Merge branch 'main' of gh:greg-hellings/nixos-config

.editorconfig

@@ -0,0 +1,122 @@
+# EditorConfig configuration for nixpkgs
+# https://EditorConfig.org
+
+# Top-most EditorConfig file
+root = true
+
+# Unix-style newlines with a newline ending every file, utf-8 charset
+[*]
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+charset = utf-8
+
+# Ignore diffs/patches
+[*.{diff,patch}]
+end_of_line = unset
+insert_final_newline = unset
+trim_trailing_whitespace = unset
+
+# We want readFile .version to return the version without a newline.
+[.version]
+insert_final_newline = false
+
+# see https://nixos.org/nixpkgs/manual/#chap-conventions
+
+# Match json/lockfiles/markdown/nix/perl/python/ruby/shell/docbook files, set indent to spaces
+[*.{json,lock,md,nix,pl,pm,py,rb,sh,xml}]
+indent_style = space
+
+# Match docbook files, set indent width of one
+[*.xml]
+indent_size = 1
+
+# Match json/lockfiles/markdown/nix/ruby files, set indent width of two
+[*.{json,lock,md,nix,rb}]
+indent_size = 2
+
+# Match perl/python/shell scripts, set indent width of four
+[*.{pl,pm,py,sh}]
+indent_size = 4
+
+# Match gemfiles, set indent to spaces with width of two
+[Gemfile]
+indent_size = 2
+indent_style = space
+
+# Match package.json, which are generally pulled from upstream and accept them as they are
+[package.json]
+indent_style = unset
+
+# Disable file types or individual files
+# some of these files may be auto-generated and/or require significant changes
+
+[*.{c,h}]
+insert_final_newline = unset
+trim_trailing_whitespace = unset
+
+[*.{asc,key,ovpn}]
+insert_final_newline = unset
+end_of_line = unset
+trim_trailing_whitespace = unset
+
+[*.lock]
+indent_size = unset
+
+# Although Markdown/CommonMark allows using two trailing spaces to denote
+# a hard line break, we do not use that feature in nixpkgs since
+# it forces the surrounding paragraph to become a <literallayout> which
+# does not wrap reasonably.
+# Instead of a hard line break, start a new paragraph by inserting a blank line.
+[*.md]
+trim_trailing_whitespace = true
+
+# binaries
+[*.nib]
+end_of_line = unset
+insert_final_newline = unset
+trim_trailing_whitespace = unset
+charset = unset
+
+[eggs.nix]
+trim_trailing_whitespace = unset
+
+[nixos/modules/services/networking/ircd-hybrid/*.{conf,in}]
+trim_trailing_whitespace = unset
+
+[pkgs/build-support/dotnetenv/Wrapper/**]
+end_of_line = unset
+indent_style = unset
+insert_final_newline = unset
+trim_trailing_whitespace = unset
+
+[pkgs/development/compilers/elm/registry.dat]
+end_of_line = unset
+insert_final_newline = unset
+
+[pkgs/development/haskell-modules/hackage-packages.nix]
+indent_style = unset
+trim_trailing_whitespace = unset
+
+[pkgs/misc/documentation-highlighter/**]
+insert_final_newline = unset
+
+[pkgs/servers/dict/wordnet_structures.py]
+trim_trailing_whitespace = unset
+
+[pkgs/tools/misc/timidity/timidity.cfg]
+trim_trailing_whitespace = unset
+
+[pkgs/tools/virtualization/ovftool/*.ova]
+end_of_line = unset
+insert_final_newline = unset
+trim_trailing_whitespace = unset
+charset = unset
+
+[lib/tests/*.plist]
+indent_style = tab
+insert_final_newline = unset
+
+[pkgs/kde/generated/**]
+insert_final_newline = unset
+end_of_line = unset

.envrc

@@ -0,0 +1 @@
+use flake

.gitignore

@@ -1,2 +1,4 @@
 host
 result
+.pre-commit-config.yaml
+.direnv

ceph/home.nix

@@ -1,20 +1,26 @@
 {
   fsid = "749bf0ea-acf5-4a5e-b33e-9a057455c06b";
   clusterName = "home";
-	initialMonitors = [ {
+  initialMonitors = [
+    {
       hostname = "myself.thehellings.lan";
       ipAddress = "10.42.1.6";
-	} {
+    }
+    {
       hostname = "jeremiah.thehellings.lan";
       ipAddress = "10.42.1.8";
-	} {
+    }
+    {
       hostname = "hosea.thehellings.lan";
       ipAddress = "10.42.1.7";
-	} ];
+    }
-	mdsNodes = [ {
+  ];
+  mdsNodes = [
+    {
       hostname = "jeremiah.thehellings.lan";
       ipAddress = "10.42.1.8";
-	} ];
+    }
+  ];
   publicNetworks = [ "10.42.0.0/16" ];
   clusterNetworks = [ "10.201.0.0/16" ];
   adminKeyring = ../secrets/home.client.admin.keyring;

checks.nix

@@ -0,0 +1,14 @@
+{ hooks, system, ... }:
+
+{
+  pre-commit-check = hooks.lib.${system}.run {
+    src = ./.;
+    hooks = {
+      deadnix.enable = true;
+      # Needs https://github.com/DeterminateSystems/flake-checker/pull/130
+      #flake-checker.enable = true;
+      nixfmt-rfc-style.enable = true;
+      check-merge-conflicts.enable = true;
+    };
+  };
+}

configuration.nix

@@ -5,10 +5,10 @@
 { config, pkgs, ... }:
 
 {
-  imports =
+  imports = [
-    [ # Include the results of the hardware scan.
+    # Include the results of the hardware scan.
     ./hardware-configuration.nix
-      ./modules/
+    ./modules
   ];
 
   # Bootloader.
@@ -72,7 +72,10 @@
   users.users.greg = {
     isNormalUser = true;
     description = "Greg Hellings";
-    extraGroups = [ "networkmanager" "wheel" ];
+    extraGroups = [
+      "networkmanager"
+      "wheel"
+    ];
     packages = with pkgs; [
       firefox
       #  thunderbird

darwin/default.nix

@@ -1,33 +1,36 @@
-{ inputs, overlays, ... }:
+{ top, overlays, ... }:
 let
-	mac = {
+  mac =
+    {
       system ? "aarch64-darwin",
       name,
-		channel ? inputs.nixunstable,
+      channel ? top.nixunstable,
-		hm ? inputs.hmunstable,
+      hm ? top.hmunstable,
-		extraMods ? []
+      extraMods ? [ ],
     }:
     let
-		nixpkgs = import channel {
+      nixpkgs = import channel { inherit system overlays; };
-			inherit system overlays;
+    in
-		};
+    top.darwin.lib.darwinSystem {
-	in inputs.darwin.lib.darwinSystem {
       inherit system;
-		specialArgs = { inherit nixpkgs; };
+      specialArgs = {
+        inherit nixpkgs;
+      };
       modules = [
         {
           nixpkgs.overlays = overlays;
           home-manager.extraSpecialArgs = {
-					inherit inputs;
+            inherit top;
             host = name;
           };
         }
         hm.darwinModules.home-manager
-			inputs.self.modules.darwinModule
+        top.self.modules.darwinModule
         ./${name}
       ] ++ extraMods;
     };
-in rec {
+in
+rec {
   la23002 = mac { name = "ivr"; };
   LA23002 = la23002;
 }

darwin/ivr/default.nix

@@ -1,41 +0,0 @@
-{ pkgs, ... }:
-let
-	qemu_conf = pkgs.stdenv.mkDerivation {
-		name = "qemu_conf";
-		phases = [ "installPhase" ];
-
-		cfg = pkgs.writeText "qemu.conf"
-		''
-			security_driver = "none"
-			dynamic_ownership = 0
-			remember_owner = 0
-		'';
-		installPhase = ''
-			mkdir -p $out/opt/homebrew/etc/libvirt/
-			cp $cfg $out/opt/homebrew/etc/libvirt/qemu.conf
-		'';
-	};
-in {
-	environment.systemPackages = with pkgs; [
-		qemu_conf
-		unixtools.watch
-	];
-
-	homebrew = {
-		enable = true;
-		brews = [
-			"qemu"
-			"gcc"
-			"libaacs"
-			{
-				name = "libvirt";
-				restart_service = true;
-			}
-			"virt-manager"
-		];
-		casks = [
-			"synology-drive"
-			"handbrake"
-		];
-	};
-}

flake.lock

@@ -23,6 +23,43 @@
         "type": "github"
       }
     },
+    "btc": {
+      "inputs": {
+        "extra-container": "extra-container",
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-unstable": "nixpkgs-unstable"
+      },
+      "locked": {
+        "lastModified": 1723533469,
+        "narHash": "sha256-8gSsZpYmOzwFRaLIX0OMBvV/+SATmu/O9QXkDgsZlIg=",
+        "owner": "fort-nix",
+        "repo": "nix-bitcoin",
+        "rev": "6e208d6a7b554be592167f6ecad9b16c0abf96d7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "fort-nix",
+        "ref": "release",
+        "repo": "nix-bitcoin",
+        "type": "github"
+      }
+    },
+    "crane": {
+      "locked": {
+        "lastModified": 1725409566,
+        "narHash": "sha256-PrtLmqhM6UtJP7v7IGyzjBFhbG4eOAHT6LPYOFmYfbk=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "7e4586bad4e3f8f97a9271def747cf58c4b68f3c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "darwin": {
       "inputs": {
         "nixpkgs": [
@@ -95,11 +132,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1722113426,
+        "lastModified": 1728330715,
-        "narHash": "sha256-Yo/3loq572A8Su6aY5GP56knpuKYRvM2a1meP9oJZCw=",
+        "narHash": "sha256-xRJ2nPOXb//u1jaBnDP56M7v5ldavjbtR6lfGqSvcKg=",
         "owner": "numtide",
         "repo": "devshell",
-        "rev": "67cce7359e4cd3c45296fb4aaf6a19e2a9c757ae",
+        "rev": "dd6b80932022cea34a019e2bb32f6fa9e494dfef",
         "type": "github"
       },
       "original": {
@@ -108,37 +145,70 @@
         "type": "github"
       }
     },
+    "extra-container": {
+      "inputs": {
+        "flake-utils": [
+          "btc",
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "btc",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1722175938,
+        "narHash": "sha256-HKyB4HD+NdX3T233bY31hm76v3/tdQBNeLLvopKbZeY=",
+        "owner": "erikarvstedt",
+        "repo": "extra-container",
+        "rev": "37e7207ac9f857eedb58b208b9dc91cd6b24e651",
+        "type": "github"
+      },
+      "original": {
+        "owner": "erikarvstedt",
+        "repo": "extra-container",
+        "type": "github"
+      }
+    },
+    "fenix": {
+      "inputs": {
+        "nixpkgs": [
+          "zed",
+          "nixpkgs"
+        ],
+        "rust-analyzer-src": "rust-analyzer-src"
+      },
+      "locked": {
+        "lastModified": 1726554553,
+        "narHash": "sha256-xakDhIS1c1VgJc/NMOLj05yBsTdlXKMEYz6wC8Hdshc=",
+        "owner": "nix-community",
+        "repo": "fenix",
+        "rev": "1f59d7585aa06d2c327960d397bea4067d8fee98",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "fenix",
+        "type": "github"
+      }
+    },
     "flake-compat": {
+      "flake": false,
       "locked": {
         "lastModified": 1696426674,
         "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
         "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
-        "revCount": 57,
+        "type": "github"
-        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.0.1/018afb31-abd1-7bff-a5e4-cff7e18efb7a/source.tar.gz"
       },
       "original": {
-        "type": "tarball",
+        "owner": "edolstra",
-        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
+        "repo": "flake-compat",
+        "type": "github"
       }
     },
     "flake-compat_2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_3": {
       "locked": {
         "lastModified": 1696426674,
         "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
@@ -152,7 +222,7 @@
         "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
       }
     },
-    "flake-compat_4": {
+    "flake-compat_3": {
       "flake": false,
       "locked": {
         "lastModified": 1696426674,
@@ -168,19 +238,77 @@
         "type": "github"
       }
     },
+    "flake-compat_4": {
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "revCount": 57,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.0.1/018afb31-abd1-7bff-a5e4-cff7e18efb7a/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
+      }
+    },
+    "flake-compat_5": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_6": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_7": {
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-parts": {
       "inputs": {
-        "nixpkgs-lib": [
+        "nixpkgs-lib": "nixpkgs-lib"
-          "nixvimstable",
-          "nixpkgs"
-        ]
       },
       "locked": {
-        "lastModified": 1722555600,
+        "lastModified": 1727826117,
-        "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
+        "narHash": "sha256-K5ZLCyfO/Zj9mPFldf3iwS6oZStJcU4tSpiXTMYaaL0=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
+        "rev": "3d04084d54bedc3d6b8b736c70ef449225c361b1",
         "type": "github"
       },
       "original": {
@@ -190,6 +318,27 @@
       }
     },
     "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nixvimstable",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1725234343,
+        "narHash": "sha256-+ebgonl3NbiKD2UD0x4BszCZQ6sTfL4xioaM49o5B3Y=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "567b938d64d4b4112ee253b9274472dc3a346eb6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_3": {
       "inputs": {
         "nixpkgs-lib": [
           "nixvimunstable",
@@ -197,11 +346,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1722555600,
+        "lastModified": 1727826117,
-        "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
+        "narHash": "sha256-K5ZLCyfO/Zj9mPFldf3iwS6oZStJcU4tSpiXTMYaaL0=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
+        "rev": "3d04084d54bedc3d6b8b736c70ef449225c361b1",
         "type": "github"
       },
       "original": {
@@ -233,11 +382,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1710146030,
+        "lastModified": 1726560853,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
         "type": "github"
       },
       "original": {
@@ -264,10 +413,28 @@
         "type": "github"
       }
     },
+    "flake-utils_4": {
+      "inputs": {
+        "systems": "systems_5"
+      },
+      "locked": {
+        "lastModified": 1726560853,
+        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "git-hooks": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
-        "gitignore": "gitignore",
+        "gitignore": "gitignore_2",
         "nixpkgs": [
           "nixvimstable",
           "nixpkgs"
@@ -278,11 +445,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723202784,
+        "lastModified": 1724857454,
-        "narHash": "sha256-qbhjc/NEGaDbyy0ucycubq4N3//gDFFH3DOmp1D3u1Q=",
+        "narHash": "sha256-Qyl9Q4QMTLZnnBb/8OuQ9LSkzWjBU1T5l5zIzTxkkhk=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "c7012d0c18567c889b948781bc74a501e92275d1",
+        "rev": "4509ca64f1084e73bc7a721b20c669a8d4c5ebe6",
         "type": "github"
       },
       "original": {
@@ -297,7 +464,7 @@
           "nixvimunstable",
           "flake-compat"
         ],
-        "gitignore": "gitignore_2",
+        "gitignore": "gitignore_3",
         "nixpkgs": [
           "nixvimunstable",
           "nixpkgs"
@@ -308,11 +475,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723202784,
+        "lastModified": 1729104314,
-        "narHash": "sha256-qbhjc/NEGaDbyy0ucycubq4N3//gDFFH3DOmp1D3u1Q=",
+        "narHash": "sha256-pZRZsq5oCdJt3upZIU4aslS9XwFJ+/nVtALHIciX/BI=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "c7012d0c18567c889b948781bc74a501e92275d1",
+        "rev": "3c3e88f0f544d6bb54329832616af7eb971b6be6",
         "type": "github"
       },
       "original": {
@@ -322,6 +489,27 @@
       }
     },
     "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "gitignore_2": {
       "inputs": {
         "nixpkgs": [
           "nixvimstable",
@@ -343,7 +531,7 @@
         "type": "github"
       }
     },
-    "gitignore_2": {
+    "gitignore_3": {
       "inputs": {
         "nixpkgs": [
           "nixvimunstable",
@@ -372,11 +560,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1720042825,
+        "lastModified": 1726989464,
-        "narHash": "sha256-A0vrUB6x82/jvf17qPCpxaM+ulJnD8YZwH9Ci0BsAzE=",
+        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e1391fb22e18a36f57e6999c7a9f966dc80ac073",
+        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
         "type": "github"
       },
       "original": {
@@ -393,11 +581,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723986931,
+        "lastModified": 1729551526,
-        "narHash": "sha256-Fy+KEvDQ+Hc8lJAV3t6leXhZJ2ncU5/esxkgt3b8DEY=",
+        "narHash": "sha256-7LAGY32Xl14OVQp3y6M43/0AtHYYvV6pdyBcp3eoz0s=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "2598861031b78aadb4da7269df7ca9ddfc3e1671",
+        "rev": "5ec753a1fc4454df9285d8b3ec0809234defb975",
         "type": "github"
       },
       "original": {
@@ -458,11 +646,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723399884,
+        "lastModified": 1729260213,
-        "narHash": "sha256-97wn0ihhGqfMb8WcUgzzkM/TuAxce2Gd20A8oiruju4=",
+        "narHash": "sha256-jAvHoU/1y/yCuXzr2fNF+q6uKmr8Jj2xgAisK4QB9to=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "086f619dd991a4d355c07837448244029fc2d9ab",
+        "rev": "09a0c0c02953318bf94425738c7061ffdc4cba75",
         "type": "github"
       },
       "original": {
@@ -471,6 +659,27 @@
         "type": "github"
       }
     },
+    "hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "gitignore": "gitignore",
+        "nixpkgs": "nixpkgs_2",
+        "nixpkgs-stable": "nixpkgs-stable"
+      },
+      "locked": {
+        "lastModified": 1727854478,
+        "narHash": "sha256-/odH2nUMAwkMgOS2nG2z0exLQNJS4S2LfMW0teqU7co=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "5f58871c9657b5fc0a7f65670fe2ba99c26c1d79",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
     "nix-darwin": {
       "inputs": {
         "nixpkgs": [
@@ -479,11 +688,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1722924007,
+        "lastModified": 1725189302,
-        "narHash": "sha256-+CQDamNwqO33REJLft8c26NbUi2Td083hq6SvAm2xkU=",
+        "narHash": "sha256-IhXok/kwQqtusPsoguQLCHA+h6gKvgdCrkhIaN+kByA=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "91010a5613ffd7ee23ee9263213157a1c422b705",
+        "rev": "7c4b53a7d9f3a3df902b3fddf2ae245ef20ebcda",
         "type": "github"
       },
       "original": {
@@ -500,11 +709,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1722924007,
+        "lastModified": 1728901530,
-        "narHash": "sha256-+CQDamNwqO33REJLft8c26NbUi2Td083hq6SvAm2xkU=",
+        "narHash": "sha256-I9Qd0LnAsEGHtKE9+uVR0iDFmsijWSy7GT0g3jihG4Q=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "91010a5613ffd7ee23ee9263213157a1c422b705",
+        "rev": "a60ac02f9466f85f092e576fd8364dfc4406b5a6",
         "type": "github"
       },
       "original": {
@@ -545,13 +754,121 @@
         "type": "github"
       }
     },
-    "nixpkgs_2": {
+    "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1723175592,
+        "lastModified": 1727825735,
-        "narHash": "sha256-M0xJ3FbDUc4fRZ84dPGx5VvgFsOzds77KiBMW/mMTnI=",
+        "narHash": "sha256-0xHYkMkeLVQAMa7gvkddbPqpxph+hDzdu1XdGPJR+Os=",
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/fb192fec7cc7a4c26d51779e9bab07ce6fa5597a.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/fb192fec7cc7a4c26d51779e9bab07ce6fa5597a.tar.gz"
+      }
+    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1720386169,
+        "narHash": "sha256-NGKVY4PjzwAa4upkGtAMz1npHGoRzWotlSnVlqI40mo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5e0ca22929f3342b19569b21b2f3462f053e497b",
+        "rev": "194846768975b7ad2c4988bdb82572c00222c0d7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1723221148,
+        "narHash": "sha256-7pjpeQlZUNQ4eeVntytU3jkw9dFK3k1Htgk2iuXjaD8=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "154bcb95ad51bc257c2ce4043a725de6ca700ef6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1719082008,
+        "narHash": "sha256-jHJSUH619zBQ6WdC21fFAlDxHErKVDJ5fpN0Hgx4sjs=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9693852a2070b398ee123a329e68f0dab5526681",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1725001927,
+        "narHash": "sha256-eV+63gK0Mp7ygCR0Oy4yIYSNcum2VQwnZamHxYTNi+M=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "6e99f2a27d600612004fbd2c3282d614bfee6421",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1729070438,
+        "narHash": "sha256-KOTTUfPkugH52avUvXGxvWy8ibKKj4genodIYUED+Kc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "5785b6bb5eaae44e627d541023034e1601455827",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1713805509,
+        "narHash": "sha256-YgSEan4CcrjivCNO5ZNzhg7/8ViLkZ4CB/GrGBVSudo=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "1e1dc66fe68972a76679644a5577828b6a7e8be4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1726463316,
+        "narHash": "sha256-gI9kkaH0ZjakJOKrdjaI/VbaMEo9qBbSUl93DnU7f4c=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "99dc8785f6a0adac95f5e2ab05cc2e1bf666d172",
         "type": "github"
       },
       "original": {
@@ -563,11 +880,11 @@
     },
     "nixstable": {
       "locked": {
-        "lastModified": 1723556749,
+        "lastModified": 1727672256,
-        "narHash": "sha256-+CHVZnTnIYRLYsARInHYoWkujzcRkLY/gXm3s5bE52o=",
+        "narHash": "sha256-9/79hjQc9+xyH+QxeMcRsA6hDyw6Z9Eo1/oxjvwirLk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "4a92571f9207810b559c9eac203d1f4d79830073",
+        "rev": "1719f27dd95fd4206afb9cec9f415b539978827e",
         "type": "github"
       },
       "original": {
@@ -579,11 +896,11 @@
     },
     "nixunstable": {
       "locked": {
-        "lastModified": 1723991338,
+        "lastModified": 1729413321,
-        "narHash": "sha256-Grh5PF0+gootJfOJFenTTxDTYPidA3V28dqJ/WV7iis=",
+        "narHash": "sha256-I4tuhRpZFa6Fu6dcH9Dlo5LlH17peT79vx1y1SpeKt0=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "8a3354191c0d7144db9756a74755672387b702ba",
+        "rev": "1997e4aa514312c1af7e2bda7fad1644e778ff26",
         "type": "github"
       },
       "original": {
@@ -596,20 +913,20 @@
     "nixvimstable": {
       "inputs": {
         "devshell": "devshell",
-        "flake-compat": "flake-compat",
+        "flake-compat": "flake-compat_2",
-        "flake-parts": "flake-parts",
+        "flake-parts": "flake-parts_2",
         "git-hooks": "git-hooks",
         "home-manager": "home-manager_2",
         "nix-darwin": "nix-darwin",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_3",
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1723536338,
+        "lastModified": 1725350106,
-        "narHash": "sha256-1bSEOtZBsAeCkg5vdDbDgOT3z91K8L/KE2s7J9hLYHw=",
+        "narHash": "sha256-TaMMlI2KPJ3wCyxJk6AShOLhNuTeabHCnvYRkLBlEFs=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "0b6aa80acbcb8387f2a4affb3dd22960ac2899aa",
+        "rev": "0f2c31e6a57a83ed4e6fa3adc76749620231055d",
         "type": "github"
       },
       "original": {
@@ -622,21 +939,21 @@
     "nixvimunstable": {
       "inputs": {
         "devshell": "devshell_2",
-        "flake-compat": "flake-compat_3",
+        "flake-compat": "flake-compat_4",
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts_3",
         "git-hooks": "git-hooks_2",
         "home-manager": "home-manager_3",
         "nix-darwin": "nix-darwin_2",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_4",
         "nuschtosSearch": "nuschtosSearch",
         "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1723816538,
+        "lastModified": 1729602958,
-        "narHash": "sha256-h37ltjdifkd7iLtMtBXSBBeYSTuBEKMW6ClFoC7nReQ=",
+        "narHash": "sha256-eKGQKlj1oShfR6uqE1RjB4CgQ3DBrMS4VPrGPDKq1J4=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "00f32f0430f82c74919c72af84bc95bf5ae434e4",
+        "rev": "b076f006c6b0cc6644a651bd21d4449cc3e7e56d",
         "type": "github"
       },
       "original": {
@@ -648,11 +965,11 @@
     },
     "nurpkgs": {
       "locked": {
-        "lastModified": 1724159175,
+        "lastModified": 1729607740,
-        "narHash": "sha256-3z9wRL+h+gTVFtecCUGrRaW6nvPPAtBCIDE9KAmZj7c=",
+        "narHash": "sha256-t5KMIn74sJOQQGfn7W7oO7MppMJe2S2X8fvUZmRDjpU=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "0b86d5643d99e3982471f0d79e553871c6f35396",
+        "rev": "5d773635b50f6d3ab2af57d0e41dd8533c37238f",
         "type": "github"
       },
       "original": {
@@ -670,11 +987,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723367906,
+        "lastModified": 1728905062,
-        "narHash": "sha256-v1qA4WBGDI2uH/TVqRwuXSBP341W681psbzYJ8zrjog=",
+        "narHash": "sha256-W/lClt0bRgFRO0WFtytX/LEILpPNq+FOjIfESpkeu5c=",
         "owner": "NuschtOS",
         "repo": "search",
-        "rev": "6ca2c3ae05a915c160512bd41f6810f456c9b30d",
+        "rev": "f82d3e1c1c9d1eaeb91878519e2d27b27c66ce84",
         "type": "github"
       },
       "original": {
@@ -686,17 +1003,38 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "btc": "btc",
         "darwin": "darwin_2",
-        "flake-utils": "flake-utils",
+        "flake-parts": "flake-parts",
         "hm": "hm",
         "hmunstable": "hmunstable",
+        "hooks": "hooks",
         "nix23_05": "nix23_05",
         "nixstable": "nixstable",
         "nixunstable": "nixunstable",
         "nixvimstable": "nixvimstable",
         "nixvimunstable": "nixvimunstable",
         "nurpkgs": "nurpkgs",
-        "wsl": "wsl"
+        "vsext": "vsext",
+        "wsl": "wsl",
+        "zed": "zed"
+      }
+    },
+    "rust-analyzer-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1726443025,
+        "narHash": "sha256-nCmG4NJpwI0IoIlYlwtDwVA49yuspA2E6OhfCOmiArQ=",
+        "owner": "rust-lang",
+        "repo": "rust-analyzer",
+        "rev": "94b526fc86eaa0e90fb4d54a5ba6313aa1e9b269",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rust-lang",
+        "ref": "nightly",
+        "repo": "rust-analyzer",
+        "type": "github"
       }
     },
     "systems": {
@@ -759,6 +1097,21 @@
         "type": "github"
       }
     },
+    "systems_5": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
@@ -767,11 +1120,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723454642,
+        "lastModified": 1724833132,
-        "narHash": "sha256-S0Gvsenh0II7EAaoc9158ZB4vYyuycvMGKGxIbERNAM=",
+        "narHash": "sha256-F4djBvyNRAXGusJiNYInqR6zIMI3rvlp6WiKwsRISos=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "349de7bc435bdff37785c2466f054ed1766173be",
+        "rev": "3ffd842a5f50f435d3e603312eefa4790db46af5",
         "type": "github"
       },
       "original": {
@@ -788,11 +1141,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723454642,
+        "lastModified": 1729242555,
-        "narHash": "sha256-S0Gvsenh0II7EAaoc9158ZB4vYyuycvMGKGxIbERNAM=",
+        "narHash": "sha256-6jWSWxv2crIXmYSEb3LEVsFkCkyVHNllk61X4uhqfCs=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "349de7bc435bdff37785c2466f054ed1766173be",
+        "rev": "d986489c1c757f6921a48c1439f19bfb9b8ecab5",
         "type": "github"
       },
       "original": {
@@ -801,20 +1154,40 @@
         "type": "github"
       }
     },
+    "vsext": {
+      "inputs": {
+        "flake-compat": "flake-compat_5",
+        "flake-utils": "flake-utils_3",
+        "nixpkgs": "nixpkgs_5"
+      },
+      "locked": {
+        "lastModified": 1729561800,
+        "narHash": "sha256-LRRLzpS7Rh6AzWempfz6xRmv09m4WLyeRKXpILGUnGY=",
+        "owner": "nix-community",
+        "repo": "nix-vscode-extensions",
+        "rev": "ba02ecf164ec8da6f4d33d1f1e270b4a84252d60",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-vscode-extensions",
+        "type": "github"
+      }
+    },
     "wsl": {
       "inputs": {
-        "flake-compat": "flake-compat_4",
+        "flake-compat": "flake-compat_6",
-        "flake-utils": "flake-utils_3",
+        "flake-utils": "flake-utils_4",
         "nixpkgs": [
           "nixunstable"
         ]
       },
       "locked": {
-        "lastModified": 1713528946,
+        "lastModified": 1729494942,
-        "narHash": "sha256-IBQta+xrEaI2S5UmYrXcgV7Tu7rGLQu2V3TeJseLPSg=",
+        "narHash": "sha256-c/WV0R0WWuK2UAjTCGntaa+y1UVPsTUJZXqwwKxcmYs=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "63c1247e12f269396ed2df8cdec3aed1f0f3928c",
+        "rev": "f26ca94fdcfc1a3adfee70e4ed5e2d8b1bab4317",
         "type": "github"
       },
       "original": {
@@ -822,6 +1195,28 @@
         "repo": "NixOS-WSL",
         "type": "github"
       }
+    },
+    "zed": {
+      "inputs": {
+        "crane": "crane",
+        "fenix": "fenix",
+        "flake-compat": "flake-compat_7",
+        "nixpkgs": "nixpkgs_6"
+      },
+      "locked": {
+        "lastModified": 1728487939,
+        "narHash": "sha256-HdiEVRssMJmn+ifa0oWhHzRXB9L4oyji0DZ3PopHSoY=",
+        "owner": "zed-industries",
+        "repo": "zed",
+        "rev": "f6d974f3b148c2d4f28b4ed97b9b6352915faeed",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zed-industries",
+        "ref": "v0.156.x",
+        "repo": "zed",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -4,16 +4,31 @@
 {
   description = "Greg's machines!";
 
+  nixConfig = {
+    extra-substituters = [
+      "https://greg-hellings.cachix.org"
+      "https://cache.garnix.io"
+    ];
+    extra-trusted-public-keys = [
+      "greg-hellings.cachix.org-1:y01Jl/L5evlhxdnUW6n56AiI1k8g1wxWhTxJCe7XSco="
+      "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g"
+    ];
+  };
+
   inputs = {
     agenix = {
       url = "github:ryantm/agenix";
       inputs.nixpkgs.follows = "nixunstable";
     };
+    btc = {
+      url = "github:fort-nix/nix-bitcoin/release";
+    };
     darwin = {
       url = "github:lnl7/nix-darwin/master";
       inputs.nixpkgs.follows = "nixunstable";
     };
-		flake-utils.url = "github:numtide/flake-utils";
+    flake-parts.url = "github:hercules-ci/flake-parts";
+    hooks.url = "github:cachix/git-hooks.nix";
     hm = {
       url = "github:nix-community/home-manager/release-24.05";
       inputs.nixpkgs.follows = "nixstable";
@@ -28,81 +43,79 @@
     nixstable.url = "github:nixos/nixpkgs/nixos-24.05";
     nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
     nurpkgs.url = "github:nix-community/NUR";
+    vsext.url = "github:nix-community/nix-vscode-extensions";
     wsl = {
       url = "github:nix-community/NixOS-WSL";
       inputs.nixpkgs.follows = "nixunstable";
     };
+    zed.url = "github:zed-industries/zed/v0.156.x";
   };
 
-	outputs = {
+  outputs =
-		agenix,
+    { self, ... }@top:
-		darwin,
-		flake-utils,
-		hm,
-		hmunstable,
-		nix23_05,
-		nixstable,
-		nixunstable,
-		nurpkgs,
-		wsl,
-
-		self,
-		...}@inputs:
     let
       local_overlay = import ./overlays;
+      packages_overlay = (
+        _: prev:
+        (import ./pkgs {
+          inherit self;
+          pkgs = prev;
+        }).packages
+      );
       overlays = [
-			agenix.overlays.default
+        top.agenix.overlays.default
         local_overlay
-			nurpkgs.overlay
+        packages_overlay
+        top.nurpkgs.overlay
+        top.vsext.overlays.default
+        (_: _: { zed-editor = top.zed.packages.x86_64-linux.default; })
       ];
 
-	in {
+    in
-		#checks = {
+    top.flake-parts.lib.mkFlake { inputs = top; } {
-		#	x86_64-linux = {
+      systems = [
-		#		unstable = self.nixosConfigurations.jude.config.system.build.toplevel;
+        "aarch64-linux"
-		#		stable   = self.nixosConfigurations.linode.config.system.build.toplevel;
+        "x86_64-linux"
-		#	};
+        "aarch64-darwin"
-		#	aarch64-linux = {
-		#		unstable = self.nixosConfigurations.nixos.config.system.build.toplevel;
-		#	};
-		#};
-
-		nixosConfigurations = (import ./hosts { inherit inputs overlays; });
-
-		darwinConfigurations = (import ./darwin { inherit inputs overlays; });
-
-		homeConfigurations = (import ./home { inherit inputs overlays; });
-
-		devShells = (flake-utils.lib.eachSystemMap flake-utils.lib.allSystems (system: let
-			pkgs = import nixunstable { inherit system overlays; };
-		in {
-			default = pkgs.mkShell {
-				buildInputs = with pkgs; [
-					bashInteractive
-					curl
-					git
-					gnutar
-					gzip
-					inject
-					inject-darwin
-					tmux
-					vim
-					xonsh
       ];
-			};
+
-		}));
+      flake = {
+        nixosConfigurations = (import ./hosts { inherit top overlays; });
+
+        darwinConfigurations = (import ./darwin { inherit top overlays; });
+
+        homeConfigurations = (import ./home { inherit top overlays; });
 
         overlays = {
-			default = local_overlay;
+          default = packages_overlay;
+          local = local_overlay;
         };
 
         modules = import ./modules;
+      };
 
-		packages = {
+      perSystem =
-			x86_64-linux = rec {
+        {
-				default = iso-beta;
+          pkgs,
-				iso = self.nixosConfigurations.iso.config.system.build.isoImage;
+          self',
-				iso-beta = self.nixosConfigurations.iso-beta.config.system.build.isoImage;
+          system,
+          ...
+        }:
+        {
+          _module.args = {
+            pkgs = import top.nixstable { inherit system overlays; };
+          };
+
+          imports = [ ./pkgs ];
+
+          checks = import ./checks.nix {
+            inherit system;
+            inherit (top) hooks;
+          };
+
+          devShells = import ./shells.nix {
+            inherit self' pkgs;
+            inherit (top) nixvimunstable;
           };
         };
     };

hardware-configuration.nix

@@ -1,26 +1,35 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "thunderbolt"
+    "nvme"
+    "uas"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
+    device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
     fsType = "btrfs";
     options = [ "subvol=@" ];
   };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/B31C-C1F4";
+    device = "/dev/disk/by-uuid/B31C-C1F4";
     fsType = "vfat";
   };
 

home/default.nix

@@ -1,20 +1,22 @@
-{
+{ top, overlays, ... }:
-	inputs,
-	overlays,
-	...
-}:
 
 rec {
   greghellings =
     let
       system = "x86_64-linux";
-		pkgs = (import inputs.nixunstable { inherit system overlays; });
+      pkgs = (
-	in inputs.hmunstable.lib.homeManagerConfiguration {
+        import top.nixunstable {
+          inherit system overlays;
+          config.allowUnfree = true;
+        }
+      );
+    in
+    top.hmunstable.lib.homeManagerConfiguration {
       inherit pkgs;
       modules = [ ./home.nix ];
       extraSpecialArgs = {
-			inherit inputs;
+        inherit top;
-			nixvim = inputs.nixvimunstable;
+        nixvim = top.nixvimunstable;
         gui = false;
         gnome = false;
         host = "ivr";

home/home.nix

@@ -1,12 +1,11 @@
-{ pkgs, lib,
+{
-  inputs,
+  pkgs,
+  lib,
   host ? "most",
   nixvim,
-  ...}:
+  ...
+}:
 
-let
-	system = pkgs.system;
-in
 {
   nixpkgs.config.allowUnfreePredicate = (_: true);
   imports = [
@@ -14,15 +13,12 @@ in
     ./modules
   ] ++ lib.optionals (builtins.pathExists ./hosts/${host}) [ ./hosts/${host} ];
 
-
   programs.tmux = {
     enable = true;
     keyMode = "vi";
     terminal = "xterm-256color";
     customPaneNavigationAndResize = true;
-		extraConfig = (lib.strings.concatStringsSep "\n" [
+    extraConfig = (lib.strings.concatStringsSep "\n" [ "bind P paste-buffer" ]);
-			"bind P paste-buffer"
-		]);
   };
 
   home.stateVersion = "23.05";

home/hosts/exodus/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, config, ... }:
+{ pkgs, ... }:
 
 {
   greg = {
@@ -9,5 +9,7 @@
   };
   home.packages = with pkgs; [
     cargo
+    freeciv
+    #freeciv_qt
   ];
 }

home/hosts/icdm-root/default.nix

@@ -1,5 +1,4 @@
 { ... }:
 
 {
-
 }

home/hosts/ivr/default.nix

@@ -1,31 +1,45 @@
-{ pkgs, lib, inputs, ...}:
+{
+  pkgs,
+  lib,
+  top,
+  ...
+}:
 let
-	nix23 = import inputs.nix23_05 {
+  nix23 = import top.nix23_05 {
     inherit (pkgs.stdenv) system;
-		overlays = [ inputs.self.overlays.default ];
+    overlays = [ top.self.overlays.default ];
   };
-	py = nix23.python311.withPackages ( p: with p; [
+  py = nix23.python311.withPackages (
-		django
+    p: with p; [
-		djangorestframework
-		django-rapyd-modernauth
-		environs
-		mysqlclient
       pyyaml
       ruamel-yaml
       tox
-	]);
+    ]
+  );
   x = pkgs.xonsh.override {
-		extraPackages = (ps: [
+    extraPackages = (
+      ps: [
         pkgs.nur.repos.xonsh-xontribs.xonsh-direnv
         pkgs.nur.repos.xonsh-xontribs.xontrib-vox
-		]);
+        ps.xonsh-apipenv
+        pkgs.pipenv-ivr
+      ]
+    );
   };
-in {
+in
+{
   greg = {
     development = true;
+    gui = true;
     pypackage = py;
     vscodium = true;
   };
+
+  nixpkgs.config = {
+    allowUnfree = true;
+    permittedInsecurePackages = [ "jitsi-meet-1.0.8043" ];
+  };
+
   home = {
     packages = with pkgs; [
       aacs
@@ -33,20 +47,24 @@ in {
       bitwarden-cli
       direnv
       home-manager
-			insomnia
+      mysql-workbench
       pipenv-ivr
       poetry
+      robo3t
       x
     ];
-		file.".pip/pip.conf".text = (lib.strings.concatStringsSep "\n" [
+    file.".pip/pip.conf".text = (
+      lib.strings.concatStringsSep "\n" [
         "[global]"
         "retries = 1"
         "index-url = https://pypi.python.org/simple"
         "extra-index-url ="
         "    https://pypi.ivrtechnology.com/simple/"
         "    https://pypidev.ivrtechnology.com/simple/"
-		]);
+      ]
+    );
     username = "gregory.hellings";
     homeDirectory = lib.mkForce "/home/gregory.hellings";
   };
+  programs.tmux.shell = (lib.getExe x);
 }

home/hosts/jude/default.nix

@@ -9,7 +9,7 @@
     development = true;
     gui = true;
     sway = false;
-		gnome = true;
+    gnome = false;
     vscodium = true;
   };
 

home/hosts/work/default.nix

@@ -3,7 +3,5 @@
 {
   greg.vscodium.enable = true;
 
-	home.packages = with pkgs; [
+  home.packages = with pkgs; [ brew ];
-		brew
-	];
 }

home/modules/baseline/direnv.nix

@@ -1,8 +1,21 @@
-{ pkgs, ... }:
+{ ... }:
 
 {
   programs.direnv = {
     enable = true;
     nix-direnv.enable = true;
+    stdlib = ''
+      layout_poetry() {
+        if [[ ! -f pyproject.toml ]]; then
+          echo "No pyproject.toml found"
+          exit 1
+        fi
+
+        venv="$(dirname "$(poetry run which python)")"
+        export VIRTUAL_ENV="$(echo "$venv" |  rev | cut -d'/' -f2- | rev)"
+        export POETRY_ACTIVE=1
+        PATH_add "$venv"
+      }
+    '';
   };
 }

home/modules/baseline/git.nix

@@ -13,7 +13,9 @@
       amend = "commit --amend";
     };
     ignores = [
-			".*.swp" ".*.swo" ".*.swn" # vim
+      ".*.swp"
+      ".*.swo"
+      ".*.swn" # vim
       ".idea" # IntelliJ
       ".DS_Store" # Macs
       "Thumbs.db" # Windows

home/modules/baseline/ssh.nix

@@ -15,15 +15,18 @@
 
     matchBlocks =
       let
-			nas = { user = "admin"; };
+        nas = {
-			owned = { user = "greg"; };
+          user = "admin";
-		in {
+        };
+        owned = {
+          user = "greg";
+        };
+      in
+      {
         inherit nas;
 
         "*" = {
-				dynamicForwards = [ {
+          dynamicForwards = [ { port = 10240; } ];
-					port = 10240;
-				} ];
         };
 
         "10.42.1.4" = lib.hm.dag.entryBefore [ "10.42.*" ] nas;
@@ -32,11 +35,18 @@
         chronicles = nas;
         "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas;
 
-			gh = { user = "git"; hostname = "github.com"; };
+        gh = {
+          user = "git";
+          hostname = "github.com";
+        };
         "src" = {
           user = "gitlab";
           hostname = "git.thehellings.lan";
         };
+        ivr = {
+          user = "git";
+          hostname = "gitlab.com";
+        };
 
         "*.thehellings.lan" = owned;
         "10.42.*" = owned;

home/modules/baseline/vim.nix

@@ -1,126 +1,16 @@
-{ pkgs, ... }:
-
-let
-	vim-stabs = pkgs.vimUtils.buildVimPlugin {
-		name = "vim-stabs";
-		src = pkgs.fetchFromGitHub {
-			owner = "Thyrum";
-			repo = "vim-stabs";
-			rev = "4654d4e000680e1f608b40f155af08873446ed63";
-			sha256 = "0hi1c5zv38hwxbyrf11fz97r728jgbppz4is7fwzwhfrzhwbw0ga";
-		};
-	};
-
-	vim-xonsh = pkgs.vimUtils.buildVimPlugin {
-		name = "vim-xonsh";
-		src = pkgs.fetchFromGitHub {
-			owner = "meatballs";
-			repo = "vim-xonsh";
-			rev = "2028aac";
-			sha256 = "sha256-0+dqtlz8LeyOoSiS12rv8aLdzOMj31PuYAyDYWnpNzw=";
-		};
-	};
-in
 {
-	home.packages = with pkgs; [
+  config,
-		ansible-language-server
+  pkgs,
-		pyright
+  lib,
-	];
+  ...
+}:
 
-	programs.nixvim = {
+{
-		enable = true;
+  # The Hack font is used in the Fugitive sidebars
-		colorschemes.gruvbox.enable = true;
+  fonts.fontconfig.enable = true;
-		globals = {
+  home.packages = [ (pkgs.nerdfonts.override { fonts = [ "Hack" ]; }) ];
-			indent_guides_enable_on_vim_startup = 1;
-			nix_recommended_style = 0;
-		};
-		opts = {
-			background = "dark";
-			backup = false;
-			copyindent = true;
-			cursorline = true;
-			expandtab = false;
-			hidden = true;
-			hlsearch = true;
-			ignorecase = true;
-			lazyredraw = true;
-			list = true;
-			listchars = "tab:→ ,extends:→,precedes:←,trail:·,eol:¬";
-			mouse = "a";
-			number = true;
-			preserveindent = true;
-			relativenumber = true;
-			shiftwidth = 4;
-			showcmd = true;
-			showmatch = true;
-			signcolumn = "yes";
-			smartcase = true;
-			softtabstop = 4;
-			tabstop = 4;
-			# Setting for CtrlP
-			wildignore = "*.swp,*.pyc,*.class,.tox";
-			wrap = false;
-			writebackup = false;
-		};
-		keymaps = let
-			winMove = key: { mode = "n"; key = "<C-${key}>"; action = "<C-w>${key}<C-w><CR>"; };
-		in [ {
-			mode = "n";
-			key = "<C-e>";
-			action = "<Esc>:BufExplorer<CR>";
-		} {
-			mode = "n";
-			key = "<C-t>";
-			action = "<Esc>:NERDTreeToggle<CR>";
-		}
-			(winMove "h")
-			(winMove "j")
-			(winMove "k")
-			(winMove "l")
-		];
-		plugins = {
-			airline.enable = true;
-			cmp.enable = true;
-			direnv.enable = true;
-			gitgutter.enable = true;
-			fugitive.enable = true;
-			fzf-lua = {
-				enable = true;
-				iconsEnabled = true;
-				keymaps = {
-					"<C-o>" = {
-						action = "files";
-						settings = {
-							previewers.cat.cmd = "${pkgs.coreutils}/bin/cat";
-							winopts.height = 0.5;
-						};
-					};
-					"<C-p>" = {
-						action = "git_files";
-						settings = {
-							previewers.cat.cmd = "${pkgs.coreutils}/bin/cat";
-							winopts.height = 0.5;
-						};
-					};
-				};
-				profile = "fzf-vim";
-			};
-			notify.enable = true;
-		};
-		extraConfigLua = builtins.replaceStrings [ "@git@" ] [ "${pkgs.git}/bin/git" ] (builtins.readFile ./vim/extra.lua);
-		extraConfigVim = builtins.readFile ./vim/extra.vimrc;
-		extraPlugins = with pkgs.vimPlugins; [
-			bufexplorer
-			nerdtree
-			nvim-web-devicons  # Be sure to install Hack Nerd Font and set it to your term default: https://gist.github.com/matthewjberger/7dd7e079f282f8138a9dc3b045ebefa0
-			packer-nvim
 
-			context-vim
+  programs.nixvim = (import ./vim/config.nix { inherit config pkgs lib; }) // {
-			vim-flake8
+    enable = true;
-			vim-indent-guides
-			vim-xonsh
-		];
-		viAlias = true;
-		vimAlias = true;
   };
 }

home/modules/baseline/vim/config.nix

@@ -0,0 +1,180 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  vim-xonsh = pkgs.vimUtils.buildVimPlugin {
+    name = "vim-xonsh";
+    src = pkgs.fetchFromGitHub {
+      owner = "meatballs";
+      repo = "vim-xonsh";
+      rev = "929f35e";
+      hash = "sha256-ugHLu2Z9bTtQsIp4FQPKxgjVe9oZNjfQYrP+aHu+/uU=";
+    };
+  };
+in
+{
+  colorschemes.gruvbox.enable = true;
+  globals = {
+    indent_guides_enable_on_vim_startup = 1;
+    nix_recommended_style = 0;
+  };
+  opts = {
+    background = "dark";
+    backup = false;
+    copyindent = true;
+    cursorline = true;
+    expandtab = false;
+    hidden = true;
+    hlsearch = true;
+    ignorecase = true;
+    lazyredraw = true;
+    list = true;
+    listchars = "tab:→ ,extends:→,precedes:←,trail:·,eol:¬";
+    mouse = "a";
+    number = true;
+    preserveindent = true;
+    relativenumber = true;
+    shiftwidth = 4;
+    showcmd = true;
+    showmatch = true;
+    signcolumn = "yes";
+    smartcase = true;
+    softtabstop = 4;
+    tabstop = 4;
+    # Setting for CtrlP
+    wildignore = "*.swp,*.pyc,*.class,.tox";
+    wrap = false;
+    writebackup = false;
+  };
+  keymaps =
+    let
+      winMove = key: {
+        mode = "n";
+        key = "<C-${key}>";
+        action = "<C-w>${key}<C-w><CR>";
+      };
+    in
+    [
+      {
+        mode = "n";
+        key = "<C-e>";
+        action = "<Esc>:BufExplorer<CR>";
+      }
+      {
+        mode = "n";
+        key = "<C-t>";
+        #action = "<Esc>:NERDTreeToggle<CR>";
+        action = "<Esc>:Neotree toggle<CR>";
+      }
+      {
+        mode = "n";
+        key = "<C-g>";
+        action = "<Esc>:Git<CR>";
+      }
+      (winMove "h")
+      (winMove "j")
+      (winMove "k")
+      (winMove "l")
+    ];
+  plugins = {
+    airline.enable = true;
+    cmp = {
+      enable = true;
+      autoEnableSources = true;
+      settings = {
+        sources = [
+          { name = "nvim_lsp"; }
+          {
+            name = "buffer";
+            group_index = 2;
+          }
+          {
+            name = "copilot-vim";
+            group_index = 2;
+          }
+          {
+            name = "path";
+            gruop_index = 3;
+          }
+        ];
+        mapping = {
+          "<C-Space>" = "cmp.mapping.complete()";
+          "<CR>" = "cmp.mapping.confirm({ select = true })";
+          "<C-f>" = "cmp.mapping.select_next_item()";
+          "<C-b>" = "cmp.mapping.select_prev_item()";
+          "<C-c>" = "cmp.mapping.abort()";
+        };
+      };
+    };
+    copilot-vim = {
+      enable = (config.nixpkgs.config ? "allowUnfree" && config.nixpkgs.config.allowUnfree);
+      settings.workspace_folders = [ "~/src/ivr" ];
+    };
+    direnv.enable = true;
+    gitgutter.enable = true;
+    fugitive.enable = true;
+    fzf-lua = {
+      enable = true;
+      keymaps = {
+        "<C-o>" = {
+          action = "files";
+          settings = {
+            previewers.cat.cmd = "${pkgs.coreutils}/bin/cat";
+            winopts.height = 0.5;
+          };
+        };
+        "<C-p>" = {
+          action = "git_files";
+          settings = {
+            previewers.cat.cmd = "${pkgs.coreutils}/bin/cat";
+            winopts.height = 0.5;
+          };
+        };
+      };
+      profile = "fzf-vim";
+    };
+    lsp = {
+      enable = true;
+      servers = {
+        ansiblels.enable = true;
+        cmake.enable = true;
+        gopls.enable = true;
+        html.enable = true;
+        nixd.enable = true;
+        pylsp.enable = true;
+        pyright.enable = true;
+        rust_analyzer = {
+          # No need to have these installed on every one of my systems
+          installCargo = false;
+          installRustc = false;
+          enable = true;
+        };
+        terraformls.enable = true;
+      };
+    };
+    neo-tree.enable = true;
+    notify.enable = true;
+  } // (if (lib.versionAtLeast lib.version "24.11") then { web-devicons.enable = true; } else { });
+  userCommands = {
+    Ggr = {
+      command = "Ggrep! <q-args> | cw | redraw!";
+      nargs = "+";
+    };
+  };
+  extraConfigLua = builtins.replaceStrings [ "@git@" ] [ "${pkgs.git}/bin/git" ] (
+    builtins.readFile ./extra.lua
+  );
+  extraConfigVim = builtins.readFile ./extra.vimrc;
+  extraPlugins = with pkgs.vimPlugins; [
+    bufexplorer
+
+    context-vim
+    vim-indent-guides
+    vim-xonsh
+  ];
+  viAlias = true;
+  vimAlias = true;
+}

home/modules/baseline/xonsh.nix

@@ -1,6 +1,16 @@
-{ pkgs, config, lib, ... }:
+{ pkgs, config, ... }:
 
 {
+  # Programs that are used in the settings file
+  home.packages = with pkgs; [
+    bitwarden-cli
+    copier
+    git
+    gnused
+    nix-output-monitor
+    nvd
+  ];
+
   programs.xonsh = {
     enable = true;
 
@@ -35,18 +45,22 @@
       # Python related ones
       ac = "vox activate";
       d = "vox deactivate";
+      s = "nix run \".#runserver\"";
 
       # Nix related ones
       gl-nging = "sudo nixos-container run gitlab -- systemctl restart nginx";
-			nixup = "nix flake lock --update-input";
+      nb = "nix build -L";
-			nixtest = "nixpkgs-review rev HEAD";
       nixdu = "sudo nix-store --gc --print-roots | egrep -v r\"^(/nix/var|/run/\\w+-system|\\{memory|/proc)\"";
+      nixtest = "nixpkgs-review rev HEAD";
+      nixup = "nix flake lock --update-input";
+      stable = "nix flake lock --update-input nixpkgs --update-input hm --update-input nixvimstable";
+      unstable = "nix flake lock --update-input nixunstable --update-input hmunstable --update-input nixvimunstable --update-input nurpkgs --update-input vsext --update-input wsl";
+      updateScript = "nix-shell maintainers/scripts/update.nix --argstr package";
 
       # General
       gh-personal = "$GH_CONFIG_DIR=\"${config.home.homeDirectory}/.config/gh/personal\" gh";
       ls = "ls --color";
       ll = "ls -l --color";
-			tf = "terraform";
 
       # Tailscale related ones
       tsup = "sudo tailscale up";
@@ -64,7 +78,9 @@
     };
 
     configHeader = builtins.readFile ./xonsh_header.xsh;
-		configFooter = (builtins.readFile ./xonsh_footer.xsh) + (builtins.concatStringsSep "\n" [
+    configFooter =
+      (builtins.readFile ./xonsh_footer.xsh)
+      + (builtins.concatStringsSep "\n" [
         "with open('${pkgs.stdenv.cc}/nix-support/dynamic-linker', 'r') as fp:"
         "    $NIX_LD = fp.read().strip()"
       ]);

home/modules/baseline/xonsh_footer.xsh

@@ -1,6 +1,6 @@
-# vim: set ft=python :
+# vim: set ft=xonsh :
 
-from tempfile import NamedTemporaryFile
+from tempfile import NamedTemporaryFile, TemporaryDirectory
 
 def bw_unlock():
     """Unlocks the BitWarden CLI and adds the resulting session code to the
@@ -37,17 +37,15 @@ def _ivr(args):
     vpn("350Main", "IVR Technology")
 aliases['ivr'] = _ivr
 
+def _ivr2(args):
+    vpn("gregory_hellings@ra.ivrtechnology.com", "IVR Technology")
+aliases['ivr2'] = _ivr2
+
 def _glrestart(args):
     sudo nixos-container run gitlab -- systemctl restart gitlab
     sudo nixos-container run gitlab -- systemctl restart nginx
 aliases['glrestart'] = _glrestart
 
-def _cfetch(args):
-    bw_unlock()
-    $CIRCLECI_CLI_TOKEN=$(bw get password CircleCI) 
-    compass workspace exec bazel run src/go/compass.com/tools/circleci_results_cache/fetch/cmd/fetch:fetch
-aliases['cfetch'] = _cfetch
-
 def _aws_creds(args):
     $AWS_ACCESS_KEY_ID=$(bw get username "AWS Access Key")
     $AWS_SECRET_ACCESS_KEY=$(bw get password "AWS Access Key")
@@ -55,10 +53,17 @@ aliases['aws_creds'] = _aws_creds
 
 def _rebuild(args):
     system = uname()
+    hostname = system.nodename
     if system.sysname == 'Darwin':
         darwin-rebuild --flake ~/.config/darwin switch
     else:
-        sudo nixos-rebuild switch
+        with TemporaryDirectory() as td:
+            pushd @(td)
+            nom build f"/etc/nixos#nixosConfigurations.{hostname}.config.system.build.toplevel"
+            if g`result`:
+                nvd diff /run/current-system result
+                sudo result/bin/switch-to-configuration switch
+            popd
 aliases['rebuild'] = _rebuild
 
 def _yaml2json(args, stdin=None, stdout=None):

home/modules/development.nix

@@ -1,17 +1,29 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   packages = with pkgs; [
+    bruno # but let's not talk about it
     cargo
+    gh-copilot
     mariadb
+    nix-eval-jobs
+    nix-fast-build
+    nix-output-monitor
     nix-update
     nixfmt-rfc-style
     nixpkgs-review
+    nodejs
     process-compose
+    zed-editor
   ];
-in with lib; {
+in
+with lib;
+{
   options.greg.development = mkEnableOption "Setup necessary development packages";
 
-	config = mkIf config.greg.development {
+  config = mkIf config.greg.development { home.packages = packages; };
-		home.packages = packages;
-	};
 }

home/modules/gnome.nix

@@ -1,13 +1,18 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 let
-	gv = lib.hm.gvariant;
   cfg = config.greg.gnome;
-
+in
-in {
+{
   options.greg.gnome = lib.mkEnableOption "Enable Gnome support and settings";
 
-	config = (lib.mkIf cfg {
+  config = (
+    lib.mkIf cfg {
       programs.gnome-terminal = lib.mkIf (pkgs.system != "x86_64-darwin") {
         enable = true;
         showMenubar = true;
@@ -67,7 +72,7 @@ in {
           favorite-apps = [
             "org.gnome.Calendar.desktop"
             "org.gnome.Nautilus.desktop"
-					"org.gnome.Console.desktop"
+            "org.gnome.Terminal.desktop"
             "firefox.desktop"
             "vlc.desktop"
           ];
@@ -113,9 +118,16 @@ in {
           show-toolbar = true;
         };
         "org/virt-manager/virt-manager/connections" = {
-				autoconnect = [ "qemu:///session" "qemu:///system" ];
+          autoconnect = [
-				uris = [ "qemu:///session" "qemu:///system" ];
+            "qemu:///session"
+            "qemu:///system"
+          ];
+          uris = [
+            "qemu:///session"
+            "qemu:///system"
+          ];
         };
       };
-	});
+    }
+  );
 }

home/modules/gui.nix

@@ -1,24 +1,32 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 let
   cfg = config.greg.gui;
 
-	excludes = systems: opts: (
+  excludes = systems: opts: (if (builtins.all (x: pkgs.system != x) systems) then opts else [ ]);
-		if ( builtins.all (x: pkgs.system != x) systems ) then opts else []
-	);
-
-	# For now, we ignore this and don't install it
-	ffPkgs = pkgs.firefox.override { cfg.enableGnomeExtensions = true; };
 
   vars = {
     XDG_CURRENT_DESKTOP = "GNOME";
   };
-in {
+in
+{
   options.greg.gui = lib.mkEnableOption "Enable GUI programs";
 
-	config = (lib.mkIf cfg {
+  config = (
+    lib.mkIf cfg {
       # These packages are Linux only
-		home.packages = with pkgs; ( excludes ["x86_64-darwin" "aarch64-darwin"]
+      home.packages =
+        with pkgs;
+        (excludes
+          [
+            "x86_64-darwin"
+            "aarch64-darwin"
+          ]
           [
             cdrtools
             element-desktop
@@ -26,10 +34,17 @@ in {
             qpwgraph
             vlc
             x265
-		]) ++
+          ]
+        )
+        ++
 
           # x86_64-linux only
-		( excludes ["x86_64-darwin" "aarch64-darwin" "aarch64-linux"]
+          (excludes
+            [
+              "x86_64-darwin"
+              "aarch64-darwin"
+              "aarch64-linux"
+            ]
             [
               bitwarden
               discord
@@ -39,11 +54,12 @@ in {
               #logseq
               nextcloud-client
               slack
-		]) ++
+            ]
+          )
+        ++
 
           # Items that are not supported on ARM/Linux
-		( excludes ["aarch64-linux"]
+          (excludes [ "aarch64-linux" ] [
-		[
             onlyoffice-bin
             synology-drive-client
             zoom-us
@@ -51,12 +67,75 @@ in {
 
       programs.firefox = {
         enable = (!pkgs.stdenv.hostPlatform.isDarwin);
-			package = ffPkgs;
+        package = pkgs.firefox-bin;
+        policies = {
+          DisableAppUpdate = true;
+        };
         profiles = {
           default = {
-					isDefault = true;
+            bookmarks = import ./gui/bookmarks.nix;
             id = 0;
-					search.default = "DuckDuckGo";
+            isDefault = true;
+            search = {
+              default = "DuckDuckGo";
+              force = true;
+              engines = {
+                Google.metaData.alias = "@g";
+                "Nix Packages" = {
+                  urls = [
+                    {
+                      template = "https://search.nixos.org/packages";
+                      params = [
+                        {
+                          name = "type";
+                          value = "packages";
+                        }
+                        {
+                          name = "query";
+                          value = "{searchTerms}";
+                        }
+                      ];
+                    }
+                  ];
+                  icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
+                  definedAliases = [ "@np" ];
+                };
+                "Nix Options" = {
+                  urls = [
+                    {
+                      template = "https://search.nixos.org/options";
+                      params = [
+                        {
+                          name = "type";
+                          value = "packages";
+                        }
+                        {
+                          name = "query";
+                          value = "{searchTerms}";
+                        }
+                      ];
+                    }
+                  ];
+                  icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
+                  definedAliases = [ "@no" ];
+                };
+                "Noogle" = {
+                  urls = [
+                    {
+                      template = "https://noogle.dev/q";
+                      params = [
+                        {
+                          name = "term";
+                          value = "{searchTerms}";
+                        }
+                      ];
+                    }
+                  ];
+                  icon = "${pkgs.nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake.svg";
+                  definedAliases = [ "@nl" ];
+                };
+              };
+            };
             settings = {
               "app.update.auto" = false;
               "browser.ctrlTab.sortByRecentlyUsed" = true;
@@ -72,6 +151,7 @@ in {
               foxyproxy-standard
               multi-account-containers
               octotree
+              okta-browser-plugin
               refined-github
               tree-style-tab
               ublock-origin
@@ -83,5 +163,6 @@ in {
       # This is supposed to be in support of Firefox, but I dunno...
       programs.bash.sessionVariables = vars;
       programs.xonsh.sessionVariables = vars;
-	});
+    }
+  );
 }

home/modules/gui/bookmarks.nix

@@ -0,0 +1,209 @@
+[
+  {
+    name = "Toolbar";
+    toolbar = true;
+    bookmarks = [
+      {
+        name = "Ansible";
+        bookmarks = [
+          {
+            name = "Collection Index";
+            url = "https://docs.ansible.com/ansible/latest/collections/index.html";
+          }
+        ];
+      }
+      {
+        name = "Church";
+        bookmarks = [
+          {
+            name = "DC4K";
+            url = "https://www.dc4k.org/leaderzone/articles";
+          }
+        ];
+      }
+      {
+        name = "IVR";
+        bookmarks = [
+          {
+            name = "Dev";
+            bookmarks = [
+              {
+                name = "Core Survey";
+                url = "https://webdev5.ivrtechnology.com/coreservices/survey/admin/";
+              }
+              {
+                name = "Audio";
+                url = "https://apidev1.ivrtechnology.com/coreservices/audio/admin/";
+              }
+              {
+                name = "Tower";
+                url = "https://towerrd1.ivrtechnology.com";
+              }
+            ];
+          }
+          {
+            name = "HC";
+            bookmarks = [
+              {
+                name = "Audio";
+                url = "https://hcweb3.ivrtechnology.com/coreservices/audio/admin/";
+              }
+              {
+                name = "Survey";
+                url = "https://hcweb2.ivrtechnology.com/coreservices/survey/admin/";
+              }
+            ];
+          }
+          {
+            name = "PCI";
+            bookmarks = [
+              {
+                name = "Audio";
+                url = "https://pciweb3.ivrtechnology.com/coreservices/audio/admin/";
+              }
+            ];
+          }
+          {
+            name = "Processes";
+            bookmarks = [
+              {
+                name = "Change Management";
+                url = "https://ivrtg.atlassian.net/wiki/spaces/ITS/pages/13094842/Executing+Change+Management";
+              }
+              {
+                name = "Okta";
+                url = "https://engagesmart.okta.com/";
+              }
+              {
+                name = "DB Request";
+                url = "https://ivrtg.aha.io/develop/features/INFR-1073";
+              }
+              {
+                name = "Server list";
+                url = "https://ivrtg.atlassian.net/wiki/spaces/ITS/pages/13009166/350+Main";
+              }
+            ];
+          }
+        ];
+      }
+      {
+        name = "Katie";
+        bookmarks = [
+          {
+            name = "Sports Forms";
+            url = "https://midlothianisd.rankone.com/New/NewStudentList.aspx";
+          }
+          {
+            name = "Skyward";
+            url = "https://skyward.iscorp.com/MidlothianISDTXStuSTS/Session/Signin?area=Home&controller=Home&action=Index&logoutreason=TimedOut";
+          }
+        ];
+      }
+      {
+        name = "Nix";
+        bookmarks = [
+          {
+            name = "Package Versions";
+            url = "https://lazamar.co.uk/nix-versions/?channel=nixpkgs-unstable&package=python3";
+          }
+          {
+            name = "Channel status";
+            url = "https://status.nixos.org/";
+          }
+          {
+            name = "Home Manager options";
+            url = "https://nix-community.github.io/home-manager/options.xhtml";
+          }
+          {
+            name = "Flake Parts";
+            url = "https://community.flake.parts/";
+          }
+          {
+            name = "Language ref";
+            url = "https://nix.dev/manual/nix/latest/language/index.html";
+          }
+          {
+            name = "Builtin functions";
+            url = "https://nix.dev/manual/nix/latest/language/builtins.html";
+          }
+          {
+            name = "Nixpkgs functions";
+            url = "https://ryantm.github.io/nixpkgs/functions/library/strings/#sec-functions-library-strings";
+          }
+          {
+            name = "Noogle";
+            url = "https://noogle.dev/";
+          }
+          {
+            name = "NUR search";
+            url = "https://nur.nix-community.org/";
+          }
+        ];
+      }
+      {
+        name = "Rust";
+        bookmarks = [
+          {
+            name = "Learn Rust";
+            url = "https://www.rust-lang.org/learn";
+          }
+          {
+            name = "Rust by Example";
+            url = "https://doc.rust-lang.org/rust-by-example/hello.html";
+          }
+          {
+            name = "Iced";
+            url = "https://docs.rs/iced/latest/iced/";
+          }
+        ];
+      }
+      {
+        name = "Shopping";
+        bookmarks = [
+          {
+            name = "Cables";
+            url = "https://www.pchcables.com";
+          }
+        ];
+      }
+      {
+        name = "SubTo";
+        bookmarks = [
+          {
+            name = "Kajabi";
+            url = "https://www.subtocourse.com/login";
+          }
+          {
+            name = "SubTo Fund";
+            url = "https://frontend.koreconx.com/auth/login";
+          }
+          {
+            name = "Creive Title";
+            url = "https://getcreativetitle.com/";
+          }
+          {
+            name = "REI Scripts";
+            url = "https://reiconveyorbelt.com/no-excuses/";
+          }
+        ];
+      }
+      {
+        name = "Tools";
+        bookmarks = [
+          {
+            name = "Password Hash";
+            url = "https://unix4lyfe.org/crypt/";
+          }
+          {
+            name = "Keymap editor";
+            url = "https://nickcoutsos.github.io/keymap-editor/";
+          }
+          {
+            name = "Bitcoin dashboard";
+            url = "http://hosea.home:60845";
+          }
+        ];
+      }
+    ];
+  }
+]

home/modules/python.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 {
   options.greg.pypackage = lib.mkOption {
     description = "Enable Gnome support and settings";

home/modules/sway.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 let
   cfg = config.greg.sway;
@@ -9,7 +14,8 @@ let
   term = "${pkgs.alacritty}/bin/alacritty";
   msg = "${pkgs.sway}/bin/swaymsg";
   sleep = "${pkgs.coreutils}/bin/sleep";
-	workstation1 = pkgs.writeScriptBin "workstation1" (builtins.concatStringsSep "\n" [
+  workstation1 = pkgs.writeScriptBin "workstation1" (
+    builtins.concatStringsSep "\n" [
       "${msg} \"workspace 1 ; exec ${pkgs.firefox}/bin/firefox ; split horizontal ; exec ${pkgs.element-desktop}/bin/element-desktop \""
       "${sleep} 1"
       "${msg} '[app_id=\"firefox\"]' move left"
@@ -18,20 +24,27 @@ let
       "${sleep} 0.3"
       "${msg} '[app_id=\"Alacritty\" workspace=\"1\"]' move right"
       "${msg} '[app_id=\"firefox\"]' resize grow width 300 px"
-	]);
+    ]
-	workstation2 = pkgs.writeScriptBin "workstation2" (builtins.concatStringsSep "\n" [
+  );
+  workstation2 = pkgs.writeScriptBin "workstation2" (
+    builtins.concatStringsSep "\n" [
       "${sleep} 5"
       "${msg} \"workspace 2 ; exec ${term} ; layout tabbed\""
-	]);
+    ]
-in {
+  );
+in
+{
   options.greg.sway = lib.mkEnableOption "Enable Sway support and settings";
 
-	config = (lib.mkIf cfg {
+  config = (
+    lib.mkIf cfg {
       programs.swaylock.enable = true;
 
-		wayland.windowManager.sway = let
+      wayland.windowManager.sway =
+        let
           mod = config.wayland.windowManager.sway.config.modifier;
-		in {
+        in
+        {
           enable = true;
           config = rec {
             #fonts.size = 10.0;
@@ -61,9 +74,7 @@ in {
               { command = "${workstation2}/bin/workstation2"; }
             ];
           };
-			extraOptions = [
+          extraOptions = [ "--unsupported-gpu" ];
-				"--unsupported-gpu"
-			];
           extraSessionCommands = ''
             export WLR_NO_HARDWARE_CURSORS=1
           '';
@@ -99,5 +110,6 @@ in {
         xorg.xmodmap
         xxdiff
       ];
-	});
+    }
+  );
 }

home/modules/vscodium.nix

@@ -1,33 +1,63 @@
-{ pkgs, config, lib, ... }:
+{
+  pkgs,
+  config,
+  lib,
+  top,
+  ...
+}:
 
 let
   cfg = config.greg.vscodium;
-in {
+in
+{
   options.greg.vscodium = lib.mkEnableOption "Enable installation of VSCodium on the host";
 
   config = lib.mkIf cfg {
     home.packages = with pkgs; [
       buildifier
       gopls
+      nixd # nix language server
     ];
 
     # An alternative editor to vim, when I need it for some things
     programs.vscode = {
       enable = true;
       package = pkgs.vscodium;
-			extensions = with pkgs.vscode-extensions; [
+      extensions = with top.vsext.extensions."${pkgs.stdenv.system}".vscode-marketplace; [
         arrterian.nix-env-selector
         asvetliakov.vscode-neovim
-				bungcip.better-toml
+        batisteo.vscode-django
+        donjayamanne.python-environment-manager
         golang.go
+        kevinrose.vsc-python-indent
         jnoortheen.nix-ide
         mkhl.direnv
         ms-python.python
+        njpwerner.autodocstring
         rust-lang.rust-analyzer
+        tamasfe.even-better-toml
+        vadimcn.vscode-lldb
         vscjava.vscode-java-test
         vscjava.vscode-java-dependency
         vscjava.vscode-java-debug
+        wholroyd.jinja
       ];
+      userSettings = {
+        "direnv.restart.automatic" = true;
+        "direnv.path.executable" = (lib.getExe pkgs.direnv);
+        "extensions.autoUpdate" = false;
+        "extensions.experimental.affinity" = {
+          "asvetliakov.vscode-neovim" = 1;
+        };
+        "git.openRepositoryInParentFolders" = "always";
+        "search.exclude" = {
+          "**/.tox" = true;
+        };
+        "terminal.integrated.defaultProfile.linux" = "tmux";
+        "vscode-neovim.neovimInitVimPaths.darwin" = "~/.config/nvim/init.lua";
+        "vscode-neovim.neovimInitVimPaths.linux" = "~/.config/nvim/init.lua";
+        "workbench.settings.applyToAllProfiles" = [ "direnv.path.executable" ];
+      };
     };
   };
 }

home/modules/xonsh.nix

@@ -1,9 +1,11 @@
-{ config, pkgs, lib, ... }:
+{ config, lib, ... }:
 
 let
   cfg = config.programs.xonsh;
 
-in with lib; {
+in
+with lib;
+{
   options = {
     programs.xonsh = {
       enable = mkEnableOption "Enable the xonsh program";
@@ -11,7 +13,9 @@ in with lib; {
       sessionVariables = mkOption {
         type = types.attrs;
         default = { };
-				example = { XONSH_TRACE_SUBPROC = true; };
+        example = {
+          XONSH_TRACE_SUBPROC = true;
+        };
         description = ''
           Environment variables that will be set for the Xonsh session.
         '';
@@ -58,28 +62,30 @@ in with lib; {
 
   config =
     let
-		shortAliases = concatStringsSep "\n" (
+      shortAliases = concatStringsSep "\n" (mapAttrsToList (k: v: "aliases['${k}']=r'${v}'") cfg.aliases);
-			mapAttrsToList (k: v: "aliases['${k}']=r'${v}'") cfg.aliases
-		);
 
-		listToPythonList = let
+      listToPythonList =
-			listInternals = args:
+        let
-			concatStringsSep "\n" (map (v: "'${v}'") args);
+          listInternals = args: concatStringsSep "\n" (map (v: "'${v}'") args);
-		in list: "[${listInternals list}]";
+        in
+        list: "[${listInternals list}]";
 
       sessionVars = concatStringsSep "\n" (
-			mapAttrsToList (k: v:
+        mapAttrsToList (
+          k: v:
           if builtins.typeOf v == "string" then
             "\$${k} = '${v}'"
           else if builtins.typeOf v == "list" then
             "\$${k} = ${listToPythonList}"
           else if builtins.typeOf v == "int" then
             "\$${k} = ${toString v}"
-				else ""
+          else
+            ""
         ) cfg.sessionVariables
       );
 
-	in mkIf cfg.enable {
+    in
+    mkIf cfg.enable {
 
       home.file.".xonshrc".text = ''
         ${cfg.configHeader}

hosts/default.nix

@@ -1,30 +1,34 @@
-{ inputs, overlays, ... }:
+{ top, overlays, ... }:
 let
-	wsl = args: (unstable (args // { extraMods = [ inputs.wsl.nixosModules.wsl ]; }));
+  wsl = args: (unstable (args // { extraMods = [ top.wsl.nixosModules.wsl ]; }));
-	unstable = args: (machine (args // {
+  unstable =
-		channel = inputs.nixunstable;
+    args:
-		hm = inputs.hmunstable;
+    (machine (
-		nixvim = inputs.nixvimunstable;
+      args
-	}));
+      // {
-	machine = {
+        channel = top.nixunstable;
-		channel ? inputs.nixstable,
+        hm = top.hmunstable;
+        nixvim = top.nixvimunstable;
+      }
+    ));
+  machine =
+    {
+      channel ? top.nixstable,
       extraMods ? [ ],
       name,
       system ? "x86_64-linux",
-		hm ? inputs.hm,
+      hm ? top.hm,
-		nixvim ? inputs.nixvimstable,
+      nixvim ? top.nixvimstable,
     }:
     let
-		nixpkgs = import channel {
+      nixpkgs = import channel { inherit system; };
+    in
+    channel.lib.nixosSystem {
       inherit system;
+      specialArgs = {
+        inherit nixpkgs top overlays;
+        inherit (top) self;
       };
-		# Use this to include modules directly from a repo
-		nurNoPkg = import inputs.nurpkgs {
-			nurpkgs = nixpkgs;
-		};
-	in channel.lib.nixosSystem {
-		inherit system;
-		specialArgs = { inherit nixpkgs inputs overlays; };
       modules = [
         {
           nixpkgs.overlays = overlays;
@@ -33,21 +37,22 @@ let
             useUserPackages = true;
             users.greg = import ../home/home.nix;
             extraSpecialArgs = {
-						inherit inputs overlays nixvim;
+              inherit top overlays nixvim;
               home = "/home/greg";
               host = name;
             };
             backupFileExtension = "bkp";
           };
         }
-			inputs.agenix.nixosModules.default
+        top.agenix.nixosModules.default
         hm.nixosModules.home-manager
-			inputs.self.modules.nixosModule
+        top.self.modules.nixosModule
-			inputs.nurpkgs.nixosModules.nur
+        top.nurpkgs.nixosModules.nur
         ./${name}
       ] ++ extraMods;
     };
-in {
+in
+{
   genesis = machine { name = "genesis"; };
   exodus = unstable { name = "exodus"; };
   jude = unstable { name = "jude"; };
@@ -59,7 +64,13 @@ in {
   iso = machine { name = "iso"; };
   iso-beta = unstable { name = "iso"; };
   # nix build '.#nixosConfigurations.wsl.config.system.build.installer'
-	nixos = wsl { name = "wsl"; system = "aarch64-linux"; };
+  nixos = wsl {
+    name = "wsl";
+    system = "aarch64-linux";
+  };
   # nix build '.#nixosConfigurations.wsl-aarch.config.system.build.installer'
-	nixos-arm = wsl { name = "wsl"; system = "aarch64-linux"; };
+  nixos-arm = wsl {
+    name = "wsl";
+    system = "aarch64-linux";
+  };
 }

hosts/exodus/default.nix

@@ -1,20 +1,26 @@
-{ pkgs, config, ... }:
+{ config, ... }:
 
 {
-	imports = [
+  imports = [ ./hardware-configuration.nix ];
-		./hardware-configuration.nix
-		../jude/printing.nix
-	];
 
-	boot.loader = {
+  boot = {
+    loader = {
       systemd-boot.enable = true;
       efi.canTouchEfiVariables = true;
     };
+    binfmt.emulatedSystems = [
+      "i686-linux"
+      "aarch64-linux"
+    ];
+  };
+
+  nix.settings.extra-platforms = config.boot.binfmt.emulatedSystems;
 
   networking.hostName = "exodus";
   greg = {
     home = true;
     gnome.enable = true;
+    print.enable = true;
     tailscale.enable = true;
     vmdev = {
       enable = true;

hosts/exodus/hardware-configuration.nix

@@ -1,26 +1,35 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "thunderbolt"
+    "nvme"
+    "uas"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
+    device = "/dev/disk/by-uuid/607b933f-2967-4652-b478-4d8e9aa38a0d";
     fsType = "btrfs";
     options = [ "subvol=@" ];
   };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/B31C-C1F4";
+    device = "/dev/disk/by-uuid/B31C-C1F4";
     fsType = "vfat";
   };
 

hosts/genesis/acme.nix

@@ -1,10 +1,18 @@
-{ pkgs, config, lib, ... }:
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
 
 let
   address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address;
   root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt);
-	intermediate_ca = pkgs.writeText "intermediate_ca.crt" (builtins.readFile ../../ca/intermediate_ca.crt);
+  intermediate_ca = pkgs.writeText "intermediate_ca.crt" (
-in {
+    builtins.readFile ../../ca/intermediate_ca.crt
+  );
+in
+{
   age.secrets.acme_password = {
     file = ../../secrets/acme_password.age;
   };
@@ -12,7 +20,10 @@ in {
     file = ../../secrets/ca/intermediate_key.age;
   };
   age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age;
-	systemd.services.step-ca.serviceConfig.Environment = lib.mkForce ["STEPDEBUG=1" "HOME=%S/step-ca"];
+  systemd.services.step-ca.serviceConfig.Environment = lib.mkForce [
+    "STEPDEBUG=1"
+    "HOME=%S/step-ca"
+  ];
   services.step-ca = {
     inherit address;
     enable = false;
@@ -34,7 +45,8 @@ in {
         dataSource = "/var/lib/step-ca/db";
         badgerFileLoadingMode = "";
       };
-			authority.provisioners = [ {
+      authority.provisioners = [
+        {
           type = "JWK";
           name = "greg@thehellings.com";
           key = {
@@ -47,7 +59,8 @@ in {
             y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk";
           };
           encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg";
-			} ];
+        }
+      ];
       tls = {
         cipherSuites = [
           "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"

hosts/genesis/default.nix

@@ -2,7 +2,7 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   imports = [
@@ -34,7 +34,6 @@
   networking.hostName = "genesis"; # Define your hostname.
   environment.systemPackages = with pkgs; [
     awscli2
-		btrfs-progs
     create_ssl
     step-ca
   ];

hosts/genesis/hardware-configuration.nix

@@ -1,26 +1,28 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{ lib, modulesPath, ... }:
 
 {
-  imports =
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-    [ (modulesPath + "/profiles/qemu-guest.nix")
-    ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "sr_mod"
+    "virtio_blk"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1";
+    device = "/dev/disk/by-uuid/a13f941e-4985-47ab-a8c6-374a627c5ce1";
     fsType = "ext4";
   };
 
-  swapDevices =
+  swapDevices = [ { device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; } ];
-    [ { device = "/dev/disk/by-uuid/ac4557de-1ad5-4d3c-b9f4-5ec50dbf76f1"; }
-    ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

hosts/genesis/home-assistant.nix

@@ -1,15 +1,11 @@
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 
-let
-	service_list = [ "podman-home-assistant.service" ];
-in
 {
   virtualisation.podman.enable = true;
 
   services.home-assistant = {
     enable = true;
     configDir = "/var/lib/hass";
-		package = (pkgs.home-assistant.override {
     extraComponents = [
       "accuweather"
       "calendar"
@@ -25,22 +21,22 @@ in
       "smart_meter_texas"
       "speedtestdotnet"
       "solaredge"
-				"tplink"
       "whisper"
       "wiz"
       "wyoming"
       "zwave_js"
     ];
-		}).overrideAttrs (oldAttrs: {
+    customComponents = with pkgs.home-assistant-custom-components; [ smartthinq-sensors ];
-			doInstallCheck = false;
-		});
 
     config = {
       default_config = { };
       tts = [ { platform = "google_translate"; } ];
       http = {
         use_x_forwarded_for = true;
-				trusted_proxies = [ "127.0.0.1" "::1" ];
+        trusted_proxies = [
+          "127.0.0.1"
+          "::1"
+        ];
         server_host = "127.0.0.1";
       };
       #"automation manual" = *nix config here* and so on
@@ -80,10 +76,14 @@ in
     containers.zwave = {
       autoStart = false; # We will try to start it with udev.extraRules listed below, as this option starts it too quickly
       image = "zwavejs/zwave-js-ui:latest";
-			ports = [ "8091:8091" "3000:3000" ];
+      ports = [
+        "8091:8091"
+        "3000:3000"
+      ];
       volumes = [ "/var/lib/zwave:/usr/src/app/store" ];
       extraOptions = [
-				"--device" "/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave"
+        "--device"
+        "/dev/serial/by-id/usb-0658_0200-if00:/dev/zwave"
         "--pull=newer"
       ];
       environment = {
@@ -97,8 +97,12 @@ in
   # the container. So we add the creation of /var/lib/{zwave,hass} to the systemd Unit files
   systemd.services = {
     "podman-zwave" = {
-			after = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
+      after = [
-			wantedBy = [ "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device" ];
+        "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device"
+      ];
+      wantedBy = [
+        "sys-devices-pci0000:00-0000:00:1e.0-0000:02:1b.0-usb2-2\\x2d1-2\\x2d1:1.0-tty-ttyACM0.device"
+      ];
       serviceConfig = {
         StateDirectory = "zwave";
         StateDirectoryMode = pkgs.lib.mkForce "0777";
@@ -110,7 +114,6 @@ in
     SUBSYSTEM=="tty", KERNEL=="ttyACM0", TAG+="systemd"
   '';
 
-
   greg.proxies = {
     "smart.home".target = "http://127.0.0.1:8123/";
     "smart.thehellings.lan".target = "http://127.0.0.1:8123/";
@@ -120,7 +123,10 @@ in
   # Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
   # directly for troubleshooting Nginx configuration
   networking.firewall = {
-		allowedTCPPorts = [ 80 443 ];
+    allowedTCPPorts = [
+      80
+      443
+    ];
   };
 
   greg.backup.jobs.zwave = {

hosts/genesis/networking.nix

@@ -1,4 +1,4 @@
-{ pkgs, config, ... }:
+{ pkgs, ... }:
 let
   lan = "ens18";
   lanIP = "10.42.1.5";
@@ -17,7 +17,8 @@ let
     "1.0.0.1" # Cloudflare
     "149.112.112.112" # Quad 9
   ];
-in {
+in
+{
   greg.tailscale.enable = true;
 
   # Really, why do I still have to force-disable this crap?
@@ -36,18 +37,22 @@ in {
       # This is our LAN port
       "${lan}" = {
         useDHCP = false;
-				ipv4.addresses = [ {
+        ipv4.addresses = [
+          {
             address = "${lanIP}";
             prefixLength = 16;
-				} ];
+          }
+        ];
       };
 
       "${iot}" = {
         useDHCP = false;
-				ipv4.addresses = [ {
+        ipv4.addresses = [
+          {
             address = "${iotIP}";
             prefixLength = 24;
-				} ];
+          }
+        ];
       };
     };
     firewall = {
@@ -89,15 +94,19 @@ in {
     ########
     _3proxy = {
       enable = true;
-			services = [ {
+      services = [
+        {
           type = "socks";
           auth = [ "strong" ];
           bindPort = proxyPort;
-				acl = [ {
+          acl = [
+            {
               rule = "allow";
               users = [ "greg" ];
-				} ];
+            }
-			} ];
+          ];
+        }
+      ];
       #usersFile = "/run/agenix/3proxy";
       denyPrivate = false;
     };
@@ -139,7 +148,7 @@ in {
           "4c:a1:61:05:cd:52,192.168.66.61" # Rainbird
           "48:d6:d5:5d:81:21,192.168.66.65" # Google Home
           "6c:29:90:3e:e2:02,192.168.66.66" # wiz
-					"28:87:ba:0e:ca:da,192.168.66.74"  #
+          "28:87:ba:0e:ca:da,192.168.66.74"
           "28:87:ba:0e:c9:fd,192.168.66.75" # Master closet
           "54:af:97:c2:0f:a1,192.168.66.76" # Master toilet
           "54:af:97:83:ed:33,192.168.66.80"
@@ -173,9 +182,7 @@ in {
     # Update adblock list
     cron = {
       enable = true;
-			systemCronJobs = [
+      systemCronJobs = [ "* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log" ];
-				"* * * * * root ${adblockUpdate} 2>&1 > /var/log/adblock.log"
-			];
     };
   }; # End of services configuration
 

hosts/hosea/bitcoin.nix

@@ -0,0 +1,76 @@
+{ config, pkgs, ... }:
+
+let
+  ip = "100.68.203.1";
+in
+{
+  nix-bitcoin = {
+    generateSecrets = true;
+    operator = {
+      enable = true;
+      name = "greg";
+    };
+    useVersionLockedPkgs = true; # Use the exact versions of packages from upstream
+  };
+
+  networking.firewall.allowedTCPPorts = with config.services; [
+    bitcoind.port
+    bitcoind.rpc.port
+    lnd.restPort
+    lnd.port
+    mempool.frontend.port
+  ];
+
+  greg.backup.jobs = {
+    clightning = {
+      src = config.services.clightning.replication.local.directory;
+      dest = "hosea-clightning";
+      id = "clightning";
+    };
+  };
+
+  services = {
+    backups = {
+      enable = true;
+      frequency = "hourly";
+    };
+    bitcoind = {
+      enable = true;
+      address = "0.0.0.0";
+      dataDir = "/chain/bitcoind";
+      listen = true;
+      rpc = {
+        address = ip;
+        allowip = [ "100.1.1.1/8" ];
+      };
+    };
+    clightning = {
+      enable = true;
+      address = ip;
+      port = 9736;
+      replication = {
+        enable = true;
+        local.directory = "/var/backup/clightning";
+        encrypt = false;
+      };
+    };
+    electrs = {
+      enable = true;
+      address = ip;
+    };
+    lnd = {
+      enable = true;
+      address = ip;
+      lndconnect.enable = true;
+    };
+    mempool = {
+      enable = true;
+      frontend = {
+        enable = true;
+        address = ip;
+      };
+    };
+  };
+
+  environment.systemPackages = with pkgs; [ ];
+}

hosts/hosea/default.nix

@@ -2,7 +2,7 @@
 # your system.	Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ config, pkgs, lib, inputs, overlays, ... }:
+{ top, ... }:
 let
   wanInterface = "enp2s0";
   lanInterface = "enp1s0";
@@ -10,13 +10,13 @@ let
 in
 
 {
-	imports =
+  imports = [
-		[ # Include the results of the hardware scan.
+    # Include the results of the hardware scan.
     ./hardware-configuration.nix
-			./minio.nix
+    top.btc.nixosModules.default
+    ./bitcoin.nix
   ];
 
-
   # Bootloader
   boot = {
     loader = {
@@ -38,10 +38,12 @@ in
       "${wanInterface}".useDHCP = true;
       "${lanInterface}" = {
         useDHCP = false;
-				ipv4.addresses = [{
+        ipv4.addresses = [
+          {
             address = lanIpAddress;
             prefixLength = 16;
-				}];
+          }
+        ];
       };
     };
   };

hosts/hosea/hardware-configuration.nix

@@ -1,29 +1,44 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "uas" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usbhid"
+    "uas"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/d4ac74f7-62bb-421a-aad8-566277c9d8ba";
+    device = "/dev/disk/by-uuid/d4ac74f7-62bb-421a-aad8-566277c9d8ba";
     fsType = "btrfs";
     options = [ "subvol=@" ];
   };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/1F51-B638";
+    device = "/dev/disk/by-uuid/1F51-B638";
     fsType = "vfat";
   };
 
+  fileSystems."/chain" = {
+    device = "/dev/sda1";
+    fsType = "xfs";
+  };
+
   swapDevices = [ ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking

hosts/hosea/minio.nix

@@ -1,32 +0,0 @@
-{ config, pkgs, ... }:
-
-let
-	minioPort = 9000;
-	minioConsolePort = 9001;
-in {
-	fileSystems."/proxy" = {
-		device = "/dev/sda1";
-		fsType = "btrfs";
-	};
-
-	networking.firewall.allowedTCPPorts = [
-		80
-		minioPort
-		minioConsolePort
-	];
-
-	age.secrets.minio.file = ../../secrets/minio.age;
-
-	services.minio = {
-		enable = true;
-		dataDir = [ "/proxy/minio" ];
-		rootCredentialsFile = config.age.secrets.minio.path;
-		browser = true;
-	};
-
-	greg.proxies."s3.thehellings.lan".target = "http://127.0.0.1:${toString minioPort}";
-
-	environment.systemPackages = with pkgs; [
-		minio-client
-	];
-}

hosts/icdm-root/boot.nix

@@ -1,4 +1,4 @@
-{ pkgs, config, ...}:
+{ ... }:
 
 {
   # Bootloader.

hosts/icdm-root/default.nix

@@ -2,10 +2,11 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ config, pkgs, agenix, ... }:
+{ pkgs, ... }:
 
 {
-	imports = [ # Include the results of the hardware scan.
+  imports = [
+    # Include the results of the hardware scan.
     ./hardware-configuration.nix
     ./boot.nix
     ./filesystem.nix
@@ -18,7 +19,10 @@
   users.users.greg = {
     isNormalUser = true;
     description = "Gregory Hellings";
-		extraGroups = [ "networkmanager" "wheel" ];
+    extraGroups = [
+      "networkmanager"
+      "wheel"
+    ];
     packages = with pkgs; [ ];
   };
 }

hosts/icdm-root/filesystem.nix

@@ -1,7 +1,8 @@
 { ... }:
 
 let
-in {
+in
+{
   fileSystems."serve" = {
     #device = "10.42.1.4:/volume1/icdm-mysql/";
     #fsType = "nfs";

hosts/icdm-root/hardware-configuration.nix

@@ -1,37 +1,45 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ehci_pci"
+    "ahci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
+    device = "/dev/disk/by-uuid/dab0d455-e25e-4445-8fa4-5320047d7e7b";
     fsType = "btrfs";
     options = [ "subvol=@" ];
   };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
+    device = "/dev/disk/by-uuid/5aedbb07-5761-423b-909d-2560405eae32";
     fsType = "ext4";
   };
 
-  fileSystems."/var" =
+  fileSystems."/var" = {
-    { device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
+    device = "/dev/disk/by-uuid/57968536-c29d-417d-997e-85223d1d1f65";
     fsType = "btrfs";
   };
 
-  swapDevices =
+  swapDevices = [ { device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; } ];
-    [ { device = "/dev/disk/by-uuid/09691dce-375a-43c6-8d40-4498d20a6d9a"; }
-    ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

hosts/icdm-root/networking.nix

@@ -1,8 +1,6 @@
 { ... }:
 let
-	dnsHosts = builtins.concatStringsSep "\n" [
+  dnsHosts = builtins.concatStringsSep "\n" [ "wiki.icdm.lan 10.42.101.1" ];
-		"wiki.icdm.lan 10.42.101.1"
-	];
 in
 {
   # If we have to do proxying in Bayonnais, we can start to work on that here
@@ -11,23 +9,32 @@ in
     hostName = "icdm-root";
     useDHCP = false;
     defaultGateway = "10.42.1.1";
-		nameservers = [ "100.100.100.100" "10.42.1.2" ];
+    nameservers = [
+      "100.100.100.100"
+      "10.42.1.2"
+    ];
     enableIPv6 = false;
 
     interfaces = {
-			eno1.ipv4.addresses = [ {
+      eno1.ipv4.addresses = [
+        {
           address = "10.42.101.1";
           prefixLength = 16;
-			} {
+        }
+        {
           address = "10.77.1.2";
           prefixLength = 16;
-			} ];
+        }
+      ];
     };
     # Allow traffic through
     firewall = {
       enable = true;
       allowedTCPPorts = [ 53 ];
-			allowedUDPPorts = [ 53 67 ];
+      allowedUDPPorts = [
+        53
+        67
+      ];
     };
 
     extraHosts = "${dnsHosts}";
@@ -37,9 +44,7 @@ in
     enable = true;
     settings = {
       domain = "icdm.lan";
-			dhcp-range = [
+      dhcp-range = [ "eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h" ];
-				"eno1,10.77.1.10,10.77.1.255,255.255.0.0,12h"
-			];
       dhcp-option = [
         "eno1,option:router,10.77.1.1"
         "eno1,option:dns-server,10.77.1.2,1.1.1.1"

hosts/icdm-root/wiki.nix

@@ -1,12 +1,7 @@
-{ pkgs, ... }:
+{ ... }:
 let
-	wikiPasswordFile = "/var/mediawiki/passwordFile";
   wikiHost = "wiki.icdm.lan";
   kiwixport = 8080;
-	dependents = with pkgs; [
-		enwiki-dump
-		transmission
-	];
 in
 {
   services.kiwix-serve = {
@@ -15,18 +10,6 @@ in
     path = "/srv/zims/*.zim";
   };
 
-	services.transmission = {
-		enable = true;
-		settings = {
-			download-dir = "/srv";
-			incomplete-dir = "/srv/incomplete";
-			rpc-bind-address = "0.0.0.0";
-			rpc-whitelist = "10.42.*,127.*,localhost";
-		};
-	};
-
   greg.proxies."${wikiHost}".target = "http://localhost:${toString kiwixport}";
   networking.firewall.allowedTCPPorts = [ 80 ];
-
-	environment.systemPackages = dependents;
 }

hosts/iso/default.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, modulesPath, ... }:
+{
+  pkgs,
+  lib,
+  modulesPath,
+  ...
+}:
 {
 
   imports = [
@@ -9,7 +14,5 @@
   networking.networkmanager.enable = lib.mkForce false;
   users.users.greg.initialPassword = "";
   #services.getty.autologinUser = lib.mkForce "greg";
-	environment.systemPackages = with pkgs; [
+  environment.systemPackages = with pkgs; [ tree ];
-		tree
-	];
 }

hosts/jeremiah/ceph.nix

@@ -6,7 +6,8 @@ let
   vip = (builtins.elemAt config.networking.interfaces.enp68s0.ipv4.addresses 1).address;
   hostname = config.networking.hostName;
   baseConfig = import ../../ceph/home.nix;
-in {
+in
+{
   services.ceph-benaco = baseConfig // {
     enable = false;
     monitor = {

hosts/jeremiah/default.nix

@@ -2,11 +2,16 @@
 # your system.	Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 {
-	imports =
+  imports = [
-		[ # Include the results of the hardware scan.
+    # Include the results of the hardware scan.
     ./ceph.nix
     ./hardware-configuration.nix
     ./minio.nix
@@ -31,31 +36,33 @@
     };
     interfaces = {
       enp68s0 = {
-				ipv4.addresses = [ {
+        ipv4.addresses = [
+          {
             address = "10.42.1.8";
             prefixLength = 16;
-				} {
+          }
+          {
             address = "10.42.100.1";
             prefixLength = 16;
-				} ];
+          }
+        ];
       };
       san = {
-				ipv4.addresses = [ {
+        ipv4.addresses = [
+          {
             address = "10.201.1.2";
             prefixLength = 24;
-				} ];
+          }
-			};
-		};
-		nameservers = [
-			"10.42.1.5"
         ];
       };
+    };
+    nameservers = [ "10.42.1.5" ];
+  };
   greg = {
     home = true;
     tailscale.enable = true;
   };
   environment.systemPackages = with pkgs; [
-		btrfs-progs
     curl
     gawk
     git
@@ -87,7 +94,7 @@
         shell = {
           executor = "shell";
           limit = 5;
-					registrationConfigFile = config.age.secrets.runner-reg.path;
+          authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
           environmentVariables = {
             EFI_DIR = "${pkgs.OVMF.fd}/FV/";
             STORAGE_URL = "http://s3.thehellings.lan:9000";

hosts/jeremiah/hardware-configuration.nix

@@ -1,25 +1,35 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
 
-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "uas" "usbhid" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "ahci"
+    "uas"
+    "usbhid"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24";
+    device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24";
     fsType = "ext4";
   };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/3047-870E";
+    device = "/dev/disk/by-uuid/3047-870E";
     fsType = "vfat";
   };
 

hosts/jeremiah/minio.nix

@@ -3,7 +3,8 @@
 let
   minioPort = 9000;
   minioConsolePort = 9001;
-in {
+in
+{
   environment.systemPackages = with pkgs; [
     minio-client
     xfsprogs

hosts/jude/boot.nix

@@ -12,23 +12,28 @@
         enable = true;
         configurationLimit = 20;
         extraEntries = {
-					"Windows.conf" = (lib.strings.concatStringsSep "\n" [
+          "Windows.conf" = (
+            lib.strings.concatStringsSep "\n" [
               "title Windows"
               "efi /EFI/Microsoft/EFI/bootmgfw.efi"
-					]);
+            ]
-					"Win2.conf" = (lib.strings.concatStringsSep "\n" [
+          );
+          "Win2.conf" = (
+            lib.strings.concatStringsSep "\n" [
               "title Windows 11"
               "efi /shellx64.efi"
               "options -nointerrupt -noconsolein -noconsoleout windows11.nsh"
-					]);
+            ]
-					"Shell.conf" = (lib.strings.concatStringsSep "\n" [
+          );
+          "Shell.conf" = (
+            lib.strings.concatStringsSep "\n" [
               "title EFI Shell"
               "efi /shell.efi"
-					]);
+            ]
+          );
         };
         extraFiles = {
-					"windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [
+          "windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [ ]));
-					]));
           "shell.efi" = "${pkgs.edk2-uefi-shell}/shell.efi";
         };
       };

hosts/jude/default.nix

@@ -5,8 +5,8 @@
     ./boot.nix
     ./hardware-configuration.nix
     ./podman.nix
-		./printing.nix
     ./virt.nix
+    ./work.nix
   ];
   programs = {
     steam.enable = true;
@@ -26,22 +26,30 @@
     firewall = {
       enable = false;
       allowedTCPPorts = [ 21000 ];
-			allowedUDPPorts = [ 21000 21010 ];
+      allowedUDPPorts = [
+        21000
+        21010
+      ];
     };
   };
   greg = {
     tailscale.enable = true;
     sway.enable = false;
-		gnome.enable = true;
+    gnome.enable = false;
-		kde.enable = false;
+    kde.enable = true;
+    print.enable = true;
+    remote-builder.enable = true;
   };
 
   boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
 
-	environment.systemPackages = with pkgs; lib.mkMerge [
+  environment.systemPackages =
-		[  # for Immersed
+    with pkgs;
+    lib.mkMerge [
+      [
+        # for Immersed
         cudatoolkit
-			immersed-vr
+        immersed
         libva
       ]
       [
@@ -64,7 +72,6 @@
         makemkv
         oathToolkit
         usbutils
-			vagrant
         ventoy
       ]
 
@@ -111,9 +118,12 @@
     nvidia = {
       modesetting.enable = true;
       nvidiaSettings = true;
-			#open = true;
+      open = true;
     };
     pulseaudio.enable = false; # This conflicts with pipewire
-		system76.enableAll = true;
+    system76 = {
+      firmware-daemon.enable = true;
+      #kernel-modules.enable = true;
+    };
   };
 }

hosts/jude/hardware-configuration.nix

@@ -1,20 +1,30 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
 
-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "ahci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { #device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf";
+    #device = "/dev/disk/by-uuid/27ae91ed-32e9-411e-8227-0d99e360fbbf";
     device = "/dev/nvme0n1p4";
     fsType = "btrfs";
   };

hosts/jude/printing.nix

@@ -1,12 +0,0 @@
-{ pkgs, ... }:
-
-{
-	# ipp://printer.thehellings.lan:631/ - generic postscript printer
-	services.printing = {
-		enable = true;
-		drivers = with pkgs; [
-			gutenprint
-			gutenprintBin
-		];
-	};
-}

hosts/jude/virt.nix

@@ -29,7 +29,7 @@
     services.vbox = {
       executor = "shell";
       limit = 5;
-			registrationConfigFile = config.age.secrets.runner-reg.path;
+      authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
       environmentVariables = {
         EFI_DIR = "${pkgs.OVMF.fd}/FV/";
       };

hosts/jude/work.nix

@@ -0,0 +1,8 @@
+{ pkgs, ... }:
+
+{
+  services.mongodb = {
+    enable = false;
+  };
+  environment.systemPackages = with pkgs; [ mongodb-compass ];
+}

hosts/linode/default.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 
 {
   imports = [
@@ -29,9 +34,7 @@
     networkmanager.enable = lib.mkForce false;
     hostName = "linode";
     domain = "thehellings.com";
-		nameservers = [
+    nameservers = [ "100.88.91.27" ];
-			"100.88.91.27"
-		];
   };
 
   age.secrets.runner-deployer = {
@@ -43,7 +46,7 @@
     enable = true;
     services.deployer = {
       executor = "shell";
-			registrationConfigFile = config.age.secrets.runner-deployer.path;
+      authenticationTokenConfigFile = config.age.secrets.runner-deployer.path;
     };
   };
 
@@ -58,16 +61,21 @@
     User = "gitlab-runner";
   };
 
-	security.sudo.extraRules = [{
+  security.sudo.extraRules = [
+    {
       users = [ "gitlab-runner" ];
-		commands = [{
+      commands = [
+        {
           command = "/run/current-system/sw/bin/systemctl";
           options = [ "NOPASSWD" ];
-		} {
+        }
+        {
           command = "/run/current-system/sw/bin/podman";
           options = [ "NOPASSWD" ];
-		}];
+        }
-	}];
+      ];
+    }
+  ];
 
   environment.systemPackages = with pkgs; [
     bind

hosts/linode/git.nix

@@ -1,9 +1,10 @@
-{ config, pkgs, ... }:
+{ ... }:
 
 let
   srcDomain = "src.thehellings.com";
   sshPort = 2222;
-in {
+in
+{
   greg.proxies."${srcDomain}" = {
     target = "http://git.thehellings.lan";
     ssl = true;

hosts/linode/hardware-configuration.nix

@@ -1,14 +1,22 @@
 # Do not modify this file!  It was generated by "nixos-generate-config"
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports = [
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
 
-  boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "virtio_pci"
+    "virtio_scsi"
+    "ahci"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
@@ -18,9 +26,7 @@
     fsType = "ext4";
   };
 
-  swapDevices = [
+  swapDevices = [ { device = "/dev/sdb"; } ];
-    #{ device = "/dev/sdb"; }
-  ];
 
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/linode/matrix.nix

@@ -2,11 +2,10 @@
 # them by the following commands:
 # nix run nixpkgs.matrix-synapse
 # register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
-{ config, pkgs, ... }:
+{ config, ... }:
 let
   domain = "${config.networking.domain}";
   fqdn = "matrix.${domain}";
-	conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
 in
 {
   services.nginx = {
@@ -20,8 +19,11 @@ in
         # the actual application server at matrix.thehellings.com
         locations."= /.well-known/matrix/server".extraConfig =
           let
-						server = { "m.server" = "${fqdn}:443"; };
+            server = {
-					in ''
+              "m.server" = "${fqdn}:443";
+            };
+          in
+          ''
             add_header Content-Type application/json;
             return 200 '${builtins.toJSON server}';
           '';
@@ -29,10 +31,15 @@ return 200 '${builtins.toJSON server}';
         locations."= /.well-known/matrix/client".extraConfig =
           let
             client = {
-							"m.homeserver" = { "base_url" = "https://${fqdn}"; };
+              "m.homeserver" = {
-							"m.identity_server" = { "base_url" = "https://vector.im"; };
+                "base_url" = "https://${fqdn}";
               };
-					in ''
+              "m.identity_server" = {
+                "base_url" = "https://vector.im";
+              };
+            };
+          in
+          ''
             add_header Content-Type application/json;
             add_header Access-Control-Allow-Origin *;
             return 200 '${builtins.toJSON client}';
@@ -57,6 +64,9 @@ return 200 '${builtins.toJSON client}';
   # Open networking ports for the server
   networking.firewall = {
     enable = true;
-		allowedTCPPorts = [ 80 443 ];
+    allowedTCPPorts = [
+      80
+      443
+    ];
   };
 }

hosts/linode/postgres.nix

@@ -1,26 +1,24 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, ... }:
 
 {
-	environment.systemPackages = [
+  environment.systemPackages = [ pkgs.upgrade-pg-cluster ];
-		pkgs.upgrade-pg-cluster
-	];
 
   services.postgresql = {
     enable = true;
     package = pkgs.postgresql_15;
     checkConfig = true;
-		ensureDatabases = [
+    ensureDatabases = [ "nextcloud" ];
-			"nextcloud"
-		];
     #initialScript = pkgs.writeText "create-matrix-db.sql" ''
     #	CREATE ROLE "matrix-synapse" WITH LOGIN;
     #	CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
     #	GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
     #'';  # These are done manually in order to set the LC_COLLATE values properly
-		ensureUsers = [ {
+    ensureUsers = [
+      {
         name = "nextcloud";
         ensureDBOwnership = true;
-		}  ];
+      }
+    ];
     settings = {
       log_connections = true;
       log_statement = "all";
@@ -34,9 +32,7 @@ root root postgres
 
   services.postgresqlBackup = {
     enable = true;
-		databases = [
+    databases = [ "nextcloud" ];
-			"nextcloud"
-		];
   };
 
   services.logrotate = {

hosts/myself/ceph.nix

@@ -6,7 +6,8 @@ let
   vip = (builtins.elemAt config.networking.interfaces.enp38s0.ipv4.addresses 1).address;
   hostname = config.networking.hostName;
   baseConfig = import ../../ceph/home.nix;
-in {
+in
+{
   services.ceph-benaco = baseConfig // {
     enable = false;
     monitor = {

hosts/myself/container-git.nix

@@ -1,12 +1,26 @@
-{ config, pkgs, lib, ... }: let
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
   registryPort = 5000;
   vpnIp = "100.78.226.76";
   containerIp = "192.168.200.2";
-in {
+in
+{
   age.secretsMountPoint = "/run/derp";
-	age.secrets = let
+  age.secrets =
-		cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; };
+    let
-	in {
+      cfg = n: {
+        file = ../../secrets/gitlab/${n}.age;
+        owner = "gitlab";
+        group = "gitlab";
+        mode = "0444";
+      };
+    in
+    {
       gitlab-secret = cfg "secret";
       gitlab-otp = cfg "otp";
       gitlab-db = cfg "db";
@@ -28,9 +42,13 @@ in {
       };
     };
 
-	networking.firewall.allowedTCPPorts = [ 80 registryPort ];
+  networking.firewall.allowedTCPPorts = [
+    80
+    registryPort
+  ];
 
-	greg.proxies = let
+  greg.proxies =
+    let
       t = {
         target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
         extraConfig = ''
@@ -38,7 +56,8 @@ in {
           proxy_set_header X-Forwarded-Ssl on;
         '';
       };
-	in {
+    in
+    {
       "${containerIp}" = t;
       "${vpnIp}" = t;
       "git.thehellings.lan" = t;
@@ -109,13 +128,22 @@ in {
             provider = "AWS";
             endpoint = "http://s3.thehellings.lan:9000";
             region = "us-east-1";
-						aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; };
+            aws_access_key_id = {
-						aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; };
+              _secret = config.age.secrets.minio_access_key_id.path;
+            };
+            aws_secret_access_key = {
+              _secret = config.age.secrets.minio_secret_access_key.path;
+            };
             path_style = true; # True for MinIO
             aws_signature_version = 2;
           };
           #storage_options = ...;
-					objects = builtins.listToAttrs ( builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [
+          objects = builtins.listToAttrs (
+            builtins.map
+              (
+                x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }
+              )
+              [
                 "artifacts"
                 "ci_secure_files"
                 "dependency_proxy"
@@ -125,17 +153,20 @@ in {
                 "pages"
                 "terraform_state"
                 "uploads"
-					]);
+              ]
+          );
         };
       };
     };
 
     nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
-			listen = [ {
+      listen = [
+        {
           addr = vpnIp;
           port = registryPort;
           ssl = true;
-			} ];
+        }
+      ];
       locations."/" = {
         proxyPass = "http://127.0.0.1:5000/";
         recommendedProxySettings = true;
@@ -150,17 +181,21 @@ in {
     # Fetch the SSL certificates for nginx to use
     cron = {
       enable = true;
-			systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ];
+      systemCronJobs = [
+        "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx"
+      ];
     };
 
     postgresql = {
       enable = true;
       checkConfig = true;
       ensureDatabases = [ "gitlab" ];
-			ensureUsers = [ {
+      ensureUsers = [
+        {
           name = "gitlab";
           ensureDBOwnership = true;
-			} ];
+        }
+      ];
       settings = {
         log_connections = true;
         log_statement = "all";
@@ -180,9 +215,8 @@ in {
   # to the 100.* addresses
   systemd.services = {
     nginx = rec {
-			after = [
+      after = [ "network-online.target" ];
-				"network-online.target"
+      requires = [ "network-online.target" ];
-			];
       wants = after;
       serviceConfig = {
         RestartMaxDelaySec = "30s";

hosts/myself/container-runner.nix

@@ -1,12 +1,24 @@
-{ inputs, name, extra ? {}, packages ? [], overlays }:
+{
+  top,
+  name,
+  extra ? { },
+  packages ? [ ],
+  overlays,
+}:
 
-({ config, pkgs, lib, ... }:
 (
-lib.attrsets.recursiveUpdate {
+  {
+    config,
+    pkgs,
+    lib,
+    ...
+  }:
+  (lib.attrsets.recursiveUpdate
+    {
 
       imports = [
-		inputs.agenix.nixosModules.default
+        top.agenix.nixosModules.default
-		inputs.self.modules.nixosModule
+        top.self.modules.nixosModule
       ];
 
       nixpkgs.overlays = overlays;
@@ -21,14 +33,17 @@ lib.attrsets.recursiveUpdate {
         };
       };
 
-	environment.systemPackages = with pkgs; [
+      environment.systemPackages =
+        with pkgs;
+        [
           curl
           gawk
           git
           unzip
           xorriso
           wget
-	] ++ packages;
+        ]
+        ++ packages;
 
       networking = {
         useHostResolvConf = pkgs.lib.mkForce false;
@@ -51,7 +66,7 @@ lib.attrsets.recursiveUpdate {
             shell = {
               executor = "shell";
               limit = 5;
-					registrationConfigFile = config.age.secrets.runner-reg.path;
+              authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
               environmentVariables = {
                 EFI_DIR = "${pkgs.OVMF.fd}/FV/";
                 STORAGE_URL = "http://s3.thehellings.lan:9000";
@@ -76,7 +91,10 @@ lib.attrsets.recursiveUpdate {
           DevicePolicy = lib.mkForce "auto";
           PrivateDevices = false;
           ProtectKernelModules = false;
-			DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
+          DevicesAllow = [
+            "/dev/kvm"
+            "/dev/mem"
+          ];
           DynamicUser = lib.mkForce false;
           User = "root";
           Group = "kvm";

hosts/myself/default.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ lib, ... }:
 {
   imports = [
     ./ceph.nix
@@ -8,7 +8,10 @@
     ./minio.nix
   ];
 
-	greg.tailscale.enable = true;
+  greg = {
+    tailscale.enable = true;
+    remote-builder.enable = true;
+  };
 
   services = {
     openssh.enable = true;
@@ -28,25 +31,28 @@
     };
     interfaces = {
       enp38s0 = {
-				ipv4.addresses = [ {
+        ipv4.addresses = [
+          {
             address = "10.42.1.6";
             prefixLength = 16;
-				} {
+          }
+          {
             address = "10.42.100.1";
             prefixLength = 16;
-				} ];
+          }
+        ];
       };
       san = {
-				ipv4.addresses = [ {
+        ipv4.addresses = [
+          {
             address = "10.201.1.1";
             prefixLength = 24;
-				} ];
+          }
-			};
-		};
-		nameservers = [
-			"10.42.1.5"
         ];
       };
+    };
+    nameservers = [ "10.42.1.5" ];
+  };
   users = {
     users = {
       greg = {
@@ -73,14 +79,10 @@
         configurationLimit = 10;
       };
     };
-		binfmt.emulatedSystems = [
+    binfmt.emulatedSystems = [ "aarch64-linux" ];
-			"aarch64-linux"
-		];
   };
   nixpkgs.config = {
     allowUnfree = true;
-		permittedInsecurePackages = [
+    permittedInsecurePackages = [ "nodejs-16.20.2" ];
-			"nodejs-16.20.2"
-		];
   };
 }

hosts/myself/git.nix

@@ -1,15 +1,14 @@
-{ config, pkgs, lib, inputs, overlays, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 let
-
   gitlabStateDir = "/var/lib/gitlab";
-
+in
-	container = input: (lib.attrsets.recursiveUpdate {
+{
-		bindMounts."/etc/ssh".hostPath = "/etc/ssh";  # For agenix secrets
-		enableTun = true;
-		privateNetwork = true;
-	} input);
-in  {
   networking = {
     firewall = {
       enable = true;
@@ -30,7 +29,9 @@ in  {
     '';
   };
 
-	system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
+  system.activationScripts.makeGitlabDir = lib.stringAfter [
+    "var"
+  ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
 
   greg.containers.gitlab = {
     tailscale = true;
@@ -38,47 +39,16 @@ in  {
     builder = (import ./container-git.nix);
   };
 
-	systemd.services = {
-		"gitlab-runner" = {
-			after = [ "container@github.service" ];
-			preStart = builtins.concatStringsSep "\n" [
-				"${pkgs.kmod}/bin/modprobe kvm"
-				"${pkgs.kmod}/bin/modprobe kvm_amd"
-			];
-			postStop = builtins.concatStringsSep "\n" [
-				"${pkgs.kmod}/bin/rmmod -f kvm_amd kvm"
-			];
-			serviceConfig = {
-				DevicePolicy = lib.mkForce "auto";
-				DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
-				EnvironmentFile = config.age.secrets.docker-auth.path;
-				PermissionsStartOnly = "true";
-				PrivateDevices = false;
-				ProtectKernelModules = false;
-			};
-		};
-	};
-
-	#####################################################################################
-	#################### Container Podman Runner ########################################
-	#####################################################################################
-	containers.gitlab-runner-shell = container {
-		autoStart = true;
-		hostAddress = "192.168.203.1";
-		localAddress = "192.168.203.2";
-		config = ((import ./container-runner.nix) {
-			inherit inputs overlays;
-			name = "shell";
-			extra.virtualisation.podman.enable = true;
-		});
-	};
-
   #####################################################################################
   #################### Local Podman/Docker Runner #####################################
   #####################################################################################
   age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
   age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age;
   age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age;
+  systemd.services.gitlab-runner = {
+    after = [ "network-online.target" ];
+    requires = [ "network-online.target" ];
+  };
   services.gitlab-runner = {
     enable = true;
     settings = {
@@ -87,7 +57,7 @@ in  {
     services = {
       default = {
         executor = "docker";
-				registrationConfigFile = config.age.secrets.runner-reg.path;
+        authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
         dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest";
         dockerAllowedImages = [
           "alpine:*"
@@ -96,10 +66,6 @@ in  {
           "fedora:*"
           "python:*"
           "ubuntu:*"
-
-					"hashicorp/*:*"
-					"koalaman/shellcheck:*"
-
           "registry.gitlab.com/gitlab-org/*"
           "registry.thehellings.com/*/*/*:*"
           "gitlab.shire-zebra.ts.net:5000/*/*/*:*"
@@ -118,7 +84,7 @@ in  {
       qemu = {
         executor = "shell";
         limit = 5;
-				registrationConfigFile = config.age.secrets.runner-qemu.path;
+        authenticationTokenConfigFile = config.age.secrets.runner-qemu.path;
         environmentVariables = {
           EFI_DIR = "${pkgs.OVMF.fd}/FV/";
           STORAGE_URL = "http://s3.thehellings.lan:9000";
@@ -127,8 +93,8 @@ in  {
     };
   };
   virtualisation = {
-		docker.enable = true;
+    podman.enable = true;
-		oci-containers.backend = "docker";
+    oci-containers.backend = "podman";
   };
   environment.systemPackages = with pkgs; [
     curl

hosts/myself/hardware-configuration.nix

@@ -1,37 +1,48 @@
 # Do not modify this file!	It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.	Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-	imports =
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-		[ (modulesPath + "/installer/scan/not-detected.nix")
-		];
 
-	boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "ahci"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+    "sr_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
-	fileSystems."/" =
+  fileSystems."/" = {
-		{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
+    device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
     fsType = "btrfs";
     options = [ "subvol=nixos" ];
   };
 
-	fileSystems."/home" =
+  fileSystems."/home" = {
-		{ device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
+    device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
     fsType = "btrfs";
     options = [ "subvol=home" ];
   };
 
-	fileSystems."/boot" =
+  fileSystems."/boot" = {
-		{ device = "/dev/disk/by-uuid/29E7-E20C";
+    device = "/dev/disk/by-uuid/29E7-E20C";
     fsType = "vfat";
   };
 
-	fileSystems."/myvol" = 
+  fileSystems."/myvol" = {
-		{ device = "/dev/nvme0n1p1";
+    device = "/dev/nvme0n1p1";
     fsType = "btrfs";
   };
 

hosts/myself/matrix.nix

@@ -1,7 +1,5 @@
-{ config, pkgs, inputs, lib, ... }:
+{ pkgs, ... }:
 let
-	domain = "thehellings.com";
-	fqdn = "matrix.${domain}";
   conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
 in
 {
@@ -10,7 +8,9 @@ in
   greg.containers.matrix = {
     tailscale = true;
     subnet = "204";
-		builder = { pkgs, config, ... }: {
+    builder =
+      { config, ... }:
+      {
         networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
 
         # Environment secrets
@@ -44,7 +44,14 @@ in
           # Identify ourselves as the root of our own domain
           settings = (
             (builtins.listToAttrs (
-					(map (x: { name = x; value = { database.connection_string = conn; }; }) [
+              (map
+                (x: {
+                  name = x;
+                  value = {
+                    database.connection_string = conn;
+                  };
+                })
+                [
                   "app_service_api"
                   "federation_api"
                   "key_server"
@@ -53,9 +60,10 @@ in
                   "relay_api"
                   "room_server"
                   "sync_api"
-					])
+                ]
-				) ) //
+              )
-				{
+            ))
+            // {
               user_api.account_database.connection_string = conn;
               user_api.device_database.connection_string = conn;
               global = {
@@ -78,7 +86,8 @@ in
                 registration_enabled = false;
                 registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
               };
-				});
+            }
+          );
         };
 
         systemd.services.dendrite = {

hosts/myself/minio.nix

@@ -3,7 +3,8 @@
 let
   minioPort = 9000;
   minioConsolePort = 9001;
-in {
+in
+{
   environment.systemPackages = with pkgs; [
     minio-client
     xfsprogs

hosts/wsl/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ ... }:
 
 {
   wsl = {

modules/baseline.nix

@@ -1,6 +1,14 @@
-{ pkgs, lib, ... }:
+{
+  pkgs,
+  config,
+  lib,
+  self,
+  ...
+}:
 let
-	notDarwin = (! pkgs.stdenv.isDarwin);
+  builderHosts = (
+    lib.attrNames (lib.filterAttrs (_: v: v.config.greg.remote-builder.enable) self.nixosConfigurations)
+  );
 in
 {
   # Enable flakes
@@ -18,22 +26,60 @@ in
       keep-derivations = true;
       min-free = (toString (1024 * 1024 * 1024));
       max-free = (toString (5 * 1024 * 1024 * 1024));
+      trusted-users = [
+        "greg"
+        "gregory.hellings"
+      ]; # For home and for work machines
       substituters = [
         "https://cache.garnix.io"
         "https://ai.cachix.org"
+        "https://nixpkgs-python.cachix.org"
+        "https://greg-hellings.cachix.org"
+        "https://nix-community.cachix.org"
       ];
       trusted-public-keys = [
         "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
         "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
+        "nixpkgs-python.cachix.org-1:hxjI7pFxTyuTHn2NkvWCrAUcNZLNS3ZAvfYNuYifcEU="
+        "greg-hellings.cachix.org-1:y01Jl/L5evlhxdnUW6n56AiI1k8g1wxWhTxJCe7XSco="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
       ];
     };
+
+    buildMachines = (
+      lib.map (host: {
+        hostName = "${host}-builder";
+        system = "x86_64-linux";
+        protocol = "ssh-ng";
+        maxJobs = 12;
+        speedFactor = 2;
+        supportedFeatures = [
+          "nixos-test"
+          "benchmark"
+          "big-parallel"
+          "kvm"
+        ];
+      }) (lib.filter (x: x != config.networking.hostName) builderHosts)
+    );
+    distributedBuilds = true;
+    extraOptions = ''
+      builders-use-substitutes = true
+    '';
   };
 
+  programs.ssh.extraConfig = (
+    builtins.concatStringsSep "\n" (
+      lib.map (x: ''
+        Host ${x}-builder
+          Hostname ${x}.home
+          User remote-builder-user
+      '') builderHosts
+    )
+  );
+
   nixpkgs.config = {
     allowUnfree = true;
-        permittedInsecurePackages = [
+    permittedInsecurePackages = [ "jitsi-meet-1.0.8043" ];
-			"jitsi-meet-1.0.8043"
-		];
   };
 
   # Base packages that need to be in all my hosts
@@ -41,6 +87,7 @@ in
     agenix
     bitwarden-cli
     bmon
+    cachix
     diffutils
     git
     gnupatch

modules/darwin/default.nix

@@ -1,8 +1,6 @@
 { ... }:
 {
-    imports = [
+  imports = [ ../baseline.nix ];
-        ../baseline.nix
-    ];
   system.stateVersion = 4;
   home-manager = {
     useGlobalPkgs = true;

modules/default.nix

@@ -1,7 +1,8 @@
 let
   nixos = (import ./nixos);
   darwin = (import ./darwin);
-in {
+in
+{
   nixosModule = nixos;
   darwinModule = darwin;
 }

modules/nixos/backup.nix

@@ -1,11 +1,16 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.greg.backup;
 
   where = j: "${config.services.syncthing.dataDir}/${j.dest}";
 
-	makeSyncFolders = name: job: {
+  makeSyncFolders = _: job: {
     devices = [ "chronicles" ];
     enable = true;
     id = job.id;
@@ -14,9 +19,12 @@ let
     type = "sendonly";
   };
 
-	makeRestic = name: job: let
+  makeRestic =
+    _: job:
+    let
       who = "${config.services.syncthing.user}:${config.services.syncthing.group}";
-	in rec {
+    in
+    rec {
       initialize = true;
       passwordFile = config.age.secrets.restic-pw.path;
       paths = [ job.src ];
@@ -24,14 +32,19 @@ let
       backupCleanupCommand = ''${pkgs.coreutils}/bin/chown -R ${who} "${repository}"'';
     };
 
-in with lib; {
+in
+with lib;
+{
   options = {
     greg.backup = {
       jobs = mkOption {
         default = { };
 
-				type = with types; attrsOf (submodule (
+        type =
-					{ name, config, options, ... }:
+          with types;
+          attrsOf (
+            submodule (
+              { ... }:
               {
                 options = {
                   src = mkOption {
@@ -39,9 +52,7 @@ in with lib; {
                     description = "Local path (string form) to backup from";
                   };
 
-							dest = mkOption {
+                  dest = mkOption { type = types.str; };
-								type = types.str;
-							};
 
                   id = mkOption {
                     type = types.str;
@@ -49,13 +60,13 @@ in with lib; {
                   };
                 };
               }
-				));
+            )
+          );
       };
     };
   };
 
-	config = mkIf ( ( attrValues cfg.jobs ) != [] )
+  config = mkIf ((attrValues cfg.jobs) != [ ]) {
-	{
     age.secrets = {
       restic-pw.file = ../../secrets/restic-pw.age;
       restic-env.file = ../../secrets/restic-env.age;

modules/nixos/ceph.nix

@@ -1,6 +1,11 @@
 # This is a good source for a Ceph dealio
 # https://gist.github.com0/nh2/13425a1f18b4c1ce82edb63c10b163c9
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with lib;
 
@@ -8,11 +13,12 @@ let
   cfg = config.services.ceph-benaco;
   commaSep = builtins.concatStringsSep ",";
 
-  ensureUnitExists = c': name: let
+  ensureUnitExists =
-    unitName = (builtins.elemAt (builtins.split "\\." name) 0);
+    c': name:
-  in if c'.systemd.services ? unitName
+    let
-     then name
+    in
-     else name;# "Unable to locate ${name} at ${commaSep (builtins.attrNames c')}";
+    #unitName = (builtins.elemAt (builtins.split "\\." name) 0);
+    if c'.systemd.services ? unitName then name else name; # "Unable to locate ${name} at ${commaSep (builtins.attrNames c')}";
 in
 
 {
@@ -44,7 +50,8 @@ in
       };
 
       initialMonitors = mkOption {
-        type = types.listOf (types.submodule {
+        type = types.listOf (
+          types.submodule {
             options = {
               hostname = mkOption {
                 type = types.str;
@@ -56,12 +63,14 @@ in
                 description = "Initial monitor IP address.";
               };
             };
-        });
+          }
+        );
         description = "Initial monitors.";
       };
 
       mdsNodes = mkOption {
-        type = types.listOf (types.submodule {
+        type = types.listOf (
+          types.submodule {
             options = {
               hostname = mkOption {
                 type = types.str;
@@ -73,7 +82,8 @@ in
                 description = "MDS IP address.";
               };
             };
-        });
+          }
+        );
         description = "MDS nodes.";
       };
 
@@ -175,7 +185,8 @@ in
           current machine only, used only to name the systemd service
           for that OSD.
         '';
-        type = types.attrsOf (types.submodule {
+        type = types.attrsOf (
+          types.submodule {
             options = {
 
               enable = mkEnableOption "Activate a Ceph OSD on this machine.";
@@ -291,7 +302,8 @@ in
               };
 
             };
-        });
+          }
+        );
       };
 
       mds = {
@@ -325,7 +337,8 @@ in
 
   ###### implementation
 
-  config = let
+  config =
+    let
       monDir = "/var/lib/ceph/mon/${cfg.clusterName}-${cfg.monitor.nodeName}";
       mgrDir = "/var/lib/ceph/mgr/${cfg.clusterName}-${cfg.manager.nodeName}";
       mdsDir = "/var/lib/ceph/mds/${cfg.clusterName}-${cfg.mds.nodeName}";
@@ -361,34 +374,46 @@ in
       cephMonitoringSudoersCommandsAndPackages = [
         {
           package = pkgs.smartmontools;
-        sudoersExtraRule = { # entry for `security.sudo.extraRules`
+          sudoersExtraRule = {
+            # entry for `security.sudo.extraRules`
             users = [ config.users.users.ceph.name ];
-          commands = [{
+            commands = [
+              {
                 command = "${lib.getBin pkgs.smartmontools}/bin/smartctl -x --json=o /dev/*";
                 options = [ "NOPASSWD" ];
-          }];
+              }
+            ];
           };
         }
         {
           package = pkgs.nvme-cli;
-        sudoersExtraRule = { # entry for `security.sudo.extraRules`
+          sudoersExtraRule = {
+            # entry for `security.sudo.extraRules`
             users = [ config.users.users.ceph.name ];
-          commands = [{
+            commands = [
+              {
                 command = "${lib.getBin pkgs.nvme-cli}/bin/nvme * smart-log-add --json /dev/*";
                 options = [ "NOPASSWD" ];
-          }];
+              }
+            ];
           };
         }
       ];
 
-    cephDeviceHealthMonitoringPathsOrPackages = with pkgs; [
+      cephDeviceHealthMonitoringPathsOrPackages =
+        with pkgs;
+        [
           # Contains `sudo`. Ceph wraps this around the other health check programs.
           # Cannot use `pkgs.sudo` because that one is not SUID, see:
           # https://discourse.nixos.org/t/sudo-uid-issues/9133
           "/run/wrappers" # `systemd.services.<name>.path` adds the `bin/` subdir of this
-    ] ++ map ({ package, ... }: package) cephMonitoringSudoersCommandsAndPackages;
+        ]
+        ++ map ({ package, ... }: package) cephMonitoringSudoersCommandsAndPackages;
 
-    makeCephOsdSetupSystemdService = localOsdServiceName: osdConfig:
+      # Unused localOsdServiceName in the following line
+      # deadnix: skip
+      makeCephOsdSetupSystemdService =
+        _localOsdServiceName: osdConfig:
         let
           osdExistenceFile = "/var/lib/ceph/osd/.${toString osdConfig.id}.${osdConfig.uuid}.nix-existence";
         in
@@ -407,7 +432,8 @@ in
           # TODO Use `udevadm trigger --settle` instead of the separate `udevadm settle`
           #      once that feature is available to us with systemd >= 238;
           #      see https://github.com/systemd/systemd/commit/792cc203a67edb201073351f5c766fce3d5eab45
-      preStart = ''
+          preStart =
+            ''
               set -x
               ${ensureCephDirs}
               install -m 755 -o ${config.users.users.ceph.name} -g ${config.users.groups.ceph.name} -d /var/lib/ceph/bootstrap-osd
@@ -420,22 +446,26 @@ in
 
               # Trigger udev rules for permissions of block devices and wait for them to settle.
               udevadm trigger --name-match=${osdConfig.blockDevice}
-      '' + lib.optionalString (osdConfig.dbBlockDevice != null) ''
-        udevadm trigger --name-match=${osdConfig.dbBlockDevice}
-      '' +
             ''
+            + lib.optionalString (osdConfig.dbBlockDevice != null) ''
+              udevadm trigger --name-match=${osdConfig.dbBlockDevice}
+            ''
+            + ''
               udevadm settle
-      '' + (optionalString (!osdConfig.skipZap) (
+            ''
+            + (optionalString (!osdConfig.skipZap) (
               ''
                 # Zap OSD block devices, otherwise `ceph-osd` below will try to fsck if there's some old
                 # ceph data on the block device (see https://tracker.ceph.com/issues/24099).
                 ${cfg.package}/bin/ceph-volume lvm zap ${osdConfig.blockDevice}
-        '' + lib.optionalString (osdConfig.dbBlockDevice != null) ''
+              ''
+              + lib.optionalString (osdConfig.dbBlockDevice != null) ''
                 ${cfg.package}/bin/ceph-volume lvm zap ${osdConfig.dbBlockDevice}
               ''
             ));
 
-      script = ''
+          script =
+            ''
               set -euo pipefail
               set -x
               until [ -f /etc/ceph/${cfg.clusterName}.client.admin.keyring ]
@@ -450,10 +480,11 @@ in
               mkdir -p /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}
 
               ln -s ${osdConfig.blockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block
-      '' + lib.optionalString (osdConfig.dbBlockDevice != null) ''
-        ln -s ${osdConfig.dbBlockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block.db
-      '' +
             ''
+            + lib.optionalString (osdConfig.dbBlockDevice != null) ''
+              ln -s ${osdConfig.dbBlockDevice} /var/lib/ceph/osd/${cfg.clusterName}-${toString osdConfig.id}/block.db
+            ''
+            + ''
 
               ${cfg.package}/bin/ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${toString osdConfig.id}/keyring \
                 --name osd.${toString osdConfig.id} --add-key $OSD_SECRET
@@ -474,14 +505,14 @@ in
           };
         };
 
-    makeCephOsdSystemdService = localOsdServiceName: osdConfig: mkIf osdConfig.enable {
+      makeCephOsdSystemdService =
+        localOsdServiceName: osdConfig:
+        mkIf osdConfig.enable {
           description = "Ceph OSD";
 
           # Note we do not have to add `osdConfig.systemdExtraRequiresAfter` here because
           # that's already a dependency of our dependency `ceph-osd-setup-*`.
-      requires = [
+          requires = [ (ensureUnitExists config "ceph-osd-setup-${localOsdServiceName}.service") ];
-        (ensureUnitExists config "ceph-osd-setup-${localOsdServiceName}.service")
-      ];
           requiredBy = [ "multi-user.target" ];
           after = [
             "network.target"
@@ -498,9 +529,7 @@ in
           path = [
             # TODO: use wrapProgram in the ceph package for this in the future
             pkgs.getopt
-      ]
+          ] ++ cephDeviceHealthMonitoringPathsOrPackages;
-        ++ cephDeviceHealthMonitoringPathsOrPackages
-      ;
 
           restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ];
 
@@ -509,9 +538,13 @@ in
             ${lib.getLib cfg.package}/libexec/ceph/ceph-osd-prestart.sh --cluster ${cfg.clusterName} --id ${toString osdConfig.id}
           '';
 
-      serviceConfig = let
+          serviceConfig =
-        clusterIpArg = lib.optionalString (osdConfig.clusterAddress != null) "--cluster_addr=${osdConfig.clusterAddress}";
+            let
-      in {
+              clusterIpArg = lib.optionalString (
+                osdConfig.clusterAddress != null
+              ) "--cluster_addr=${osdConfig.clusterAddress}";
+            in
+            {
               LimitNOFILE = "1048576";
               LimitNPROC = "1048576";
 
@@ -531,7 +564,8 @@ in
           # startLimitIntervalSec = 30 * 60;
         };
 
-  in mkIf cfg.enable {
+    in
+    mkIf cfg.enable {
       environment.systemPackages = [ cfg.package ];
 
       networking.firewall = {
@@ -541,7 +575,10 @@ in
           3300 # ceph msgr-v2
         ];
         allowedTCPPortRanges = [
-        { from = 6800; to = 7300; } # https://docs.ceph.com/en/pacific/rados/configuration/network-config-ref/
+          {
+            from = 6800;
+            to = 7300;
+          } # https://docs.ceph.com/en/pacific/rados/configuration/network-config-ref/
         ];
       };
 
@@ -555,8 +592,7 @@ in
       #   if you want to override an option you've set in `global`.
       #
       # Sample: https://github.com/ceph/ceph/blob/master/src/sample.ceph.conf
-    environment.etc."ceph/${cfg.clusterName}.conf".text =
+      environment.etc."ceph/${cfg.clusterName}.conf".text = ''
-      ''
         [global]
         fsid = ${cfg.fsid}
         mon_initial_members = ${commaSep (map (mon: mon.hostname) cfg.initialMonitors)}
@@ -639,37 +675,45 @@ in
       };
 
       # Allow ceph daemons (which run as user ceph) to collect device health metrics.
-    security.sudo.extraRules =
+      security.sudo.extraRules = map (
-      map ({ sudoersExtraRule, ... }: sudoersExtraRule) cephMonitoringSudoersCommandsAndPackages;
+        { sudoersExtraRule, ... }: sudoersExtraRule
+      ) cephMonitoringSudoersCommandsAndPackages;
 
       # The udevadm trigger/settle in `makeCephOsdSetupSystemdService` waits for these rules rule to be applied.
-    services.udev.extraRules =
+      services.udev.extraRules = lib.concatStringsSep "\n" (
-      lib.concatStringsSep "\n" (
+        lib.mapAttrsToList (
-        lib.mapAttrsToList (_localOsdServiceName: osdConfig:
+          _localOsdServiceName: osdConfig:
           ''
             SUBSYSTEM=="block", ${osdConfig.blockDeviceUdevRuleMatcher}, OWNER="${config.users.users.ceph.name}", GROUP="${config.users.groups.ceph.name}", MODE="0660"
           ''
-          + lib.optionalString (osdConfig.dbBlockDeviceUdevRuleMatcher != null) (
+          + lib.optionalString (osdConfig.dbBlockDeviceUdevRuleMatcher != null) (''
-              ''
             SUBSYSTEM=="block", ${osdConfig.dbBlockDeviceUdevRuleMatcher}, OWNER="${config.users.users.ceph.name}", GROUP="${config.users.groups.ceph.name}", MODE="0660"
-              ''
+          '')
-            )
         ) cfg.osds
       );
 
-    systemd.services = {
+      systemd.services =
+        {
 
           ceph-mon-setup = mkIf cfg.monitor.enable {
             description = "Initialize ceph monitor";
 
             preStart = ensureCephDirs;
 
-        script = let
+            script =
+              let
                 # `--addv` seems currently required to get msgr-v2 working, see:
                 #     https://tracker.ceph.com/issues/53751#note-11
-          monmapNodes = builtins.concatStringsSep " " (lib.concatMap (mon: [ "--addv" mon.hostname "[v2:${mon.ipAddress}:3300,v1:${mon.ipAddress}:6789]" ]) cfg.initialMonitors);
+                monmapNodes = builtins.concatStringsSep " " (
+                  lib.concatMap (mon: [
+                    "--addv"
+                    mon.hostname
+                    "[v2:${mon.ipAddress}:3300,v1:${mon.ipAddress}:6789]"
+                  ]) cfg.initialMonitors
+                );
+              in
               # Monitors cannot simply be changed in config, one has to update the monmap, see note [replacing-ceph-monmap-ips-for-existing-cluster]
-        in ''
+              ''
                 set -euo pipefail
                 rm -rf "${monDir}" # Start from scratch.
                 echo "Initializing monitor."
@@ -697,8 +741,17 @@ in
 
             requires = [ (ensureUnitExists config "ceph-mon-setup.service") ];
             requiredBy = [ "multi-user.target" ];
-        after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mon-setup.service") ];
+            after = [
-        wants = [ "network.target" "local-fs.target" "time-sync.target" ];
+              "network.target"
+              "local-fs.target"
+              "time-sync.target"
+              (ensureUnitExists config "ceph-mon-setup.service")
+            ];
+            wants = [
+              "network.target"
+              "local-fs.target"
+              "time-sync.target"
+            ];
 
             restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ];
 
@@ -760,8 +813,17 @@ in
 
             requires = [ (ensureUnitExists config "ceph-mgr-setup.service") ];
             requiredBy = [ "multi-user.target" ];
-        after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mgr-setup.service") ];
+            after = [
-        wants = [ "network.target" "local-fs.target" "time-sync.target" ];
+              "network.target"
+              "local-fs.target"
+              "time-sync.target"
+              (ensureUnitExists config "ceph-mgr-setup.service")
+            ];
+            wants = [
+              "network.target"
+              "local-fs.target"
+              "time-sync.target"
+            ];
 
             restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ];
 
@@ -817,8 +879,17 @@ in
 
             requires = [ (ensureUnitExists config "ceph-mds-setup.service") ];
             requiredBy = [ "multi-user.target" ];
-        after = [ "network.target" "local-fs.target" "time-sync.target" (ensureUnitExists config "ceph-mds-setup.service") ];
+            after = [
-        wants = [ "network.target" "local-fs.target" "time-sync.target" ];
+              "network.target"
+              "local-fs.target"
+              "time-sync.target"
+              (ensureUnitExists config "ceph-mds-setup.service")
+            ];
+            wants = [
+              "network.target"
+              "local-fs.target"
+              "time-sync.target"
+            ];
 
             restartTriggers = [ config.environment.etc."ceph/${cfg.clusterName}.conf".source ];
 
@@ -842,8 +913,17 @@ in
 
         }
         # Make one OSD service for each configured OSD.
-      // lib.mapAttrs' (localOsdServiceName: osdConfig: nameValuePair "ceph-osd-setup-${localOsdServiceName}" (makeCephOsdSetupSystemdService localOsdServiceName osdConfig)) cfg.osds
+        // lib.mapAttrs' (
-      // lib.mapAttrs' (localOsdServiceName: osdConfig: nameValuePair "ceph-osd-${localOsdServiceName}"       (makeCephOsdSystemdService      localOsdServiceName osdConfig)) cfg.osds;
+          localOsdServiceName: osdConfig:
+          nameValuePair "ceph-osd-setup-${localOsdServiceName}" (
+            makeCephOsdSetupSystemdService localOsdServiceName osdConfig
+          )
+        ) cfg.osds
+        // lib.mapAttrs' (
+          localOsdServiceName: osdConfig:
+          nameValuePair "ceph-osd-${localOsdServiceName}" (
+            makeCephOsdSystemdService localOsdServiceName osdConfig
+          )
+        ) cfg.osds;
     };
 }
-

modules/nixos/container.nix

@@ -1,13 +1,22 @@
-{ config, lib, inputs, overlays, ... }:
+{
+  config,
+  lib,
+  top,
+  overlays,
+  ...
+}:
 
 let
   cfg = config.greg.containers;
 
   # Create a container with all our default settings
 
-	makeContainer = name: container: let
+  makeContainer =
+    _: container:
+    let
       agekey = "/etc/ssh/agenix_key";
-	in {
+    in
+    {
       autoStart = true;
       hostAddress = "192.168.${container.subnet}.1";
       localAddress = "192.168.${container.subnet}.2";
@@ -16,10 +25,12 @@ let
         "${agekey}".hostPath = "/etc/ssh/ssh_host_ed25519_key"; # This is needed for agenix to
       };
       enableTun = container.tailscale;
-		config = { config, pkgs, ... }: {
+      config =
+        { ... }:
+        {
           imports = [
-				inputs.agenix.nixosModules.default
+            top.agenix.nixosModules.default
-				inputs.self.modules.nixosModule
+            top.self.modules.nixosModule
             container.builder
           ];
 
@@ -35,12 +46,14 @@ let
           greg.tailscale.enable = container.tailscale;
         };
     };
-in {
+in
+{
   options.greg.containers = lib.mkOption {
     default = { };
 
-		type = with lib.types; attrsOf ( submodule (
+    type =
-			{
+      with lib.types;
+      attrsOf (submodule ({
         options = {
           tailscale = lib.mkOption {
             type = bool;
@@ -66,8 +79,7 @@ in {
             '';
           };
         };
-			}
+      }));
-		));
   };
 
   config = {

modules/nixos/db.nix

@@ -1,17 +1,28 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.greg.databases;
   dbs = (lib.attrNames cfg);
-in {
+in
+{
   options.greg.databases = lib.mkOption {
     default = { };
-		type = with lib.types; attrsOf ( submodule (
+    type =
-			{ name, config, options, ... }: {
+      with lib.types;
+      attrsOf (
+        submodule (
+          { ... }:
+          {
             # Options reserved for future expansion
             options = { };
           }
-		));
+        )
+      );
   };
 
   config = lib.mkIf (dbs != [ ]) {
@@ -21,7 +32,10 @@ in {
         package = pkgs.postgresql_15;
         checkConfig = true;
         ensureDatabases = dbs;
-				ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs;
+        ensureUsers = map (db: {
+          name = db;
+          ensureDBOwnership = true;
+        }) dbs;
         settings = {
           log_connections = true;
           log_statement = "all";

modules/nixos/default.nix

@@ -1,10 +1,14 @@
-{ config, pkgs, inputs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 let
-	x = if builtins.hasAttr "xonsh-unwrapped" pkgs then
+  x = if builtins.hasAttr "xonsh-unwrapped" pkgs then pkgs.xonsh else pkgs.xonsh.passthru.wrapper;
-		pkgs.xonsh else
+in
-		pkgs.xonsh.passthru.wrapper;
+{
-in {
   imports = [
     ../baseline.nix
     ./backup.nix
@@ -16,7 +20,9 @@ in {
     ./kde.nix
     ./kiwix-serve.nix
     ./linode.nix
+    ./print.nix
     ./proxy.nix
+    ./remote-builder.nix
     ./router.nix
     ./rpi4.nix
     ./sway.nix
@@ -25,14 +31,14 @@ in {
     ./vmdev.nix
   ];
 
-	environment.sessionVariables.MOZ_ENABLE_WAYLAND = "0";
   environment.systemPackages = with pkgs; [
+    btrfs-progs
     coreutils-full
-		direnv  # needed for xonsh-direnv
     efibootmgr
     psmisc
     lshw
     usbutils
+    xfsprogs
   ];
 
   system.stateVersion = "24.05";
@@ -53,8 +59,10 @@ in {
 
   programs.xonsh = {
     enable = true;
-		package = (x.override {
+    package = (
-			extraPackages = (ps: with ps; [
+      x.override {
+        extraPackages = (
+          ps: with ps; [
             (ps.toPythonModule pkgs.pipenv)
             pyyaml
             requests
@@ -62,8 +70,10 @@ in {
             xonsh-apipenv
             pkgs.nur.repos.xonsh-xontribs.xonsh-direnv
             pkgs.nur.repos.xonsh-xontribs.xontrib-vox
-			]);
+          ]
-		});
+        );
+      }
+    );
   };
 
   # Enable the OpenSSH daemon for remote control
@@ -78,9 +88,14 @@ in {
   users.users.greg = {
     isNormalUser = true;
     createHome = true;
-		extraGroups = [ "wheel" "networkmanager" ]; # Enable ‘sudo’ for the user.
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+    ]; # Enable ‘sudo’ for the user.
     shell = config.programs.xonsh.package;
-		openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile ../../home/ssh/authorized_keys);
+    openssh.authorizedKeys.keys = lib.strings.splitString "\n" (
+      builtins.readFile ../../home/ssh/authorized_keys
+    );
   };
 
   i18n.defaultLocale = "en_US.UTF-8";

modules/nixos/gnome.nix

@@ -1,9 +1,16 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 let
   cfg = config.greg.gnome;
 
-in with lib; {
+in
+with lib;
+{
   options = {
     greg.gnome.enable = mkEnableOption "Enable my default Gnome3 setup";
   };
@@ -23,9 +30,7 @@ in with lib; {
         xkb.layout = "us";
       };
 
-			udev.packages = with pkgs; [
+      udev.packages = with pkgs; [ gnome-settings-daemon ];
-				gnome3.gnome-settings-daemon
-			];
 
       pipewire.enable = true;
 

modules/nixos/home.nix

@@ -3,7 +3,8 @@
 let
   cfg = config.greg.home;
 
-in with lib;
+in
+with lib;
 {
   options.greg.home = mkOption {
     type = types.bool;

modules/nixos/kde.nix

@@ -1,30 +1,46 @@
-{ config, pkgs, lib, options, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  options,
+  ...
+}:
 
 let
   cfg = config.greg.kde;
 
-in with lib; {
+in
+with lib;
+{
   options = {
     greg.kde.enable = mkEnableOption "Enable my default KDE setup";
   };
 
   config = mkIf cfg.enable {
+    hardware = {
+      bluetooth.enable = true;
+    };
     # Sets up a basic KDE installation
-		services = {
+    systemd.services.bluetooth.requiredBy = [ "multi-user.target" ];
+    services =
+      {
         xserver = {
           enable = true;
           xkb.layout = "us";
           # Trackpad support
-				libinput.enable = true;
         };
 
+        libinput.enable = true;
+        blueman.enable = true;
+
         pipewire = {
           enable = true;
           alsa.enable = true;
           alsa.support32Bit = true;
           pulse.enable = true;
         };
-		} // (optionalAttrs (builtins.hasAttr "plasma6" options.services.xserver.desktopManager) {
+      }
+      // (optionalAttrs (builtins.hasAttr "plasma6" options.services.xserver.desktopManager) {
         desktopManager.plasma6.enable = true;
         displayManager = {
           defaultSession = "plasma";
@@ -42,7 +58,6 @@ in with lib; {
     environment.systemPackages = with pkgs; [
       kalendar
       korganizer
-			plasma-pa
     ];
   };
 }

modules/nixos/kiwix-serve.nix

@@ -1,8 +1,15 @@
-{  config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 let
   cfg = config.services.kiwix-serve;
-in with lib; {
+in
+with lib;
+{
   options.services.kiwix-serve = {
     enable = mkEnableOption "Enable the Kiwix web server";
 
@@ -21,16 +28,15 @@ in with lib; {
     proxy = mkOption {
       type = types.str;
       default = "";
-			description = ''Upstream proxy, if any, to configure with kiwix. Specify
+      description = ''
+        Upstream proxy, if any, to configure with kiwix. Specify
         				host and port. E.g. "localhost:8080"
         			'';
     };
   };
 
   config = mkIf cfg.enable {
-		environment.systemPackages = [
+    environment.systemPackages = [ pkgs.kiwix-tools ];
-			pkgs.kiwix-tools
-		];
 
     systemd.services.kiwix-serve = {
       enable = true;

modules/nixos/linode.nix

@@ -1,9 +1,15 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.greg.linode;
 
-in with lib;
+in
+with lib;
 {
   options.greg.linode = {
     enable = mkEnableOption "Set sensible defaults for a Linode host";

modules/nixos/print.nix

@@ -0,0 +1,39 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.greg.print;
+
+in
+with lib;
+{
+  options.greg.print.enable = mkOption {
+    type = types.bool;
+    default = true;
+    description = "Configures the system to print with my home printer";
+  };
+
+  config = mkIf cfg.enable {
+    # ipp://printer.thehellings.lan:631/ - generic postscript printer
+    services.printing = {
+      enable = true;
+      drivers = with pkgs; [ gutenprint ] ++ (lib.optional pkgs.stdenv.isx86_64 gutenprintBin);
+    };
+
+    hardware.printers.ensurePrinters = [
+      {
+        name = "HomeLexmarkColorPrinter";
+        location = "Home office";
+        deviceUri = "ipp://printer.thehellings.lan:631/";
+        model = "drv:///sample.drv/generic.ppd";
+        ppdOptions = {
+          PageSize = "Letter";
+        };
+      }
+    ];
+  };
+}

modules/nixos/proxy.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:
 
 let
   cfg = config.greg.proxies;
@@ -10,16 +10,20 @@ let
     enableACME = dest.ssl;
     locations."${dest.path}" = {
       proxyPass = dest.target;
-			extraConfig = ''
+      extraConfig =
+        ''
           proxy_http_version 1.1;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection $connection_upgrade;
-'' + dest.extraConfig;
+        ''
+        + dest.extraConfig;
     };
     serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ];
   };
 
-in with lib; {
+in
+with lib;
+{
   options = {
     greg.proxies = mkOption {
       default = { };
@@ -36,8 +40,11 @@ in with lib; {
         enablement.
       '';
 
-			type = with types; attrsOf (submodule (
+      type =
-				{ name, config, options, ... }:
+        with types;
+        attrsOf (
+          submodule (
+            { ... }:
             {
               options = {
                 genAliases = mkOption {
@@ -70,7 +77,9 @@ in with lib; {
                   default = "";
                 };
               };
-				}));
+            }
+          )
+        );
     };
   };
 

modules/nixos/remote-builder.nix

@@ -0,0 +1,33 @@
+{ lib, config, ... }:
+
+let
+  cfg = config.greg.remote-builder;
+in
+with lib;
+{
+  options.greg.remote-builder = {
+    enable = mkEnableOption "Enable this as a remote builder for myself";
+  };
+
+  config = mkIf cfg.enable {
+    greg.tailscale.enable = true;
+    users.users.remote-builder-user = {
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG4fNCnomQEsFKQZp16LXRqkfXHzzZbGAYJWPMvlGGQy root@exodus"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMGJjyFVOsF74QKzRITc8z/5MJlIa47P1tMm9Z8HRJLm root@jude"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMMOdWSq6NtcP6sfe2uke4wSfgE16hfa970t+8ADdLwk root@nixos"
+      ];
+      homeMode = "500";
+      isNormalUser = true;
+      useDefaultShell = true;
+    };
+    # The builder user needs to be trusted to submit builds
+    nix.settings.trusted-users = [ config.users.users.remote-builder-user.name ];
+    # If the system is powerful enough to be a remote builder, it should
+    # be powerful enough to do some basic qemu stuff
+    boot.binfmt.emulatedSystems = [
+      "i686-linux"
+      "aarch64-linux"
+    ];
+  };
+}

modules/nixos/router.nix

@@ -1,21 +1,41 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist);
   # Pass the names of the wan/lan ports
-	nftConfig = {
+  nftConfig =
+    {
       wan,
       lan,
       limitedLan ? [ ],
-		openPorts ? [ "ssh" "67" "53" ],  # ssh, dhcpd, dns
+      openPorts ? [
-		openUDPPorts ? [ "67" "53" ] # dhcpd, dns
+        "ssh"
-	}: let
+        "67"
+        "53"
+      ],
+      # ssh, dhcpd, dns
+      openUDPPorts ? [
+        "67"
+        "53"
+      ], # dhcpd, dns
+    }:
+    let
       lanList = names lan;
       allLan = names (lan ++ limitedLan);
       wanName = names wan;
-			portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept") openPorts;
+      portsString = lib.strings.concatMapStringsSep "\n" (
-			udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts;
+        x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept"
-	in lib.strings.concatStringsSep "\n" [
+      ) openPorts;
+      udpPortsString = lib.strings.concatMapStringsSep "\n" (
+        x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept"
+      ) openUDPPorts;
+    in
+    lib.strings.concatStringsSep "\n" [
       "table ip filter {"
       "	chain output {"
       "		type filter hook output priority 100; policy accept;"
@@ -57,7 +77,9 @@ let
     ];
   cfg = config.greg.router;
 
-in with lib; {
+in
+with lib;
+{
   options.greg.router = {
     enable = mkEnableOption "Enable NFTables and routing";
     wan = mkOption {
@@ -78,11 +100,13 @@ in with lib; {
   config = mkIf cfg.enable {
     networking.nftables = {
       enable = true;
-			ruleset = (nftConfig {
+      ruleset = (
+        nftConfig {
           inherit (cfg) lan wan;
           openPorts = config.networking.firewall.allowedTCPPorts;
           openUDPPorts = config.networking.firewall.allowedUDPPorts;
-			});
+        }
+      );
     };
 
     environment.systemPackages = [

modules/nixos/rpi4.nix

@@ -1,9 +1,16 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.greg.rpi4;
 
-in with lib; {
+in
+with lib;
+{
   options = {
     greg.rpi4 = {
       enable = mkEnableOption "Enable support for Raspberry Pi 4s";

modules/nixos/sway.nix

@@ -1,9 +1,11 @@
-{ config, pkgs, lib, ... }:
+{ config, lib, ... }:
 
 let
   cfg = config.greg.sway;
 
-in with lib; {
+in
+with lib;
+{
   options = {
     greg.sway.enable = mkEnableOption "Enable my default Gnome3 setup";
   };

modules/nixos/syncthing.nix

@@ -1,8 +1,10 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:
 
 let
   cfg = config.greg.syncthing;
-in with lib; {
+in
+with lib;
+{
   options.greg.syncthing = {
     enable = mkEnableOption "Setup my personal minimal configuration for Syncthing";
   };

modules/nixos/tailscale.nix

@@ -2,7 +2,8 @@
 
 let
   cfg = config.greg.tailscale;
-in {
+in
+{
   options = {
     greg.tailscale.enable = lib.mkEnableOption "Enable Tailscale";
   };
@@ -14,5 +15,6 @@ in {
       "net.ipv4.ip_forward" = "1";
       "net.ipv6.conf.all.forwarding" = "1";
     };
+    systemd.services.tailscaled.partOf = [ "network-online.target" ];
   };
 }

modules/nixos/vmdev.nix

@@ -1,8 +1,14 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 
 let
   cfg = config.greg.vmdev;
-in with lib;
+in
+with lib;
 {
   options = {
     greg.vmdev = {
@@ -23,7 +29,7 @@ in with lib;
   config = mkIf cfg.enable {
     environment.systemPackages = with pkgs; [
       dmidecode
-			guestfs-tools
+      #guestfs-tools
       libguestfs
       OVMFFull
       packer
@@ -58,6 +64,7 @@ in with lib;
         preStart = "${pkgs.kmod}/bin/modprobe kvm_${cfg.system}";
         postStop = "${pkgs.kmod}/bin/rmmod kvm_${cfg.system} kvm";
         conflicts = [ "vbox.service" ];
+        #overrideStrategy = "asDropin";
       };
       vbox = {
         preStart = "${pkgs.kmod}/bin/modprobe vboxdrv vboxnetadp vboxnetflt";

overlays/aacs.nix

@@ -1,10 +0,0 @@
-{ pkgs, ... }:
-
-pkgs.writeShellScriptBin "aacs" ''
-set -ex
-[ ! -d "''${HOME}/.config/aacs" ] && mkdir -p "''${HOME}/.config/aacs"
-cd "''${HOME}/.config/aacs"
-[ -f KEYDB.cfg.zip ] && rm -f KEYDB.cfg.zip
-curl -L -o KEYDB.cfg.zip "http://fvonline-db.bplaced.net/fv_download.php?lang=eng"
-${pkgs.unzip}/bin/unzip KEYDB.cfg.zip
-mv keydb.cfg KEYDB.cfg''

overlays/create_ssl.nix

@@ -1,28 +0,0 @@
-{ writeShellScriptBin, openssl, ...}:
-
-writeShellScriptBin "create_ssl" ''
-set -e -o pipefail
-name="''${1}"
-root_key="''${2}"
-
-function usage {
-	echo "USAGE: create_ssl <cert name> <root path>"
-}
-
-if [ -z "''${name}" ]; then
-	usage
-	exit 1
-fi
-
-if [ -z "''${root_key}" ]; then
-	usage
-	exit 1
-fi
-
-# Create the certificate key
-${openssl}/bin/openssl ecparam -out "''${name}.key" -name prime256v1 -genkey
-# Create the CSR
-${openssl}/bin/openssl req -name -sha256 -key "''${name}.key" -out "''${name}.csr"
-# Sign it
-${openssl}/bin/openssl x509 -req -in "''${name}.csr" -CA "''${root_key}.crt" -CAkey "''${root_key}.key" -CAcreateserial -out "''${name}.crt" -days 3650 -sha256
-''