wip

chore: run formatter
temp: workaround for nixpkgs#514705
2026-05-20 22:55:27 +02:00 · 2026-05-12 10:36:25 +02:00 · 2026-05-12 10:35:53 +02:00 · 2026-05-10 00:08:17 +02:00 · 2026-05-09 23:38:56 +02:00 · 2026-05-09 23:38:51 +02:00
14 changed files with 221 additions and 256 deletions
--- a/features/bootloader.nix
+++ b/features/bootloader.nix
@@ -3,11 +3,23 @@
    {
      config,
      lib,
+      pkgs,
      inputs,
      ...
    }:
    let
      cfg = config.features.bootloader;
+      keyDir = "/etc/secrets/initrd";
+
+      mkIpString =
+        {
+          address,
+          gateway,
+          netmask,
+          interface,
+          ...
+        }:
+        "${address}::${gateway}:${netmask}::${interface}:none";
    in
    {
      imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
@@ -23,15 +35,88 @@
          default = "systemd-boot";
        };

-        plymouth.enable = lib.mkEnableOption "plymouth boot splash";
+        configurationLimit = lib.mkOption {
+          type = lib.types.int;
+          default = 10;
+        };
+
+        consoleFont = lib.mkOption {
+          type = lib.types.str;
+          default = "ter-v32n";
+        };
+
+        resumeDevice = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+
+        initrdSsh = {
+          enable = lib.mkEnableOption "remote LUKS unlock via ssh in initrd";
+
+          networkModule = lib.mkOption {
+            type = lib.types.str;
+          };
+
+          ip = {
+            enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";
+
+            address = lib.mkOption {
+              type = lib.types.str;
+            };
+
+            gateway = lib.mkOption {
+              type = lib.types.str;
+            };
+
+            netmask = lib.mkOption {
+              type = lib.types.str;
+              default = "255.255.255.0";
+            };
+
+            interface = lib.mkOption {
+              type = lib.types.str;
+            };
+          };
+
+          authorizedKeys = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+          };
+        };
      };

      config = lib.mkIf cfg.enable (
        lib.mkMerge [
          {
            boot.loader.efi.canTouchEfiVariables = true;
-            # request the largest framebuffer uefi offers; plymouth inherits it
-            boot.loader.systemd-boot.consoleMode = "max";
+
+            # lanzaboote inherits editor + configurationLimit from systemd-boot.*
+            boot.loader.systemd-boot = {
+              editor = false;
+              inherit (cfg) configurationLimit;
+            };
+
+            boot.initrd.systemd.enable = true;
+
+            # block simpledrm so fbcon defers until the gpu driver binds; avoids
+            # the simpledrm -> real-driver fbcon transition that mangles console
+            # text and leaves the luks prompt typing offset from the visible
+            # surface. hosts must put the gpu driver in initrd (nixos-hardware
+            # does this for amd; manual hardware.amdgpu.initrd.enable on others)
+            boot.kernelParams = [ "initcall_blacklist=simpledrm_platform_driver_init" ];
+
+            # verbose boot: kernel messages and systemd unit lines visible end
+            # to end. trade-off: the luks prompt will be interleaved with the
+            # last few "Starting/Started ..." lines (no upstream fix exists
+            # without plymouth). boot.initrd.verbose is a no-op under
+            # systemd-initrd, so not set here.
+
+            # readable luks prompt at panel-native dpi
+            console = {
+              earlySetup = true;
+              font = cfg.consoleFont;
+              packages = [ pkgs.terminus_font ];
+            };
          }

          (lib.mkIf (cfg.mode == "systemd-boot") {
@@ -46,26 +131,41 @@
            };
          })

-          (lib.mkIf cfg.plymouth.enable {
-            # plymouth needs systemd-initrd to render the luks prompt cleanly
-            boot.initrd.systemd.enable = true;
+          (lib.mkIf (cfg.resumeDevice != null) {
+            boot.resumeDevice = cfg.resumeDevice;
+          })

-            # host is responsible for early-KMS so plymouth lands on the gpu driver,
-            # not simpledrm (e.g. hardware.amdgpu.initrd.enable on amd hosts)
-            boot.plymouth.enable = true;
-            stylix.targets.plymouth.logoAnimated = false;
+          (lib.mkIf cfg.initrdSsh.enable {
+            boot.initrd.systemd.settings.Manager.DefaultDeviceTimeoutSec = "infinity";

-            boot.kernelParams = [
-              "quiet"
-              "splash"
-              "loglevel=3"
-              "rd.systemd.show_status=false"
-              "rd.udev.log_level=3"
-              "udev.log_priority=3"
-              "plymouth.force-scale=1"
+            boot.initrd.availableKernelModules = [ cfg.initrdSsh.networkModule ];
+
+            boot.kernelParams = lib.mkIf cfg.initrdSsh.ip.enable [
+              "ip=${mkIpString cfg.initrdSsh.ip}"
            ];
-            boot.consoleLogLevel = 0;
-            boot.initrd.verbose = false;
+
+            boot.initrd.network = {
+              enable = true;
+              ssh = {
+                enable = true;
+                port = 22;
+                hostKeys = [
+                  "${keyDir}/ssh_host_rsa_key"
+                  "${keyDir}/ssh_host_ed25519_key"
+                ];
+                inherit (cfg.initrdSsh) authorizedKeys;
+              };
+            };
+
+            # forward LUKS password prompt to the ssh session (systemd-initrd idiom)
+            boot.initrd.systemd.users.root.shell = "/bin/systemd-tty-ask-password-agent";
+
+            boot.initrd.systemd.network.networks = lib.mkIf (!cfg.initrdSsh.ip.enable) {
+              "10-initrd" = {
+                matchConfig.Driver = cfg.initrdSsh.networkModule;
+                networkConfig.DHCP = "yes";
+              };
+            };
          })
        ]
      );
--- a/features/desktop.nix
+++ b/features/desktop.nix
@@ -105,7 +105,11 @@
          # bluetooth
          (lib.mkIf cfg.bluetooth.enable {
            hardware.bluetooth.enable = true;
-            services.blueman.enable = true;
+            services.blueman = {
+              enable = true;
+              # TEMP:(@janezicmatej) workaround for nixpkgs#514705, fix in nixpkgs#517250
+              withApplet = false;
+            };
          })

          # apps
--- a/features/initrd-ssh.nix
+++ b/features/initrd-ssh.nix
@@ -1,90 +0,0 @@
-{
-  nixos =
-    { lib, config, ... }:
-    let
-      cfg = config.features.initrd-ssh;
-      keyDir = "/etc/secrets/initrd";
-
-      mkIpString =
-        {
-          address,
-          gateway,
-          netmask,
-          interface,
-          ...
-        }:
-        "${address}::${gateway}:${netmask}::${interface}:none";
-    in
-    {
-      options.features.initrd-ssh = {
-        enable = lib.mkEnableOption "initrd ssh";
-
-        ip = {
-          enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";
-
-          address = lib.mkOption {
-            type = lib.types.str;
-          };
-
-          gateway = lib.mkOption {
-            type = lib.types.str;
-          };
-
-          netmask = lib.mkOption {
-            type = lib.types.str;
-            default = "255.255.255.0";
-          };
-
-          interface = lib.mkOption {
-            type = lib.types.str;
-          };
-        };
-
-        authorizedKeys = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-        };
-
-        networkModule = lib.mkOption {
-          type = lib.types.str;
-        };
-      };
-
-      config = lib.mkIf cfg.enable {
-        boot.initrd.availableKernelModules = [ cfg.networkModule ];
-        boot.initrd.kernelModules = [ cfg.networkModule ];
-        boot.kernelParams = lib.mkIf cfg.ip.enable [
-          "ip=${mkIpString cfg.ip}"
-        ];
-
-        boot.initrd.systemd.enable = true;
-
-        # remote unlock may take a while; don't let device units give up
-        boot.initrd.systemd.settings.Manager.DefaultDeviceTimeoutSec = "infinity";
-
-        boot.initrd.network = {
-          enable = true;
-          ssh = {
-            enable = true;
-            port = 22;
-            hostKeys = [
-              "${keyDir}/ssh_host_rsa_key"
-              "${keyDir}/ssh_host_ed25519_key"
-            ];
-            inherit (cfg) authorizedKeys;
-          };
-        };
-
-        # systemd-networkd retries DHCP indefinitely, unlike udhcpc
-        boot.initrd.systemd.network.networks = lib.mkIf (!cfg.ip.enable) {
-          "10-initrd" = {
-            matchConfig.Driver = cfg.networkModule;
-            networkConfig.DHCP = "yes";
-          };
-        };
-
-        # forward LUKS password prompt to the SSH session
-        boot.initrd.systemd.users.root.shell = "/bin/systemd-tty-ask-password-agent";
-      };
-    };
-}
--- a/features/power.nix
+++ b/features/power.nix
@@ -8,11 +8,6 @@
      options.features.power = {
        enable = lib.mkEnableOption "laptop power management";

-        resumeDevice = lib.mkOption {
-          type = lib.types.nullOr lib.types.str;
-          default = null;
-        };
-
        lidSwitch = lib.mkOption {
          type = lib.types.str;
          default = "suspend-then-hibernate";
@@ -40,8 +35,6 @@
      };

      config = lib.mkIf cfg.enable {
-        boot.resumeDevice = lib.mkIf (cfg.resumeDevice != null) cfg.resumeDevice;
-
        services.logind.settings.Login = {
          HandleLidSwitch = cfg.lidSwitch;
          HandlePowerKey = cfg.powerKey;
--- a/flake.lock
+++ b/flake.lock
@@ -54,11 +54,11 @@
    "base16-helix": {
      "flake": false,
      "locked": {
-        "lastModified": 1760703920,
-        "narHash": "sha256-m82fGUYns4uHd+ZTdoLX2vlHikzwzdu2s2rYM2bNwzw=",
+        "lastModified": 1776754714,
+        "narHash": "sha256-E3OAK27smtATTmX45uoTSRsVD+Y+ZiVVfgM/tjpbtYg=",
        "owner": "tinted-theming",
        "repo": "base16-helix",
-        "rev": "d646af9b7d14bff08824538164af99d0c521b185",
+        "rev": "4d508123037e7851ad36ebf7d9c48b0e9e1eb581",
        "type": "github"
      },
      "original": {
@@ -106,11 +106,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1776613567,
-        "narHash": "sha256-gC9Cp5ibBmGD5awCA9z7xy6MW6iJufhazTYJOiGlCUI=",
+        "lastModified": 1777713215,
+        "narHash": "sha256-8GzXDOXckDWwST8TY5DbwYFjdvQLlP7K9CLSVx6iTTo=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "32f4236bfc141ae930b5ba2fb604f561fed5219d",
+        "rev": "63b4e7e6cf75307c1d26ac3762b886b5b0247267",
        "type": "github"
      },
      "original": {
@@ -122,11 +122,11 @@
    "firefox-gnome-theme": {
      "flake": false,
      "locked": {
-        "lastModified": 1775176642,
-        "narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=",
+        "lastModified": 1776136500,
+        "narHash": "sha256-r0gN2brVWA351zwMV0Flmlcd6SGMvYqFbvC3DfKFM8Y=",
        "owner": "rafaelmardojai",
        "repo": "firefox-gnome-theme",
-        "rev": "179704030c5286c729b5b0522037d1d51341022c",
+        "rev": "0f8ba203d475587f477e7ae12661bd8459e225b7",
        "type": "github"
      },
      "original": {
@@ -156,11 +156,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "lastModified": 1777988971,
+        "narHash": "sha256-qIoWPDs+0/8JecyYgE3gpKQxW/4bLW/gp45vow9ioCQ=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "0678d8986be1661af6bb555f3489f2fdfc31f6ff",
        "type": "github"
      },
      "original": {
@@ -177,11 +177,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "lastModified": 1777988971,
+        "narHash": "sha256-qIoWPDs+0/8JecyYgE3gpKQxW/4bLW/gp45vow9ioCQ=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "0678d8986be1661af6bb555f3489f2fdfc31f6ff",
        "type": "github"
      },
      "original": {
@@ -273,11 +273,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1777518431,
-        "narHash": "sha256-SwgiG2T5pbyo33Vz7/vUCAhEMgwCK8Pa2nDSx5a6/WE=",
+        "lastModified": 1778248595,
+        "narHash": "sha256-dhFgEjoeJMYN/7OY6xfxS799YB4IjbbYXTjyGIJyLpc=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "2e54a938cdd4c8e414b2518edc3d82308027c670",
+        "rev": "fdb2ccba9d5e1238d32e0c4a3ec1a277efa80c1d",
        "type": "github"
      },
      "original": {
@@ -317,11 +317,11 @@
        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1777507505,
-        "narHash": "sha256-TDm5ZGtXChEnfjaPO+n/aP06nw+h0qO+n/ir92M01KQ=",
+        "lastModified": 1778285091,
+        "narHash": "sha256-4YwkGkjvLD0EB7rQGCRA9J/zgwrnTL20dJd7Wmnicj0=",
        "owner": "nix-community",
        "repo": "neovim-nightly-overlay",
-        "rev": "9ed2a106889573d81b1076a39e2db2fec045335a",
+        "rev": "cca2a2d1c03f763fdcd7066791363d792313c641",
        "type": "github"
      },
      "original": {
@@ -333,11 +333,11 @@
    "neovim-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1777498667,
-        "narHash": "sha256-MMCCJz0e7sA6+y/1/mp3M44JaELrDgYEu1Ii7r/4Cj4=",
+        "lastModified": 1778266020,
+        "narHash": "sha256-qoydKalrn/QGsGYVRicz0Hzb7bfGmV7Z9CnVONXN/Lc=",
        "owner": "neovim",
        "repo": "neovim",
-        "rev": "1e06e9566262eab316a9d9b6a4a6f14f9f15fa01",
+        "rev": "b7d8a41d91dcfebe9a5f3d0cf2f0bb0b8d59e32e",
        "type": "github"
      },
      "original": {
@@ -348,11 +348,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1776983936,
-        "narHash": "sha256-ZOQyNqSvJ8UdrrqU1p7vaFcdL53idK+LOM8oRWEWh6o=",
+        "lastModified": 1778143761,
+        "narHash": "sha256-lkesY6x2X2qxlqLM7CT2iM/0rP2JB7fruPN3h8POXmI=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "2096f3f411ce46e88a79ae4eafcfc9df8ed41c61",
+        "rev": "3bcaa367d4c550d687a17ac792fd5cda214ee871",
        "type": "github"
      },
      "original": {
@@ -364,11 +364,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1777395829,
-        "narHash": "sha256-HposVFZcsBCevgqLR73w/BpSe8J1lMgw5kASnnxO3A4=",
+        "lastModified": 1778124196,
+        "narHash": "sha256-pYEytCNic/czazbV9r3tbQ6BZzqRBg/41x2dIC5ymOo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e75f25705c2934955ee5075e62530d74aca973c6",
+        "rev": "68a8af93ff4297686cb68880845e61e5e2e41d92",
        "type": "github"
      },
      "original": {
@@ -380,11 +380,11 @@
    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1774748309,
-        "narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=",
+        "lastModified": 1777168982,
+        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "333c4e0545a6da976206c74db8773a1645b5870a",
+        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
        "type": "github"
      },
      "original": {
@@ -395,11 +395,11 @@
    },
    "nixpkgs-master": {
      "locked": {
-        "lastModified": 1777538234,
-        "narHash": "sha256-6XIK/VIRTb00ElO1JBCPQFh6MjeyRMQOIBLOku9/xBM=",
+        "lastModified": 1778360830,
+        "narHash": "sha256-tD44tgf123UcERx3cC91rwefFmGmlTd2M1QdL6d5iLc=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "f7af830dc62b2b435dcae761e29888e89964f4d1",
+        "rev": "82cbc979e10cf2b893566a0f259daf5e1f26c887",
        "type": "github"
      },
      "original": {
@@ -411,11 +411,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1777428379,
-        "narHash": "sha256-ypxFOeDz+CqADEQNL72haqGjvZQdBR5Vc7pyx2JDttI=",
+        "lastModified": 1778003029,
+        "narHash": "sha256-q/nkKLDtHIyLjZpKhWk3cSK5IYsFqtMd6UtXF3ddjgA=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "755f5aa91337890c432639c60b6064bb7fe67769",
+        "rev": "0c88e1f2bdb93d5999019e99cb0e61e1fe2af4c5",
        "type": "github"
      },
      "original": {
@@ -427,11 +427,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1777268161,
-        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
+        "lastModified": 1777954456,
+        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
+        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
        "type": "github"
      },
      "original": {
@@ -453,11 +453,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775228139,
-        "narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=",
+        "lastModified": 1777598946,
+        "narHash": "sha256-X239dAGaU1+gfDj8jKH8GzlqKMcxaVfXOio+uzBOkeE=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "601971b9c89e0304561977f2c28fa25e73aa7132",
+        "rev": "5d55af01c0f86be583931fe99207fc56c14134b3",
        "type": "github"
      },
      "original": {
@@ -550,11 +550,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1777338324,
-        "narHash": "sha256-bc+ZZCmOTNq86/svGnw0tVpH7vJaLYvGLLKFYP08Q8E=",
+        "lastModified": 1777944972,
+        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "8eaee5c45428b28b8c47a83e4c09dccec5f279b5",
+        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
        "type": "github"
      },
      "original": {
@@ -583,11 +583,11 @@
        "tinted-zed": "tinted-zed"
      },
      "locked": {
-        "lastModified": 1777501441,
-        "narHash": "sha256-+QWZ2/LvtEfbI4a5OiJmfv8aypBdm0u4Ui9t6LNHkRc=",
+        "lastModified": 1778104276,
+        "narHash": "sha256-/DSSnU0LLmOTG/OCgGwYpxP6+5YvxRx2g/GhI4x6aCU=",
        "owner": "danth",
        "repo": "stylix",
-        "rev": "0bd266569c03b74234b8a2ae73d05055fb02a35f",
+        "rev": "18ed8d270231e067fe2739998479ed5d7c659c2c",
        "type": "github"
      },
      "original": {
@@ -630,11 +630,11 @@
    "tinted-schemes": {
      "flake": false,
      "locked": {
-        "lastModified": 1772661346,
-        "narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=",
+        "lastModified": 1777041405,
+        "narHash": "sha256-BAGZ7ObFV/9Z61OJZun7ifPyhkuHqNuW1QIhQ8LuzCo=",
        "owner": "tinted-theming",
        "repo": "schemes",
-        "rev": "13b5b0c299982bb361039601e2d72587d6846294",
+        "rev": "5f868b3a338b6904c47f3833b9c411be641983a8",
        "type": "github"
      },
      "original": {
@@ -646,11 +646,11 @@
    "tinted-tmux": {
      "flake": false,
      "locked": {
-        "lastModified": 1772934010,
-        "narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=",
+        "lastModified": 1777169200,
+        "narHash": "sha256-h7dDbIzP5hDr9v97w9PL6jdAgXawmj6krcH+959rqpU=",
        "owner": "tinted-theming",
        "repo": "tinted-tmux",
-        "rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d",
+        "rev": "f798c2dce44ef815bb6b8f05a82135c7942d35ac",
        "type": "github"
      },
      "original": {
@@ -662,11 +662,11 @@
    "tinted-zed": {
      "flake": false,
      "locked": {
-        "lastModified": 1772909925,
-        "narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=",
+        "lastModified": 1777463218,
+        "narHash": "sha256-Bhkozqtq3BKLqWTlmKm8uAptfX4aRGI8QX3eEL54Vpc=",
        "owner": "tinted-theming",
        "repo": "base16-zed",
-        "rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df",
+        "rev": "5768d08ed2e7944a26a958868cdb073cb8856dae",
        "type": "github"
      },
      "original": {
--- a/flake/hosts.nix
+++ b/flake/hosts.nix
@@ -55,7 +55,6 @@ in
        "git"
        "gnupg"
        "harmonia"
-        "initrd-ssh"
        "localisation"
        "neovim"
        "networkmanager"
@@ -124,6 +123,7 @@ in
        "localisation"
        "networkmanager"
        "nix-settings"
+        "onepassword"
        "sway"
        "udev"
        "zsh"
--- a/flake/overlays.nix
+++ b/flake/overlays.nix
@@ -2,6 +2,6 @@

 {
  flake.overlays.default = final: _prev: {
-    mcp-nixos = inputs.nixpkgs-stable.legacyPackages.${final.stdenv.hostPlatform.system}.mcp-nixos;
+    inherit (inputs.nixpkgs-stable.legacyPackages.${final.stdenv.hostPlatform.system}) mcp-nixos;
  };
 }
--- a/hosts/fw16/configuration.nix
+++ b/hosts/fw16/configuration.nix
@@ -10,16 +10,13 @@
    inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
  ];

-  features.bootloader.plymouth.enable = true;
+  features.bootloader.resumeDevice = "/dev/mapper/vg0-swap";
  features.desktop.bluetooth.enable = true;
  features.gnupg.yubikey.enable = true;
  features.udev = {
    ledger.enable = true;
    keyboard-zsa.enable = true;
  };
-  features.power.resumeDevice = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540";
-
-  boot.kernelParams = [ "pcie_aspm.policy=powersupersave" ];

  programs.nix-ld.libraries = options.programs.nix-ld.libraries.default;

--- a/hosts/fw16/hardware-configuration.nix
+++ b/hosts/fw16/hardware-configuration.nix
@@ -37,10 +37,7 @@
  fileSystems."/boot" = {
    device = "/dev/disk/by-uuid/42D9-FAFD";
    fsType = "vfat";
-    options = [
-      "fmask=0022"
-      "dmask=0022"
-    ];
+    options = [ "umask=0077" ];
  };

  swapDevices = [
--- a/hosts/tower/configuration.nix
+++ b/hosts/tower/configuration.nix
@@ -8,7 +8,11 @@
  features.nix-settings.towerCache.enable = false;
  features.bootloader = {
    mode = "lanzaboote";
-    plymouth.enable = true;
+    initrdSsh = {
+      enable = true;
+      networkModule = "r8169";
+      authorizedKeys = userKeys.sshAuthorizedKeys;
+    };
  };
  features.desktop.bluetooth.enable = true;
  features.gnupg.yubikey.enable = true;
@@ -16,17 +20,14 @@
    ledger.enable = true;
    keyboard-zsa.enable = true;
  };
-  features.initrd-ssh = {
-    networkModule = "r8169";
-    authorizedKeys = userKeys.sshAuthorizedKeys;
-  };

  # nix store signing
  sops.secrets.nix-signing-key.sopsFile = ../../secrets/tower.yaml;
  nix.settings.secret-key-files = [ config.sops.secrets.nix-signing-key.path ];

  boot.kernelParams = [ "btusb.reset=1" ];
-  # early kms so plymouth lands on amdgpu, not simpledrm
+  # pairs with bootloader's simpledrm initcall blacklist: amdgpu owns fbcon
+  # from the start, no driver-swap mode-set
  hardware.amdgpu.initrd.enable = true;

  services.udisks2.enable = true;
--- a/33
+++ b/33
@@ -2,31 +2,20 @@
 default:
    @just --list

-# rebuild and switch
-switch config="":
-    nixos-rebuild switch --flake .{{ if config != "" { "#" + config } else { "" } }} --sudo
-
-# fetch flake inputs
-sync:
-    nix flake prefetch-inputs
+# rebuild the system
+rebuild op="switch" host=`hostname`:
+    nixos-rebuild {{op}} --flake .#{{host}} --sudo

 # update flake inputs
 update:
    nix flake update

-# update flake inputs, rebuild and switch
-bump: update switch
-
-# update a package to latest version
-update-package pkg:
-    bash packages/{{pkg}}/update.sh
-
 # update all packages with update scripts
-update-package-all:
+update-package:
    @for script in packages/*/update.sh; do bash "$script"; done

 # build all packages and hosts
-build:
+check:
    nix flake check

 # build installation iso
@@ -37,10 +26,6 @@ iso:
 ephvm *ARGS:
    bash scripts/ephvm-run.sh {{ARGS}}

-# ssh into running ephemeral VM
-ephvm-ssh port="2222":
-    ssh -p {{port}} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null matej@localhost
-
 # provision a host with nixos-anywhere
 provision host ip:
    #!/usr/bin/env bash
@@ -59,9 +44,9 @@ provision host ip:
    ssh root@{{ip}} reboot

 # deploy config to a remote host
-deploy host remote=host:
-    nixos-rebuild switch --flake .#{{host}} --target-host {{remote}} --sudo --ask-sudo-password
+deploy op="switch" host=`hostname` remote=host:
+    nixos-rebuild {{op}} --flake .#{{host}} --target-host {{remote}} --sudo --ask-sudo-password

 # garbage collect old generations
-clean:
-    sudo nix-collect-garbage $(nix eval --raw -f ./nix.nix nix.gc.options)
+clean host=`hostname`:
+    sudo nix-collect-garbage $(nix eval --raw .#nixosConfigurations.{{host}}.config.nix.gc.options)
--- a/lib/mkHost.nix
+++ b/lib/mkHost.nix
@@ -87,6 +87,17 @@ nixpkgs.lib.nixosSystem {
    { nixpkgs.config.allowUnfree = true; }
    { networking.hostName = name; }

+    # TEMP:(@janezicmatej) temporary mitigation for dirty frag
+    # blocks esp4/esp6 (CVE-2026-43284) and rxrpc (CVE-2026-43500)
+    # remove once nixpkgs ships a kernel with f4c50a4034e6 and the rxrpc fix
+    {
+      boot.blacklistedKernelModules = [
+        "esp4"
+        "esp6"
+        "rxrpc"
+      ];
+    }
+
    featureEnableModule
    hostConfig
  ]
--- a/nix.nix
+++ b/nix.nix
@@ -1,33 +0,0 @@
-{
-  nix = {
-    settings = {
-      experimental-features = [
-        "nix-command"
-        "flakes"
-      ];
-      download-buffer-size = 2 * 1024 * 1024 * 1024;
-      warn-dirty = false;
-      substituters = [
-        "https://cache.nixos.org"
-        "https://nix-community.cachix.org?priority=45"
-        "http://tower:5000?priority=50"
-      ];
-      trusted-public-keys = [
-        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "matej.nix-1:TdbemLVYblvAxqJcwb3mVKmmr3cfzXbMcZHE5ILnZDE="
-      ];
-    };
-
-    gc = {
-      automatic = true;
-      dates = "monthly";
-      options = "--delete-older-than 30d";
-    };
-
-    optimise = {
-      automatic = true;
-      dates = [ "monthly" ];
-    };
-  };
-}
--- a/packages/claude-code/package.nix
+++ b/packages/claude-code/package.nix
@@ -2,7 +2,7 @@

 let
  inherit (pkgs) stdenv lib;
-  version = "2.1.121";
+  version = "2.1.138";

  # upstream ships platform-native binaries as separate npm packages under
  # @anthropic-ai/claude-code-<platform>; the wrapper package is just a
@@ -10,19 +10,19 @@ let
  sources = {
    "x86_64-linux" = {
      slug = "linux-x64";
-      hash = "sha256-TNQ6N2BaaxOMpA488HTPyHdmifsLytwRAt8uMKkJzKg=";
+      hash = "sha256-MGYEPPO4O84Egb5Ym/9f56l+TzPqogpSabosvHTIJZg=";
    };
    "aarch64-linux" = {
      slug = "linux-arm64";
-      hash = "sha256-EwumkxN6rKy6wIVvjIlIlfMyPq3G4Ahq83F7QFMQEdU=";
+      hash = "sha256-LWBtOAjPDFtLP93TNrsd8bPHJd7VKK6J90CRxUp1/XQ=";
    };
    "x86_64-darwin" = {
      slug = "darwin-x64";
-      hash = "sha256-iFA9vHEZieWN4ie/R8HSP7Hz0meHYf4hRnfiyKcvdf8=";
+      hash = "sha256-tkupKzb+XAPmdCRNoT90cfVLKUar3FCTRgufiMVuVPc=";
    };
    "aarch64-darwin" = {
      slug = "darwin-arm64";
-      hash = "sha256-g3tlbs1CvoLz97+eSBXVE5J+kasadlE7c1E8Fuxi+5c=";
+      hash = "sha256-jmB4t11BI1LKanuuXRJv5IBe8a9gSrFvTMP3KarsioU=";
    };
  };
Author	SHA1	Message	Date
Matej Janežič	524dafd513	wip	2026-05-20 22:55:27 +02:00
Matej Janežič	db1e9c15ac	chore: run formatter	2026-05-12 10:36:25 +02:00
Matej Janežič	f4b9eff715	temp: workaround for nixpkgs#514705	2026-05-12 10:35:53 +02:00
Matej Janežič	325b863238	feat: justfile recipe improvements	2026-05-10 00:08:17 +02:00
Matej Janežič	79a67284af	chore: bump lockfile - bump flake inputs - bump claude-code to 2.1.138	2026-05-09 23:38:56 +02:00
Matej Janežič	fae6b25137	temp: dirty-frag (CVE-2026-43284, CVE-2026-43500)	2026-05-09 23:38:51 +02:00
Matej Janežič	4a59f6b57c	feat: enable one password on fortress	2026-05-06 15:07:01 +02:00
Matej Janežič	4771d8c7d6	chore: run linter	2026-05-06 15:03:16 +02:00
Matej Janežič	2fc05cdfd0	chore: remove deprecated nix.nix	2026-05-04 11:13:39 +02:00
Matej Janežič	ac0958db60	chore: bump lockfile	2026-05-04 09:35:10 +02:00
Matej Janežič	5f8f1ee138	chore: update claude-code to v2.1.126	2026-05-04 09:33:19 +02:00