merge: harden ephvm

.git-blame-ignore-revs

@@ -1,6 +1,8 @@
 # nix fmt & statix
 f011c8d71ba09bd94ab04b8d771858b90a03fbf9
 3aff25b4486a143cd6282f8845c16216598e1c7e
+2204b12fadf27886058e6945806ce93a547f5278
+77236af5896524218605badcd3cdfc2267b213da
 
 # host rename
 cfe4c43887a41e52be4e6472474c0fc3788f86e8

features/bootloader.nix

@@ -1,6 +1,11 @@
 {
   nixos =
-    { config, lib, inputs, ... }:
+    {
+      config,
+      lib,
+      inputs,
+      ...
+    }:
     let
       cfg = config.features.bootloader;
     in
@@ -17,11 +22,16 @@
           ];
           default = "systemd-boot";
         };
+
+        plymouth.enable = lib.mkEnableOption "plymouth boot splash";
       };
 
-      config = lib.mkIf cfg.enable (lib.mkMerge [
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
           {
             boot.loader.efi.canTouchEfiVariables = true;
+            # request the largest framebuffer uefi offers; plymouth inherits it
+            boot.loader.systemd-boot.consoleMode = "max";
           }
 
           (lib.mkIf (cfg.mode == "systemd-boot") {
@@ -35,6 +45,29 @@
               pkiBundle = "/var/lib/sbctl";
             };
           })
-      ]);
+
+          (lib.mkIf cfg.plymouth.enable {
+            # plymouth needs systemd-initrd to render the luks prompt cleanly
+            boot.initrd.systemd.enable = true;
+
+            # host is responsible for early-KMS so plymouth lands on the gpu driver,
+            # not simpledrm (e.g. hardware.amdgpu.initrd.enable on amd hosts)
+            boot.plymouth.enable = true;
+            stylix.targets.plymouth.logoAnimated = false;
+
+            boot.kernelParams = [
+              "quiet"
+              "splash"
+              "loglevel=3"
+              "rd.systemd.show_status=false"
+              "rd.udev.log_level=3"
+              "udev.log_priority=3"
+              "plymouth.force-scale=1"
+            ];
+            boot.consoleLogLevel = 0;
+            boot.initrd.verbose = false;
+          })
+        ]
+      );
     };
 }

features/claude.nix

@@ -6,14 +6,21 @@
     };
 
   home =
-    { pkgs, lib, osConfig, ... }:
+    {
+      pkgs,
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
     let
       cfg = osConfig.features.claude;
+      packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
     in
     {
       config = lib.mkIf cfg.enable {
         home.packages = [
-          pkgs.claude-code
+          packages.claude-code
           pkgs.mcp-nixos
         ];
       };

features/desktop.nix

@@ -1,6 +1,12 @@
 {
   nixos =
-    { config, lib, pkgs, inputs, ... }:
+    {
+      config,
+      lib,
+      pkgs,
+      inputs,
+      ...
+    }:
     let
       cfg = config.features.desktop;
     in
@@ -49,7 +55,8 @@
         };
       };
 
-      config = lib.mkIf cfg.enable (lib.mkMerge [
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
           # base desktop
           {
             security.polkit.enable = true;
@@ -58,13 +65,18 @@
 
             xdg.portal = {
               enable = true;
-            xdgOpenUsePortal = true;
               extraPortals = with pkgs; [
                 xdg-desktop-portal-wlr
                 xdg-desktop-portal-gtk
               ];
             };
 
+            # honor persist_mode so electron apps don't re-prompt for screencast every login
+            systemd.user.services.xdg-desktop-portal-wlr.environment.XDPW_PERSIST_MODE = "permanent";
+
+            # enable ozone/wayland for electron apps so idle detection works
+            environment.sessionVariables.NIXOS_OZONE_WL = "1";
+
             fonts.packages = with pkgs; [
               font-awesome
               nerd-fonts.jetbrains-mono
@@ -72,7 +84,7 @@
 
             stylix = {
               enable = true;
-            polarity = cfg.theme.polarity;
+              inherit (cfg.theme) polarity;
               image = cfg.theme.wallpaper;
               base16Scheme = "${pkgs.base16-schemes}/share/themes/${cfg.theme.scheme}.yaml";
             };
@@ -108,7 +120,7 @@
               bolt-launcher
               libnotify
               bibata-cursors
-            vesktop
+              discord
               rocketchat-desktop
               telegram-desktop
               slack
@@ -120,12 +132,13 @@
               wl-mirror
               protonmail-bridge
               ledger-live-desktop
+              imv
+              yazi
+              nemo
+              file-roller
+              libreoffice-still
             ];
 
-          xdg.mime.defaultApplications = {
-            "application/pdf" = "org.pwmt.zathura.desktop";
-          };
-
             # kindle udev rules for calibre
             features.udev.kindle.enable = lib.mkDefault true;
           })
@@ -136,17 +149,125 @@
               inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system}.ca-matheo-si
             ];
           })
-      ]);
+        ]
+      );
     };
 
   home =
-    { lib, inputs, osConfig, ... }:
+    {
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
     let
       cfg = osConfig.features.desktop;
     in
     {
-      config = lib.mkIf cfg.enable {
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
+          {
             home.file.".assets".source = inputs.assets;
+          }
+
+          (lib.mkIf cfg.apps.enable {
+            # TODO:(@janezicmatej) consider moving nvim desktop entry to neovim feature
+            xdg.desktopEntries.nvim = {
+              name = "Neovim";
+              exec = "ghostty -e nvim %F";
+              terminal = false;
+              mimeType = [
+                "text/plain"
+                "application/json"
+                "text/markdown"
+              ];
             };
+
+            xdg.mimeApps = {
+              enable = true;
+              defaultApplications = {
+                # text
+                "text/plain" = "nvim.desktop";
+                "application/json" = "nvim.desktop";
+                "text/markdown" = "nvim.desktop";
+
+                # web
+                "text/html" = "google-chrome.desktop";
+                "application/xhtml+xml" = "google-chrome.desktop";
+                "x-scheme-handler/http" = "google-chrome.desktop";
+                "x-scheme-handler/https" = "google-chrome.desktop";
+                "x-scheme-handler/ftp" = "google-chrome.desktop";
+                "x-scheme-handler/about" = "google-chrome.desktop";
+                "x-scheme-handler/unknown" = "google-chrome.desktop";
+
+                # mail and calendar
+                "x-scheme-handler/mailto" = "thunderbird.desktop";
+                "message/rfc822" = "thunderbird.desktop";
+                "text/calendar" = "thunderbird.desktop";
+
+                # documents
+                "application/pdf" = "org.pwmt.zathura.desktop";
+                "application/postscript" = "org.pwmt.zathura.desktop";
+                "image/vnd.djvu" = "org.pwmt.zathura.desktop";
+                "application/epub+zip" = "org.pwmt.zathura.desktop";
+
+                # office
+                "application/msword" = "libreoffice-writer.desktop";
+                "application/vnd.ms-excel" = "libreoffice-calc.desktop";
+                "application/vnd.ms-powerpoint" = "libreoffice-impress.desktop";
+                "application/vnd.openxmlformats-officedocument.wordprocessingml.document" =
+                  "libreoffice-writer.desktop";
+                "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" = "libreoffice-calc.desktop";
+                "application/vnd.openxmlformats-officedocument.presentationml.presentation" =
+                  "libreoffice-impress.desktop";
+                "application/vnd.oasis.opendocument.text" = "libreoffice-writer.desktop";
+                "application/vnd.oasis.opendocument.spreadsheet" = "libreoffice-calc.desktop";
+                "application/vnd.oasis.opendocument.presentation" = "libreoffice-impress.desktop";
+                "text/csv" = "libreoffice-calc.desktop";
+
+                # images
+                "image/png" = "imv-dir.desktop";
+                "image/jpeg" = "imv-dir.desktop";
+                "image/gif" = "imv-dir.desktop";
+                "image/webp" = "imv-dir.desktop";
+                "image/tiff" = "imv-dir.desktop";
+                "image/bmp" = "imv-dir.desktop";
+                "image/svg+xml" = "google-chrome.desktop";
+
+                # video
+                "video/mp4" = "mpv.desktop";
+                "video/x-matroska" = "mpv.desktop";
+                "video/webm" = "mpv.desktop";
+                "video/quicktime" = "mpv.desktop";
+                "video/x-msvideo" = "mpv.desktop";
+
+                # audio
+                "audio/mpeg" = "mpv.desktop";
+                "audio/flac" = "mpv.desktop";
+                "audio/ogg" = "mpv.desktop";
+                "audio/wav" = "mpv.desktop";
+                "audio/aac" = "mpv.desktop";
+
+                # archives
+                "application/zip" = "org.gnome.FileRoller.desktop";
+                "application/x-tar" = "org.gnome.FileRoller.desktop";
+                "application/gzip" = "org.gnome.FileRoller.desktop";
+                "application/x-rar-compressed" = "org.gnome.FileRoller.desktop";
+                "application/x-7z-compressed" = "org.gnome.FileRoller.desktop";
+                "application/x-bzip2" = "org.gnome.FileRoller.desktop";
+                "application/x-xz" = "org.gnome.FileRoller.desktop";
+
+                # file manager
+                "inode/directory" = "nemo.desktop";
+
+                # app deep links
+                "x-scheme-handler/tg" = "org.telegram.desktop.desktop";
+                "x-scheme-handler/discord" = "discord.desktop";
+                "x-scheme-handler/slack" = "slack.desktop";
+              };
+            };
+          })
+        ]
+      );
     };
 }

features/dev.nix

@@ -6,7 +6,13 @@
     };
 
   home =
-    { pkgs, lib, inputs, osConfig, ... }:
+    {
+      pkgs,
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
     let
       cfg = osConfig.features.dev;
       packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
@@ -23,6 +29,7 @@
           packages.ahab
           pkgs.just
           pkgs.presenterm
+          pkgs.qemu
         ];
       };
     };

features/direnv/default.nix

@@ -1,6 +1,11 @@
 {
   nixos =
-    { config, lib, inputs, ... }:
+    {
+      config,
+      lib,
+      inputs,
+      ...
+    }:
     let
       cfg = config.features.direnv;
     in

features/docker.nix

@@ -1,6 +1,11 @@
 {
   nixos =
-    { config, lib, user, ... }:
+    {
+      config,
+      lib,
+      user,
+      ...
+    }:
     let
       cfg = config.features.docker;
     in

features/filedrop.nix

@@ -1,6 +1,11 @@
 {
   nixos =
-    { config, lib, userKeys, ... }:
+    {
+      config,
+      lib,
+      userKeys,
+      ...
+    }:
     let
       cfg = config.features.filedrop;
     in

features/gaming.nix

@@ -1,6 +1,11 @@
 {
   nixos =
-    { config, lib, pkgs, ... }:
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
     let
       cfg = config.features.gaming;
     in

features/git.nix

@@ -6,7 +6,13 @@
     };
 
   home =
-    { pkgs, lib, inputs, osConfig, ... }:
+    {
+      pkgs,
+      lib,
+      inputs,
+      osConfig,
+      ...
+    }:
     let
       cfg = osConfig.features.git;
       packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};

features/gnupg.nix

@@ -1,6 +1,11 @@
 {
   nixos =
-    { config, lib, pkgs, ... }:
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
     let
       cfg = config.features.gnupg;
     in
@@ -14,7 +19,8 @@
         };
       };
 
-      config = lib.mkIf cfg.enable (lib.mkMerge [
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
           {
             programs.gnupg.agent = {
               enable = true;
@@ -31,6 +37,7 @@
 
             services.pcscd.enable = true;
           })
-      ]);
+        ]
+      );
     };
 }

features/harmonia/default.nix

@@ -43,15 +43,10 @@
           path = [ config.nix.package ];
         };
 
-        systemd.timers.cache-builder = {
+        # restart cache-builder after every nixos switch (non-blocking)
-          description = "Periodically build all host closures";
+        system.activationScripts.cache-builder = lib.stringAfter [ "specialfs" ] ''
-          wantedBy = [ "timers.target" ];
+          ${config.systemd.package}/bin/systemctl restart --no-block cache-builder.service || true
-          timerConfig = {
+        '';
-            OnUnitActiveSec = "15min";
-            OnBootSec = "5min";
-            Persistent = true;
-          };
-        };
       };
     };
 }

features/initrd-ssh.nix

@@ -57,9 +57,13 @@
           "ip=${mkIpString cfg.ip}"
         ];
 
+        boot.initrd.systemd.enable = true;
+
+        # remote unlock may take a while; don't let device units give up
+        boot.initrd.systemd.settings.Manager.DefaultDeviceTimeoutSec = "infinity";
+
         boot.initrd.network = {
           enable = true;
-          udhcpc.enable = !cfg.ip.enable;
           ssh = {
             enable = true;
             port = 22;
@@ -69,10 +73,18 @@
             ];
             inherit (cfg) authorizedKeys;
           };
-          postCommands = ''
-            echo 'cryptsetup-askpass' >> /root/.profile
-          '';
         };
+
+        # systemd-networkd retries DHCP indefinitely, unlike udhcpc
+        boot.initrd.systemd.network.networks = lib.mkIf (!cfg.ip.enable) {
+          "10-initrd" = {
+            matchConfig.Driver = cfg.networkModule;
+            networkConfig.DHCP = "yes";
+          };
+        };
+
+        # forward LUKS password prompt to the SSH session
+        boot.initrd.systemd.users.root.shell = "/bin/systemd-tty-ask-password-agent";
       };
     };
 }

features/neovim.nix

@@ -26,7 +26,8 @@
       cfg = osConfig.features.neovim;
     in
     {
-      config = lib.mkIf cfg.enable (lib.mkMerge [
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
           (lib.optionalAttrs (options ? stylix) {
             # disable stylix neovim target when stylix is present
             stylix.targets.neovim.enable = false;
@@ -38,6 +39,7 @@
 
             programs.neovim = {
               enable = true;
+              sideloadInitLua = true;
               vimAlias = true;
               defaultEditor = true;
               package = inputs.neovim-nightly-overlay.packages.${pkgs.stdenv.hostPlatform.system}.default;
@@ -74,6 +76,7 @@
               ];
             };
           }
-      ]);
+        ]
+      );
     };
 }

features/nix-settings.nix

@@ -40,15 +40,15 @@
               "flakes"
             ];
             download-buffer-size = 2 * 1024 * 1024 * 1024;
+            download-attempts = 3;
+            fallback = true;
             warn-dirty = false;
-            substituters =
+            substituters = [
-              [
               "https://cache.nixos.org"
               "https://nix-community.cachix.org?priority=45"
             ]
             ++ lib.optional cfg.towerCache.enable "http://tower:5000?priority=50";
-            trusted-public-keys =
+            trusted-public-keys = [
-              [
               "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
               "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
             ]
@@ -57,13 +57,13 @@
 
           gc = {
             automatic = true;
-            dates = cfg.gc.dates;
+            inherit (cfg.gc) dates;
             options = "--delete-older-than ${cfg.gc.olderThan}";
           };
 
           optimise = {
             automatic = true;
-            dates = cfg.optimise.dates;
+            inherit (cfg.optimise) dates;
           };
         };
       };

features/onepassword.nix

@@ -1,6 +1,11 @@
 {
   nixos =
-    { config, lib, user, ... }:
+    {
+      config,
+      lib,
+      user,
+      ...
+    }:
     let
       cfg = config.features.onepassword;
     in

features/remote-base.nix

@@ -1,6 +1,11 @@
 {
   nixos =
-    { config, lib, user, ... }:
+    {
+      config,
+      lib,
+      user,
+      ...
+    }:
     let
       cfg = config.features.remote-base;
     in

features/shell.nix

@@ -6,7 +6,12 @@
     };
 
   home =
-    { pkgs, lib, osConfig, ... }:
+    {
+      pkgs,
+      lib,
+      osConfig,
+      ...
+    }:
     let
       cfg = osConfig.features.shell;
     in

features/sway.nix

@@ -1,6 +1,11 @@
 {
   nixos =
-    { config, lib, pkgs, ... }:
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
     let
       cfg = config.features.sway;
       desktopCfg = config.features.desktop;
@@ -15,7 +20,8 @@
         };
       };
 
-      config = lib.mkIf cfg.enable (lib.mkMerge [
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
           {
             # soft dependency
             features.desktop.enable = lib.mkDefault true;
@@ -35,6 +41,8 @@
               extraSessionCommands = ''
                 # fix for java awt apps not rendering
                 export _JAVA_AWT_WM_NONREPARENTING=1
+                # propagate XDG_DATA_DIRS to dbus/systemd for d-bus activated apps
+                dbus-update-activation-environment --systemd XDG_DATA_DIRS
               '';
             };
 
@@ -86,6 +94,7 @@
               };
             };
           })
-      ]);
+        ]
+      );
     };
 }

features/udev.nix

@@ -1,6 +1,11 @@
 {
   nixos =
-    { config, lib, pkgs, ... }:
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
     let
       cfg = config.features.udev;
     in
@@ -24,7 +29,8 @@
         };
       };
 
-      config = lib.mkIf cfg.enable (lib.mkMerge [
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
           (lib.mkIf cfg.kindle.enable {
             # NOTE:(@janezicmatej) uses services.udev.packages instead of extraRules
             # because extraRules writes to 99-local.rules which is too late for uaccess
@@ -47,6 +53,7 @@
           (lib.mkIf cfg.keyboard-zsa.enable {
             hardware.keyboard.zsa.enable = true;
           })
-      ]);
+        ]
+      );
     };
 }

features/user-matej.nix

@@ -9,9 +9,7 @@ in
     sshAuthorizedKeys = sshKeys;
   };
 
-  nixos =
+  nixos = _: {
-    { ... }:
-    {
     users.users.matej = {
       uid = 1000;
       isNormalUser = true;

features/vm-guest.nix

@@ -40,21 +40,18 @@
         };
       };
 
-      config = lib.mkIf cfg.enable (lib.mkMerge [
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
           {
-          services.qemuGuest.enable = true;
             services.spice-vdagentd.enable = lib.mkIf (!cfg.headless) true;
 
             boot.kernelParams = lib.mkIf cfg.headless [ "console=ttyS0,115200" ];
 
+            # 9p autoloads on first mount
             boot.initrd.availableKernelModules = [
               "9p"
               "9pnet_virtio"
             ];
-          boot.kernelModules = [
-            "9p"
-            "9pnet_virtio"
-          ];
 
             networking = {
               useDHCP = true;
@@ -67,7 +64,6 @@
               curl
               wget
               htop
-            sshfs
             ];
           }
 
@@ -110,6 +106,7 @@
               };
             };
           })
-      ]);
+        ]
+      );
     };
 }

features/zsh.nix

@@ -1,6 +1,12 @@
 {
   nixos =
-    { config, lib, pkgs, user, ... }:
+    {
+      config,
+      lib,
+      pkgs,
+      user,
+      ...
+    }:
     let
       cfg = config.features.zsh;
     in
@@ -15,7 +21,8 @@
         };
       };
 
-      config = lib.mkIf cfg.enable (lib.mkMerge [
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
           {
             programs.zsh.enable = true;
             environment.etc."zshenv".text = ''
@@ -26,11 +33,17 @@
           (lib.mkIf cfg.loginShell.enable {
             users.users.${user}.shell = pkgs.zsh;
           })
-      ]);
+        ]
+      );
     };
 
   home =
-    { pkgs, lib, osConfig, ... }:
+    {
+      pkgs,
+      lib,
+      osConfig,
+      ...
+    }:
     let
       cfg = osConfig.features.zsh;
     in

flake.lock

@@ -106,11 +106,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773889306,
+        "lastModified": 1776613567,
-        "narHash": "sha256-PAqwnsBSI9SVC2QugvQ3xeYCB0otOwCacB1ueQj2tgw=",
+        "narHash": "sha256-gC9Cp5ibBmGD5awCA9z7xy6MW6iJufhazTYJOiGlCUI=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "5ad85c82cc52264f4beddc934ba57f3789f28347",
+        "rev": "32f4236bfc141ae930b5ba2fb604f561fed5219d",
         "type": "github"
       },
       "original": {
@@ -273,11 +273,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776030105,
+        "lastModified": 1776777932,
-        "narHash": "sha256-b4cNpWPDSH+/CTTiw8++yGh1UYG2kQNrbIehV2iGoeo=",
+        "narHash": "sha256-0R3Yow/NzSeVGUke5tL7CCkqmss4Vmi6BbV6idHzq/8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "49088dc2e7a876e338e510c5f5f60f659819c650",
+        "rev": "5d5640599a0050b994330328b9fd45709c909720",
         "type": "github"
       },
       "original": {
@@ -317,11 +317,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1775952282,
+        "lastModified": 1776729909,
-        "narHash": "sha256-iJcGy0pW0wX7q6HAQuKx8sskTyu8an0l0gI3TBgzk3E=",
+        "narHash": "sha256-wGu/N42PJqrj8ju9GoXdppg4rwaKzZqdAjsgxJbCvfY=",
         "owner": "nix-community",
         "repo": "neovim-nightly-overlay",
-        "rev": "f719e136a8e0cd91e70515e590385356abce1341",
+        "rev": "ff21a18bde28b4c8ca0bc1f9a5b7186a1b89a3d1",
         "type": "github"
       },
       "original": {
@@ -333,11 +333,11 @@
     "neovim-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1775949028,
+        "lastModified": 1776727374,
-        "narHash": "sha256-JXrr9lxKfTIm/VW4jvaB1RU9r+7pAoaXeDsy24TGPiw=",
+        "narHash": "sha256-iP5SviNXW5W+ay4ZmwjDFsfQjfM+fYlUxRlLPHjpwWI=",
         "owner": "neovim",
         "repo": "neovim",
-        "rev": "4a289bfce3e71bf00d1eced168a6a7bbb270b95b",
+        "rev": "901b3f0c394a53961781ebeee682e64ad690a242",
         "type": "github"
       },
       "original": {
@@ -364,11 +364,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1775888245,
+        "lastModified": 1776329215,
-        "narHash": "sha256-nwASzrRDD1JBEu/o8ekKYEXm/oJW6EMCzCRdrwcLe90=",
+        "narHash": "sha256-a8BYi3mzoJ/AcJP8UldOx8emoPRLeWqALZWu4ZvjPXw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "13043924aaa7375ce482ebe2494338e058282925",
+        "rev": "b86751bc4085f48661017fa226dee99fab6c651b",
         "type": "github"
       },
       "original": {
@@ -395,11 +395,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1776031281,
+        "lastModified": 1776807375,
-        "narHash": "sha256-MCXhNHfTvsvbdkn9WV3Rv5Z0tUig1CtINZV+jaWh04k=",
+        "narHash": "sha256-LDnHG0T54OEHyRydmGUlAND8ham0KrRNWjgoS+6GUd4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "4ee46f65286df51761a238bb0f024f8d696ac683",
+        "rev": "553ecb1686a2edb75dee44c9f72e1674e6adc26a",
         "type": "github"
       },
       "original": {
@@ -411,11 +411,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1775811116,
+        "lastModified": 1776560675,
-        "narHash": "sha256-t+HZK42pB6N+i5RGbuy7Xluez/VvWbembBdvzsc23Ss=",
+        "narHash": "sha256-p68udKWWh7+V4ZPpcMDq0gTHWNZJnr4JPI+kHPPE40o=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "54170c54449ea4d6725efd30d719c5e505f1c10e",
+        "rev": "e07580dae39738e46609eaab8b154de2488133ce",
         "type": "github"
       },
       "original": {
@@ -427,11 +427,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1775710090,
+        "lastModified": 1776548001,
-        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
+        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
+        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
         "type": "github"
       },
       "original": {
@@ -550,11 +550,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775971308,
+        "lastModified": 1776771786,
-        "narHash": "sha256-VKp9bhVSm0bT6JWctFy06ocqxGGnWHi1NfoE90IgIcY=",
+        "narHash": "sha256-DRFGPfFV6hbrfO9a1PH1FkCi7qR5FgjSqsQGGvk1rdI=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "31ac5fe5d015f76b54058c69fcaebb66a55871a4",
+        "rev": "bef289e2248991f7afeb95965c82fbcd8ff72598",
         "type": "github"
       },
       "original": {
@@ -583,11 +583,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1775936757,
+        "lastModified": 1776170745,
-        "narHash": "sha256-KJO/7qoxJ+hlsb3WlFSl6IGrExBIf1GvKdrhOlnGdKY=",
+        "narHash": "sha256-Tl1aZVP5EIlT+k0+iAKH018GLHJpLz3hhJ0LNQOWxCc=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "d3e447786b74d62c75f665e17cb3e681c66e90c7",
+        "rev": "e3861617645a43c9bbefde1aa6ac54dd0a44bfa9",
         "type": "github"
       },
       "original": {

flake/overlays.nix

@@ -1,19 +1,5 @@
-{ inputs, ... }:
+_:
 
 {
-  flake.overlays.default =
+  flake.overlays.default = _: _: { };
-    _: prev:
-    let
-      pkgs-stable = import inputs.nixpkgs-stable {
-        inherit (prev.stdenv.hostPlatform) system;
-        inherit (prev) config;
-      };
-      pkgs-master = import inputs.nixpkgs-master {
-        inherit (prev.stdenv.hostPlatform) system;
-        inherit (prev) config;
-      };
-    in
-    {
-      inherit (pkgs-master) claude-code;
-    };
 }

hosts/ephvm/configuration.nix

@@ -13,22 +13,74 @@
   documentation.enable = false;
   environment.defaultPackages = [ ];
 
-  # compressed qcow2, no channel copy
+  # qcow2, no channel copy; post-processed with parallel zstd on qcow2 v3
+  # (~half the size of zlib v2, faster decompress)
   image.modules.qemu =
     { config, modulesPath, ... }:
     {
       system.build.image = lib.mkForce (
-        import (modulesPath + "/../lib/make-disk-image.nix") {
+        let
+          rawImage = import (modulesPath + "/../lib/make-disk-image.nix") {
             inherit lib config pkgs;
             inherit (config.virtualisation) diskSize;
             inherit (config.image) baseName;
-          format = "qcow2-compressed";
+            format = "qcow2";
             copyChannel = false;
             partitionTableType = "legacy";
-        }
+          };
+          inherit (config.image) baseName;
+        in
+        pkgs.runCommand baseName { nativeBuildInputs = [ pkgs.qemu-utils ]; } ''
+          mkdir -p $out
+          # qemu-img caps -m at 16
+          cores="''${NIX_BUILD_CORES:-4}"
+          [ "$cores" -gt 0 ] || cores=4
+          [ "$cores" -gt 16 ] && cores=16
+          qemu-img convert \
+            -f qcow2 \
+            -O qcow2 \
+            -c \
+            -o compression_type=zstd \
+            -m "$cores" \
+            ${rawImage}/${baseName}.qcow2 \
+            $out/${baseName}.qcow2
+        ''
       );
     };
 
+  # auto-login on serial console
+  services.getty.autologinUser = "matej";
+
+  # enable zsh in home-manager so starship init gets wired up
+  home-manager.users.matej.programs.zsh = {
+    enable = true;
+    dotDir = "/home/matej/.config/zsh";
+    shellAliases.dsp = "claude --dangerously-skip-permissions";
+  };
+
+  home-manager.users.matej.programs.starship = {
+    enable = true;
+    settings = {
+      add_newline = false;
+      format = "$username$hostname$directory$character";
+      hostname = {
+        ssh_only = false;
+        style = "bold blue";
+        format = "[@$hostname]($style)";
+      };
+      username = {
+        show_always = true;
+        style_user = "bold blue";
+        format = "[$user]($style)";
+      };
+      directory.format = " [$path]($style) ";
+      character = {
+        success_symbol = "[>](bold green)";
+        error_symbol = "[>](bold red)";
+      };
+    };
+  };
+
   features.vm-guest.headless = true;
   features.vm-guest.automount = {
     enable = true;
@@ -37,7 +89,17 @@
   features.neovim.dotfiles = inputs.nvim;
 
   # ensure .config exists with correct ownership before automount
-  systemd.tmpfiles.rules = [ "d /home/matej/.config 0755 matej users -" ];
+  systemd.tmpfiles.rules = [ "d /home/matej/.config 0700 matej users -" ];
+
+  # TODO:(@janezicmatej) replace ssh with virtio-console (hvc0) when qemu 11.0 lands
+  # https://www.mail-archive.com/qemu-devel@nongnu.org/msg1162844.html
+  # accept any ssh key (ephemeral localhost-only vm)
+  services.openssh.settings.AuthorizedKeysCommand =
+    let
+      acceptKey = pkgs.writeShellScript "ephvm-accept-key" ''echo "$1 $2"'';
+    in
+    "${acceptKey} %t %k";
+  services.openssh.settings.AuthorizedKeysCommandUser = "nobody";
 
   # writable claude config via 9p
   fileSystems."/home/matej/.config/claude" = {

hosts/fw16/configuration.nix

@@ -10,6 +10,7 @@
     inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
   ];
 
+  features.bootloader.plymouth.enable = true;
   features.desktop.bluetooth.enable = true;
   features.gnupg.yubikey.enable = true;
   features.udev = {

hosts/tower/configuration.nix

@@ -6,7 +6,10 @@
 
 {
   features.nix-settings.towerCache.enable = false;
-  features.bootloader.mode = "lanzaboote";
+  features.bootloader = {
+    mode = "lanzaboote";
+    plymouth.enable = true;
+  };
   features.desktop.bluetooth.enable = true;
   features.gnupg.yubikey.enable = true;
   features.udev = {
@@ -23,6 +26,8 @@
   nix.settings.secret-key-files = [ config.sops.secrets.nix-signing-key.path ];
 
   boot.kernelParams = [ "btusb.reset=1" ];
+  # early kms so plymouth lands on amdgpu, not simpledrm
+  hardware.amdgpu.initrd.enable = true;
 
   services.udisks2.enable = true;
 

lib/mkHost.nix

@@ -79,8 +79,7 @@ let
 in
 nixpkgs.lib.nixosSystem {
   inherit system;
-  modules =
+  modules = [
-    [
     inputs.sops-nix.nixosModules.sops
     inputs.stylix.nixosModules.stylix
 

packages/claude-code/package.nix

@@ -0,0 +1,91 @@
+{ pkgs, ... }:
+
+let
+  inherit (pkgs) stdenv lib;
+  version = "2.1.116";
+
+  # upstream ships platform-native binaries as separate npm packages under
+  # @anthropic-ai/claude-code-<platform>; the wrapper package is just a
+  # postinstall shim that copies the matching one into place
+  sources = {
+    "x86_64-linux" = {
+      slug = "linux-x64";
+      hash = "sha256-QEjJ4CRk35TubDNW02Dzcu+EMRLLndJUXJeP3BFT3b8=";
+    };
+    "aarch64-linux" = {
+      slug = "linux-arm64";
+      hash = "sha256-/Hqp8GQx8Hub8K4w0Fnx/AksksY61vRC44XxrJVwF5w=";
+    };
+    "x86_64-darwin" = {
+      slug = "darwin-x64";
+      hash = "sha256-O3J/ew2fWbUQePs6tHEhK0Q9E3Mx/BDSL7b7NL3FRc8=";
+    };
+    "aarch64-darwin" = {
+      slug = "darwin-arm64";
+      hash = "sha256-O41sf7b05SJfXVjszMeTp838mja+PgZ+aEKykLsHeNo=";
+    };
+  };
+
+  source =
+    sources.${stdenv.hostPlatform.system}
+      or (throw "claude-code: unsupported system ${stdenv.hostPlatform.system}");
+in
+stdenv.mkDerivation {
+  pname = "claude-code";
+  inherit version;
+
+  src = pkgs.fetchzip {
+    url = "https://registry.npmjs.org/@anthropic-ai/claude-code-${source.slug}/-/claude-code-${source.slug}-${version}.tgz";
+    inherit (source) hash;
+  };
+
+  nativeBuildInputs = [
+    pkgs.makeWrapper
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ pkgs.patchelf ];
+
+  dontBuild = true;
+  dontConfigure = true;
+  dontStrip = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 claude $out/bin/claude
+    runHook postInstall
+  '';
+
+  # NOTE:(@janezicmatej) upstream is a bun single-file-executable; the
+  # embedded script payload sits at the tail of the ELF, so autoPatchelfHook's
+  # section-layout changes corrupt it — only the interpreter can be rewritten
+  postFixup =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      patchelf --set-interpreter ${stdenv.cc.bintools.dynamicLinker} $out/bin/claude
+    ''
+    + ''
+      wrapProgram $out/bin/claude \
+        --set DISABLE_AUTOUPDATER 1 \
+        --set-default FORCE_AUTOUPDATE_PLUGINS 1 \
+        --set DISABLE_INSTALLATION_CHECKS 1 \
+        --unset DEV \
+        --prefix PATH : ${
+          lib.makeBinPath (
+            [
+              pkgs.procps
+            ]
+            ++ lib.optionals stdenv.hostPlatform.isLinux [
+              pkgs.bubblewrap
+              pkgs.socat
+            ]
+          )
+        }
+    '';
+
+  meta = {
+    description = "Agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster";
+    homepage = "https://github.com/anthropics/claude-code";
+    downloadPage = "https://www.npmjs.com/package/@anthropic-ai/claude-code";
+    license = lib.licenses.unfree;
+    mainProgram = "claude";
+    platforms = lib.attrNames sources;
+  };
+}

packages/claude-code/update.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix
+# shellcheck shell=bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PKG_FILE="$SCRIPT_DIR/package.nix"
+
+# keep in sync with the `sources` attrset in package.nix
+PLATFORMS=(linux-x64 linux-arm64 darwin-x64 darwin-arm64)
+
+prefetch() {
+	local url="$1"
+	nix --extra-experimental-features 'nix-command flakes' \
+		store prefetch-file --unpack --json "$url" 2>/dev/null | jq -r '.hash'
+}
+
+main() {
+	echo "fetching latest version from npm..."
+	local latest current
+	latest=$(curl -sf "https://registry.npmjs.org/@anthropic-ai/claude-code/latest" | jq -r '.version')
+	current=$(grep 'version = ' "$PKG_FILE" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+
+	if [[ "$current" == "$latest" ]]; then
+		echo "claude-code already at $latest"
+		return 0
+	fi
+
+	echo "updating claude-code: $current -> $latest"
+
+	sed -i "s|version = \"$current\"|version = \"$latest\"|" "$PKG_FILE"
+
+	local slug url new_hash old_hash
+	for slug in "${PLATFORMS[@]}"; do
+		url="https://registry.npmjs.org/@anthropic-ai/claude-code-${slug}/-/claude-code-${slug}-${latest}.tgz"
+		echo "  prefetching $slug..."
+		new_hash=$(prefetch "$url")
+		old_hash=$(awk -v slug="$slug" '
+			$0 ~ "slug = \"" slug "\";" { found=1; next }
+			found && /hash = "sha256-/ {
+				match($0, /sha256-[A-Za-z0-9+\/]+=*/)
+				print substr($0, RSTART, RLENGTH)
+				exit
+			}
+		' "$PKG_FILE")
+		sed -i "s|$old_hash|$new_hash|" "$PKG_FILE"
+		echo "    $new_hash"
+	done
+
+	echo "claude-code updated to $latest"
+}
+
+main "$@"

scripts/ephvm-run.sh

@@ -27,23 +27,44 @@ info() {
 
 # globals for cleanup trap
 CLEANUP_OVERLAY=""
+CLEANUP_TMPDIR=""
+QEMU_PID=""
+VM_READY=false
 cleanup() {
+	[ -n "$QEMU_PID" ] && kill "$QEMU_PID" 2>/dev/null && wait "$QEMU_PID" 2>/dev/null
 	[ -n "$CLEANUP_OVERLAY" ] && rm -rf "$CLEANUP_OVERLAY"
+	# preserve tmpdir on abnormal exit so the qemu log survives for inspection
+	if [ -n "$CLEANUP_TMPDIR" ]; then
+		if [ "$VM_READY" = true ]; then
+			rm -rf "$CLEANUP_TMPDIR"
+		else
+			echo "qemu log preserved: $CLEANUP_TMPDIR/qemu.log" >&2
+		fi
+	fi
 	return 0
 }
 trap cleanup EXIT
 
+# returns 0 once the guest's sshd is speaking (first bytes are "SSH-")
+awaiting_ssh_banner() {
+	local port="$1"
+	local banner
+	banner=$(timeout 2 bash -c "exec 3<>/dev/tcp/localhost/$port; head -c 4 <&3" 2>/dev/null) || return 1
+	[ "$banner" = "SSH-" ]
+}
+
 usage() {
 	cat <<EOF
 Usage: ephvm-run.sh [options]
 
 Options:
   --mount <path>       Mount host directory into VM (repeatable)
-  --claude             Mount claude config dir (requires CLAUDE_CONFIG_DIR)
+  --no-claude          Skip mounting claude config dir
   --disk-size <size>   Resize guest disk (e.g. 50G)
-  --memory <size>      VM memory (default: 8G)
+  --memory <size>      VM memory (default: 4G)
-  --cpus <n>           VM CPUs (default: 4)
+  --cpus <n>           VM CPUs (default: 2)
-  --ssh-port <port>    SSH port forward (default: 2222)
+  --ssh-port <port>    Use specific SSH port (default: auto)
+  --serial             Attach to serial console instead of SSH
   -h, --help           Show usage
 EOF
 	exit "${1:-0}"
@@ -52,7 +73,9 @@ EOF
 main() {
 	setup_colors
 
-	local ssh_port=2222 memory=8G cpus=4 claude=false disk_size=""
+	[ "$EUID" -eq 0 ] && die "ephvm-run.sh must not run as root"
+
+	local ssh_port="" memory=4G cpus=2 claude=true disk_size="" serial=false
 	local -a mounts=()
 
 	while [ $# -gt 0 ]; do
@@ -61,8 +84,8 @@ main() {
 			mounts+=("$2")
 			shift 2
 			;;
-		--claude)
+		--no-claude)
-			claude=true
+			claude=false
 			shift
 			;;
 		--disk-size)
@@ -81,6 +104,10 @@ main() {
 			ssh_port="$2"
 			shift 2
 			;;
+		--serial)
+			serial=true
+			shift
+			;;
 		-h | --help) usage ;;
 		*)
 			echo "${red}error:${reset} unknown option: $1" >&2
@@ -91,7 +118,9 @@ main() {
 
 	info "building ephvm image..."
 	local image_dir image
-	image_dir=$(nix build --no-link --print-out-paths .#nixosConfigurations.ephvm.config.system.build.images.qemu)
+	[ -n "${EPHVM_FLAKE:-}" ] || die "EPHVM_FLAKE must be set to the flake directory"
+	local flake="$EPHVM_FLAKE"
+	image_dir=$(nix build --no-link --print-out-paths "${flake}#nixosConfigurations.ephvm.config.system.build.images.qemu")
 	image=$(find "$image_dir" -name '*.qcow2' -print -quit)
 	[ -n "$image" ] || die "no qcow2 image found in $image_dir"
 
@@ -101,31 +130,49 @@ main() {
 		CLEANUP_OVERLAY=$(mktemp -d)
 		local overlay="$CLEANUP_OVERLAY/overlay.qcow2"
 		qemu-img create -f qcow2 -b "$(realpath "$image")" -F qcow2 "$overlay" "$disk_size"
-		drive_arg="file=$overlay,format=qcow2"
+		drive_arg="if=none,id=hd0,file=$overlay,format=qcow2,cache=writeback,aio=threads,discard=unmap,detect-zeroes=unmap"
 	else
-		drive_arg="file=$image,format=qcow2,snapshot=on"
+		drive_arg="if=none,id=hd0,file=$image,format=qcow2,snapshot=on,cache=writeback,aio=threads,discard=unmap,detect-zeroes=unmap"
 	fi
 
-	local accel="tcg"
+	command -v qemu-system-x86_64 &>/dev/null || die "qemu-system-x86_64 not found"
-	[ -r /dev/kvm ] && accel="kvm"
+	[ -r /dev/kvm ] || die "/dev/kvm not readable; kvm is required"
+
+	# auto-allocate ssh port unless serial mode
+	if [ "$serial" = false ] && [ -z "$ssh_port" ]; then
+		ssh_port=10022
+		while ss -tln | grep -q ":${ssh_port}\b"; do
+			ssh_port=$((ssh_port + 1))
+		done
+	fi
+
+	local nic_arg="user,model=virtio-net-pci"
+	if [ -n "$ssh_port" ]; then
+		nic_arg="user,model=virtio-net-pci,hostfwd=tcp:127.0.0.1:${ssh_port}-:22"
+	fi
 
 	local -a qemu_args=(
 		qemu-system-x86_64
-		-accel "$accel"
+		-accel kvm
+		-cpu host
 		-m "$memory"
 		-smp "$cpus"
 		-drive "$drive_arg"
-		-nic "user,hostfwd=tcp::${ssh_port}-:22"
+		-device "virtio-blk-pci,drive=hd0"
+		-device virtio-rng-pci
+		-nic "$nic_arg"
 		-nographic
+		-sandbox "on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny"
 	)
 
-	if [ "$accel" != "tcg" ]; then
-		qemu_args+=(-cpu host)
-	fi
-
 	local fs_id=0 mount_path name tag
 	for mount_path in "${mounts[@]}"; do
+		[ -e "$mount_path" ] || die "--mount path does not exist: $mount_path"
 		mount_path=$(realpath "$mount_path")
+		# qemu parses -virtfs as csv, a comma in the path would inject options
+		case "$mount_path" in
+		*,*) die "--mount path may not contain commas: $mount_path" ;;
+		esac
 		name=$(basename "$mount_path")
 		tag="m_${name:0:29}"
 		qemu_args+=(
@@ -135,10 +182,13 @@ main() {
 	done
 
 	if [ "$claude" = true ]; then
-		[ -n "${CLAUDE_CONFIG_DIR:-}" ] || die "--claude requires CLAUDE_CONFIG_DIR to be set"
+		[ -n "${CLAUDE_CONFIG_DIR:-}" ] || die "CLAUDE_CONFIG_DIR must be set (use --no-claude to skip)"
 		mkdir -p "$CLAUDE_CONFIG_DIR"
 		local claude_dir
 		claude_dir=$(realpath "$CLAUDE_CONFIG_DIR")
+		case "$claude_dir" in
+		*,*) die "claude config dir may not contain commas: $claude_dir" ;;
+		esac
 
 		qemu_args+=(
 			-virtfs "local,path=$claude_dir,mount_tag=claude,security_model=none,id=fs${fs_id}"
@@ -147,10 +197,42 @@ main() {
 	fi
 
 	info "---"
-	info "Accel: $accel | SSH: ssh -p $ssh_port matej@localhost"
+	[ -n "$ssh_port" ] && info "SSH: ssh -p $ssh_port matej@localhost"
 	info "---"
 
+	if [ "$serial" = true ]; then
 		exec "${qemu_args[@]}"
+	fi
+
+	CLEANUP_TMPDIR=$(mktemp -d)
+	local qemu_log="$CLEANUP_TMPDIR/qemu.log"
+
+	# start qemu in background and auto-ssh
+	"${qemu_args[@]}" &>"$qemu_log" &
+	QEMU_PID=$!
+
+	# throwaway ssh key (vm accepts any key via AuthorizedKeysCommand)
+	local ssh_key="$CLEANUP_TMPDIR/id_ed25519"
+	ssh-keygen -t ed25519 -f "$ssh_key" -N "" -q
+
+	info "waiting for vm (port $ssh_port)..."
+	local attempts=0
+	# poll for the real SSH banner, not TCP accept: qemu's user-mode nic
+	# accepts host-side the moment qemu starts, well before guest sshd is up
+	while ! awaiting_ssh_banner "$ssh_port"; do
+		attempts=$((attempts + 1))
+		[ $attempts -gt 120 ] && die "vm did not become ready in 60s"
+		kill -0 "$QEMU_PID" 2>/dev/null || die "qemu exited unexpectedly"
+		sleep 0.5
+	done
+	VM_READY=true
+
+	ssh -p "$ssh_port" -t \
+		-i "$ssh_key" \
+		-o StrictHostKeyChecking=no \
+		-o UserKnownHostsFile=/dev/null \
+		-o LogLevel=ERROR \
+		matej@localhost
 }
 
 main "$@"