@
-{
-  lib,
-  callPackage,
-  buildPythonPackage,
-  fetchFromGitHub,
-
-  setuptools,
-
-  toml,
-  ply,
-  pycparser,
-  prompt-toolkit,
-  tqdm,
-  psutil,
-  pyghidra,
-  platformdirs,
-  filelock,
-  networkx,
-
-  pytestCheckHook,
-  writableTmpDirAsHomeHook,
-
-  # ghidra_headless,
-
-  withGhidra ? false,
-}:
-
-let
-  # Binary files from https://github.com/binsync/bs-artifacts (only used for testing and only here)
-  binaries = fetchFromGitHub {
-    owner = "binsync";
-    repo = "bs-artifacts";
-    rev = "0d300eb679b9a07bbdcf8b77a9f4917d48133c6c";
-    hash = "sha256-P7+BTJgdC9W8cC/7xQduFYllF+0ds1dSlm59/BFvZ2g=";
-  };
-in
-buildPythonPackage rec {
-  pname = "libbs";
-  version = "3.7.0+dev";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "binsync";
-    repo = "libbs";
-    rev = "55f9b2fc441a4e8aaf3ff4bdc2ee51eddef46ef4";
-    hash = "sha256-Z1OAgJjNA7WJDjy4KEuVFyWgq3WjwhpFzf8dAYe8c1E=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    toml
-    ply
-    pycparser
-    # (callPackage ./pycparser_3.nix {})
-    setuptools
-    prompt-toolkit
-    tqdm
-    psutil
-    platformdirs
-    filelock
-    networkx
-  ]
-  ++ lib.optionals withGhidra [ pyghidra ];
-
-  pythonRemoveDeps = lib.optionals (!withGhidra) [ "pyghidra" ];
-
-  nativeCheckInputs = [
-    pytestCheckHook
-    writableTmpDirAsHomeHook
-  ];
-  # ] ++ (lib.optionals withGhidra [ ghidra_headless ]);
-
-  # Place test binaries in place
-  preCheck = ''
-    export HOME=$TMPDIR
-    mkdir -p $HOME/bs-artifacts/binaries
-    cp -r ${binaries}/binaries/. $HOME/bs-artifacts/binaries/.
-    export TEST_BINARIES_DIR=$HOME/bs-artifacts/binaries
-  '';
-  # '' + lib.optionalString withGhidra ''
-  #   export PATH="${lib.makeBinPath [ ghidra_headless.jdkPackage ]}:$PATH"
-  #   export NIX_GHIDRAHOME="${ghidra_headless}/lib/ghidra/Ghidra"
-  #   export GHIDRA_INSTALL_DIR="${ghidra_headless}/lib/ghidra"
-  # '';
-
-  pythonImportsCheck = [ "libbs" ];
-
-  disabledTests = [
-    "test_change_watcher_plugin_cli"
-    "TestHeadlessInterfaces"
-    "TestNewLibbsFeatures"
-  ]
-  ++ lib.optionals (!withGhidra) [ "TestClientServer" ];
-
-  meta = {
-    description = "Library for writing plugins in any decompiler: includes API lifting, common data formatting, and GUI abstraction";
-    homepage = "https://github.com/binsync/libbs";
-    changelog = "https://github.com/binsync/libbs/releases/tag/${src.tag}";
-    license = lib.licenses.bsd2;
-    maintainers = with lib.maintainers; [ scoder12 ];
-  };
-}

pkgs/units-desktop.nix

@@ -1,18 +1,18 @@
 {
-  lib,
+    lib,
-  writeTextFile,
+    writeTextFile,
-  units,
+    units,
 }:
 writeTextFile {
-  name = "units-desktop";
+    name = "units-desktop";
-  destination = "/share/applications/units.desktop";
+    destination = "/share/applications/units.desktop";
-  text = ''
+    text = ''
-    [Desktop Entry]
+        [Desktop Entry]
-    Encoding=UTF-8
+        Encoding=UTF-8
-    Version=${units.version}
+        Version=${units.version}
-    Type=Application
+        Type=Application
-    Terminal=true
+        Terminal=true
-    Exec=${lib.getExe units}
+        Exec=${lib.getExe units}
-    Name=Units
+        Name=Units
-  '';
+    '';
 }

release.nix

@@ -1,7 +0,0 @@
-{ }@args: let
-  everything = import ./default.nix args;
-  mkSite = site: { inherit (site) system deploy; };
-  sites = builtins.mapAttrs (k: mkSite) everything.sites;
-in {
-    inherit sites;
-}

sites/chrysanthemum/configuration.nix

@@ -1,30 +1,53 @@
-{
+{ pkgs, lib, config, ... }:
-  pkgs,
-  lib,
-  config,
-  ...
-}:
 {
   imports = [ ./hardware-configuration.nix ];
 
   networking.hostName = "chrysanthemum";
   networking.hostId = "6bb591ac";
+  networking.dhcpcd.wait = "background";
+  networking.interfaces.wlan0.wlandev = "iwlwifi0";
+  services.wpa_supplicant.configFile = "/home/audrey/wpa_supplicant.conf";
 
-  system.stateVersion = "25.04";
+  system.stateVersion = "25.11";
   environment.etc.machine-id.text = "d3d521900f0e11f0af2b9d9b219a1c36\n";
 
   security.sudo.wheelNeedsPassword = false;
   hardware.opengl.enable = true;
   services.dbus.enable = true;
-  services.accounts-daemon.enable = true;
+  services.seatd.enable = true;
-  services.consolekit2.enable = true;
+  boot.extraModulePackages = [ pkgs.freebsd.wifi-firmware-kmod ];
-  services.xserver = {
+  users.users.audrey.extraGroups = [
-    enable = true;
+    "u2f"
-    displayManager.lightdm.enable = true;
+    "seat"
-    displayManager.defaultSession = "xfce";
+    "_video"
-    desktopManager.xfce = {
+  ];
-      enable = true;
+  # boot.kernelEnvironment."hw.psm.synaptics_support" = "1";
-    };
+  boot.kernelEnvironment."compat.linuxkpi.iwlwifi_disable_11ac" = "0";
-    exportConfiguration = true;
+  boot.kernelEnvironment."compat.linuxkpi.iwlwifi_11n_disable" = "0";
-  };
+  freebsd.rc.conf.kld_list = "i915kms";
+
+  audrey-sway.enable = true;
+  environment.systemPackages = with pkgs; [
+    firefox
+    foot
+    dino
+    fzf
+    (libinput.override { eventGUISupport = true; })
+    util-linuxMinimal
+  ];
+  fonts.packages = builtins.filter lib.attrsets.isDerivation (builtins.attrValues pkgs.nerd-fonts);
+  services.powerd.enable = true;
+  hardware.bsdfan.enable = true;
+
+  #services.accounts-daemon.enable = true;
+  #services.consolekit2.enable = true;
+  #services.xserver = {
+  #  enable = true;
+  #  displayManager.lightdm.enable = true;
+  #  displayManager.defaultSession = "xfce";
+  #  desktopManager.xfce = {
+  #    enable = true;
+  #  };
+  #  exportConfiguration = true;
+  #};
 }

sites/chrysanthemum/hardware-configuration.nix

@@ -1,38 +1,37 @@
-{
+{ config, lib, pkgs, modulesPath, ... }:
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
 
 {
-  fileSystems."/" = {
+  fileSystems."/" =
-    device = "system/local/root";
+    { device = "system/tier1/root";
-    fsType = "zfs";
+      fsType = "zfs";
-  };
+    };
 
-  fileSystems."/nix" = {
+  fileSystems."/var" =
-    device = "system/local/nix";
+    { device = "system/tier1/var";
-    fsType = "zfs";
+      fsType = "zfs";
-  };
+    };
 
-  fileSystems."/var" = {
+  fileSystems."/home" =
-    device = "system/local/var";
+    { device = "system/tier1/home";
-    fsType = "zfs";
+      fsType = "zfs";
-  };
+    };
 
-  fileSystems."/home" = {
+  fileSystems."/nix" =
-    device = "system/home";
+    { device = "system/scratch/nix";
-    fsType = "zfs";
+      fsType = "zfs";
-  };
+    };
 
-  fileSystems."/boot" = {
+  fileSystems."/tmp" =
-    device = "/dev/gpt/ESP";
+    { device = "system/scratch/tmp";
-    fsType = "msdos";
+      fsType = "zfs";
-  };
+    };
 
-  swapDevices = [ { device = "/dev/gpt/swap"; } ];
+  fileSystems."/boot" =
+    { device = "/dev/nda0p1";
+      fsType = "msdos";
+    };
+
+  #swapDevices = [ { device = "/dev/gpt/swap"; } ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-freebsd";
 }

sites/chrysanthemum/system

@@ -0,0 +1 @@
+nixbsd

sites/clove/configuration.nix

@@ -1,94 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  imports = [ ./hardware-configuration.nix ];
-  rhelmot.isDesktop = true;
-
-  boot.initrd.supportedFilesystems = [ "zfs" ];
-  boot.initrd.systemd.enable = true;
-  services.zfs.autoScrub.enable = true;
-  services.zfs.trim.enable = true;
-  # fstrim is also enabled by nixos-hardware, but only runs for /boot
-
-  networking.hostName = "clove";
-  networking.hostId = "e2a6d757";
-
-  time.timeZone = "America/Phoenix";
-
-  # Open ports in the firewall.
-  networking.firewall.enable = false;
-  # networking.firewall.allowedTCPPorts = [ 22 80 443 1337 1338 8081 2222 ];
-  # networking.firewall.allowedUDPPorts = [ 1337 ];
-  systemd.coredump.enable = false;
-
-  system.stateVersion = "25.11";
-
-  environment.systemPackages = [
-    pkgs.racket
-    pkgs.qemu_kvm
-    (pkgs.runCommand "OVMF-fd" { } ''
-      mkdir -p $out/share/FV
-      ln -s ${pkgs.OVMF.fd}/FV/OVMF_CODE.fd $out/share/FV/OVMF_CODE.fd
-    '')
-    pkgs.OVMF.fd
-  ];
-
-  services.tailscale = {
-    enable = true;
-    openFirewall = true;
-  };
-
-  #programs.celestegame = {
-  #  enable = true;
-  #  withEverest = true;
-  #  withOlympus = true;
-  #  writableDir = "/var/lib/celeste";
-  #};
-
-  boot.binfmt.emulatedSystems = [
-    "aarch64-linux"
-    "mips-linux"
-    "mipsel-linux"
-    "armv7l-linux"
-  ];
-  boot.binfmt.preferStaticEmulators = true;
-
-  programs.steam.enable = true;
-  programs.steam.gamescopeSession.enable = true;
-  programs.gamescope.enable = true;
-  programs.gamescope.capSysNice = true;
-  services.pulseaudio.support32Bit = true;
-  hardware.graphics.enable32Bit = true;
-
-  virtualisation.libvirtd = {
-    enable = true;
-    qemu.package = pkgs.qemu_kvm;
-  };
-
-  security.sudo.wheelNeedsPassword = false;
-
-  audrey-sway.background = ../../dotfiles/rtfs.jpg;
-
-  services.syncthing-cluster = {
-    enable = true;
-    device = "WB3OPFM-5S7CLM4-PN7JIWE-H66YCFD-7UKW7PE-7KM4CMT-WPQ5BK5-ZFPMQAM";
-    user = "audrey";
-    configDir = "/home/audrey/.config/syncthing";
-    dataDir = "/home/audrey";
-  };
-
-  #services.xserver.videoDrivers = [ "nvidia" ];
-  #hardware.nvidia.open = true;
-  audrey-sway.extraSwayArgs = [ "--unsupported-gpu" ];
-  audrey-sway.suspendTimeout = null;
-
-  networking.extraHosts = ''
-    127.0.0.1 tumblr.com
-    127.0.0.1 www.tumblr.com
-    127.0.0.1 types.pl
-  '';
-}

sites/clove/hardware-configuration.nix

@@ -1,95 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot.initrd.availableKernelModules = [
-    "xhci_pci"
-    "ahci"
-    "nvme"
-    "usb_storage"
-    "usbhid"
-    "sd_mod"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "clove/tier1/root";
-    fsType = "zfs";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/66C8-15C6";
-    fsType = "vfat";
-    options = [
-      "fmask=0022"
-      "dmask=0022"
-    ];
-  };
-
-  fileSystems."/var" = {
-    device = "clove/tier1/var";
-    fsType = "zfs";
-  };
-
-  fileSystems."/home" = {
-    device = "clove/tier1/home";
-    fsType = "zfs";
-  };
-
-  fileSystems."/var/lib/containers" = {
-    device = "clove/tier2/containers";
-    fsType = "zfs";
-  };
-
-  fileSystems."/var/lib/docker" = {
-    device = "clove/tier2/docker";
-    fsType = "zfs";
-  };
-
-  fileSystems."/var/log" = {
-    device = "clove/tier2/log";
-    fsType = "zfs";
-  };
-
-  fileSystems."/var/spool" = {
-    device = "clove/tier2/spool";
-    fsType = "zfs";
-  };
-
-  fileSystems."/var/tmp" = {
-    device = "clove/scratch/tmp";
-    fsType = "zfs";
-  };
-
-  fileSystems."/nix" = {
-    device = "clove/scratch/nix";
-    fsType = "zfs";
-  };
-
-  fileSystems."/var/cache" = {
-    device = "clove/scratch/cache";
-    fsType = "zfs";
-  };
-
-  swapDevices = [
-    {
-      device = "/dev/disk/by-uuid/31ae9d96-d3dc-45e4-9b36-707df8b4f6c2";
-    }
-  ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

sites/daisy/cert.pem

@@ -0,0 +1,34 @@
+-----BEGIN CERTIFICATE-----
+MIIF1zCCA7+gAwIBAgIUKYdQD74Iefk1CyzHvROGC83Hw6IwDQYJKoZIhvcNAQEL
+BQAwezELMAkGA1UEBhMCVVMxDzANBgNVBAgMBk5ldmFkYTESMBAGA1UEBwwJTGFz
+IFZlZ2FzMRMwEQYDVQQKDApTaGVsbHBoaXNoMRUwEwYDVQQLDAxhd29vLnN5c3Rl
+bXMxGzAZBgNVBAMMEmRvY2tlci5zaGVsbC5waGlzaDAeFw0yNTA4MDQxNjI5NDda
+Fw0zNTA4MDIxNjI5NDdaMHsxCzAJBgNVBAYTAlVTMQ8wDQYDVQQIDAZOZXZhZGEx
+EjAQBgNVBAcMCUxhcyBWZWdhczETMBEGA1UECgwKU2hlbGxwaGlzaDEVMBMGA1UE
+CwwMYXdvby5zeXN0ZW1zMRswGQYDVQQDDBJkb2NrZXIuc2hlbGwucGhpc2gwggIi
+MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDyVMA3TRVo52CNfmo4KCEF1UXR
+km3z2fezjsbjEOCeMTsirkFp71g4Cvj4RPCrIASq1DVXkOI6ZaU2OEfm15TcY0Q1
+DG8/zvjVFTOGGNqfCyz+DUSr3qweeAijyLMygjTvK1LrCUJ1daYTdr9es1Qd29dV
+Z2QxWy9+BOpz9oCs8ph+SUCVSfqn11mJ7btgSN9EU8K8f7vhm4PHpruaIJzXh6l0
+tl3wLvXbG8QW1Ms95oBCxiGFKxhAOhGQYlWkODJuh9nF+K/erXv/gmC9Xth/mbL9
+fRJpW+gPK79bhdSTPf9qLmanesRh7ZYxqDW/b7a1moR1u/MNqn4evm0muiz+cb/4
+e6PaRQfwD21dS4FNiJRWtUgSSa0qV7UdvFXvRIev/1f6jbeP0NB6txRxfRwf7cHQ
+ceWIMZgfLeGXjS1VUFnyvEL2iRgFE86YVgaYd6TIafN2tcKBb5CBJCZkkP2BBk17
+NJ/S4h1H0w9u9yyfSz8kvrFf8KMGreRsZGdq776ajI1RNye+kdOQdu8UVN/W2ewu
+E7vBw6NdDRuYGZ/pCULaXgdabiEYnzuwD5k9AKAeArWVDltSk8pS0gv8cI1MXt8J
+TBcSEal5SPwjQNVjahghc3ASydkGN31U0roXuV8+5CjTxfzE6vVsQ2PdF9cSEVHT
+kO6uIlMF7UKlytz2TwIDAQABo1MwUTAdBgNVHQ4EFgQUfMaBc83sxwCnJEeS893N
+hpFQF5gwHwYDVR0jBBgwFoAUfMaBc83sxwCnJEeS893NhpFQF5gwDwYDVR0TAQH/
+BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEATt+MoCjOJ7MlgfX/vvgrnjp9RCwY
+ltjg1n2sFzObJN0FpukFYLUdLXNj7YI34qL30FRjVDbEw3Q7ciXDPafqkzu/fMDd
+/QkOnkIPa7oQ1qHGTODN/a3/sDkGcf7Mf1KV2B3QovybhRjB+N35C2zDA6V4TWik
+AKXfqdJJEcSaG9yv1Kp4wmHvEOI0jruK2dks+46Ulw1eGk5xOHtRElfVfvO0LwGz
+8vvv+6WNoBNMw9inzwmEQALvVooWdh4cJnkUIWlSPI2n091dtU57rzvsAnPtV/sW
+Xvn9ZpRxw9vyKUBkWLLQAUbdn+XDM8XXi7zRGaY8b9LKWoNA2PGltpteCYck9za0
+a/F5Jt3f78d/vug/6Q0U2SiWNbqL9pzMX8gLIOuTqw6Rx6W32VY6WT418WqWjfsG
+iySaMbJ+P+EpIFn57UvKV5CgdDFroBLnS1YpYNpZAJJubpJLVyMxQMhb47K5vU6s
+YpsRm96kC0cZvP4J7+xpVilbzIqIHoV1foz0eRhCcS9bY+p22oLQY0EQ2joMnMnq
+VvffPBaIWMkx6hoSaoQl7nhksu1UQrzomGJfOEK+jGkRbo1QI/qz38EuvlUfSayu
+ONbCx7j+x++DyxvIQ9JEuu+cC76CNWjiDU0xFUhURrlS3t5AGe0+2ZBjcxWeX7jF
+iwbYVRB2xqWwxek=
+-----END CERTIFICATE-----

sites/daisy/configuration.nix

@@ -1,13 +1,7 @@
-{
+{ config, lib, pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 
 {
-  imports = [ ./hardware-configuration.nix ];
+  imports = [ ./hardware-configuration.nix ../../configuration-desktop.nix ];
-  rhelmot.isDesktop = true;
 
   boot.initrd.supportedFilesystems = [ "zfs" ];
   boot.initrd.systemd.enable = true;
@@ -29,29 +23,55 @@
   hardware.bluetooth.powerOnBoot = true;
 
   # Open ports in the firewall.
-  networking.firewall.allowedTCPPorts = [
+  networking.firewall.allowedTCPPorts = [ 22 80 443 1337 1338 8081 2222 ];
-    22
-    80
-    443
-    1337
-    1338
-    8081
-    2222
-  ];
   networking.firewall.allowedUDPPorts = [ 1337 ];
-  systemd.coredump.enable = false;
 
   system.stateVersion = "24.11";
+  #services.immich.enable = true;
 
   hardware.ipu6 = {
     enable = true;
     platform = "ipu6ep";
   };
 
+  # not sure when this commit will reach upstream
+  #boot.kernelPackages = pkgs.linuxPackages_6_16.extend ( self: super: {
+  #  ipu6-drivers = super.ipu6-drivers.overrideAttrs (
+  #    final: previous: rec {
+  #      src = builtins.fetchGit {
+  #        url = "https://github.com/intel/ipu6-drivers.git";
+  #        ref = "master";
+  #        rev = "b4ba63df5922150ec14ef7f202b3589896e0301a";
+  #      };
+  #      patches = [
+  #        "${src}/patches/0001-v6.10-IPU6-headers-used-by-PSYS.patch"
+  #      ] ;
+  #    }
+  #  );
+  #} );
+  #boot.kernelPackages = pkgs.linuxPackages_latest;
+  # https://discourse.nixos.org/t/how-to-hide-this-dummy-video-device/40985/3
+  services.udev.extraRules = ''
+    # If the system is not a video device, we skip these rules by jumping to the end
+    SUBSYSTEM!="video4linux", GOTO="hide_cam_end"
+    #ATTR{name}=="Intel MIPI Camera", GOTO="hide_cam_end" # This line cannot be used as it would move too much stuff and then the camera would not work. Instead, we just move the dummy camera,
+    # I found its name with udevadm info -q all -a /dev/video0
+    # If this is not the dummy video, we also skip these rules.
+    ATTR{name}!="Dummy video device (0x0000)", GOTO="hide_cam_end"
+    ACTION=="add", RUN+="${pkgs.coreutils}/bin/mkdir -p /dev/not-for-user"
+    ACTION=="add", RUN+="${pkgs.coreutils}/bin/mv -f $env{DEVNAME} /dev/not-for-user/"
+
+    ACTION=="remove", RUN+="${pkgs.coreutils}/bin/rm -f /dev/not-for-user/$name"
+    ACTION=="remove", RUN+="${pkgs.coreutils}/bin/rm -f /dev/not-for-user/$env{ID_SERIAL}"
+
+    LABEL="hide_cam_end"
+  '';
+
   environment.systemPackages = [
     pkgs.racket
+    pkgs.idapro9
     pkgs.qemu_kvm
-    (pkgs.runCommand "OVMF-fd" { } ''
+    (pkgs.runCommand "OVMF-fd" {} ''
       mkdir -p $out/share/FV
       ln -s ${pkgs.OVMF.fd}/FV/OVMF_CODE.fd $out/share/FV/OVMF_CODE.fd
     '')
@@ -63,6 +83,14 @@
     openFirewall = true;
   };
 
+  #services.coolify = {
+  #  enable = true;
+  #  hostname = "coolify";
+  #};
+  # networking.extraHosts = ''
+  #   135.181.103.93 anons.ee
+  # '';
+
   #programs.celestegame = {
   #  enable = true;
   #  withEverest = true;
@@ -128,9 +156,4 @@
     configDir = "/home/audrey/.syncthing";
     dataDir = "/home/audrey";
   };
-
-  services.thinkfan = {
-    enable = true;
-    smartSupport = true;
-  };
 }

sites/daisy/hardware-configuration.nix

@@ -1,58 +1,46 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
+{ config, lib, pkgs, modulesPath, ... }:
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
 
 {
-  imports = [
+  imports =
-    (modulesPath + "/installer/scan/not-detected.nix")
+    [ (modulesPath + "/installer/scan/not-detected.nix")
-  ];
+    ];
 
-  boot.initrd.availableKernelModules = [
+  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "usb_storage" "sd_mod" ];
-    "xhci_pci"
-    "thunderbolt"
-    "nvme"
-    "usb_storage"
-    "sd_mod"
-  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" = {
+  fileSystems."/" =
-    device = "system/local/root";
+    { device = "system/local/root";
-    fsType = "zfs";
+      fsType = "zfs";
-    options = [ "zfsutil" ];
+      options = [ "zfsutil" ];
-  };
+    };
 
-  fileSystems."/nix" = {
+  fileSystems."/nix" =
-    device = "system/local/nix";
+    { device = "system/local/nix";
-    fsType = "zfs";
+      fsType = "zfs";
-    #options = [ "zfsutil" ];
+      #options = [ "zfsutil" ];
-  };
+    };
 
-  fileSystems."/var" = {
+  fileSystems."/var" =
-    device = "system/local/var";
+    { device = "system/local/var";
-    fsType = "zfs";
+      fsType = "zfs";
-    #options = [ "zfsutil" ];
+      #options = [ "zfsutil" ];
-  };
+    };
 
-  fileSystems."/home" = {
+  fileSystems."/home" =
-    device = "system/home";
+    { device = "system/home";
-    fsType = "zfs";
+      fsType = "zfs";
-    #options = [ "zfsutil" ];
+      #options = [ "zfsutil" ];
-  };
+    };
 
-  fileSystems."/boot" = {
+  fileSystems."/boot" =
-    device = "/dev/disk/by-uuid/8261-4807";
+    { device = "/dev/disk/by-uuid/8261-4807";
-    fsType = "vfat";
+      fsType = "vfat";
-  };
+    };
 
   swapDevices = [ ];
 

sites/daisy/key.pem

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDyVMA3TRVo52CN
+fmo4KCEF1UXRkm3z2fezjsbjEOCeMTsirkFp71g4Cvj4RPCrIASq1DVXkOI6ZaU2
+OEfm15TcY0Q1DG8/zvjVFTOGGNqfCyz+DUSr3qweeAijyLMygjTvK1LrCUJ1daYT
+dr9es1Qd29dVZ2QxWy9+BOpz9oCs8ph+SUCVSfqn11mJ7btgSN9EU8K8f7vhm4PH
+pruaIJzXh6l0tl3wLvXbG8QW1Ms95oBCxiGFKxhAOhGQYlWkODJuh9nF+K/erXv/
+gmC9Xth/mbL9fRJpW+gPK79bhdSTPf9qLmanesRh7ZYxqDW/b7a1moR1u/MNqn4e
+vm0muiz+cb/4e6PaRQfwD21dS4FNiJRWtUgSSa0qV7UdvFXvRIev/1f6jbeP0NB6
+txRxfRwf7cHQceWIMZgfLeGXjS1VUFnyvEL2iRgFE86YVgaYd6TIafN2tcKBb5CB
+JCZkkP2BBk17NJ/S4h1H0w9u9yyfSz8kvrFf8KMGreRsZGdq776ajI1RNye+kdOQ
+du8UVN/W2ewuE7vBw6NdDRuYGZ/pCULaXgdabiEYnzuwD5k9AKAeArWVDltSk8pS
+0gv8cI1MXt8JTBcSEal5SPwjQNVjahghc3ASydkGN31U0roXuV8+5CjTxfzE6vVs
+Q2PdF9cSEVHTkO6uIlMF7UKlytz2TwIDAQABAoICACrgMug188lNUuiGCu4nr3wU
+OZe0dE7WbHyxEOCBDnT+2esvcLR5HB9CVb27mOd2MU02Yb++C0Dw1hPrTlF6KET8
+LUfDjPV5vc4Zw7WAtUG5nPrQRyuvqL11WHX+HzKbFhmRDUk3qLIWoE1GT+LGEOZ9
+jLJ4KiKPcy41WXQuE6NGAxQpCsu/PKGwuQ9t6B7HlfVFaqmmYgwvU1giWIQTLBz4
+TFOxpppF/MsJNR8jBFjN7TijTK/+qXpHq+7jbyqwpL+ouq/L6fYYtN1G6K3o155w
+B9rQ486Pa9YvU9qyKaPprsTPM+uDDbcT7eSYUfYuomGsVq5sFDuBRHJVGAPnoekE
++ybrHST0MBwMqt3IUzNTfoNkO+/JKlEdAIMvmTkZERgw1yLokNUHlvoWSdiKkbpp
+ZsFpsS6nLucaUg2YxKRBkUFNXIwmO9RcCrax0putRkLeW+iYDd/1HyD8xyCpBLyG
+v/e0uUepx2i/T096YBNLrIj95Lqh1rdGOXmN2b98vEJhgZN0FCmmlIiMbYXYlrpQ
+8+6yNjpc36fFa0Af2xtv0RwULj1pEVI2QjTJCecKk9rjYBVOM8gp6xVpjy538+Zy
+yvkhKchILT4fZq8wXD8LBnFuFRjpgFQnHbN46J++y4+o0t8Kfjq+v8ttuCXLLkks
+LVCUu7GAWjejxWdQ0t/xAoIBAQD8MNQ2U6BzlVmTKjLhl9HrJd1zFEDVFDRseJjs
+YIfknIAtZMP12F810QQD0MMFisge8iDy+pm5K1GrauL5yKQUPExszFHLx9SyL4Ui
+TtsfWwHXFRged4+HS0RAqTCYpdfsKbnAYfpJCw99H1x0E6mcz2DBKS7vlO6gqhCL
+SkKwBtoXzh8IX8JpFI6blHGIZNdKF00a7iavG8ct7awHxZ5fhENnxz0QF/RCSXrG
+DIWJFC/Sa+iOq5YKQ9BjrVEsm2BwSfdD7DO1mrBYFutRz99aaACXnDnRscYPQw1G
+Et71wWE3qtkObMzIJhoEoS8gghRTpwW2/g8mueMpiFe61W6/AoIBAQD1/cvmSlGQ
+9S6mDpbSOo8r3kbcdj/Apv7rY18Ais8kynOADqlCbS3svWSL8h6tkD1SsA1ypsrq
+4n3ko5c/7IjqqRgeFE9ZNAFFTiqrbSw7W2EdH3/OtUJQUehu335Yl3mDqMu86874
+iGaHMQSfCRI2Cl7xbbseoZo7r0OiBhb8ERjTl8cJfVud9nO+oS267VyremmvDgmT
+c/SPiMJaFdQKy9l8c+VC89eTXnmzPeBERhmWhLdX9L4k+pjNtaSP2bc9W05pMzy4
+ST1XcyRT7ab1uaI7gs0RQApPrvUQuts2XnAr+mZ4K/xlvKxBQ7vEtNrkb4UunLt2
+ORZyD+AiMexxAoIBAByMfomD4AcVoiVJwqbNJANlrvMHGOvGNMUOxekEaH3VxaDd
+5l0fWG/kMHsqF9m5wzvVlytKeTqAD+fC2t0B/KkZxmEOpDfYcFiXjo+6s42SJNwv
+VCKm0EW1nI1hWdH9/DqM4q1Hqii4qtE0SqgNTcclpsNXISwYBQeFGQhbqL76l5fY
+SqUNChoRLK+qF0wkdka56o2g5houn9awMChVE7+mXmcSI/R9cbZLUS24XymMcnl0
+o8f63qpc0OtnxGezUzCC/w3eYGAvmcTvG0aQrK00VtTS56y4Xj5+DbOgEUNq19GQ
+cq/yWyBRR+K8SHR6pUhvAPOdQSPWKUQbXisVXEsCggEBAPP6woZphdb5Z0gqRirD
+DAedkbjNy9Ofjk0XJT3bbzJ1XfNQF06cDSW2fwhSn1zUKA5gMSZbCf3HoMfp/XTY
+fMAJ8LK8wCqgavY7XhTi1jEVJBAHkvMJUnlpk9iL8LubmVkdTN3XIFPerZo+4u99
+xsM0rBBXHnV2IQw7fCAyXA+sQWx0KGRgIkNdElWrdTjmfbhSVIncqWDHbHQEV4eU
+CNigcNh/9o7eXR18YcaGg24T/QMOJO6m/wScTHwTQeGvNZA0hGPQ/tNlSOL4f7qC
+hstHUAIobI5EbzWzOLtcKVoWdrkXxRRBxDd/13Vv4cdq/YP+nCCsMT5DxuBgoJQp
+4fECggEAc0joAOCppQsqi0+MYtnz+sLnN0LkedI4Pc+BrFgZe+pa0gOuz816Xf6R
+nJEuRo1DcbyOZ0/DldQdoMFd9c6kmFO2WIHJ4JsZXDRCZWFGIeakVQyepbB2J0n9
+dqSL7+o3nTtYtIbVbhIwQi0FGSLNIzyKycms0rxG4Rz3B9dzk+NEdrBYdCV/eiVo
+DHAnokgLTRKyINMiUreB/QUxg+4TOarXBJJPhqEQjHgVXXRhQzk4EH3EsU6wjFSo
+/q0J2vQ1CJJDM0YKV4izWSCjvpd6MuMPyHBCOVqWpMy3cOwzRGTO0asaG43GK1H3
+VkJw2xvYBO477ta66id4RDUBBXXzQQ==
+-----END PRIVATE KEY-----

sites/daisy/system

@@ -0,0 +1 @@
+nixos

sites/hydrangea/configuration.nix

@@ -1,9 +1,4 @@
-{
+{ config, lib, pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 
 {
   imports = [ ./hardware-configuration.nix ];
@@ -12,7 +7,6 @@
   boot.initrd.systemd.enable = true;
   services.zfs.autoScrub.enable = true;
   services.zfs.trim.enable = true;
-  services.syncoid.enable = lib.mkForce false;
 
   networking.hostName = "hydrangea";
   networking.hostId = "5dfd64c1";
@@ -41,60 +35,18 @@
     shell = pkgs.bashInteractive;
   };
 
-  fileSystems."/run/nginx/tmp" = {
-    fsType = "tmpfs";
-  };
-
-  systemd.tmpfiles.settings.nginx = {
-    "/run/nginx/tmp/dash".d = {
-      user = "nginx";
-      group = "nginx";
-      mode = "0700";
-    };
-    "/run/nginx/tmp/hls".d = {
-      user = "nginx";
-      group = "nginx";
-      mode = "0700";
-    };
-  };
-
   services.nginx = {
     enable = true;
-    additionalModules = [
-      pkgs.nginxModules.rtmp
-    ];
-
     recommendedGzipSettings = true;
     recommendedOptimisation = true;
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
-    clientMaxBodySize = "10g";
 
     virtualHosts = {
       "home.rhelmot.io" = {
         enableACME = true;
         forceSSL = true;
         locations."/".root = "/var/www/home.rhelmot.io/";
-        locations."/stream/".extraConfig = ''
-          alias /run/nginx/tmp/;
-          types {
-            application/dash+xml mpd;
-            application/vnd.apple.mpegurl m3u8;
-            video/mp2t ts;
-            image/jpeg jpg;
-          }
-          add_header 'Access-Control-Allow-Credentials' 'true';
-          add_header 'Access-Control-Expose-Headers' 'Content-Length';
-          add_header 'Access-Control-Allow-Origin' '*';
-          add_header Cache-Control no-cache;
-          if ($request_method = 'OPTIONS') {
-            add_header 'Access-Control-Max-Age' 1728000;
-            add_header 'Content-Type' 'text/plain charset=UTF-8';
-            add_header Cache-Control no-cache;
-            add_header 'Content-Length' 0;
-            return 204;
-          }
-        '';
       };
       "vaultwarden.home.rhelmot.io" = {
         enableACME = true;
@@ -133,73 +85,7 @@
           proxyWebsockets = true;
         };
       };
-      "sftpgo.home.rhelmot.io" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:3006";
-          proxyWebsockets = true;
-        };
-      };
-      "jellyfin.home.rhelmot.io" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:8096";
-          proxyWebsockets = true;
-        };
-      };
-      "aria2.home.rhelmot.io" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/".root = "${pkgs.ariang}/share/ariang";
-        locations."/jsonrpc" = {
-          proxyPass = "http://127.0.0.1:${toString config.services.aria2.settings.rpc-listen-port}";
-        };
-      };
-      # "owncast.home.rhelmot.io" = {
-      #   enableACME = true;
-      #   forceSSL = true;
-      #   locations."/" = {
-      #     proxyPass = "http://127.0.0.1:3007";
-      #     proxyWebsockets = true;
-      #   };
-      # };
-      "127.0.0.1:1934" = {
-        listen = [
-          {
-            addr = "127.0.0.1";
-            port = 1934;
-            ssl = false;
-          }
-        ];
-        locations."/" = {
-          root = "/var/www/stream/";
-          tryFiles = "/$arg_name =404";
-        };
-      };
     };
-
-    appendConfig = ''
-      rtmp {
-        server {
-          listen 1935;
-          chunk_size 4000;
-          application live {
-            live on;
-            dash on;
-            dash_path /run/nginx/tmp/dash;
-            hls on;
-            hls_path /run/nginx/tmp/hls;
-            hls_fragment 2s;
-            allow publish all;
-            allow play all;
-            notify_method get;
-            on_publish http://127.0.0.1:1934/;
-          }
-        }
-      }
-    '';
   };
 
   services.vaultwarden = {
@@ -242,14 +128,6 @@
     settings = {
       newVersionCheck.enabled = false;
       server.externalDomain = "https://immich.home.rhelmot.io";
-      oauth = {
-        enabled = true;
-        autoLaunch = true;
-        buttonText = "Single Sign-On";
-        clientId = "immich";
-        clientSecret._secret = "/var/lib/immich/oidc-client-secret";
-        issuerUrl = "https://auth.rhelmot.io/realms/rhelmot";
-      };
     };
   };
 
@@ -267,7 +145,7 @@
   };
 
   systemd.timers.pepper-glucose = {
-    wantedBy = [ "timers.target" ];
+    wantedBy = ["timers.target"];
     timerConfig = {
       OnBootSec = "60";
       OnUnitActiveSec = "60";
@@ -275,7 +153,7 @@
   };
 
   systemd.services.pepper-glucose = {
-    path = [ (pkgs.python3.withPackages (p: [ p.pydexcom ])) ];
+    path = [(pkgs.python3.withPackages (p: [p.pydexcom]))];
     script = ''
       ~/glucose/dexcom.py /var/www/home.rhelmot.io/pepper/glucose.json
     '';
@@ -316,148 +194,12 @@
     settings.gui.user = "audrey";
   };
 
-  services.sftpgo = {
-    enable = true;
-    dataDir = "/var/lib/sftpgo";
-    extraReadWriteDirs = [
-      "/var/lib/jellyfin/library"
-      "/var/lib/aria2/Downloads"
-    ];
-    settings = {
-      tz = "local";
-      httpd.bindings = [
-        {
-          port = 3006;
-          # 1 means OIDC for the WebAdmin UI.
-          # 2 means OIDC for the WebClient UI.
-          # 4 means login form for the WebAdmin UI.
-          # 8 means login form for the WebClient UI.
-          # 16 means the admin token endpoint for REST API.
-          # 32 means the user token endpoint for REST API.
-          # 64 means admin API key login.
-          # 128 means user API key login.
-          disabled_login_methods = 1 + 8;
-          oidc = {
-            config_url = "https://auth.rhelmot.io/realms/rhelmot";
-            client_id = "sftpgo";
-            client_secret_file = "/var/lib/sftpgo/oidc-client-secret";
-            redirect_base_url = "https://sftpgo.home.rhelmot.io";
-            username_field = "preferred_username";
-            scopes = [
-              "openid"
-              "profile"
-              "email"
-              "sftpgo"
-            ];
-          };
-        }
-      ];
-      sftpd.bindings = [
-        {
-          port = 28022;
-          address = "0.0.0.0";
-        }
-      ];
-      sftpd.password_authentication = false;
-    };
-  };
-  systemd.services.sftpgo.serviceConfig.UMask = lib.mkForce "0007";
-
-  services.jellyfin = {
-    enable = true;
-  };
-
-  services.aria2 = {
-    enable = true;
-    rpcSecretFile = "/var/lib/aria2/secret";
-    settings = {
-      rpc-listen-port = 3008;
-      retry-wait = 15;
-      interface = "10.100.0.2";
-    };
-  };
-  systemd.services.aria2 = {
-    wants = [ "openvpn-nordvpn.service" ];
-    after = [ "openvpn-nordvpn.service" ];
-  };
-  users.users.audrey.extraGroups = [ "aria2" ];
-  users.users.sftpgo.extraGroups = [ "aria2" ];
-  users.users.jellyfin.extraGroups = [ "sftpgo" ];
-
-  services.openvpn = {
-    servers.nordvpn = {
-      config = "config /var/lib/openvpn/nordvpn.ovpn";
-      autoStart = true;
-      authUserPass = "/var/lib/openvpn/nordvpn.passwd";
-    };
-  };
-
-  services.radicle = {
-    enable = true;
-    privateKey = "/var/lib/radicle/keys/radicle";
-    publicKey = "/var/lib/radicle/keys/radicle.pub";
-    httpd = {
-      enable = true;
-      listenPort = 3009;
-      nginx = {
-        serverName = "rad.rhelmot.io";
-      };
-    };
-    settings = {
-      node = {
-        alias = "rad.rhelmot.io";
-        listen = [ "0.0.0.0:8776" ];
-        externalAddresses = [ "rad.rhelmot.io:8776" ];
-        seedingPolicy = {
-          default = "block";
-          scope = "all";
-        };
-      };
-    };
-  };
-
-  services.ddns-updater = {
-    enable = true;
-  };
-
-  systemd.timers.offsite-backups = {
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnBootSec = "15min";
-      OnUnitActiveSec = "1w";
-    };
-  };
-
-  systemd.services.offsite-backups = {
-    path = with pkgs; [
-      zfs
-      backblaze-b2
-    ];
-    environment = {
-      paths = "/var/lib/immich /var/lib/syncthing /var/lib/vaultwarden /var/lib/sftpgo";
-      HOME = "/root";
-    };
-    script = /* bash */ ''
-      set +e
-      result=0
-      for f in $paths; do
-        backblaze-b2 sync --replace-newer --keep-days 30 "$f" "b2://hydrangea-datasets/$(basename $f)" || result=1
-      done
-      exit $result
-    '';
-
-    serviceConfig = {
-      Type = "oneshot";
-      User = "root";
-      Group = "root";
-    };
-  };
-
   # TODO
+  # - sftpgo
   # - transfer old nextcloud files
-  # - move old data files to sftpgo/audrey?
+  # - jellyfin
-  # - alerting
   # ON HOLD
-  # - hedgedoc keycloak
+  # - dyndns
-  #   - waiting for hedgedoc2 release to get oidc
+  #   - https://github.com/qdm12/ddns-updater/pull/1046
+  #   - https://github.com/ddclient/ddclient/pull/852
 }

sites/hydrangea/hardware-configuration.nix

@@ -21,18 +21,11 @@
     "main/hedgedoc".mountPoint = "/var/lib/hedgedoc";
     "main/immich".mountPoint = "/var/lib/immich";
     "main/syncthing".mountPoint = "/var/lib/syncthing";
-    "main/jellyfin".mountPoint = "/var/lib/jellyfin";
-    "main/jellyfin/cache".mountPoint = "/var/cache/jellyfin";
-    "main/jellyfin/library".mountPoint = "/var/lib/jellyfin/library";
-    "main/radicle".mountPoint = "/var/lib/radicle";
   };
 
   fileSystems."/boot" = {
     device = "/dev/disk/by-uuid/910E-0D0F";
     fsType = "vfat";
-    options = [
+    options = [ "fmask=0022" "dmask=0022" ];
-      "fmask=0022"
-      "dmask=0022"
-    ];
   };
 }

sites/hydrangea/system

@@ -0,0 +1 @@
+nixos

sites/redshank/configuration.nix

@@ -1,14 +1,8 @@
-{
+{ config, lib, pkgs, nixpkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
 
 {
   imports = [
-    "${modulesPath}/installer/cd-dvd/installation-cd-graphical-gnome.nix"
+    "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix"
   ];
 
   networking.hostName = "redshank";

sites/redshank/system

@@ -0,0 +1 @@
+nixos

sites/sunflower/anonsee.nix

@@ -71,18 +71,13 @@ in
       inherit wp-wordpress-importer wp-blocksy-companion;
     };
     settings = {
-      FORCE_SSL_ADMIN = true;
+        FORCE_SSL_ADMIN = true;
     };
     extraConfig = ''
       $_SERVER['HTTPS']='on';
     '';
   };
-  services.nginx.virtualHosts."anonsee.rhelmot.io".listen = [
+  services.nginx.virtualHosts."anonsee.rhelmot.io".listen = [ { addr = "0.0.0.0"; port = 3000; } ];
-    {
-      addr = "0.0.0.0";
-      port = 3000;
-    }
-  ];
   networking.firewall.allowedTCPPorts = [ 3000 ];
   services.wordpress.webserver = "nginx";
   system.stateVersion = "25.05";

sites/sunflower/configuration.nix

@@ -0,0 +1,295 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [ ./hardware-configuration.nix ];
+
+  boot.initrd.supportedFilesystems = [ "zfs" ];
+  boot.initrd.systemd.enable = true;
+  services.zfs.autoScrub.enable = true;
+  services.zfs.trim.enable = true;
+
+  networking.hostName = "sunflower";
+  networking.hostId = "77d68c52";
+  networking.useNetworkd = true;
+  systemd.network.enable = true;
+  systemd.network.networks."30-wan" = {
+    matchConfig.Name = "enp1s0";
+    networkConfig.DHCP = "ipv4";
+    address = [
+      "2a01:4f9:c013:ce62::1/64"
+    ];
+    routes = [
+      { Gateway = "fe80::1"; }
+    ];
+  };
+
+  time.timeZone = "America/Phoenix";
+
+  system.stateVersion = "24.11";
+
+  security.sudo.wheelNeedsPassword = false;
+
+  networking.firewall.allowedTCPPorts = [ 22 80 443 1337 1338 ];
+  networking.firewall.allowedUDPPorts = [ 1337 1338 ];
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "audrey@rhelmot.io";
+  };
+
+  services.bingosync = {
+    enable = true;
+    domain = "celestebingo.rhelmot.io";
+    socketsDomain = "sockets-celestebingo.rhelmot.io";
+    databaseUrl = "postgres://%2Frun%2Fpostgresql/bingosync";
+    extraPythonPackages = p: [ p.psycopg2 ];
+  };
+
+  users.users.wiki-js = {
+    isSystemUser = true;
+    group = "wiki-js";
+  };
+  users.groups.wiki-js = {};
+
+  users.groups.${config.services.forgejo.group}.members = [config.services.nginx.user];
+
+  services.wiki-js = {
+    enable = true;
+    settings = {
+      db.type = "postgres";
+      db.db = "wiki-js";
+      db.user = "wiki-js";
+      db.host = "/run/postgresql";
+      bindIP = "127.0.0.1";
+      port = 5517;
+    };
+  };
+
+  services.forgejo = {
+    enable = true;
+    lfs.enable = true;
+    database = {
+      createDatabase = true;
+      type = "postgres";
+      socket = "/run/postgresql";
+    };
+    settings = {
+      DEFAULT = {
+        APP_NAME = "Shellphish Git";
+      };
+
+      server = {
+        DOMAIN = "git.rhelmot.io";
+        PROTOCOL = "http+unix";
+        ROOT_URL = "https://git.rhelmot.io/";
+        UNIX_SOCKET_PERMISSION = "770";
+        LANDING_PAGE = "explore";
+      };
+
+      "ssh.minimum_key_sizes".RSA = "2047";
+
+      repository = {
+        ENABLE_PUSH_CREATE_USER = "true";
+        ENABLE_PUSH_CREATE_ORG = "true";
+      };
+    };
+  };
+
+  services.postgresql = {
+    enable = true;
+    ensureDatabases = [
+      "bingosync"
+      "mspa"
+      "wiki-js"
+      "forgejo"
+    ];
+    ensureUsers = [
+      { name = "bingosync"; ensureDBOwnership = true; }
+      { name = "mspa"; ensureDBOwnership = true; }
+      { name = "wiki-js"; ensureDBOwnership = true; }
+      { name = "forgejo"; ensureDBOwnership = true; }
+    ];
+    authentication = pkgs.lib.mkOverride 10 ''
+      #type database  DBuser  auth-method optional_ident_map
+      local all  all     peer        map=defaultmap
+    '';
+    identMap = ''
+      # ArbitraryMapName systemUser DBUser
+       defaultmap      root      postgres
+       defaultmap      postgres  postgres
+       defaultmap      php-nginx mspa
+       defaultmap      bingosync bingosync
+       defaultmap      wiki-js   wiki-js
+       defaultmap      forgejo   forgejo
+    '';
+  };
+
+  users.users.php-nginx = {
+    isSystemUser = true;
+    group = "php-nginx";
+  };
+  users.groups.php-nginx = {};
+
+  services.phpfpm.pools.nginx = {
+    user = "php-nginx";
+    settings = {
+      "pm" = "dynamic";
+      "listen.owner" = config.services.nginx.user;
+      "pm.max_children" = 5;
+      "pm.start_servers" = 2;
+      "pm.min_spare_servers" = 1;
+      "pm.max_spare_servers" = 3;
+      "pm.max_requests" = 500;
+    };
+  };
+
+  services.nginx = {
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+
+    virtualHosts = {
+      "rhelmot.io" = {
+        default = true;
+        forceSSL = true;
+        enableACME = true;
+        root = "/var/www/rhelmot.io/";
+        locations."/secret/" = {
+          basicAuthFile = "/var/lib/rhelmot.io/secret";
+        };
+        locations."~ ^/MSPA/(.*\\.php|)$" = {
+          extraConfig = ''
+            fastcgi_pass  unix:${config.services.phpfpm.pools.nginx.socket};
+            fastcgi_index index.php;
+          '';
+          index = "index.php index.html";
+        };
+      };
+      "www.rhelmot.io" = {
+        globalRedirect = "rhelmot.io";
+        enableACME = true;
+      };
+      "blog.rhelmot.io" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          root = "/nix/var/nix/profiles/blog-rhelmot-io";
+        };
+      };
+      "www.blog.rhelmot.io" = {
+        globalRedirect = "blog.rhelmot.io";
+        enableACME = true;
+      };
+
+      "bingosync.rhelmot.io" = {
+        locations."/" = {
+          proxyPass = "https://bingosync.com/";
+          proxyWebsockets = true;
+        };
+      };
+      # proxy conf generated by services.bingosync
+      "celestebingo.rhelmot.io" = {
+        enableACME = true;
+        addSSL = true;
+      };
+      "sockets-celestebingo.rhelmot.io" = {
+        enableACME = true;
+        addSSL = true;
+      };
+      "www.celestebingo.rhelmot.io" = {
+        globalRedirect = "celestebingo.rhelmot.io";
+        enableACME = true;
+      };
+
+      "minal.rhelmot.io" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/".root = "/var/www/minal.rhelmot.io/";
+      };
+      "www.minal.rhelmot.io" = {
+        globalRedirect = "minal.rhelmot.io";
+        enableACME = true;
+      };
+      "mimispastrypost.com" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/".root = "/var/www/mimispastrypost.com/";
+      };
+      "www.mimispastrypost.com" = {
+        globalRedirect = "mimispastrypost.com";
+        enableACME = true;
+      };
+
+      "wiki.rhelmot.io" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://localhost:5517/";
+          proxyWebsockets = true;
+        };
+      };
+
+      "git.rhelmot.io" = {
+        forceSSL = true;
+        enableACME = true;
+        extraConfig = ''
+          client_max_body_size 4G;
+        '';
+        locations."/" = {
+          proxyPass = "http://unix:/run/forgejo/forgejo.sock";
+          proxyWebsockets = true;
+        };
+      };
+
+      "anonsee.rhelmot.io" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://192.168.100.11:3000";
+          proxyWebsockets = true;
+          recommendedProxySettings = true;
+          extraConfig = ''
+          '';
+        };
+      };
+      "anons.ee" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://192.168.100.11:3000";
+          proxyWebsockets = true;
+          recommendedProxySettings = true;
+          extraConfig = ''
+          '';
+        };
+      };
+    };
+  };
+
+  users.users.reminder-bot = {
+    isSystemUser = true;
+    group = "nogroup";
+  };
+  systemd.services.reminder-bot = {
+    path = [ (pkgs.python3.withPackages (p: with p; [ discordpy aiocron aiosqlite cronsim ])) ];
+    script = ''
+      exec python ${./reminder_bot.py}
+    '';
+    serviceConfig = {
+      Type = "simple";
+      Restart = "always";
+      User = "reminder-bot";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+
+  containers.anonsee = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = "192.168.100.10";
+    localAddress = "192.168.100.11";
+    config.imports = [ ./anonsee.nix ];
+  };
+  services.nginx.logError = "stderr info";
+}

sites/sunflower/hardware-configuration.nix

@@ -0,0 +1,53 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "system/local/root";
+      fsType = "zfs";
+      options = [ "zfsutil" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "system/local/nix";
+      fsType = "zfs";
+    };
+
+  fileSystems."/var" =
+    { device = "system/local/var";
+      fsType = "zfs";
+    };
+
+  fileSystems."/home" =
+    { device = "system/home";
+      fsType = "zfs";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/564D-E28E";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

sites/sunflower/system

@@ -0,0 +1 @@
+nixos

sites/tulip/configuration.nix

@@ -1,10 +1,4 @@
-{
+{ config, lib, pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  inputs,
-  ...
-}:
 
 {
   imports = [ ./hardware-configuration.nix ];
@@ -23,268 +17,6 @@
 
   security.sudo.wheelNeedsPassword = false;
 
-  networking.firewall.allowedTCPPorts = [
+  networking.firewall.allowedTCPPorts = [ 22 80 443 1337 1338 ];
-    22
+  networking.firewall.allowedUDPPorts = [ 1337 1338 ];
-    80
-    443
-    1337
-    1338
-  ];
-  networking.firewall.allowedUDPPorts = [
-    1337
-    1338
-  ];
-
-  users.users.vamp = {
-    isNormalUser = true;
-  };
-
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "audrey@rhelmot.io";
-  };
-
-  services.bingosync = {
-    enable = true;
-    domain = "celestebingo.rhelmot.io";
-    socketsDomain = "sockets-celestebingo.rhelmot.io";
-    databaseUrl = "postgres://%2Frun%2Fpostgresql/bingosync";
-    extraPythonPackages = p: [ p.psycopg2 ];
-  };
-
-  services.postgresql = {
-    enable = true;
-    ensureDatabases = [
-      "bingosync"
-      "mspa"
-      "keycloak"
-    ];
-    ensureUsers = [
-      {
-        name = "bingosync";
-        ensureDBOwnership = true;
-      }
-      {
-        name = "mspa";
-        ensureDBOwnership = true;
-      }
-      {
-        name = "keycloak";
-        ensureDBOwnership = true;
-      }
-    ];
-    authentication = pkgs.lib.mkOverride 10 ''
-      #type database  DBuser  auth-method optional_ident_map
-      local all  all     peer        map=defaultmap
-    '';
-    identMap = ''
-      # ArbitraryMapName systemUser DBUser
-       defaultmap      root      postgres
-       defaultmap      postgres  postgres
-       defaultmap      php-nginx mspa
-       defaultmap      bingosync bingosync
-       defaultmap      keycloak  keycloak
-    '';
-  };
-
-  users.users.php-nginx = {
-    isSystemUser = true;
-    group = "php-nginx";
-  };
-  users.groups.php-nginx = { };
-
-  services.phpfpm.pools.nginx = {
-    user = "php-nginx";
-    settings = {
-      "pm" = "dynamic";
-      "listen.owner" = config.services.nginx.user;
-      "pm.max_children" = 5;
-      "pm.start_servers" = 2;
-      "pm.min_spare_servers" = 1;
-      "pm.max_spare_servers" = 3;
-      "pm.max_requests" = 500;
-    };
-  };
-
-  security.acme.certs = {
-    "rhelmot.io".extraDomainNames = [
-      "www.rhelmot.io"
-      "blog.rhelmot.io"
-      "www.blog.rhelmot.io"
-      "celestebingo.rhelmot.io"
-      "sockets-celestebingo.rhelmot.io"
-      "www.celestebingo.rhelmot.io"
-      "minal.rhelmot.io"
-      "www.minal.rhelmot.io"
-      "auth.rhelmot.io"
-    ];
-    "mimispastrypost.com".extraDomainNames = [
-      "www.mimispastrypost.com"
-    ];
-  };
-  services.nginx = {
-    recommendedGzipSettings = true;
-    recommendedOptimisation = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-
-    virtualHosts = {
-      "rhelmot.io" = {
-        default = true;
-        forceSSL = true;
-        enableACME = true;
-        root = "/var/www/rhelmot.io/";
-        locations."/secret/" = {
-          basicAuthFile = "/var/lib/rhelmot.io/secret";
-        };
-        locations."~ ^/MSPA/(.*\\.php|)$" = {
-          extraConfig = ''
-            fastcgi_pass  unix:${config.services.phpfpm.pools.nginx.socket};
-            fastcgi_index index.php;
-          '';
-          index = "index.php index.html";
-        };
-      };
-      "www.rhelmot.io" = {
-        globalRedirect = "rhelmot.io";
-        useACMEHost = "rhelmot.io";
-      };
-      "blog.rhelmot.io" = {
-        forceSSL = true;
-        useACMEHost = "rhelmot.io";
-        locations."/" = {
-          root = "/nix/var/nix/profiles/blog-rhelmot-io";
-        };
-      };
-      "www.blog.rhelmot.io" = {
-        globalRedirect = "blog.rhelmot.io";
-        useACMEHost = "rhelmot.io";
-      };
-
-      "bingosync.rhelmot.io" = {
-        locations."/" = {
-          proxyPass = "https://bingosync.com/";
-          proxyWebsockets = true;
-        };
-      };
-      # proxy conf generated by services.bingosync
-      "celestebingo.rhelmot.io" = {
-        addSSL = true;
-        useACMEHost = "rhelmot.io";
-      };
-      "sockets-celestebingo.rhelmot.io" = {
-        addSSL = true;
-        useACMEHost = "rhelmot.io";
-      };
-      "www.celestebingo.rhelmot.io" = {
-        globalRedirect = "celestebingo.rhelmot.io";
-        useACMEHost = "rhelmot.io";
-      };
-
-      "minal.rhelmot.io" = {
-        forceSSL = true;
-        useACMEHost = "rhelmot.io";
-        locations."/".root = "/var/www/minal.rhelmot.io/";
-      };
-      "www.minal.rhelmot.io" = {
-        globalRedirect = "minal.rhelmot.io";
-        useACMEHost = "rhelmot.io";
-      };
-      "mimispastrypost.com" = {
-        forceSSL = true;
-        enableACME = true;
-        locations."/".root = "/var/www/mimispastrypost.com/";
-      };
-      "www.mimispastrypost.com" = {
-        globalRedirect = "mimispastrypost.com";
-        useACMEHost = "mimispastrypost.com";
-      };
-
-      "anons.ee" = {
-        forceSSL = true;
-        enableACME = true;
-        locations."/" = {
-          proxyPass = "http://192.168.100.11:3000";
-          proxyWebsockets = true;
-          recommendedProxySettings = true;
-        };
-      };
-      "auth.rhelmot.io" = {
-        forceSSL = true;
-        useACMEHost = "rhelmot.io";
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:3030";
-          proxyWebsockets = true;
-        };
-      };
-    };
-  };
-
-  users.users.reminder-bot = {
-    isSystemUser = true;
-    group = "nogroup";
-  };
-  systemd.services.reminder-bot = {
-    path = [
-      (pkgs.python3.withPackages (
-        p: with p; [
-          (discordpy.override { withVoice = false; })
-          aiocron
-          aiosqlite
-          cronsim
-        ]
-      ))
-    ];
-    script = ''
-      exec python ${./reminder_bot.py}
-    '';
-    serviceConfig = {
-      Type = "simple";
-      Restart = "always";
-      User = "reminder-bot";
-    };
-    wantedBy = [ "multi-user.target" ];
-  };
-
-  containers.anonsee = {
-    autoStart = true;
-    privateNetwork = true;
-    hostAddress = "192.168.100.10";
-    localAddress = "192.168.100.11";
-    config.imports = [ ./anonsee.nix ];
-  };
-  services.nginx.logError = "stderr info";
-
-  services.keycloak = {
-    enable = true;
-    database.host = "/run/postgresql";
-    database.type = "postgresql";
-    initialAdminPassword = "bitesyouchangeme";
-    plugins = with pkgs.keycloak.plugins; [
-      junixsocket-common
-      junixsocket-native-common
-    ];
-    settings = {
-      hostname = "auth.rhelmot.io";
-      http-host = "127.0.0.1";
-      http-port = 3030;
-      proxy-headers = "xforwarded";
-      http-enabled = true;
-    };
-  };
-
-  rhelmot.deployments = {
-    "blog-rhelmot-io" = {
-      target = (import inputs."blog-rhelmot-io" { }).site;
-    };
-  };
-
-  networking.extraHosts = ''
-    129.146.203.142 rhelmot.io
-    129.146.203.142 auth.rhelmot.io
-    129.146.203.142 celestebingo.rhelmot.io
-    129.146.203.142 anons.ee
-  '';
-
-  services.fwupd.enable = lib.mkForce false;
 }

sites/tulip/hardware-configuration.nix

@@ -1,52 +1,43 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
+{ config, lib, pkgs, modulesPath, ... }:
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
 
 {
-  imports = [
+  imports =
-    (modulesPath + "/profiles/qemu-guest.nix")
+    [ (modulesPath + "/profiles/qemu-guest.nix")
-  ];
+    ];
 
   boot.initrd.availableKernelModules = [ "virtio_scsi" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" = {
+  fileSystems."/" =
-    device = "system/root";
+    { device = "system/root";
-    fsType = "zfs";
+      fsType = "zfs";
-  };
+    };
 
-  fileSystems."/var" = {
+  fileSystems."/var" =
-    device = "system/var";
+    { device = "system/var";
-    fsType = "zfs";
+      fsType = "zfs";
-  };
+    };
 
-  fileSystems."/nix" = {
+  fileSystems."/nix" =
-    device = "system/nix";
+    { device = "system/nix";
-    fsType = "zfs";
+      fsType = "zfs";
-  };
+    };
 
-  fileSystems."/home" = {
+  fileSystems."/home" =
-    device = "system/home";
+    { device = "system/home";
-    fsType = "zfs";
+      fsType = "zfs";
-  };
+    };
 
-  fileSystems."/boot" = {
+  fileSystems."/boot" =
-    device = "/dev/disk/by-uuid/7798-9D4F";
+    { device = "/dev/disk/by-uuid/7798-9D4F";
-    fsType = "vfat";
+      fsType = "vfat";
-    options = [
+      options = [ "fmask=0022" "dmask=0022" ];
-      "fmask=0022"
+    };
-      "dmask=0022"
-    ];
-  };
 
   swapDevices = [ ];
 

sites/tulip/system

@@ -0,0 +1 @@
+nixos