update inputs

https://keepassxc.org/docs/KeePassXC_UserGuide#_automatic_database_opening

extra-builtins.nix

@@ -1,11 +1,11 @@
 { exec, ... }: {
-  secrets = exec [ "cat" "/etc/nixos/private/default.nix" ] {
+  secrets = exec [ "cat" "/secrets/nixos/default.nix" ] {
     # compress and base64 the file to make it representable in nix,
     # then decompress it back in a derivation (shouldn't there be a better way...)
     copyToStore = pkgs: name: path:
       let
         archive = exec [ "${pkgs.bash}/bin/bash" "-c" ''
-          cd /etc/nixos/private
+          cd /secrets/nixos
           echo '"'"$(
             ${pkgs.gnutar}/bin/tar -I ${pkgs.zstd}/bin/zstd --exclude-vcs \
               --transform='s#'${pkgs.lib.escapeShellArg path}'#!#' \

flake.lock

@@ -16,6 +16,49 @@
         "type": "gitlab"
       }
     },
+    "coop-ofd": {
+      "inputs": {
+        "crane": "crane",
+        "flake-compat": "flake-compat",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1703252072,
+        "narHash": "sha256-IY/0CeFhaKMBcNUmGXwsPazeKu2rGqCa4IHXSmHy5u0=",
+        "owner": "chayleaf",
+        "repo": "coop-ofd",
+        "rev": "c18e676934884181ad8687e069d28db3c7d1cdfb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "chayleaf",
+        "repo": "coop-ofd",
+        "type": "github"
+      }
+    },
+    "crane": {
+      "inputs": {
+        "nixpkgs": [
+          "coop-ofd",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1700327093,
+        "narHash": "sha256-OgYvlBABxJYWhZ/HBd0bPVcIEkT+xDhDCpRYqtVhYWY=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "ae7cd510e508ee03d792005c2f1c0a3ff25ecb80",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -49,6 +92,22 @@
       }
     },
     "flake-compat_3": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_4": {
       "flake": false,
       "locked": {
         "lastModified": 1668681692,
@@ -69,11 +128,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1698882062,
-        "narHash": "sha256-HkhafUayIqxXyHH1X8d9RDl1M2CkFgZLjKD3MzabiEo=",
+        "lastModified": 1704982712,
+        "narHash": "sha256-2Ptt+9h8dczgle2Oo6z5ni5rt/uLMG47UFTR1ry/wgg=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "8c9fa2545007b49a5db5f650ae91f227672c3877",
+        "rev": "07f6395285469419cf9d078f59b5b49993198c00",
         "type": "github"
       },
       "original": {
@@ -107,11 +166,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1700553346,
-        "narHash": "sha256-kW7uWsCv/lxuA824Ng6EYD9hlVYRyjuFn0xBbYltAeQ=",
+        "lastModified": 1706221476,
+        "narHash": "sha256-T4b8YafVjHXvtDY8ARec1WrXO8uyyNZOpNgv9yoQy2M=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "1aabb0a31b25ad83cfaa37c3fe29053417cd9a0f",
+        "rev": "c7ce343d9bf1a329056a4dd5b32ea8cc43b55e15",
         "type": "github"
       },
       "original": {
@@ -122,11 +181,11 @@
     },
     "impermanence": {
       "locked": {
-        "lastModified": 1697303681,
-        "narHash": "sha256-caJ0rXeagaih+xTgRduYtYKL1rZ9ylh06CIrt1w5B4g=",
+        "lastModified": 1703656108,
+        "narHash": "sha256-hCSUqdFJKHHbER8Cenf5JRzjMlBjIdwdftGQsO0xoJs=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "0f317c2e9e56550ce12323eb39302d251618f5b5",
+        "rev": "033643a45a4a920660ef91caa391fbffb14da466",
         "type": "github"
       },
       "original": {
@@ -137,17 +196,17 @@
     },
     "maubot": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1700661503,
-        "narHash": "sha256-2GGbVFmAC8G1FLxIabCBYhfbUeUIZM/3p2VW9Eia60Q=",
+        "lastModified": 1701193205,
+        "narHash": "sha256-7TK2+YLEvR7z2mj6hT/yay24The4nhpr3KozGSHfKH4=",
         "owner": "chayleaf",
         "repo": "maubot.nix",
-        "rev": "71d397c5897233c592d35be6c4f28c295ce2e79d",
+        "rev": "3a300230955b2e3af1f3472b8704a936b550548a",
         "type": "github"
       },
       "original": {
@@ -159,16 +218,16 @@
     "mobile-nixos": {
       "flake": false,
       "locked": {
-        "lastModified": 1697544701,
-        "narHash": "sha256-u/59b13bwEqxR1x2l9SeSya2ZXABmjpUCdTrXVMLrsA=",
+        "lastModified": 1702959560,
+        "narHash": "sha256-3EmjKFKBypRGluGEY1oUMkQRBRDO5rZdzUXwTlRbUiY=",
         "owner": "chayleaf",
         "repo": "mobile-nixos",
-        "rev": "b3ec466c5abbda7de279dccb010ab10e74dd07ee",
+        "rev": "55ec06035e85fcbda5caa6a73d045a9910fb16a2",
         "type": "github"
       },
       "original": {
         "owner": "chayleaf",
-        "ref": "cleanup",
+        "ref": "fix-op6-modem",
         "repo": "mobile-nixos",
         "type": "github"
       }
@@ -181,11 +240,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1700616016,
-        "narHash": "sha256-GCD2U3jMWmBqJccDDXr8pf2Ia2NnFiIYqnm9wK1DxLk=",
+        "lastModified": 1706145483,
+        "narHash": "sha256-omDJXQPBNCFGjSSP4X3mlITdmgfkJ3wrlLN1RhR6ld0=",
         "owner": "fufexan",
         "repo": "nix-gaming",
-        "rev": "7d81bdbf62936d50906609097b1fd6e68e59daa7",
+        "rev": "b9f77409aad6976efdae3b05523a07b328920c97",
         "type": "github"
       },
       "original": {
@@ -194,13 +253,33 @@
         "type": "github"
       }
     },
+    "nix-index-database": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1705806513,
+        "narHash": "sha256-FcOmNjhHFfPz2udZbRpZ1sfyhVMr+C2O8kOxPj+HDDk=",
+        "owner": "nix-community",
+        "repo": "nix-index-database",
+        "rev": "f8e04fbcebcc24cebc91989981bd45f69b963ed7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-index-database",
+        "type": "github"
+      }
+    },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1700559156,
-        "narHash": "sha256-gL4epO/qf+wo30JjC3g+b5Bs8UrpxzkhNBBsUYxpw2g=",
+        "lastModified": 1706182238,
+        "narHash": "sha256-Ti7CerGydU7xyrP/ow85lHsOpf+XMx98kQnPoQCSi1g=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "c3abafb01cd7045dba522af29b625bd1e170c2fb",
+        "rev": "f84eaffc35d1a655e84749228cde19922fcf55f1",
         "type": "github"
       },
       "original": {
@@ -212,24 +291,24 @@
     "nixos-mailserver": {
       "inputs": {
         "blobs": "blobs",
-        "flake-compat": "flake-compat_3",
+        "flake-compat": "flake-compat_4",
         "nixpkgs": [
           "nixpkgs"
         ],
-        "nixpkgs-22_11": [
-          "nixpkgs"
-        ],
         "nixpkgs-23_05": [
           "nixpkgs"
         ],
+        "nixpkgs-23_11": [
+          "nixpkgs"
+        ],
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1700085753,
-        "narHash": "sha256-qtib7f3eRwfaUF+VziJXiBcZFqpHCAXS4HlrFsnzzl4=",
+        "lastModified": 1706219574,
+        "narHash": "sha256-qO+8UErk+bXCq2ybHU4GzXG4Ejk4Tk0rnnTPNyypW4g=",
         "owner": "simple-nixos-mailserver",
         "repo": "nixos-mailserver",
-        "rev": "008d78cc21959e33d0d31f375b88353a7d7121ae",
+        "rev": "e47f3719f1db3e0961a4358d4cb234a0acaa7baf",
         "type": "gitlab"
       },
       "original": {
@@ -245,11 +324,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1700524221,
-        "narHash": "sha256-YQGjhwhd68N9fILRwZXlT3z6yXP5kRH8B6bxD2uQq14=",
+        "lastModified": 1701663968,
+        "narHash": "sha256-vsBlAzDJlpFpDfoE8RZMiYHe9bWu6SC5KAayh4fxIvg=",
         "owner": "chayleaf",
         "repo": "nixos-router",
-        "rev": "e9d2ec7ad1f34cb9f1f71c1400430af817431a3b",
+        "rev": "567dd3fd022874e10ffea7d06901075a3efa3215",
         "type": "github"
       },
       "original": {
@@ -260,15 +339,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1700647334,
-        "narHash": "sha256-0F5B7oJAAJ4u4sq97nIhcH/pVFkFjYY5JFxXXHOBJQ4=",
+        "lastModified": 1706300291,
+        "narHash": "sha256-VPDupUs/Pm3hUgDipmobXD82b7hlNIBfVO3RjsQXdf4=",
         "owner": "chayleaf",
         "repo": "nixpkgs",
-        "rev": "e70edbbc30bca7d90c4a1e8c653ceb1607cc2858",
+        "rev": "980c983f4f55bd30b653e4512b2eb85aee71964d",
         "type": "github"
       },
       "original": {
         "owner": "chayleaf",
+        "ref": "ci",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -276,11 +356,11 @@
     "nixpkgs-lib": {
       "locked": {
         "dir": "lib",
-        "lastModified": 1698611440,
-        "narHash": "sha256-jPjHjrerhYDy3q9+s5EAsuhyhuknNfowY6yt6pjn9pc=",
+        "lastModified": 1703961334,
+        "narHash": "sha256-M1mV/Cq+pgjk0rt6VxoyyD+O8cOUiai8t9Q6Yyq4noY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0cbe9f69c234a7700596e943bfae7ef27a31b735",
+        "rev": "b0d36bd0a420ecee3bc916c91886caca87c894e9",
         "type": "github"
       },
       "original": {
@@ -333,11 +413,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1700660661,
-        "narHash": "sha256-1+//5oLdqYo8ptS/ZpaGEzgnQ6FWJOjLPyTuiD6mPjY=",
+        "lastModified": 1706298359,
+        "narHash": "sha256-Akibmb69MTDTZ+sSbRngKROKPqbAFVwI+GD8git9qLY=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "0707dd061f4fb82393f3c96c6ed10c60396d7f9c",
+        "rev": "2fde9f9248e2dea3c2534ade2e4a9c3ea079a025",
         "type": "github"
       },
       "original": {
@@ -348,12 +428,14 @@
     },
     "root": {
       "inputs": {
-        "flake-compat": "flake-compat",
+        "coop-ofd": "coop-ofd",
+        "flake-compat": "flake-compat_2",
         "home-manager": "home-manager",
         "impermanence": "impermanence",
         "maubot": "maubot",
         "mobile-nixos": "mobile-nixos",
         "nix-gaming": "nix-gaming",
+        "nix-index-database": "nix-index-database",
         "nixos-hardware": "nixos-hardware",
         "nixos-mailserver": "nixos-mailserver",
         "nixos-router": "nixos-router",
@@ -372,11 +454,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1700619457,
-        "narHash": "sha256-zjmlh8xo4UsNdw7nMyiHgQg1xXNcJnpdMLvyunnnitQ=",
+        "lastModified": 1706235145,
+        "narHash": "sha256-3jh5nahTlcsX6QFcMPqxtLn9p9CgT9RSce5GLqjcpi4=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "7c94410d52d4e8bd72803fc1fe6c51fe179edaf5",
+        "rev": "3a57c4e29cb2beb777b2e6ae7309a680585b8b2f",
         "type": "github"
       },
       "original": {

flake.nix

@@ -4,11 +4,15 @@
   inputs = {
     #nixpkgs.url = "github:NixOS/nixpkgs/3dc2b4f8166f744c3b3e9ff8224e7c5d74a5424f";
     # nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgs.url = "github:chayleaf/nixpkgs";
+    nixpkgs.url = "github:chayleaf/nixpkgs/ci";
     nixos-hardware.url = "github:NixOS/nixos-hardware";
+    nix-index-database = {
+      url = "github:nix-community/nix-index-database";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     mobile-nixos = {
       # url = "github:NixOS/mobile-nixos";
-      url = "github:chayleaf/mobile-nixos/cleanup";
+      url = "github:chayleaf/mobile-nixos/fix-op6-modem";
       flake = false;
     };
     impermanence.url = "github:nix-community/impermanence";
@@ -17,6 +21,10 @@
       url = "github:oxalica/rust-overlay";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    coop-ofd = {
+      url = "github:chayleaf/coop-ofd";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -46,8 +54,8 @@
       inputs.nixpkgs.follows = "nixpkgs";
       # prevent extra input from being in flake.lock
       # (this doesn't affect any behavior)
-      inputs.nixpkgs-22_11.follows = "nixpkgs";
       inputs.nixpkgs-23_05.follows = "nixpkgs";
+      inputs.nixpkgs-23_11.follows = "nixpkgs";
     };
     flake-compat = {
       url = "github:edolstra/flake-compat";
@@ -55,36 +63,34 @@
     };
   };
 
-  outputs = inputs@
-    { self
-    , nixpkgs
-    , nixos-hardware
-    , mobile-nixos
-    , impermanence
-    , home-manager
-    , nur
-    , nix-gaming
-    , notlua
-    , notnft
-    , nixos-mailserver
-    , nixos-router
-    , maubot
-    , ... }:
+  outputs = base-inputs@{ self, nixpkgs, ... }:
   let
     # --impure required for developing
     # it takes the paths for modules from filesystem as opposed to flake inputs
-    devNft = false;
-    devNixRt = false;
-    devMaubot = false;
+    dev = {
+      # coop-ofd = true;
+      # maubot = true;
+      # mobile-nixos = true;
+      # nixos-router = true;
+      # notnft = true;
+    };
     # IRL-related stuff I'd rather not put into git
     priv =
-      if builtins.pathExists ./private.nix then (import ./private.nix { })
-      else if builtins.pathExists ./private/default.nix then (import ./private { })
+      if builtins.pathExists ./private.nix then import ./private.nix { }
+      else if builtins.pathExists ./private/default.nix then import ./private { }
       # workaround for git flakes not having access to non-checked out files
       else if builtins?extraBuiltins.secrets then builtins.extraBuiltins.secrets
       # yes, this is impure, this is a last ditch effort at getting access to secrets
-      else import /etc/nixos/private { };
+      else import /secrets/nixos { };
     devPath = priv.devPath or ../.;
+    inputs = builtins.mapAttrs
+      (name: input:
+        if dev.${name} or false then
+          (if input._type or null == "flake"
+          then (import base-inputs.flake-compat { src = /${devPath}/${name}; }).defaultNix
+          else /${devPath}/${name})
+          else input)
+      base-inputs;
     # if x has key s, get it. Otherwise return def
     # All private config for hostname
     getPriv = hostname: priv.${hostname} or { };
@@ -93,20 +99,13 @@
     # Private home-manager config for hostname and username
     getPrivUser = hostname: user: (getPriv hostname).${user} or { };
     # extended lib
-    lib = nixpkgs.lib // {
-      quoteListenAddr = addr:
-        if nixpkgs.lib.hasInfix ":" addr then "[${addr}]" else addr;
-    };
+    lib = nixpkgs.lib // import ./lib.nix { inherit (nixpkgs) lib; };
     # can't use callPackage ./pkgs here, idk why; use import instead
     overlay' = args: self: super: import ./pkgs ({
       pkgs = super;
       pkgs' = self;
       lib = super.lib;
-      nur = import nur {
-        pkgs = super;
-        nurpkgs = super;
-      };
-      nix-gaming = nix-gaming.packages.${super.system};
+      inherit inputs;
     } // args);
     overlay = overlay' { };
     # I override some settings down the line, but overlays always stay the same
@@ -123,180 +122,41 @@
         system = "aarch64-linux";
         modules = [
           {
-            _module.args.server-config = nixosConfigurations.server.config;
-            _module.args.notnft = if devNft then (import /${devPath}/notnft { inherit (nixpkgs) lib; }).config.notnft else notnft.lib.${system};
+            _module.args.server-config = self.nixosConfigurations.server.config;
+            _module.args.notnft = inputs.notnft.lib.${system};
           }
-          (if devNixRt then import /${devPath}/nixos-router else nixos-router.nixosModules.default)
+          inputs.nixos-router.nixosModules.default
         ];
       };
-      crossConfig' = from: config: config // {
-        modules = config.modules ++ [
-          {
-            _module.args.fromSourcePkgs = (mkPkgs { system = from; }).pkgsCross.${{
-              aarch64-linux = "aarch64-multiplatform";
-            }.${config.system}};
-          }
-        ];
-      };
-      crossConfig = config: crossConfig' ({
-        x86_64-linux = "aarch64-linux";
-        aarch64-linux = "x86_64-linux";
-      }.${config.system}) config;
-    in rec {
+    in {
       router-emmc = mkBpiR3 "emmc" routerConfig;
       router-sd = mkBpiR3 "sd" routerConfig;
-      router-emmc-cross = crossConfig router-emmc;
-      router-sd-cross = crossConfig router-emmc;
       server = {
         system = "aarch64-linux";
         modules = [
-          { _module.args.router-config = nixosConfigurations.router-emmc.config; }
-          nixos-mailserver.nixosModules.default
+          { _module.args.router-config = self.nixosConfigurations.router-emmc.config; }
           ./system/devices/radxa-rock5a-server.nix
-          (if devMaubot then import /${devPath}/maubot.nix/module else maubot.nixosModules.default)
-          ./system/modules/scanservjs.nix
         ];
       };
-      server-cross = crossConfig server;
       nixmsi = rec {
         system = "x86_64-linux";
-        modules = [
-          nix-gaming.nixosModules.pipewireLowLatency
-          ./system/devices/msi-delta-15-workstation.nix
-        ];
-        home.common.enableNixosModule = false;
+        modules = [ ./system/devices/msi-delta-15-workstation.nix ];
         home.common.extraSpecialArgs = {
-          notlua = notlua.lib.${system};
+          notlua = inputs.notlua.lib.${system};
         };
-        home.user = [
-          nur.nixosModules.nur
-          ./home/hosts/nixmsi.nix
-        ];
+        home.user = [ ./home/hosts/nixmsi.nix ];
       };
-      nixmsi-cross = crossConfig nixmsi;
-      phone = {
+      phone = rec {
         system = "aarch64-linux";
-        modules = [
-          (import "${mobile-nixos}/lib/configuration.nix" {
-            device = "oneplus-enchilada";
-          })
-          ./system/hosts/phone/default.nix
-        ];
+        modules = [ ./system/devices/oneplus-6-phone.nix ];
+        home.common.extraSpecialArgs = {
+          notlua = inputs.notlua.lib.${system};
+        };
+        home.user = [ ./home/hosts/phone.nix ];
       };
-      phone-cross = crossConfig phone;
     };
 
-    # this is the system config processing part
-    nixosConfigurations = builtins.mapAttrs (hostname: args @ { system, modules, specialArgs ? {}, nixpkgs ? {}, home ? {}, ... }:
-      lib.nixosSystem ({
-        inherit system;
-        # allow modules to access nixpkgs directly, use customized lib,
-        # and pass nixos-harware to let hardware modules import parts of nixos-hardware
-        specialArgs = {
-          inherit lib nixpkgs;
-          hardware = nixos-hardware.nixosModules;
-        } // specialArgs;
-        modules = modules ++ [
-          # Third-party NixOS modules
-          impermanence.nixosModule 
-          # My custom NixOS modules
-          ./system/modules/vfio.nix
-          ./system/modules/ccache.nix
-          ./system/modules/impermanence.nix
-          ./system/modules/common.nix
-          (getPrivSys hostname)
-          # The common configuration that isn't part of common.nix
-          ({ config, pkgs, lib, ... }: {
-            networking.hostName = lib.mkDefault hostname;
-            nixpkgs.overlays = [ overlay ];
-            nix.extraOptions = ''
-              plugin-files = ${pkgs.nix-plugins.override { nix = config.nix.package; }}/lib/nix/plugins/libnix-extra-builtins.so
-            '';
-
-            # registry is used for the new flaky nix command
-            nix.registry =
-              builtins.mapAttrs
-              (_: v: { flake = v; })
-              (lib.filterAttrs (_: v: v?outputs) inputs);
-
-            # add import'able flake inputs (like nixpkgs) to nix path
-            # nix path is used for old nix commands (like nix-build, nix-shell)
-            environment.etc = lib.mapAttrs'
-              (name: value: {
-                name = "nix/inputs/${name}";
-                value = { source = value.outPath; };
-              })
-              (lib.filterAttrs (_: v: builtins.pathExists "${v}/default.nix") inputs);
-            nix.nixPath = [ "/etc/nix/inputs" ];
-          })
-        ]
-        # the following is NixOS home-manager module configuration. Currently unused, but I might start using it for some hosts later.
-        ++ (lib.optionals (home != {} && ((home.common or {}).enableNixosModule or true)) [
-          home-manager.nixosModules.home-manager
-          {
-            home-manager = builtins.removeAttrs (home.common or { }) [ "nixpkgs" "nix" "enableNixosModule" ];
-          }
-          {
-            # set both to false to match behavior with standalone home-manager
-            home-manager.useGlobalPkgs = false;
-            home-manager.useUserPackages = false;
-            home-manager.users = builtins.mapAttrs (username: modules: {
-              imports = modules ++ [
-                {
-                  nixpkgs = (home.common or { }).nixpkgs or { };
-                  nix = (home.common or { }).nix or { };
-                }
-                ({ config, pkgs, lib, ...}: {
-                  nixpkgs.overlays = [ overlay ];
-                  nix.package = lib.mkDefault pkgs.nixForNixPlugins;
-                  # this is only needed if nixos doesnt set plugin-files already
-                  /*nix.extraOptions = ''
-                    plugin-files = ${pkgs.nix-plugins.override { nix = config.nix.package; }}/lib/nix/plugins/libnix-extra-builtins.so
-                  '';*/
-                })
-                (getPrivUser hostname username)
-              ];
-            }) (builtins.removeAttrs home [ "common" ]);
-          }
-        ]);
-      } // (builtins.removeAttrs args [ "home" "modules" "nixpkgs" ])))
-      config;
-
-    # for each hostname, for each user, generate an attribute "${user}@${hostname}"
-    homeConfigurations =
-      builtins.foldl'
-        (a: b: a // b)
-        { }
-        (builtins.concatLists
-          (lib.mapAttrsToList
-            (hostname: sysConfig:
-            let
-              inherit (sysConfig) system;
-              common' = builtins.removeAttrs (sysConfig.home.common or { }) [ "nix" "nixpkgs" "enableNixosModule" ];
-              pkgs = mkPkgs ({ inherit system; } // ((sysConfig.home.common or { }).nixpkgs or {}));
-              common = common' // { inherit pkgs; };
-            in 
-              lib.mapAttrsToList
-                # this is where actual config takes place
-                (user: homeConfig: {
-                  "${user}@${hostname}" = home-manager.lib.homeManagerConfiguration (common // {
-                    modules = homeConfig ++ [
-                      (getPrivUser hostname user)
-                      ({ config, pkgs, lib, ... }: {
-                        nixpkgs.overlays = [ overlay ];
-                        nix.package = lib.mkDefault pkgs.nixForNixPlugins;
-                        # this is only needed if nixos doesnt set plugin-files already
-                        /*nix.extraOptions = ''
-                          plugin-files = ${pkgs.nix-plugins.override { nix = config.nix.package; }}/lib/nix/plugins/libnix-extra-builtins.so
-                        '';*/
-                      })
-                    ];
-                  });
-                })
-                (builtins.removeAttrs (sysConfig.home or { }) [ "common" ]))
-            config));
   in {
-    inherit nixosConfigurations homeConfigurations;
     overlays.default = overlay;
     packages = lib.genAttrs [
       "x86_64-linux"
@@ -304,24 +164,89 @@
     ] (system: let self = overlay' { isOverlay = false; } (mkPkgs { inherit system; } // self) (import nixpkgs { inherit system; }); in self);
     nixosImages.router = let pkgs = mkPkgs { inherit (config.router-emmc) system; }; in {
       emmcImage = pkgs.callPackage ./system/hardware/bpi-r3/image.nix {
-        inherit (nixosConfigurations.router-emmc) config;
-        rootfsImage = nixosConfigurations.router-emmc.config.system.build.rootfsImage;
+        inherit (self.nixosConfigurations.router-emmc) config;
+        rootfsImage = self.nixosConfigurations.router-emmc.config.system.build.rootfsImage;
         bpiR3Stuff = pkgs.bpiR3StuffEmmc;
       };
       sdImage = pkgs.callPackage ./system/hardware/bpi-r3/image.nix {
-        inherit (nixosConfigurations.router-sd) config;
-        rootfsImage = nixosConfigurations.router-sd.config.system.build.rootfsImage;
+        inherit (self.nixosConfigurations.router-sd) config;
+        rootfsImage = self.nixosConfigurations.router-sd.config.system.build.rootfsImage;
         bpiR3Stuff = pkgs.bpiR3StuffSd;
       };
     };
-    nixosImages.phone = nixosConfigurations.phone.config.mobile.outputs.disk-image;
-    nixosImages.phone-fastboot = nixosConfigurations.phone.config.mobile.outputs.android.android-fastboot-image;
 
     hydraJobs = {
-      server.${config.server.system} = nixosConfigurations.server.config.system.build.toplevel;
-      workstation.${config.nixmsi.system} = nixosConfigurations.nixmsi.config.system.build.toplevel;
-      router.${config.router-emmc.system} = nixosConfigurations.router-emmc.config.system.build.toplevel;
-      workstation-home.${config.nixmsi.system} = homeConfigurations."user@nixmsi".activation-script;
+      server.${config.server.system} = self.nixosConfigurations.server.config.system.build.toplevel;
+      router.${config.router-emmc.system} = self.nixosConfigurations.router-emmc.config.system.build.toplevel;
+      phone.${config.phone.system} = self.nixosConfigurations.phone.config.system.build.toplevel;
+      phone-home.${config.phone.system} = self.homeConfigurations."user@phone".activation-script;
+      workstation.${config.nixmsi.system} = self.nixosConfigurations.nixmsi.config.system.build.toplevel;
+      workstation-home.${config.nixmsi.system} = self.homeConfigurations."user@nixmsi".activation-script;
     };
+
+    # this is the system config processing part
+    nixosConfigurations = lib.flip builtins.mapAttrs config (hostname: args @ { modules, nixpkgs ? {}, home ? {}, ... }:
+      lib.nixosSystem {
+        inherit (args) system;
+        # allow modules to access nixpkgs directly, use customized lib,
+        # and pass nixos-harware to let hardware modules import parts of nixos-hardware
+        specialArgs = {
+          inherit inputs lib;
+          hardware = inputs.nixos-hardware.nixosModules;
+        } // args.specialArgs or { };
+        modules = args.modules or [ ]
+        ++ [
+          (getPrivSys hostname)
+          { networking.hostName = lib.mkDefault hostname;
+            nixpkgs.overlays = [ overlay ]; }
+          inputs.impermanence.nixosModule 
+        ]
+        ++ map (x: ./system/modules/${x}) (builtins.attrNames (builtins.readDir ./system/modules))
+        # the following is NixOS home-manager module configuration. Currently unused, but I might start using it for some hosts later.
+        ++ lib.optionals (home != { } && home.common.enableNixosModule or false) [
+          inputs.home-manager.nixosModules.home-manager
+          { home-manager = builtins.removeAttrs (home.common or { }) [ "nixpkgs" "nix" "enableNixosModule" ]; }
+          { # set both to false to match behavior with standalone home-manager
+            home-manager.useGlobalPkgs = false;
+            home-manager.useUserPackages = false;
+            home-manager.users = builtins.mapAttrs (username: modules: {
+              imports = modules ++ [
+                { nixpkgs = home.common.nixpkgs or { };
+                  nix = home.common.nix or { }; }
+                ({ config, pkgs, lib, ...}: {
+                  nixpkgs.overlays = [ overlay ];
+                  nix.package = lib.mkDefault pkgs.nixForNixPlugins; })
+                (getPrivUser hostname username)
+              ];
+            }) (builtins.removeAttrs home [ "common" ]); }
+        ];
+      });
+
+    # for each hostname, for each user, generate an attribute "${user}@${hostname}"
+    homeConfigurations =
+      builtins.listToAttrs (builtins.concatLists
+        (lib.flip lib.mapAttrsToList config
+          (hostname: { system, home ? {}, ... }:
+          let
+            common' = builtins.removeAttrs (home.common or { }) [ "nix" "nixpkgs" "enableNixosModule" ];
+            pkgs = mkPkgs ({ inherit system; } // home.common.nixpkgs or { });
+            common = common' // { inherit pkgs; };
+          in 
+            lib.flip lib.mapAttrsToList (builtins.removeAttrs home [ "common" ])
+              # this is where actual config takes place
+              (user: homeConfig: lib.nameValuePair "${user}@${hostname}" 
+              (inputs.home-manager.lib.homeManagerConfiguration (common // {
+                extraSpecialArgs = (common.extraSpecialArgs or { }) // { inherit inputs; };
+                modules =
+                  homeConfig
+                  ++ common.modules or [ ]
+                  ++ [
+                    (getPrivUser hostname user)
+                    ({ pkgs, lib, ... }: {
+                      nixpkgs.overlays = [ overlay ];
+                      nix.package = lib.mkDefault pkgs.nixForNixPlugins;
+                    })
+                  ];
+              }))))));
   };
 }

home/common/firefox.nix

@@ -1,43 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  imports = [
-    ./gui.nix
-  ];
-  programs.firefox = {
-    enable = true;
-    package = pkgs.wrapFirefox pkgs.librewolf-unwrapped {
-      inherit (pkgs.librewolf-unwrapped) extraPrefsFiles extraPoliciesFiles;
-      wmClass = "LibreWolf";
-      libName = "librewolf";
-      nativeMessagingHosts = with pkgs; [ keepassxc ];
-    };
-    profiles.chayleaf = {
-      extensions = (with config.nur.repos.rycee.firefox-addons; [
-        cookies-txt
-        don-t-fuck-with-paste
-        greasemonkey
-        keepassxc-browser
-        libredirect
-        localcdn
-        noscript
-        privacy-pass
-        protondb-for-steam
-        return-youtube-dislikes
-        rust-search-extension
-        search-by-image
-        sponsorblock
-        steam-database
-        ublock-origin
-        unpaywall
-        vimium-c
-        youtube-shorts-block
-      ]) ++ (with pkgs.firefoxAddons; [
-        fastforwardteam
-        middle-mouse-button-scroll
-        rikaitan
-        youtube-nonstop
-      ]);
-    };
-  };
-}

home/common/waybar.nix

@@ -1,130 +0,0 @@
-{ config, pkgs, ... }:
-{
-  services.playerctld.enable = config.wayland.windowManager.sway.enable;
-  programs.waybar = {
-    enable = config.wayland.windowManager.sway.enable;
-    package = pkgs.waybar.override {
-      withMediaPlayer = true;
-    };
-    /*).overrideAttrs (old: {
-      src = pkgs.fetchFromGitHub {
-        owner = "chayleaf";
-        repo = "Waybar";
-        rev = "3091cf4a009e92665325c0dd61adf5ab367786a3";
-        sha256 = "sha256-zH4hbQ8+9TYRVW/XYqmAVsi0vsSPn1LPqXxr0gi0j1E=";
-      };
-    });*/
-    settings = [{
-      layer = "bottom";
-      # position = "bottom";
-      ipc = true;
-      height = 40;
-      modules-left = [ "sway/workspaces" "sway/mode" "idle_inhibitor" "mpris" ];
-      idle_inhibitor = {
-        format = "{icon}";
-        format-icons = {
-          activated = "󰅶";
-          deactivated = "󰾪";
-        };
-      };
-      mpris = {
-        tooltip = true;
-        format = "{player_icon} {dynamic}";
-        format-paused = "{status_icon} {dynamic}";
-        interval = 1;
-        ellipsis = "…";
-        # tooltip-format = "{dynamic}";
-        album-len = 44;
-        artist-len = 44;
-        title-len = 44;
-        dynamic-len = 44;
-        player-icons = {
-          default = "";
-          mpd = "";
-	};
-        status-icons.paused = "";
-      };
-      "sway/workspaces" = {
-        disable-scroll = true;
-        format = "{value}{icon}";
-        format-icons = {
-          default = "";
-          focused = "";
-          urgent = " ";
-          "2" = " 󰵅";
-          "3" = " ";
-          "4" = " ";
-          "5" = " ";
-        };
-        persistent-workspaces = {
-          "1" = []; "2" = []; "3" = []; "4" = []; "5" = [];
-        };
-      };
-      "sway/mode" = {
-        tooltip = false;
-      };
-      modules-center = [ "sway/window" ];
-      #fixed-center = false;
-      "sway/window" = {
-        format = "{title}";
-        max-length = 50;
-        # tooltip = false;
-        icon = true;
-        rewrite = {
-          kitty = "";
-          zsh = "";
-          nheko = "";
-          Nextcloud = "";
-          "(.*) — LibreWolf" = "$1";
-          "(.*) - KeePassXC" = "$1";
-        };
-      };
-      modules-right = [ "memory" "cpu" "tray" "wireplumber" "clock" "sway/language" ];
-      cpu = {
-        # format = "{usage}% ";
-        format = "{icon0}{icon1}{icon2}{icon3}{icon4}{icon5}{icon6}{icon7}{icon8}{icon9}{icon10}{icon11}{icon12}{icon13}{icon14}{icon15}";
-        format-icons = ["▁" "▂" "▃" "▄" "▅" "▆" "▇" "█"];
-      };
-      memory = {
-        format = "{used}G";
-      };
-      tray = {
-        icon-size = 26;
-        spacing = 5;
-      };
-      wireplumber = {
-        format = "{volume}%";
-        format-muted = "ﱝ";
-        tooltip = false;
-      };
-      clock = {
-        interval = 5;
-        format = "{:%Y-%m-%d %H:%M:%S}";
-        tooltip-format = "<tt><small>{calendar}</small></tt>";
-        calendar = {
-          mode = "year";
-          # TODO: make this work
-          mode-mon-col = 3;
-          on-scroll = 1;
-          on-click-right = "mode";
-          format = {
-            months = "<span color='#ffead3'><b>{}</b></span>";
-            days = "<span color='#ecc6d9'><b>{}</b></span>";
-            weeks = "<span color='#99ffdd'><b>W{}</b></span>";
-            weekdays = "<span color='#ffcc66'><b>{}</b></span>";
-            today = "<span color='#ff6699'><b><u>{}</u></b></span>";
-          };
-        };
-      };
-      "sway/language" = {
-        tooltip = false;
-        # make sure it isn't pushed away when other modules get too big
-        min-length = 2;
-      };
-    }];
-    style = ./waybar.css;
-  };
-  home.packages = with pkgs; [
-    playerctl
-  ];
-}

home/hosts/nixmsi.nix

@@ -1,12 +1,18 @@
-{ pkgs, lib, ... }:
+{ pkgs
+, lib
+, inputs,
+...
+}:
+
 {
   imports = [
-    ../common/general.nix
-    ../common/firefox.nix
-    ../common/i3-sway.nix
-    ../common/nvim.nix
-    ../common/helix.nix
-    ../common/kakoune.nix
+    ../modules/general.nix
+    ../modules/firefox.nix
+    ../modules/i3-sway.nix
+    ../modules/nvim.nix
+    ../modules/helix.nix
+    ../modules/kakoune.nix
+    inputs.nur.nixosModules.nur
   ];
 
   nix.settings = {
@@ -36,28 +42,10 @@
   home.stateVersion = "22.11";
   home.username = "user";
   home.homeDirectory = "/home/user";
-  termShell = {
-    enable = true;
-    path = "${pkgs.fish}/bin/fish";
-  };
+  terminals = [ "kitty" ];
   # xsession.windowManager.i3.enable = true;
   wayland.windowManager.sway.enable = true;
-  terminals = [ "kitty" "urxvt" ];
-  services.mpd = {
-    enable = true;
-    network.startWhenNeeded = true;
-  };
-  services.mpdris2 = {
-    enable = true;
-  };
-  programs.ncmpcpp = {
-    enable = true;
-  };
   services.kdeconnect.enable = true;
-  systemd.user.services.kdeconnect.Service = {
-    Restart = lib.mkForce "always";
-    RestartSec = "30";
-  };
   home.sessionVariables = {
     STEAM_EXTRA_COMPAT_TOOLS_PATHS = "${pkgs.proton-ge}";
     CARGO_PROFILE_DEV_INCREMENTAL = "true";
@@ -67,6 +55,7 @@
     CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS = "-C link-arg=--ld-path=${pkgs.mold}/bin/mold";
   };
   home.packages = with pkgs; [
+    anki-bin
     (gimp.overrideAttrs (old: { doCheck = false; })) krita blender-hip
     kdenlive glaxnimate mediainfo
     ghidra (cutter.withPlugins (p: with p; [ sigdb rz-ghidra ]))

home/hosts/phone.nix

@@ -0,0 +1,38 @@
+{ pkgs
+, inputs,
+...
+}:
+
+{
+  imports = [
+    ../modules/general.nix
+    ../modules/firefox.nix
+    ../modules/i3-sway.nix
+    ../modules/nvim.nix
+    inputs.nur.nixosModules.nur
+  ];
+
+  nix.settings = {
+    trusted-public-keys = [
+      "binarycache.pavluk.org:Vk0ms/vSqoOV2JXeNVOroc8EfilgVxCCUtpCShGIKsQ="
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+    ];
+    trusted-substituters = [
+      "https://binarycache.pavluk.org"
+      "https://cache.nixos.org"
+    ];
+  };
+
+  phone.enable = true;
+  home.stateVersion = "23.11";
+  home.username = "user";
+  home.homeDirectory = "/home/user";
+  terminals = [ "foot" "kitty" ];
+  wayland.windowManager.sway.enable = true;
+  services.kdeconnect.enable = true;
+  home.packages = with pkgs; [
+    squeekboard
+    techmino
+    tdesktop
+  ];
+}

home/modules/firefox.nix

@@ -0,0 +1,75 @@
+{ config
+, pkgs
+, lib
+, ...
+}:
+
+{
+  imports = [
+    ./gui.nix
+  ];
+  home.file.".mozilla/firefox/profiles.ini".target = ".librewolf/profiles.ini";
+  programs.firefox = {
+    enable = true;
+    package = pkgs.wrapFirefox pkgs.librewolf-unwrapped {
+      inherit (pkgs.librewolf-unwrapped) extraPrefsFiles extraPoliciesFiles;
+      wmClass = "LibreWolf";
+      libName = "librewolf";
+      nativeMessagingHosts = with pkgs; [ keepassxc ];
+    };
+    profiles.chayleaf = lib.mkMerge [
+      {
+        extensions = (with config.nur.repos.rycee.firefox-addons; [
+          cookies-txt
+          don-t-fuck-with-paste
+          greasemonkey
+          keepassxc-browser
+          libredirect
+          localcdn
+          noscript
+          privacy-pass
+          protondb-for-steam
+          return-youtube-dislikes
+          rust-search-extension
+          search-by-image
+          sponsorblock
+          steam-database
+          ublock-origin
+          unpaywall
+          vimium-c
+          youtube-shorts-block
+        ]) ++ (with pkgs.firefoxAddons; [
+          fastforwardteam
+          middle-mouse-button-scroll
+          rikaitan
+          youtube-nonstop
+        ]);
+        settings = lib.mkIf config.phone.enable {
+          "dom.w3c.touch_events.enabled" = true;
+          "apz.allow_zooming" = true;
+          "apz.allow_double_tap_zooming" = true;
+          "dom.w3c_touch_events.legacy_apis.enabled" = true;
+          "browser.tabs.inTitlebar" = 1;
+          "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
+          "browser.urlbar.clickSelectsAll" = true;
+          "toolkit.cosmeticAnimations.enabled" = false;
+          "browser.download.animateNotifications" = false;
+        };
+      }
+      (let
+        concatFiles = dir:
+          builtins.concatStringsSep ""
+            (map
+              (k: lib.optionalString (!lib.hasInfix ".before-ff" k) (builtins.readFile "${dir}/${k}"))
+              (builtins.attrNames (builtins.readDir dir)));
+      in lib.mkIf config.phone.enable {
+        userChrome =
+          concatFiles "${pkgs.mobile-config-firefox}/etc/mobile-config-firefox/common"
+          + concatFiles "${pkgs.mobile-config-firefox}/etc/mobile-config-firefox/userChrome";
+        userContent =
+          concatFiles "${pkgs.mobile-config-firefox}/etc/mobile-config-firefox/common"
+          + concatFiles "${pkgs.mobile-config-firefox}/etc/mobile-config-firefox/userContent";
+      })
+    ];
+  };
+}

home/modules/fish.nix

@@ -102,7 +102,7 @@
       set -U _tide_left_items pwd git vi_mode
       set -U _tide_prompt_69105 \x1b\x28B\x1b\x5bm\x1b\x28B\x1b\x5bm\x1b\x5b34m\x1b\x5b44m\x20\x40PWD\x40\x20\x1b\x5b34m\x1b\x5b40m\ue0b0\x1b\x5b32m\x1b\x5b40m\x20\u276f\x20\x1b\x28B\x1b\x5bm\x1b\x28B\x1b\x5bm\x1b\x5b30m\ue0b0 \x1b\x28B\x1b\x5bm\x1b\x28B\x1b\x5bm\x1b\x5b30m\ue0b2\x1b\x5b32m\x1b\x5b40m\x20\uf00c\x20\x1b\x5b33m\x1b\x5b40m\ue0b2\x1b\x5b30m\x1b\x5b43m\x2021m\x2023s\x20\x1b\x28B\x1b\x5bm\x1b\x28B\x1b\x5bm\x1b\x5b33m
       set -U _tide_prompt_79899 \x1b\x28B\x1b\x5bm\x1b\x28B\x1b\x5bm\x1b\x5b34m\x1b\x5b44m\x20\x40PWD\x40\x20\x1b\x5b34m\x1b\x5b40m\ue0b0\x1b\x5b32m\x1b\x5b40m\x20\u276f\x20\x1b\x28B\x1b\x5bm\x1b\x28B\x1b\x5bm\x1b\x5b30m\ue0b0 \x1b\x28B\x1b\x5bm\x1b\x28B\x1b\x5bm\x1b\x5b30m\ue0b2\x1b\x5b32m\x1b\x5b40m\x20\uf00c\x20\x1b\x5b33m\x1b\x5b40m\ue0b2\x1b\x5b30m\x1b\x5b43m\x2015s\x20\x1b\x28B\x1b\x5bm\x1b\x28B\x1b\x5bm\x1b\x5b33m
-      set -U _tide_right_items status cmd_duration context jobs virtual_env rustc nix_shell
+      set -U _tide_right_items status cmd_duration context jobs rustc nix_shell
 
       # for the following values, -gx works too (-g doesn't)
       # but it pollutes children's env, so do -U
@@ -116,9 +116,6 @@
       set -U tide_character_vi_icon_default \u276e
       set -U tide_character_vi_icon_replace \u25b6
       set -U tide_character_vi_icon_visual V
-      set -U tide_chruby_bg_color red
-      set -U tide_chruby_color black
-      set -U tide_chruby_icon \ue23e
       set -U tide_cmd_duration_bg_color yellow
       set -U tide_cmd_duration_color black
       set -U tide_cmd_duration_decimals 0
@@ -198,7 +195,7 @@
       set -U tide_pwd_icon_unwritable \uf023
       set -U tide_pwd_markers \x2ebzr \x2ecitc \x2egit \x2ehg \x2enode\x2dversion \x2epython\x2dversion \x2eruby\x2dversion \x2eshorten_folder_marker \x2esvn \x2eterraform Cargo\x2etoml composer\x2ejson CVS go\x2emod package\x2ejson
       set -U tide_right_prompt_frame_enabled false
-      set -U tide_right_prompt_items status cmd_duration context jobs node virtual_env rustc java php chruby go kubectl toolbox terraform aws nix_shell crystal
+      set -U tide_right_prompt_items status cmd_duration context jobs node rustc java php go kubectl toolbox terraform aws nix_shell crystal
       set -U tide_right_prompt_prefix \ue0b2
       set -U tide_right_prompt_separator_diff_color \ue0b2
       set -U tide_right_prompt_separator_same_color \ue0b3
@@ -237,9 +234,6 @@
       set -U tide_vi_mode_icon_insert \u276f
       set -U tide_vi_mode_icon_replace R
       set -U tide_vi_mode_icon_visual V
-      set -U tide_virtual_env_bg_color brblack
-      set -U tide_virtual_env_color cyan
-      set -U tide_virtual_env_icon \ue73c
     '';
     plugins = with pkgs.fishPlugins; [
       { name = "tide"; src = tide.src; }

home/modules/general.nix

@@ -1,4 +1,10 @@
-{ config, pkgs, lib, ... }:
+{ config
+, pkgs
+, lib
+, inputs
+, ...
+}:
+
 {
   imports = [
     ./options.nix
@@ -20,9 +26,9 @@
     ll = "lsd -l";
     g = "git";
     gp = "git push";
-    gpuo = "git push -u origin";
     gr = "git rebase";
     gri = "git rebase -i";
+    grc = "git rebase --continue";
     gc = "git commit";
     gca = "git commit --amend";
     gm = "git merge";
@@ -38,22 +44,21 @@
     };
     nnn = let pluginSrc = "${pkgs.nnn.src}/plugins"; in {
       enable = true;
-      package = (pkgs.nnn.override ({ withNerdIcons = true; })).overrideAttrs (oldAttrs: {
+      package = (pkgs.nnn.override { withNerdIcons = true; }).overrideAttrs (oldAttrs: {
         # no need to add makeWrapper to nativeBuildInputs as home-manager does it already
         postInstall =
           let nnnArchiveRegex = "\\.(${lib.strings.concatStringsSep "|" [
             "7z" "a" "ace" "alz" "arc" "arj" "bz" "bz2" "cab" "cpio" "deb" "gz" "jar" "lha" "lz" "lzh" "lzma" "lzo" "rar" "rpm" "rz" "t7z" "tar" "tbz" "tbz2" "tgz" "tlz" "txz" "tZ" "tzo" "war" "xpi" "xz" "Z" "zip"
-          ]})$"; in with lib; with strings; ''
-          wrapProgram $out/bin/nnn \
-            --set GUI 1 \
-            --set NNN_OPENER ${escapeShellArg "${pluginSrc}/nuke"} \
-            --set NNN_ARCHIVE ${escapeShellArg nnnArchiveRegex} \
-            --add-flags ${
+          ]})$"; in ''
+            wrapProgram $out/bin/nnn ${lib.escapeShellArgs [
+              "--set" "GUI" "1"
+              "--set" "NNN_OPENER" "${pluginSrc}/nuke"
+              "--set" "NNN_ARCHIVE" nnnArchiveRegex
               # -a: auto create fifo file
               # -c: use NNN_OPENER
               # -x: x server features
-              escapeShellArg "-a -c -x"
-            }
+              "--add-flags" "-a -c -x"
+            ]}
         '';
       });
       extraPackages = with pkgs; [
@@ -147,6 +152,7 @@
     readline = {
       enable = true;
       variables.editing-mode = "vi";
+      variables.show-mode-in-prompt = true;
     };
     nix-index = {
       enable = true;
@@ -183,27 +189,7 @@
     text/html;  ${pkgs.w3m}/bin/w3m -dump -o document_charset=%{charset} -o display_link_number=1 '%s'; nametemplate=%s.html; copiousoutput
   '';
 
-  systemd.user.timers.nix-index = {
-    Install.WantedBy = [ "timers.target" ];
-    Unit = {
-      Description = "Update nix-index";
-      PartOf = [ "nix-index.service" ];
-    };
-    Timer = {
-      OnCalendar = "Mon *-*-* 00:00:00";
-      RandomizedDelaySec = 600;
-      Persistent = true;
-    };
-  };
-  systemd.user.services.nix-index = {
-    Unit.Description = "Update nix-index";
-    Service = {
-      Type = "oneshot";
-      ExecStart = "${config.programs.nix-index.package}/bin/nix-index";
-      Environment = [ "PATH=/home/${config.home.username}/.nix-profile/bin:/etc/profiles/per-user/${config.home.username}/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin" ];
-      TimeoutStartSec = 1800;
-    };
-  };
+  home.file.".cache/nix-index/files".source = assert config.xdg.cacheHome == "${config.home.homeDirectory}/.cache"; inputs.nix-index-database.legacyPackages.${pkgs.system}.database;
 
   systemd.user.tmpfiles.rules = builtins.map (file: "r!  \"/home/${config.home.username}/${file}\"") [
     ".local/share/clipman.json"

home/modules/gui.nix

@@ -1,6 +1,13 @@
 { config, pkgs, lib, ... }:
 {
   imports = [ ./terminal.nix ];
+  systemd.user.services.fcitx5-daemon = {
+    Unit.After = "graphical-session-pre.target";
+    Service = {
+      Restart = "on-failure";
+      RestartSec = 3;
+    };
+  };
   i18n.inputMethod = let fcitx5-qt = pkgs.libsForQt5.fcitx5-qt; in {
     enabled = "fcitx5";
     fcitx5.addons = with pkgs; [ fcitx5-lua fcitx5-gtk fcitx5-mozc fcitx5-configtool fcitx5-qt ];
@@ -24,7 +31,7 @@
     # this is for steam games, I set the launch options to:
     # `SDL_DYNAMIC_API=$SDL2_DYNAMIC_API %command%`
     # Steam itself doesn't work with SDL2_DYNAMIC_API set, so it's
-    # a bad idea to set SDL2_DYNAMIC_API globally
+    # a bad idea to set SDL_DYNAMIC_API globally
     SDL2_DYNAMIC_API = "${pkgs.SDL2}/lib/libSDL2.so";
   };
   programs.nnn.extraPackages = with pkgs; [
@@ -180,7 +187,7 @@
     # profiles = { };
     package = pkgs.wrapMpv ((pkgs.mpv-unwrapped.override {
       # webp support
-      ffmpeg = pkgs.ffmpeg-custom;
+      ffmpeg = pkgs.ffmpeg-full;
     }).overrideAttrs (old: {
       patches = old.patches or [] ++ [
         (pkgs.fetchpatch {
@@ -216,15 +223,6 @@
     enable = true;
   };
 
-  systemd.user.services = {
-    fcitx5-daemon = {
-      Unit.After = "graphical-session-pre.target";
-      Service = {
-        Restart = "on-failure";
-        RestartSec = 3;
-      };
-    };
-  };
   # i run this manually instead
   #services.nextcloud-client = {
   #  enable = true;
@@ -236,6 +234,23 @@
   #  settings = {
   #  };
   #};
+  termShell = {
+    enable = true;
+    path = "${pkgs.fish}/bin/fish";
+  };
+  services.mpd = {
+    enable = true;
+    network.startWhenNeeded = true;
+  };
+  services.mpdris2 = {
+    enable = true;
+  };
+  systemd.user.services.kdeconnect = lib.mkIf config.services.kdeconnect.enable {
+    Service = {
+      Restart = lib.mkForce "always";
+      RestartSec = "30";
+    };
+  };
 
   # some packages require a pointer theme
   home.pointerCursor.gtk.enable = true;
@@ -249,7 +264,7 @@
     qt5ct qgnomeplatform
     # various programs i use
     keepassxc nheko qbittorrent mumble
-    nextcloud-client gnome.zenity kdeconnect
+    nextcloud-client kdeconnect
     # cli tools
     imagemagick ffmpeg-full xdg-utils
     # fonts
@@ -263,7 +278,5 @@
     nix-init
     nvfetcher
     config.nur.repos.rycee.mozilla-addons-to-nix
-
-    anki-bin
   ];
 }

home/modules/i3-sway.nix

@@ -1,41 +1,64 @@
 { options, config, pkgs, lib, ... }:
 let
-modifier = "Mod4";
+modifier = if config.phone.enable then "Mod1" else "Mod4";
 rofiSway = config.programs.rofi.finalPackage;
 rofiI3 = pkgs.rofi.override { plugins = config.programs.rofi.plugins; };
-audioNext = with pkgs; writeShellScript "playerctl-next" ''
-  ${playerctl}/bin/playerctl next
-  PLAYER=$(${playerctl}/bin/playerctl -l | head -n 1)
+audioNext = pkgs.writeShellScript "playerctl-next" ''
+  ${pkgs.playerctl}/bin/playerctl next
+  PLAYER=$(${pkgs.playerctl}/bin/playerctl -l | ${pkgs.coreutils}/bin/head -n 1)
   # mpdris2 bug: audio wont play after a seek/skip, you have to pause-unpause
   if [[ "$PLAYER" == "mpd" ]]; then
-    ${playerctl}/bin/playerctl pause
-    ${playerctl}/bin/playerctl position 0
-    ${playerctl}/bin/playerctl play
+    ${pkgs.playerctl}/bin/playerctl pause
+    ${pkgs.playerctl}/bin/playerctl position 0
+    ${pkgs.playerctl}/bin/playerctl play
   fi
 '';
-audioPrev = with pkgs; writeShellScript "playerctl-prev" ''
+audioPrev = pkgs.writeShellScript "playerctl-prev" ''
   # just seek if over 5 seconds into the track
-  POS=$(${playerctl}/bin/playerctl position)
-  PLAYER=$(${playerctl}/bin/playerctl -l | head -n 1)
+  POS=$(${pkgs.playerctl}/bin/playerctl position)
+  PLAYER=$(${pkgs.playerctl}/bin/playerctl -l | ${pkgs.coreutils}/bin/head -n 1)
   if [ -n "$POS" ]; then
-    if (( $(echo "$POS > 5.01" | ${bc}/bin/bc -l) )); then
+    if (( $(echo "$POS > 5.01" | ${pkgs.bc}/bin/bc -l) )); then
       SEEK=1
     fi
   fi
   if [ -z "$SEEK" ]; then
-    ${playerctl}/bin/playerctl previous
+    ${pkgs.playerctl}/bin/playerctl previous
   else
-    ${playerctl}/bin/playerctl position 0
+    ${pkgs.playerctl}/bin/playerctl position 0
   fi
   # mpdris2 bug: audio wont play after a seek/skip, you have to pause-unpause
   if [[ "$PLAYER" == "mpd" ]]; then
-    ${playerctl}/bin/playerctl pause
-    ${playerctl}/bin/playerctl position 0
-    ${playerctl}/bin/playerctl play
+    ${pkgs.playerctl}/bin/playerctl pause
+    ${pkgs.playerctl}/bin/playerctl position 0
+    ${pkgs.playerctl}/bin/playerctl play
   fi
 '';
+swaylock =
+  if config.phone.enable
+  then "${pkgs.schlock}/bin/schlock -fp /secrets/schlock.pin"
+  else "${pkgs.swaylock}/bin/swaylock -f";
+swaylock-start = pkgs.writeShellScript "swaylock-start" ''
+  ${pkgs.procps}/bin/pgrep -fx "${swaylock}" || ${swaylock}
+'';
+dpms-off = pkgs.writeShellScript "sway-dpms-off" ''
+  ${config.wayland.windowManager.sway.package}/bin/swaymsg output "*" power off
+  ${config.wayland.windowManager.sway.package}/bin/swaymsg input type:touch events disabled
+'';
+dpms-on = pkgs.writeShellScript "sway-dpms-on" ''
+  ${config.wayland.windowManager.sway.package}/bin/swaymsg output "*" power on
+  ${config.wayland.windowManager.sway.package}/bin/swaymsg input type:touch events enabled
+'';
+lock-script = pkgs.writeShellScript "lock-start" ''
+  ${swaylock-start}
+  ${lib.optionalString config.phone.enable
+  # suspend if nothing is playing
+  ''
+    ${pkgs.playerctl}/bin/playerctl -a status | ${pkgs.gnugrep}/bin/grep Playing >/dev/null || /run/current-system/sw/bin/systemctl suspend
+  ''}
+'';
 barConfig = {
-  mode = "dock";
+  mode = "overlay";
   hiddenState = "hide";
   position = "bottom";
   workspaceButtons = true;
@@ -79,13 +102,29 @@ barConfig = {
 commonConfig = {
   inherit modifier;
   startup = [
-    { command = builtins.toString (with pkgs; writeShellScript "init-wm" ''
-      ${home-daemon}/bin/home-daemon system76-scheduler&
-      ${gnome.zenity}/bin/zenity --password | (${keepassxc}/bin/keepassxc --pw-stdin ~/Nextcloud/keepass.kdbx&)
+    { command = toString (pkgs.writeShellScript "init-wm" ''
+      ${lib.optionalString config.phone.enable ''
+        ${pkgs.procps}/bin/pkill -x wvkbd-mobintl
+        ${pkgs.wvkbd}/bin/wvkbd-mobintl --hidden -l full,special,cyrillic,emoji&
+        ${pkgs.procps}/bin/pkill -x squeekboard
+        ${pkgs.squeekboard}/bin/squeekboard&
+        /run/current-system/sw/bin/busctl call --user sm.puri.OSK0 /sm/puri/OSK0 sm.puri.OSK0 SetVisible b true
+      ''}
+      ${pkgs.procps}/bin/pkill -x home-daemon
+      ${pkgs.home-daemon}/bin/home-daemon system76-scheduler&
+      ${pkgs.procps}/bin/pkill -x keepassxc
+      ${pkgs.gnome.zenity}/bin/zenity --password | (${pkgs.keepassxc}/bin/keepassxc --pw-stdin ~/var/local.kdbx &)
+      # sleep to give keepassxc time to take the input
+      sleep 1
       # nextcloud and nheko need secret service access
-      ${nextcloud-client}/bin/nextcloud --background&
-      ${nheko}/bin/nheko&
-      ${tdesktop}/bin/telegram-desktop -startintray&
+      ${pkgs.procps}/bin/pkill -x nextcloud
+      ${pkgs.nextcloud-client}/bin/nextcloud --background&
+      ${pkgs.procps}/bin/pkill -x nheko
+      ${pkgs.nheko}/bin/nheko&
+      ${pkgs.procps}/bin/pkill -x telegram-desktop
+      ${pkgs.tdesktop}/bin/telegram-desktop -startintray&
+      # and final sleep just in case
+      sleep 1
     ''); }
   ];
   colors = {
@@ -149,13 +188,13 @@ genKeybindings = (default_options: kb:
     XF86MonBrightnessDown = "exec ${pkgs.brightnessctl}/bin/brightnessctl set 5%-";
     XF86MonBrightnessUp = "exec ${pkgs.brightnessctl}/bin/brightnessctl set 5%+";
   }
-  // (lib.attrsets.filterAttrs
+  // (lib.filterAttrs
     (k: v:
       !(builtins.elem
         k
-        ["${modifier}+space" "${modifier}+Shift+space"]))
-    (lib.lists.head
-      (lib.lists.head
+        [ "${modifier}+space" "${modifier}+Shift+space" ]))
+    (builtins.head
+      (builtins.head
         default_options.config.type.getSubModules)
       .imports)
     .options.keybindings.default)
@@ -232,7 +271,7 @@ in
     extraConfig = ''
       title_align center
     '';
-    config = let swayConfig = {
+    config = commonConfig // {
       bars = [
         {
           command = "${config.programs.waybar.package}/bin/waybar";
@@ -242,8 +281,17 @@ in
         }
       ];
       terminal = config.terminalBin;
-      window = commonConfig.window // { commands = [
-        { command = "floating enable; move workspace current";
+      window = commonConfig.window // { commands = lib.optionals config.phone.enable [
+        { command = "floating off; fullscreen off";
+          criteria = {
+            floating = true;
+          }; }
+        { command = "fullscreen off";
+          criteria = {
+            tiling = true;
+          }; }
+      ] ++ [
+        { command = "floating on; move workspace current";
           criteria = {
             app_id = "^org.keepassxc.KeePassXC$";
             title = "^KeePassXC - (?:Browser |ブラウザーの)?(?:Access Request|アクセス要求)$";
@@ -308,15 +356,22 @@ in
         "--inhibited --no-repeat --allow-other --release Scroll_Lock" = "exec ${pkgs.mumble}/bin/mumble rpc stoptalking";
         "${modifier}+c" = "exec ${rofiSway}/bin/rofi -show calc -no-show-match -no-sort -no-persist-history";
         "${modifier}+Print" = "exec ${grimshot}/bin/grimshot copy area";
-        "${modifier}+Mod1+Print" = "exec ${grimshot}/bin/grimshot copy window";
+        "${modifier}+${if modifier == "Mod1" then "Mod4" else "Mod1"}+Print" = "exec ${grimshot}/bin/grimshot copy window";
         "--locked XF86AudioRaiseVolume" = "exec ${pkgs.pamixer}/bin/pamixer --increase 5";
         "--locked XF86AudioLowerVolume" = "exec ${pkgs.pamixer}/bin/pamixer --decrease 5";
         "--locked XF86AudioMute" = "exec ${pkgs.pamixer}/bin/pamixer --toggle-mute";
         "--locked --inhibited XF86AudioPlay" = "exec ${pkgs.playerctl}/bin/playerctl play-pause";
         "--locked --inhibited XF86AudioNext" = "exec ${audioNext}";
         "--locked --inhibited XF86AudioPrev" = "exec ${audioPrev}";
+        "--locked --inhibited --release XF86PowerOff" = lib.mkIf config.phone.enable "exec ${pkgs.writeShellScript "power-key" ''
+          if ${config.wayland.windowManager.sway.package}/bin/swaymsg -rt get_outputs | ${pkgs.jq}/bin/jq ".[].power" | ${pkgs.gnugrep}/bin/grep true; then
+            ${dpms-off}
+          else
+            ${dpms-on}
+          fi
+        ''}";
       });
-      startup = commonConfig.startup ++ [
+      startup = [
         {
           always = true;
           command = "systemctl --user import-environment DISPLAY WAYLAND_DISPLAY SWAYSOCK XDG_CURRENT_DESKTOP";
@@ -324,7 +379,7 @@ in
         {
           command = "${pkgs.wl-clipboard}/bin/wl-paste -t text --watch ${pkgs.clipman}/bin/clipman store --no-persist";
         }
-      ];
+      ] ++ commonConfig.startup;
       output = {
         "*" = {
           bg = "~/var/wallpaper.jpg fill";
@@ -340,11 +395,12 @@ in
         };
       };
       menu = "${rofiSway}/bin/rofi -show drun";
-    }; in commonConfig // swayConfig;
+      workspaceLayout = "tabbed";
+    };
     # export WLR_RENDERER=vulkan
-    extraSessionCommands = (lib.optionalString config.wayland.windowManager.sway.vulkan ''
+    extraSessionCommands = lib.optionalString config.wayland.windowManager.sway.vulkan ''
       export WLR_RENDERER=vulkan
-    '') + ''
+    '' + ''
       export SDL_VIDEODRIVER=wayland,x11,kmsdrm,windows,directx
       # SDL3
       export SDL_VIDEO_DRIVER=wayland,x11,kmsdrm,windows
@@ -358,21 +414,18 @@ in
       export XDG_SESSION_DESKTOP=sway
     '';
   };
-  services.swayidle = let swaylock-start = builtins.toString (with pkgs; writeScript "swaylock-start" ''
-    #! ${bash}/bin/bash
-    ${procps}/bin/pgrep -fx "${swaylock}/bin/swaylock -f" || ${swaylock}/bin/swaylock -f
-  ''); in {
-    enable = config.wayland.windowManager.sway.enable;
+  services.swayidle = {
+    enable = config.wayland.windowManager.sway.enable && !config.phone.enable;
     events = [
-      { event = "before-sleep"; command = swaylock-start; }
+      { event = "before-sleep"; command = toString swaylock-start; }
       # after-resume, lock, unlock
     ];
     timeouts = [
-      { timeout = 300; 
-        command = "${config.wayland.windowManager.sway.package}/bin/swaymsg \"output * power off\"";
-        resumeCommand = "${config.wayland.windowManager.sway.package}/bin/swaymsg \"output * power on\""; }
-      { timeout = 600;
-        command = swaylock-start; }
+      { timeout = if config.phone.enable then 30 else 300; 
+        command = toString dpms-off;
+        resumeCommand = toString dpms-on; }
+      { timeout = if config.phone.enable then 60 else 600;
+        command = toString lock-script; }
     ];
   };
   programs.swaylock.settings = rec {
@@ -415,12 +468,12 @@ in
     text-wrong-color = text-color;
     ring-wrong-color = "#e64e4e"; # deep-ish red
   };
-  home.packages = with pkgs; if config.wayland.windowManager.sway.enable then [
+  home.packages = lib.mkIf config.wayland.windowManager.sway.enable (with pkgs; [
     wl-clipboard
     xdg-desktop-portal
     xdg-desktop-portal-wlr
     xdg-desktop-portal-gtk
-  ] else [];
+  ]);
   programs.rofi = {
     enable = true;
     font = "Noto Sans Mono 16";
@@ -467,7 +520,13 @@ in
     };
     terminal = config.terminalBin;
     extraConfig = {
-      modi = [ "steam:${pkgs.rofi-steam-game-list}/bin/rofi-steam-game-list" "drun" "run" "ssh" ];
+      modi = lib.optionals (!config.phone.enable) [
+        "steam:${pkgs.rofi-steam-game-list}/bin/rofi-steam-game-list"
+      ] ++ [
+        "drun"
+        "run"
+        "ssh"
+      ];
       icon-theme = "hicolor";
       drun-match-fields = [ "name" "generic" "exec" "keywords" ];
       show-icons = true;

home/modules/options.nix

@@ -1,5 +1,12 @@
 { lib, config, ... }:
 with lib; {
+  options.phone = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "whether this is a phone";
+    };
+  };
   options.rustAnalyzerAndroidSettings = mkOption {
     type = with types; attrs;
     description = "Additional cargo arguments for rust-analyzer's RustAndroid command";
@@ -28,50 +35,46 @@ with lib; {
     type = types.str;
     description = "Path to terminal binary for X server (output)";
   };
-  options.colors = mkOption {
-    type = types.submodule {
-      options = {
-        base = mkOption {
-          type = with types; listOf str;
-          description = "16 theme colors";
-        };
-        foreground = mkOption {
-          type = types.str;
-        };
-        background = mkOption {
-          type = types.str;
-        };
-        # 0-1
-        alpha = mkOption {
-          type = types.float;
-          description = "opacity (0.0-1.0)";
-        };
-        hexAlpha = mkOption {
-          type = types.str;
-          description = "hex opacity (read-only)";
-        };
-        percentAlpha = mkOption {
-          type = types.int;
-          description = "opacity percentage (read-only)";
-        };
-        black = mkOption { type = types.str; description = "read-only"; };
-        red = mkOption { type = types.str; description = "read-only"; };
-        green = mkOption { type = types.str; description = "read-only"; };
-        yellow = mkOption { type = types.str; description = "read-only"; };
-        blue = mkOption { type = types.str; description = "read-only"; };
-        magenta = mkOption { type = types.str; description = "read-only"; };
-        cyan = mkOption { type = types.str; description = "read-only"; };
-        white = mkOption { type = types.str; description = "read-only"; };
-        brBlack = mkOption { type = types.str; description = "read-only"; };
-        brRed = mkOption { type = types.str; description = "read-only"; };
-        brGreen = mkOption { type = types.str; description = "read-only"; };
-        brYellow = mkOption { type = types.str; description = "read-only"; };
-        brBlue = mkOption { type = types.str; description = "read-only"; };
-        brMagenta = mkOption { type = types.str; description = "read-only"; };
-        brCyan = mkOption { type = types.str; description = "read-only"; };
-        brWhite = mkOption { type = types.str; description = "read-only"; };
-      };
+  options.colors = {
+    base = mkOption {
+      type = with types; listOf str;
+      description = "16 theme colors";
     };
+    foreground = mkOption {
+      type = types.str;
+    };
+    background = mkOption {
+      type = types.str;
+    };
+    # 0-1
+    alpha = mkOption {
+      type = types.float;
+      description = "opacity (0.0-1.0)";
+    };
+    hexAlpha = mkOption {
+      type = types.str;
+      description = "hex opacity (read-only)";
+    };
+    percentAlpha = mkOption {
+      type = types.int;
+      description = "opacity percentage (read-only)";
+    };
+    black = mkOption { type = types.str; description = "read-only"; };
+    red = mkOption { type = types.str; description = "read-only"; };
+    green = mkOption { type = types.str; description = "read-only"; };
+    yellow = mkOption { type = types.str; description = "read-only"; };
+    blue = mkOption { type = types.str; description = "read-only"; };
+    magenta = mkOption { type = types.str; description = "read-only"; };
+    cyan = mkOption { type = types.str; description = "read-only"; };
+    white = mkOption { type = types.str; description = "read-only"; };
+    brBlack = mkOption { type = types.str; description = "read-only"; };
+    brRed = mkOption { type = types.str; description = "read-only"; };
+    brGreen = mkOption { type = types.str; description = "read-only"; };
+    brYellow = mkOption { type = types.str; description = "read-only"; };
+    brBlue = mkOption { type = types.str; description = "read-only"; };
+    brMagenta = mkOption { type = types.str; description = "read-only"; };
+    brCyan = mkOption { type = types.str; description = "read-only"; };
+    brWhite = mkOption { type = types.str; description = "read-only"; };
   };
   config.colors.hexAlpha =
     let hex = lib.trivial.toHexString (lib.trivial.min 255 (builtins.floor (config.colors.alpha * 256.0)));
@@ -93,19 +96,14 @@ with lib; {
   config.colors.brMagenta = builtins.elemAt config.colors.base 13;
   config.colors.brCyan = builtins.elemAt config.colors.base 14;
   config.colors.brWhite = builtins.elemAt config.colors.base 15;
-  options.termShell = mkOption {
-    type = types.submodule {
-      options = {
-        enable = mkOption {
-          type = types.bool;
-          default = false;
-        };
-        path = mkOption {
-          type = types.str;
-        };
-      };
+  options.termShell = {
+    enable = mkOption {
+      description = "Use a separate shell for gui terminal";
+      type = types.bool;
+      default = false;
+    };
+    path = mkOption {
+      type = types.str;
     };
-    default = {enable=false;};
-    description = "Use a separate shell for gui terminal";
   };
 }

home/modules/terminal.nix

@@ -1,14 +1,14 @@
 { config, pkgs, lib, ... }:
 let
-  supportTerminal = (term: builtins.elem term config.terminals);
-  getTerminalBin = (term: ({
+  supportTerminal = term: builtins.elem term config.terminals;
+  getTerminalBin = term: {
     alacritty = "${pkgs.alacritty}/bin/alacritty";
     foot = "${pkgs.foot}/bin/footclient";
     kitty = "${pkgs.kitty}/bin/kitty";
     urxvt = "${pkgs.rxvt-unicode-emoji}/bin/urxvt";
-  }).${term});
+  }.${term};
   color = builtins.elemAt config.colors.base;
-  hex = (x: if builtins.isFunction x then (y: "#" + (x y)) else ("#" + x));
+  hex = x: if builtins.isFunction x then (y: "#" + (x y)) else ("#" + x);
   shell = lib.mkIf config.termShell.enable (lib.mkDefault config.termShell.path);
 in {
   imports = [ ./options.nix ];
@@ -94,7 +94,7 @@ in {
   xresources.properties = lib.mkIf config.programs.urxvt.enable {
     # special colors
     "*.foreground" = hex config.colors.foreground;
-    "*.background" = "[${builtins.toString config.colors.percentAlpha}]#${config.colors.background}";
+    "*.background" = "[${toString config.colors.percentAlpha}]#${config.colors.background}";
     "*.cursorColor" = hex config.colors.foreground;
     # black
     "*.color0" = hex color 0;
@@ -123,7 +123,9 @@ in {
     "*antialias" = true;
     "*autohint" = true;
   };
-  home.file.".Xdefaults".source = lib.mkIf config.programs.urxvt.enable config.home.file."${config.home.homeDirectory}/.Xresources".source;
+  home.file.".Xdefaults" = lib.mkIf config.programs.urxvt.enable {
+    source = config.home.file."${config.home.homeDirectory}/.Xresources".source;
+  };
   programs.foot = {
     enable = supportTerminal "foot";
     server.enable = true;
@@ -174,7 +176,7 @@ in {
       repaint_delay = 4;
       foreground = hex config.colors.foreground;
       background = hex config.colors.background;
-      background_opacity = builtins.toString config.colors.alpha;
+      background_opacity = toString config.colors.alpha;
       color0 = hex color 0;
       color1 = hex color 1;
       color2 = hex color 2;
@@ -196,18 +198,21 @@ in {
       enabled_layouts = "all";
     };
   };
-  xdg.configFile."fontconfig/conf.d/10-kitty-fonts.conf".text = lib.mkIf ((supportTerminal "kitty") && (config.programs.kitty.font.name == "Noto Sans Mono")) ''
-<?xml version="1.0"?>
-<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
-<fontconfig>
-<match target="scan">
-    <test name="family">
+  xdg.configFile."fontconfig/conf.d/10-kitty-fonts.conf".text =
+    lib.mkIf
+      (supportTerminal "kitty" && config.programs.kitty.font.name == "Noto Sans Mono")
+  ''
+    <?xml version="1.0"?>
+    <!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+    <fontconfig>
+    <match target="scan">
+      <test name="family">
         <string>Noto Sans Mono</string>
-    </test>
-    <edit name="spacing">
+      </test>
+      <edit name="spacing">
         <int>90</int>
-    </edit>
-</match>
-</fontconfig>
+      </edit>
+    </match>
+    </fontconfig>
   '';
 }

home/modules/waybar.css

@@ -11,10 +11,18 @@
   border: none;
   border-radius: 0;
   font-family: Noto Sans Mono, "Symbols Nerd Font Mono", monospace;
-  font-size: 19;
+  font-size: 19px;
   min-height: 0;
 }
 
+#custom-a { font-size: 40px; }
+#custom-b { font-size: 40px; }
+#custom-c { font-size: 40px; }
+#custom-d { font-size: 40px; }
+#custom-e { font-size: 40px; }
+#custom-f { font-size: 40px; }
+#custom-g { font-size: 40px; }
+
 #mpris {
   padding-left: 3px;
   font-family: "Noto Sans Mono CJK JP", "Noto Sans Mono", "Symbols Nerd Font Mono", monospace;

home/modules/waybar.nix

@@ -0,0 +1,225 @@
+{ config
+, pkgs
+, lib
+, ...
+}:
+
+{
+  services.playerctld.enable = config.wayland.windowManager.sway.enable;
+  programs.waybar = {
+    enable = config.wayland.windowManager.sway.enable;
+    package = pkgs.waybar.override {
+      withMediaPlayer = true;
+    };
+    /*).overrideAttrs (old: {
+      src = pkgs.fetchFromGitHub {
+        owner = "chayleaf";
+        repo = "Waybar";
+        rev = "3091cf4a009e92665325c0dd61adf5ab367786a3";
+        sha256 = "sha256-zH4hbQ8+9TYRVW/XYqmAVsi0vsSPn1LPqXxr0gi0j1E=";
+      };
+    });*/
+    settings = lib.toList {
+      layer = "top";
+      position = "top";
+      ipc = true;
+      height = 40;
+      modules-left = [
+        "sway/workspaces"
+        "sway/mode"
+        "idle_inhibitor"
+      ]
+      ++ lib.optional (!config.phone.enable) "mpris";
+      idle_inhibitor = {
+        format = "{icon}";
+        format-icons = {
+          activated = "󰅶";
+          deactivated = "󰾪";
+        };
+      };
+      mpris = {
+        tooltip = true;
+        format = "{player_icon} {dynamic}";
+        format-paused = "{status_icon} {dynamic}";
+        interval = 1;
+        ellipsis = "…";
+        # tooltip-format = "{dynamic}";
+        album-len = 44;
+        artist-len = 44;
+        title-len = 44;
+        dynamic-len = 44;
+        player-icons = {
+          default = "";
+          mpd = "";
+	};
+        status-icons.paused = "";
+      };
+      "sway/workspaces" = {
+        disable-scroll = true;
+        format = "{value}{icon}";
+        format-icons = {
+          default = "";
+          urgent = " ";
+        } // lib.optionalAttrs (!config.phone.enable) {
+          "2" = " 󰵅";
+          "3" = " ";
+          "4" = " ";
+          "5" = " ";
+        };
+        persistent-workspaces = {
+          "1" = [ ]; "2" = [ ]; "3" = [ ];
+        };
+      };
+      "sway/mode" = {
+        tooltip = false;
+      };
+      modules-center = [ "sway/window" ];
+      #fixed-center = false;
+      "sway/window" = {
+        format = "{title}";
+        max-length = 50;
+        # tooltip = false;
+        icon = true;
+        rewrite = {
+          kitty = "";
+          zsh = "";
+          nheko = "";
+          Nextcloud = "";
+          "(.*) — LibreWolf" = "$1";
+          "(.*) - KeePassXC" = "$1";
+        };
+      };
+      modules-right = [
+        "memory"
+      ]
+      ++ lib.optional (!config.phone.enable) "cpu"
+      ++ [
+        "tray"
+        (if config.phone.enable then "pulseaudio" else "wireplumber")
+      ]
+      ++ lib.optional (!config.phone.enable) "clock"
+      ++ [ "sway/language" ]
+      ++ lib.optional config.phone.enable "battery";
+      battery = {
+        format = "{capacity}%";
+      };
+      cpu = {
+        # format = "{usage}% ";
+        format = "{icon0}{icon1}{icon2}{icon3}{icon4}{icon5}{icon6}{icon7}{icon8}{icon9}{icon10}{icon11}{icon12}{icon13}{icon14}{icon15}";
+        format-icons = ["▁" "▂" "▃" "▄" "▅" "▆" "▇" "█"];
+      };
+      memory = {
+        format = "{used}G";
+      };
+      tray = {
+        icon-size = 26;
+        spacing = 5;
+      };
+      wireplumber = {
+        format = "{volume}%";
+        format-muted = "ﱝ";
+        tooltip = false;
+      };
+      pulseaudio = {
+        format = "{volume}%";
+        format-muted = "ﱝ";
+        tooltip = false;
+      };
+      clock = {
+        interval = 5;
+        format = "{:%Y-%m-%d %H:%M:%S}";
+        tooltip-format = "<tt><small>{calendar}</small></tt>";
+        calendar = {
+          mode = "year";
+          # TODO: make this work
+          mode-mon-col = 3;
+          on-scroll = 1;
+          on-click-right = "mode";
+          format = {
+            months = "<span color='#ffead3'><b>{}</b></span>";
+            days = "<span color='#ecc6d9'><b>{}</b></span>";
+            weeks = "<span color='#99ffdd'><b>W{}</b></span>";
+            weekdays = "<span color='#ffcc66'><b>{}</b></span>";
+            today = "<span color='#ff6699'><b><u>{}</u></b></span>";
+          };
+        };
+      };
+      "sway/language" = {
+        tooltip = false;
+        # make sure it isn't pushed away when other modules get too big
+        min-length = 2;
+      };
+    } ++ lib.optionals config.phone.enable [
+      {
+        layer = "top";
+        position = "top";
+        ipc = true;
+        height = 40;
+        clock = {
+          interval = 5;
+          format = "{:%Y-%m-%d %H:%M:%S}";
+        };
+        cpu = {
+          # format = "{usage}% ";
+          format = "{icon0}{icon1}{icon2}{icon3}{icon4}{icon5}{icon6}{icon7}{icon8}{icon9}{icon10}{icon11}{icon12}{icon13}{icon14}{icon15}";
+          format-icons = ["▁" "▂" "▃" "▄" "▅" "▆" "▇" "█"];
+        };
+        modules-left = [ "cpu" ];
+        modules-right = [ "clock" ];
+      }
+      {
+        layer = "top";
+        position = "bottom";
+        ipc = true;
+        height = 80;
+        modules-left = [ "custom/a" "custom/b" "custom/c" ];
+        modules-right = [ "custom/d""custom/e"  "custom/f" ];
+        # 2 btns: keyboards
+        # 1 btn: close
+        # 
+        "custom/a" = {
+          interval = "once"; exec = "${pkgs.coreutils}/bin/echo a"; exec-if = "${pkgs.coreutils}/bin/true";
+          format = " A  ";
+          on-click = "${config.home.homeDirectory}/scripts/a.sh";
+        };
+        "custom/b" = {
+          interval = "once"; exec = "${pkgs.coreutils}/bin/echo a"; exec-if = "${pkgs.coreutils}/bin/true";
+          format = " 󰌌   ";
+          on-click = pkgs.writeShellScript "toggle-keyboard.sh" ''
+            ${pkgs.procps}/bin/pkill -SIGRTMIN -x wvkbd-mobintl
+          '';
+        };
+        "custom/c" = {
+          interval = "once"; exec = "${pkgs.coreutils}/bin/echo a"; exec-if = "${pkgs.coreutils}/bin/true";
+          format = " C ";
+          on-click = "${config.home.homeDirectory}/scripts/c.sh";
+        };
+        "custom/d" = {
+          interval = "once"; exec = "${pkgs.coreutils}/bin/echo a"; exec-if = "${pkgs.coreutils}/bin/true";
+          format = " D  ";
+          on-click = "${config.home.homeDirectory}/scripts/d.sh";
+        };
+        "custom/e" = {
+          interval = "once"; exec = "${pkgs.coreutils}/bin/echo a"; exec-if = "${pkgs.coreutils}/bin/true";
+          format = " 󰌌   ";
+          on-click = pkgs.writeShellScript "toggle-keyboard.sh" ''
+            if /run/current-system/sw/bin/busctl get-property --user sm.puri.OSK0 /sm/puri/OSK0 sm.puri.OSK0 Visible | ${pkgs.gnugrep}/bin/grep true; then
+              /run/current-system/sw/bin/busctl call --user sm.puri.OSK0 /sm/puri/OSK0 sm.puri.OSK0 SetVisible b false
+            else
+              /run/current-system/sw/bin/busctl call --user sm.puri.OSK0 /sm/puri/OSK0 sm.puri.OSK0 SetVisible b true
+            fi
+          '';
+        };
+        "custom/f" = {
+          interval = "once"; exec = "${pkgs.coreutils}/bin/echo a"; exec-if = "${pkgs.coreutils}/bin/true";
+          format = " X ";
+          on-click = "${config.wayland.windowManager.sway.package}/bin/swaymsg kill";
+        };
+      }
+    ];
+    style = ./waybar.css;
+  };
+  home.packages = with pkgs; [
+    playerctl
+  ];
+}

home/modules/zsh.nix

@@ -125,16 +125,16 @@
     };
     plugins = with pkgs; [
       { name = "zsh-vi-mode";
-        src = zsh-vi-mode.src; }
+        inherit (zsh-vi-mode) src; }
       { name = "fzf-tab";
-        src = zsh-fzf-tab.src; }
+        inherit (zsh-fzf-tab) src; }
       { name = "nix-shell";
-        src = zsh-nix-shell.src; }
+        inherit (zsh-nix-shell) src; }
       { name = "powerlevel10k";
-        src = zsh-powerlevel10k.src;
+        inherit (zsh-powerlevel10k) src;
         file = "powerlevel10k.zsh-theme"; }
       { name = "you-should-use";
-        src = zsh-you-should-use.src; }
+        inherit (zsh-you-should-use) src; }
     ];
   };
 }

lib.nix

@@ -0,0 +1,6 @@
+{ lib, ... }:
+
+{
+  quoteListenAddr = addr:
+    if lib.hasInfix ":" addr then "[${addr}]" else addr;
+}

overlays.nix

@@ -1,2 +1,5 @@
-# [ (import (builtins.fetchTarball "https://github.com/oxalica/rust-overlay/archive/master.tar.gz")) ]
-[ (import <self>).overlays.default (import <rust-overlay>) (import <nix-gaming>).overlays.default ]
+[
+  (import <self>).overlays.default
+  (import <rust-overlay>)
+  (import <nix-gaming>).overlays.default
+]

pkgs/_sources/generated.json

@@ -22,24 +22,24 @@
         "pinned": false,
         "src": {
             "name": null,
-            "sha256": "sha256-72jxUJdn4j0FV1qFH0r7UEVrAvSwrWgWsxCXyT1N/1A=",
+            "sha256": "sha256-5fEYhazqXcMENjp+37IcF5U81vZ9bPDkS0siUVi9mdg=",
             "type": "url",
-            "url": "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/GE-Proton8-24/GE-Proton8-24.tar.gz"
+            "url": "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/GE-Proton8-27/GE-Proton8-27.tar.gz"
         },
-        "version": "GE-Proton8-24"
+        "version": "GE-Proton8-27"
     },
     "searxng": {
         "cargoLocks": null,
-        "date": "2023-11-14",
+        "date": "2024-01-25",
         "extract": null,
         "name": "searxng",
         "passthru": null,
         "pinned": false,
         "src": {
-            "sha256": "sha256-vgDQ7cdWN79TFEbJGq0AdvC8p2YOmogk9iVViDkZDXw=",
+            "sha256": "sha256-QW1xC6RsHpn5P/QHjyc3O24tSmLvRCVIJwNqPyp1DV0=",
             "type": "tarball",
-            "url": "https://github.com/searxng/searxng/archive/b3d29cb86db4cc1a4e6320016529d1361451e1f1.tar.gz"
+            "url": "https://github.com/searxng/searxng/archive/8c73aa772b7d4446f77be82d8f9d9eef1e348deb.tar.gz"
         },
-        "version": "b3d29cb86db4cc1a4e6320016529d1361451e1f1"
+        "version": "8c73aa772b7d4446f77be82d8f9d9eef1e348deb"
     }
 }

pkgs/_sources/generated.nix

@@ -12,19 +12,19 @@
   };
   proton-ge = {
     pname = "proton-ge";
-    version = "GE-Proton8-24";
+    version = "GE-Proton8-27";
     src = fetchurl {
-      url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/GE-Proton8-24/GE-Proton8-24.tar.gz";
-      sha256 = "sha256-72jxUJdn4j0FV1qFH0r7UEVrAvSwrWgWsxCXyT1N/1A=";
+      url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/GE-Proton8-27/GE-Proton8-27.tar.gz";
+      sha256 = "sha256-5fEYhazqXcMENjp+37IcF5U81vZ9bPDkS0siUVi9mdg=";
     };
   };
   searxng = {
     pname = "searxng";
-    version = "b3d29cb86db4cc1a4e6320016529d1361451e1f1";
+    version = "8c73aa772b7d4446f77be82d8f9d9eef1e348deb";
     src = fetchTarball {
-      url = "https://github.com/searxng/searxng/archive/b3d29cb86db4cc1a4e6320016529d1361451e1f1.tar.gz";
-      sha256 = "sha256-vgDQ7cdWN79TFEbJGq0AdvC8p2YOmogk9iVViDkZDXw=";
+      url = "https://github.com/searxng/searxng/archive/8c73aa772b7d4446f77be82d8f9d9eef1e348deb.tar.gz";
+      sha256 = "sha256-QW1xC6RsHpn5P/QHjyc3O24tSmLvRCVIJwNqPyp1DV0=";
     };
-    date = "2023-11-14";
+    date = "2024-01-25";
   };
 }

pkgs/buffyboard/default.nix

@@ -0,0 +1,51 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, libinput
+, libxkbcommon
+, libevdev
+}:
+
+stdenv.mkDerivation {
+  pname = "buffyboard";
+  version = "unstable-2023-11-20";
+
+  src = fetchFromGitLab {
+    owner = "postmarketOS";
+    repo = "buffybox";
+    rev = "14b30c60183d98e8d0b4dadf66198e08badf631e";
+    hash = "sha256-9wLuTAqYoFl+IAR1ixp0nHwh6jBWl+1jDPhhxqE+LHQ=";
+    fetchSubmodules = true;
+  };
+
+  # https://gitlab.com/postmarketOS/buffybox/-/issues/1
+  hardeningDisable = [ "fortify3" ];
+
+  postPatch = ''
+    cd buffyboard
+  '';
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    libevdev
+    libinput
+    libxkbcommon
+  ];
+
+  meta = with lib; {
+    description = "";
+    homepage = "https://gitlab.com/postmarketOS/buffybox/-/tree/master/buffyboard";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ chayleaf ];
+    mainProgram = "buffyboard";
+    platforms = platforms.all;
+  };
+}

pkgs/default.nix

@@ -1,20 +1,25 @@
 { pkgs
 , lib
-, nur
-, nix-gaming
+, inputs
 , pkgs' ? pkgs
 , isOverlay ? true
-, ... }:
+, ...
+}:
+
 let
   inherit (pkgs') callPackage;
   sources = import ./_sources/generated.nix {
     inherit (pkgs) fetchgit fetchurl fetchFromGitHub dockerTools;
   };
   nixForNixPlugins = pkgs.nixVersions.nix_2_18;
+  nur = import inputs.nur {
+    inherit pkgs;
+    nurpkgs = pkgs;
+  };
 in
 
 {
-  inherit (nix-gaming) faf-client osu-lazer-bin;
+  inherit (inputs.nix-gaming.packages.${pkgs.system}) faf-client osu-lazer-bin;
   inherit nixForNixPlugins;
   nix = nixForNixPlugins;
   nixVersions = pkgs.nixVersions.extend (self: super: {
@@ -22,7 +27,7 @@ in
     unstable = nixForNixPlugins;
   });
   # Various patches to change Nix version of existing packages so they don't error out because of nix-plugins in nix.conf
-  nix-plugins = (pkgs.nix-plugins.override { nix = nixForNixPlugins; }).overrideAttrs (old: {
+  /*nix-plugins = (pkgs.nix-plugins.override { nix = nixForNixPlugins; }).overrideAttrs (old: {
     version = "13.0.0";
     patches = [
       (pkgs.fetchpatch {
@@ -31,15 +36,15 @@ in
         hash = "sha256-pOogMtjXYkSDtXW12TmBpGr/plnizJtud2nP3q2UldQ=";
       })
     ];
+  });*/
+  harmonia = (pkgs.harmonia.override { nixVersions.nix_2_19 = nixForNixPlugins; }).overrideAttrs (old: rec {
+    version = "0.7.3";
+    src = old.src.override {
+      rev = "refs/tags/${old.pname}-v${version}";
+      hash = "sha256-XtnK54HvZMKZGSCrVD0FO5PQLMo3Vkj8ezUlsfqStq0=";
+    };
+    cargoDeps = pkgs.rustPlatform.importCargoLock { lockFile = "${src}/Cargo.lock"; };
   });
-  harmonia = (pkgs.harmonia.override { nix = nixForNixPlugins; }); /*.overrideAttrs {
-    patches = [
-      (pkgs.fetchpatch {
-        url = "https://github.com/nix-community/harmonia/pull/145/commits/394c939a45fa9c590347e149400876c318610b1e.patch";
-        hash = "sha256-DvyE7/0PW3XRtFgIrl4IQa7RIQLQZoKLddxCZvhpu3I=";
-      })
-    ];
-  };*/
   nix-init = pkgs.nix-init.override { nix = nixForNixPlugins; };
   nix-serve = pkgs.nix-serve.override { nix = nixForNixPlugins; };
   nix-serve-ng = pkgs.nix-serve-ng.override { nix = nixForNixPlugins; };
@@ -49,49 +54,25 @@ in
       configureFlags = builtins.filter (x: x != "--enable-lto") (old.configureFlags or []);
     });*/
   }).overrideAttrs (old: {
-    # who cares about failing tests amirite
+    # who cares about tests amirite
+    version = "2023-12-01";
     doCheck = false;
-    patches = (old.patches or [ ]) ++ [
-      (pkgs.fetchpatch {
-        url = "https://github.com/chayleaf/hydra/commit/e9da80fff6234fab2458173272ee0bedbe8935c3.patch";
-        hash = "sha256-PS8rwe5lIzvaVlh/DogYmW5OccVfpKQ6JehTQibx2XQ=";
-      })
-    ];
+    src = old.src.override {
+      rev = "4d1c8505120961f10897b8fe9a070d4e193c9a13";
+      hash = "sha256-vXTuE83GL15mgZHegbllVAsVdDFcWWSayPfZxTJN5ys=";
+    };
   });
   nurl = pkgs.nurl.override { nix = nixForNixPlugins; };
   /*nvfetcher = pkgs.nvfetcher.overrideAttrs (old: {
     meta = builtins.removeAttrs old.meta [ "broken" ];
   });*/
 
+  buffyboard = pkgs.callPackage ./buffyboard { };
   clang-tools_latest = pkgs.clang-tools_16;
   clang_latest = pkgs.clang_16;
   /*ghidra = pkgs.ghidra.overrideAttrs (old: {
     patches = old.patches ++ [ ./ghidra-stdcall.patch ];
   });*/
-  ffmpeg-custom = (pkgs.callPackage (import /${pkgs.path}/pkgs/development/libraries/ffmpeg/generic.nix {
-    version = "6.1";
-    sha256 = "sha256-NzhD2D16bCVCyCXo0TRwZYp3Ta5eFSfoQPa+iRkeNZg=";
-  }) {
-    ffmpegVariant = "full";
-    withCuda = false;
-    withCudaLLVM = false;
-    withNvdec = false;
-    withNvenc = false;
-    inherit (pkgs'.darwin.apple_sdk.frameworks)
-      Cocoa CoreServices CoreAudio CoreMedia AVFoundation MediaToolbox
-      VideoDecodeAcceleration VideoToolbox;
-  }).overrideAttrs (old: {
-    postPatch = ''
-      ${old.postPatch or ""}
-      substituteInPlace libavutil/hwcontext_vulkan.c \
-        --replace FF_VK_KHR_VIDEO_DECODE_QUEUE FF_VK_EXT_VIDEO_DECODE_QUEUE \
-        --replace FF_VK_KHR_VIDEO_DECODE_H264 FF_VK_EXT_VIDEO_DECODE_H264 \
-        --replace FF_VK_KHR_VIDEO_DECODE_H265 FF_VK_EXT_VIDEO_DECODE_H265 \
-        --replace FF_VK_KHR_VIDEO_DECODE_AV1 FF_VK_EXT_VIDEO_DECODE_AV1
-    '';
-    buildInputs = old.buildInputs ++ [ pkgs.libaribcaption ];
-    configureFlags = old.configureFlags ++ [ "--enable-libaribcaption" ];
-  });
   gimp = callPackage ./gimp { inherit (pkgs) gimp; };
   home-daemon = callPackage ./home-daemon { };
   # pin version
@@ -108,6 +89,8 @@ in
   kvmfrOverlay = kvmfr: kvmfr.overrideAttrs (old: {
     inherit (pkgs'.looking-glass-client) version src;
   });
+  mobile-config-firefox = callPackage ./mobile-config-firefox { };
+  ping-exporter = callPackage ./ping-exporter { };
   proton-ge = pkgs.stdenvNoCC.mkDerivation {
     inherit (sources.proton-ge) pname version src;
     installPhase = ''
@@ -122,6 +105,7 @@ in
     version = "unstable-" + sources.searxng.date;
     postInstall = builtins.replaceStrings [ "/botdetection" ] [ "" ] old.postInstall;
   }));
+  schlock = callPackage ./schlock { };
   techmino = callPackage ./techmino { };
 
   firefoxAddons = lib.recurseIntoAttrs (callPackage ./firefox-addons { inherit nur sources; });
@@ -155,3 +139,4 @@ in
 }
 // import ./ccache.nix { inherit pkgs pkgs' lib sources; }
 // import ../system/hardware/bpi-r3/pkgs.nix { inherit pkgs pkgs' lib sources; }
+// import ../system/hardware/oneplus-enchilada/pkgs.nix { inherit inputs pkgs pkgs' lib sources; }

pkgs/firefox-addons/generated.nix

@@ -37,23 +37,21 @@
       };
     "rikaitan" = buildFirefoxXpiAddon {
       pname = "rikaitan";
-      version = "23.9.25.1";
+      version = "24.1.22.0";
       addonId = "tatsu@autistici.org";
-      url = "https://addons.mozilla.org/firefox/downloads/file/4172402/rikaitan-23.9.25.1.xpi";
-      sha256 = "d954f90939455dd52ce161729d7175fac63cf10daea386a1eab34529e03c8f29";
+      url = "https://addons.mozilla.org/firefox/downloads/file/4224979/rikaitan-24.1.22.0.xpi";
+      sha256 = "7df217a68077d45b9f41fe0170193c9224abc2a543c121429ebef4e7e857b0df";
       meta = with lib;
       {
         homepage = "https://github.com/Ajatt-Tools/rikaitan";
-        description = "Japanese dictionary with Anki integration. \n\nThis project is a community-driven fork of Yomichan, which is no longer maintained.";
-        license = licenses.lgpl3;
+        description = "Japanese dictionary with Anki integration and flashcard creation support.";
+        license = licenses.gpl3;
         mozPermissions = [
-          "<all_urls>"
           "storage"
           "clipboardWrite"
           "unlimitedStorage"
-          "webRequest"
-          "webRequestBlocking"
-          "nativeMessaging"
+          "declarativeNetRequest"
+          "scripting"
           "http://*/*"
           "https://*/*"
           "file://*/*"

pkgs/mobile-config-firefox/default.nix

@@ -0,0 +1,31 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mobile-config-firefox";
+  version = "4.2.0";
+
+  src = fetchFromGitLab {
+    owner = "postmarketOS";
+    repo = "mobile-config-firefox";
+    rev = version;
+    hash = "sha256-JEfgB+dqfy97n4FC2N6eHDV0aRFAhmFujYJHYa3kENE=";
+  };
+
+  makeFlags = [ "DESTDIR=$(out)" "FIREFOX_DIR=/lib/firefox" ];
+
+  postInstall = ''
+    rm -rf "$out/usr"
+  '';
+
+  meta = with lib; {
+    description = "Mobile and privacy friendly configuration for Firefox (distro-independent";
+    homepage = "https://gitlab.com/postmarketOS/mobile-config-firefox";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ chayleaf ];
+    mainProgram = "mobile-config-firefox";
+    platforms = platforms.all;
+  };
+}

pkgs/ping-exporter/default.nix

@@ -0,0 +1,24 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ping-exporter";
+  version = "0.1";
+
+  src = fetchFromGitHub {
+    owner = "chayleaf";
+    repo = "ping-exporter";
+    rev = "cf5e5f7e96fb477e015d44cd462fb996b944c896";
+    hash = "sha256-eZncfKTegLp+KBnAds8YR7ZMN8i7jDIIN8qt7832+0Y=";
+  };
+
+  cargoLock.lockFile = "${src}/Cargo.lock";
+
+  meta = with lib; {
+    description = "A ping exporter for Prometheus";
+    license = with lib.licenses; [ mit asl20 ];
+    maintainers = with lib.maintainers; [ chayleaf ];
+  };
+}

pkgs/schlock/default.nix

@@ -0,0 +1,56 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, scdoc
+, cairo
+, gdk-pixbuf
+, libsodium
+, libxkbcommon
+, wayland
+, wayland-protocols
+}:
+
+stdenv.mkDerivation {
+  pname = "schlock";
+  version = "unstable-2022-02-02";
+
+  src = fetchFromGitHub {
+    owner = "telent";
+    repo = "schlock";
+    rev = "f3dde16f074fd5b7482a253b9d26b4ead66dea82";
+    hash = "sha256-Ot86vALt1kkzbBocwh9drCycbRIw2jMKJU4ODe9PYQM=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    scdoc
+  ];
+
+  buildInputs = [
+    cairo
+    gdk-pixbuf
+    libsodium
+    libxkbcommon
+    wayland
+    wayland-protocols
+  ];
+
+  mesonFlags = [
+    "-Dgdk-pixbuf=enabled"
+    "-Dman-pages=enabled"
+  ];
+
+  meta = with lib; {
+    description = "";
+    homepage = "https://github.com/telent/schlock";
+    license = licenses.mit;
+    maintainers = with maintainers; [ chayleaf ];
+    mainProgram = "schlock";
+    platforms = platforms.all;
+  };
+}

system/devices/bpi-r3-router.nix

@@ -14,6 +14,12 @@ in
   ];
   networking.hostName = "nixos-router";
 
+  systemd.enableEmergencyMode = false;
+  boot.kernel.sysctl = {
+    "net.core.default_qdisc" = "fq";
+    "net.ipv4.tcp_congestion_control" = "bbr";
+  };
+
   fileSystems = {
     # mount root on tmpfs
     "/" =     { device = "none"; fsType = "tmpfs"; neededForBoot = true;

system/devices/msi-delta-15-workstation.nix

@@ -1,91 +1,58 @@
 # device-specific non-portable config
+{ pkgs
+, ...
+}:
+
 let
-  efiPart = "/dev/disk/by-uuid/D77D-8CE0";
+  uuids.efi = "D97E-A4D5";
+  uuids.encroot = "a2c3c9ea-2c73-4786-bff7-5f0aa7097912";
+  uuids.root = "dc669123-d6d3-447f-9ce3-c22587e5fa6a";
+  uuids.encdata = "f1447692-fa7c-4bd6-9cb5-e44c13fddfe3";
+  uuids.data = "fa754b1e-ac83-4851-bf16-88efcd40b657";
+  uuids.swap = "01c21ed8-0f40-4892-825d-81f5ddb9a0a2";
+  parts = builtins.mapAttrs (k: v: "/dev/disk/by-uuid/${v}") uuids;
+in
 
-  encPart = "/dev/disk/by-uuid/ce6ccdf0-7b6a-43ae-bfdf-10009a55041a";
-  cryptrootUuid = "f4edc0df-b50b-42f6-94ed-1c8f88d6cdbb";
-  cryptroot = "/dev/disk/by-uuid/${cryptrootUuid}";
-
-  dataPart = "/dev/disk/by-uuid/f1447692-fa7c-4bd6-9cb5-e44c13fddfe3";
-  datarootUuid = "fa754b1e-ac83-4851-bf16-88efcd40b657";
-  dataroot = "/dev/disk/by-uuid/${datarootUuid}";
-in {
+{
   imports = [
     ../hardware/msi-delta-15
     ../hosts/nixmsi.nix
   ];
 
+  boot.initrd.systemd.enable = false;
   boot.initrd = {
-    # insert crypto_keyfile into initrd so that grub can tell the kernel the
-    # encryption key once I unlock the /boot partition
-    secrets."/crypto_keyfile.bin" = "/boot/initrd/crypto_keyfile.bin";
-    luks.devices."cryptroot" = {
-      device = encPart;
-      # idk whether this is needed but it works
-      preLVM = true;
+    luks.devices.cryptroot = {
+      device = parts.encroot;
       # see https://asalor.blogspot.de/2011/08/trim-dm-crypt-problems.html before enabling
       allowDiscards = true;
-      # improve SSD performance
-      bypassWorkqueues = true;
-      keyFile = "/crypto_keyfile.bin";
     };
-    luks.devices."dataroot" = {
-      device = dataPart;
-      preLVM = true;
+    luks.devices.dataroot = {
+      device = parts.encdata;
       allowDiscards = true;
-      bypassWorkqueues = true;
-      keyFile = "/crypto_keyfile.bin";
     };
   };
-  boot.loader = {
-    grub = {
-      enable = true;
-      enableCryptodisk = true;
-      efiSupport = true;
-      # nodev = disable bios support 
-      device = "nodev";
-    };
-    efi.canTouchEfiVariables = true;
-    efi.efiSysMountPoint = "/boot/efi";
-  };
-  boot.resumeDevice = cryptroot;
-  boot.kernelParams = [
-    "resume=/@swap/swapfile"
-    # resume_offset = $(btrfs inspect-internal map-swapfile -r path/to/swapfile)
-    "resume_offset=533760"
-  ];
-  fileSystems = let
-    device = cryptroot;
-    fsType = "btrfs";
-    # max compression! my cpu is pretty good anyway
-    compress = "compress=zstd:15";
-    discard = "discard=async";
-    neededForBoot = true;
-  in {
-    # mount root on tmpfs
-    "/" =     { device = "none"; fsType = "tmpfs"; inherit neededForBoot;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  boot.kernelPackages = pkgs.linuxPackages_testing;
+  boot.kernelParams = [ "boot.shell_on_fail" ];
+
+  fileSystems = {
+    "/" =     { device = "none"; fsType = "tmpfs"; neededForBoot = true;
                 options = [ "defaults" "size=2G" "mode=755" ]; };
     "/persist" =
-              { inherit device fsType neededForBoot;
-                options = [ discard compress "subvol=@" ]; };
-    "/nix" =  { inherit device fsType neededForBoot;
-                options = [ discard compress "subvol=@nix" "noatime" ]; };
-    "/swap" = { inherit device fsType neededForBoot;
-                options = [ discard "subvol=@swap" "noatime" ]; };
-    "/home" = { inherit device fsType;
-                options = [ discard compress "subvol=@home" ]; };
-    # why am I even bothering with creating this subvolume every time if I don't use snapshots anyway?
-    "/.snapshots" =
-              { inherit device fsType;
-                options = [ discard compress "subvol=@snapshots" ]; };
-    "/boot" = { inherit device fsType neededForBoot;
-                options = [ discard compress "subvol=@boot" ]; };
-    "/boot/efi" =
-              { device = efiPart; fsType = "vfat"; inherit neededForBoot; };
-    "/data" =
-              { device = dataroot; fsType = "btrfs";
-                options = [ discard compress ]; };
+              { device = parts.root; fsType = "bcachefs"; neededForBoot = true;
+                options = [ "discard=1" ]; };
+    "/boot" = { device = parts.efi; fsType = "vfat"; neededForBoot = true; };
+    "/data" = { device = parts.data; fsType = "btrfs";
+                options = [ "discard=async" "compress=zstd:15" ]; };
   };
+  impermanence.directories = [
+    /root
+    /home
+    /nix
+  ];
 
   impermanence = {
     enable = true;
@@ -95,18 +62,13 @@ in {
   # fix for my realtek usb ethernet adapter
   services.tlp.settings.USB_DENYLIST = "0bda:8156";
 
-  swapDevices = [ { device = "/swap/swapfile"; } ];
+  swapDevices = [ { device = parts.swap; } ];
+  boot.resumeDevice = parts.swap;
 
   # dedupe
   services.beesd = {
-    # i have a lot of ram :tonystark:
-    filesystems.cryptroot = {
-      spec = "UUID=${cryptrootUuid}";
-      hashTableSizeMB = 128;
-      extraOptions = [ "--loadavg-target" "8.0" ];
-    };
     filesystems.dataroot = {
-      spec = "UUID=${datarootUuid}";
+      spec = "UUID=${uuids.data}";
       hashTableSizeMB = 256;
       extraOptions = [ "--loadavg-target" "8.0" ];
     };

system/devices/oneplus-6-phone.nix

@@ -0,0 +1,60 @@
+{ config
+, ...
+}:
+
+let
+  uuids.enc = "e2abdea5-71dc-4a9e-aff3-242117342d60";
+  uuids.boot = "9DA3-28AC";
+  uuids.bch = "ac343ffb-407c-4966-87bf-a0ef1075e93d";
+  parts = builtins.mapAttrs (k: v: "/dev/disk/by-uuid/${v}") uuids;
+in
+
+{
+  imports = [
+    ../hardware/oneplus-enchilada
+    ../hosts/phone
+  ];
+
+  # https://gitlab.com/postmarketOS/pmaports/-/issues/2440
+  # networking.wireless.iwd.enable = true;
+  networking.networkmanager.enable = true;
+
+  boot.loader = {
+    grub.enable = false;
+    systemd-boot.enable = true;
+    efi.canTouchEfiVariables = false;
+  };
+
+  boot.initrd = {
+    luks.devices.cryptroot = {
+      device = parts.enc;
+      allowDiscards = true;
+    };
+  };
+
+  boot.supportedFilesystems = [ "bcachefs" ];
+
+  fileSystems = let
+    neededForBoot = true;
+  in {
+    "/" =     { device = "none"; fsType = "tmpfs"; inherit neededForBoot;
+                options = [ "defaults" "size=2G" "mode=755" ]; };
+    "/persist" =
+              { device = "UUID=${uuids.bch}"; fsType = "bcachefs"; inherit neededForBoot;
+                options = [ "errors=ro" ]; };
+    "/boot" = { device = parts.boot; fsType = "vfat"; inherit neededForBoot; };
+  };
+
+  zramSwap.enable = true;
+
+  impermanence = {
+    enable = true;
+    path = /persist;
+    directories = [
+      { directory = /home/${config.common.mainUsername}; user = config.common.mainUsername; group = "users"; mode = "0700"; }
+      { directory = /root; mode = "0700"; }
+      { directory = /nix; }
+      { directory = /secrets; mode = "0000"; }
+    ];
+  };
+}

system/devices/radxa-rock5a-server.nix

@@ -6,7 +6,7 @@
 
 let
   uuids.enc = "15945050-df48-418b-b736-827749b9262a";
-  uuids.oldroot = "de454394-8cc1-4267-b62b-1e25062f7cf4";
+  uuids.swap = "5c7f9e4e-c245-4ccb-98a2-1211ea7008e8";
   uuids.boot = "0603-5955";
   uuids.bch0 = "9f10b9ac-3102-4816-8f2c-e0526c2aa65b";
   uuids.bch1 = "4ffed814-057c-4f9f-9a12-9d8ac6331e62";
@@ -29,6 +29,12 @@ in
     "dm_mod" "dm_crypt" "encrypted_keys"
   ];
 
+  systemd.enableEmergencyMode = false;
+  boot.kernel.sysctl = {
+    "net.core.default_qdisc" = "fq";
+    "net.ipv4.tcp_congestion_control" = "bbr";
+  };
+
   networking.useDHCP = true;
   /*
   # as expected, systemd initrd and networking didn't work well, and i really cba to debug it
@@ -104,26 +110,19 @@ in
   fileSystems = let
     neededForBoot = true;
   in {
-    "/" =    { device = "none"; fsType = "tmpfs"; inherit neededForBoot;
-               options = [ "defaults" "size=2G" "mode=755" ]; };
+    "/" =     { device = "none"; fsType = "tmpfs"; inherit neededForBoot;
+                options = [ "defaults" "size=2G" "mode=755" ]; };
     "/persist" =
               { device = "UUID=${uuids.bch}"; fsType = "bcachefs"; inherit neededForBoot;
                 options = [ "errors=ro" ]; };
-    #"/persist" =
-    #          { device = parts.oldroot; fsType = "btrfs"; inherit neededForBoot;
-    #            options = [ "discard=async" "compress=zstd" "subvol=@" ]; };
-    "/swap" = { device = parts.oldroot; fsType = "btrfs"; inherit neededForBoot;
-                options = [ "discard=async" "subvol=@swap" "noatime" ]; };
     "/boot" = { device = parts.boot; fsType = "vfat"; inherit neededForBoot; };
   };
 
-  swapDevices = [ { device = "/swap/swapfile"; } ];
+  swapDevices = [ { device = parts.swap; } ];
 
-  boot.kernelParams = [
-    "resume=/@swap/swapfile"
-    # resume_offset = $(btrfs inspect-internal map-swapfile -r path/to/swapfile)
-    "resume_offset=26001976"
-  ];
+  boot.kernel.sysctl = {
+    "vm.swappiness" = 10;
+  };
 
   impermanence = {
     enable = true;

system/hardware/bpi-r3/default.nix

@@ -8,8 +8,7 @@
     generic-extlinux-compatible.enable = true;
   };
 
-  #boot.kernelPackages = config._module.args.fromSourcePkgs.linuxPackages_bpiR3_ccache or pkgs.linuxPackages_bpiR3_ccache;
-  boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.buildLinuxWithCcache (config._module.args.fromSourcePkgs.linux_bpiR3 or pkgs.linux_bpiR3));
+  boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.buildLinuxWithCcache pkgs.linux_bpiR3);
 
   hardware.deviceTree.enable = true;
   hardware.deviceTree.filter = "mt7986a-bananapi-bpi-r3.dtb";

system/hardware/bpi-r3/image.sh

@@ -86,7 +86,7 @@ run mkdir -p "$tmp/out/@/var/log"
 
 # secrets, we don't want to pass them via the store
 run mkdir -p "$tmp/out/@/secrets"
-run cp -v /etc/nixos/private/wireguard-key "$tmp/out/@/secrets/"
+run cp -v /secrets/nixos/wireguard-key "$tmp/out/@/secrets/"
 run chmod -R 000 "$tmp/out/@/secrets"
 
 cpr "$rootfs/nix" "$tmp/out/@nix"

system/hardware/bpi-r3/pkgs.nix

@@ -117,6 +117,7 @@ in rec {
     fixupPhase = "true";
   };
   linux_bpiR3 = pkgs.linux_latest.override {
+    ignoreConfigErrors = false;
     # there's probably more enabled-by-default configs that are better left disabled, but whatever
     structuredExtraConfig = with lib.kernel; {
       /* "Select this option if you are building a kernel for a server or
@@ -125,7 +126,6 @@ in rec {
           latencies." */
       PREEMPT_NONE = yes;
       # disable the other preempts
-      PREEMPTION = no;
       PREEMPT_VOLUNTARY = lib.mkForce no;
       PREEMPT = no;
 
@@ -134,12 +134,10 @@ in rec {
       CPU_FREQ_DEFAULT_GOV_PERFORMANCE = lib.mkForce no;
       CPU_FREQ_GOV_CONSERVATIVE = yes;
       # disable virtualisation stuff
-      PARAVIRT = lib.mkForce no;
       VIRTUALIZATION = no;
       XEN = lib.mkForce no;
       # zstd
-      KERNEL_ZSTD = yes;
-      MODULE_COMPRESS_ZSTD = yes;
+      # MODULE_COMPRESS_ZSTD = yes;
       MODULE_DECOMPRESS = yes;
       FW_LOADER_COMPRESS_ZSTD = yes;
       # zram
@@ -299,13 +297,50 @@ in rec {
       MT76_CORE  = module;
       MT76_LEDS = yes;
       MT76_CONNAC_LIB = module;
-      MT7815E = module;
       MT7915E = module;
-      MT7986_WMAC = yes;
+      MT798X_WMAC = yes;
       SPI_MT65XX = yes;
       SPI_MTK_NOR = yes;
       SPI_MTK_SNFI = yes;
       MMC_MTK = yes;
+
+      # keys that are unused in this case
+      # used because i got bitten by config keys changing once
+      "9P_FSCACHE".tristate = lib.mkForce null; CROS_EC_ISHTP.tristate = lib.mkForce null; CROS_EC_LPC.tristate = lib.mkForce null;
+      DRM_AMDGPU_CIK.tristate = lib.mkForce null; DRM_AMDGPU_SI.tristate = lib.mkForce null; DRM_AMDGPU_USERPTR.tristate = lib.mkForce null;
+      DRM_AMD_DC_FP.tristate = lib.mkForce null; DRM_AMD_DC_SI.tristate = lib.mkForce null; DRM_DP_AUX_CHARDEV.tristate = lib.mkForce null;
+      DRM_FBDEV_EMULATION.tristate = lib.mkForce null; DRM_GMA500.tristate = lib.mkForce null; DRM_LEGACY.tristate = lib.mkForce null;
+      DRM_LOAD_EDID_FIRMWARE.tristate = lib.mkForce null; DRM_SIMPLEDRM.tristate = lib.mkForce null; DRM_VBOXVIDEO.tristate = lib.mkForce null;
+      DRM_VC4_HDMI_CEC.tristate = lib.mkForce null; FB_3DFX_ACCEL.tristate = lib.mkForce null; FB_ATY_CT.tristate = lib.mkForce null;
+      FB_ATY_GX.tristate = lib.mkForce null; FB_EFI.tristate = lib.mkForce null; FB_NVIDIA_I2C.tristate = lib.mkForce null;
+      FB_RIVA_I2C.tristate = lib.mkForce null; FB_SAVAGE_ACCEL.tristate = lib.mkForce null; FB_SAVAGE_I2C.tristate = lib.mkForce null;
+      FB_SIMPLE.tristate = lib.mkForce null; FB_SIS_300.tristate = lib.mkForce null; FB_SIS_315.tristate = lib.mkForce null;
+      FB_VESA.tristate = lib.mkForce null; FONTS.tristate = lib.mkForce null; FONT_8x8.tristate = lib.mkForce null;
+      FONT_TER16x32.tristate = lib.mkForce null; FRAMEBUFFER_CONSOLE.tristate = lib.mkForce null;
+      FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER.tristate = lib.mkForce null;
+      FRAMEBUFFER_CONSOLE_DETECT_PRIMARY.tristate = lib.mkForce null; FRAMEBUFFER_CONSOLE_ROTATION.tristate = lib.mkForce null;
+      HMM_MIRROR.tristate = lib.mkForce null; HSA_AMD.tristate = lib.mkForce null; HYPERVISOR_GUEST.tristate = lib.mkForce null;
+      INFINIBAND_IPOIB.tristate = lib.mkForce null; INFINIBAND_IPOIB_CM.tristate = lib.mkForce null;
+      IP_MROUTE_MULTIPLE_TABLES.tristate = lib.mkForce null; JOYSTICK_PSXPAD_SPI_FF.tristate = lib.mkForce null;
+      KERNEL_ZSTD.tristate = lib.mkForce null; KEYBOARD_APPLESPI.tristate = lib.mkForce null; KVM_ASYNC_PF.tristate = lib.mkForce null;
+      KVM_GENERIC_DIRTYLOG_READ_PROTECT.tristate = lib.mkForce null; KVM_GUEST.tristate = lib.mkForce null; KVM_MMIO.tristate = lib.mkForce null;
+      KVM_VFIO.tristate = lib.mkForce null; LOGO.tristate = lib.mkForce null; MICROCODE.tristate = lib.mkForce null;
+      MOUSE_PS2_VMMOUSE.tristate = lib.mkForce null; MTRR_SANITIZER.tristate = lib.mkForce null; NFS_FSCACHE.tristate = lib.mkForce null;
+      PINCTRL_BAYTRAIL.tristate = lib.mkForce null;
+      PINCTRL_CHERRYVIEW.tristate = lib.mkForce null; PM_ADVANCED_DEBUG.tristate = lib.mkForce null; PM_TRACE_RTC.tristate = lib.mkForce null;
+      SND_AC97_POWER_SAVE.tristate = lib.mkForce null; SND_DYNAMIC_MINORS.tristate = lib.mkForce null;
+      SND_HDA_INPUT_BEEP.tristate = lib.mkForce null; SND_HDA_PATCH_LOADER.tristate = lib.mkForce null;
+      SND_HDA_RECONFIG.tristate = lib.mkForce null; SND_OSSEMUL.tristate = lib.mkForce null; SND_USB_CAIAQ_INPUT.tristate = lib.mkForce null;
+      VFIO_PCI_VGA.tristate = lib.mkForce null; VGA_SWITCHEROO.tristate = lib.mkForce null; X86_AMD_PLATFORM_DEVICE.tristate = lib.mkForce null;
+      X86_CHECK_BIOS_CORRUPTION.tristate = lib.mkForce null; X86_MCE.tristate = lib.mkForce null;
+      X86_PLATFORM_DRIVERS_DELL.tristate = lib.mkForce null; X86_PLATFORM_DRIVERS_HP.tristate = lib.mkForce null;
+      JOYSTICK_XPAD_FF.tristate = lib.mkForce null; JOYSTICK_XPAD_LEDS.tristate = lib.mkForce null; KEXEC_JUMP.tristate = lib.mkForce null;
+      PERF_EVENTS_AMD_BRS.tristate = lib.mkForce null; HVC_XEN.tristate = lib.mkForce null; HVC_XEN_FRONTEND.tristate = lib.mkForce null;
+      PARAVIRT_SPINLOCKS.tristate = lib.mkForce null; PCI_XEN.tristate = lib.mkForce null; SWIOTLB_XEN.tristate = lib.mkForce null;
+      VBOXGUEST.tristate = lib.mkForce null; XEN_BACKEND.tristate = lib.mkForce null; XEN_BALLOON.tristate = lib.mkForce null;
+      XEN_BALLOON_MEMORY_HOTPLUG.tristate = lib.mkForce null; XEN_DOM0.tristate = lib.mkForce null; XEN_EFI.tristate = lib.mkForce null;
+      XEN_HAVE_PVMMU.tristate = lib.mkForce null; XEN_MCE_LOG.tristate = lib.mkForce null; XEN_PVH.tristate = lib.mkForce null;
+      XEN_PVHVM.tristate = lib.mkForce null; XEN_SAVE_RESTORE.tristate = lib.mkForce null; XEN_SYS_HYPERVISOR.tristate = lib.mkForce null;
     };
   };
   linuxPackages_bpiR3 = pkgs.linuxPackagesFor linux_bpiR3;

system/hardware/msi-delta-15/default.nix

@@ -1,5 +1,6 @@
 { hardware
 , pkgs
+, lib
 , ... }:
 
 {
@@ -13,7 +14,7 @@
   common.resolution = "1920x1080";
   vfio.pciIDs = [ "1002:73df" "1002:ab28" ];
   boot = {
-    kernelPackages = pkgs.linuxPackagesFor pkgs.linux_latest;
+    kernelPackages = lib.mkDefault (pkgs.linuxPackagesFor pkgs.linux_latest);
     initrd.availableKernelModules = [ "nvme" "xhci_pci" ];
     kernelParams = [
       # disable PSR to *hopefully* avoid random hangs
@@ -23,45 +24,4 @@
       "amdgpu.noretry=0"
     ];
   };
-  # TODO: really, really, please, I want latest firmware to work...
-  nixpkgs.overlays = [
-    (final: prev: {
-      amd-ucode = prev.amd-ucode.override { inherit (final) linux-firmware; };
-      linux-firmware = prev.stdenvNoCC.mkDerivation {
-        inherit (prev.linux-firmware) pname version meta src dontFixup installFlags nativeBuildInputs;
-        passthru = { inherit (prev.linux-firmware) version; };
-
-        # revert microcode updates which break boot for me
-        patches = [
-          ./revert-amd-ucode-update-fam17h.patch
-          ./revert-amd-ucode-update-fam19h.patch
-        ];
-        postPatch = ''
-          cp ${final.fetchurl {
-            name = "microcode_amd_fam17h.bin";
-            url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/plain/amd-ucode/microcode_amd_fam17h.bin?id=b250b32ab1d044953af2dc5e790819a7703b7ee6";
-            hash = "sha256-HnKjEb2di7BiKB09JYUjIUuZNCVgXlwRSbjijnuYBcM=";
-          }} amd-ucode/microcode_amd_fam17h.bin
-          cp ${final.fetchurl {
-            name = "microcode_amd_fam19h.bin";
-            url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/plain/amd-ucode/microcode_amd_fam19h.bin?id=0ab353f8d8aa96d68690911cea22ec538f3095c4";
-            hash = "sha256-LlA+E4EVQpfjD3/cg6Y52BsCGW/5ZfY0J2UnCUI/3MQ";
-          }} amd-ucode/microcode_amd_fam19h.bin
-        '';
-      };
-    })
-  ];
-  specialisation.no_patches.configuration = {
-    nixpkgs.overlays = [
-      (final: prev: {
-        amd-ucode = prev.amd-ucode.override { inherit (final) linux-firmware; };
-        linux-firmware = prev.stdenvNoCC.mkDerivation {
-          inherit (prev.linux-firmware) pname version meta src dontFixup installFlags nativeBuildInputs;
-          passthru = { inherit (prev.linux-firmware) version; };
-          patches = [ ];
-          postPatch = "";
-        };
-      })
-    ];
-  };
 }

system/hardware/msi-delta-15/revert-amd-ucode-update-fam17h.patch

@@ -1,52 +0,0 @@
-diff --git a/WHENCE b/WHENCE
-index dbcdced..9ae8ff7 100644
---- a/WHENCE
-+++ b/WHENCE
-@@ -3919,7 +3919,7 @@ Version: 2018-05-24
- RawFile: amd-ucode/microcode_amd_fam16h.bin
- Version: 2014-10-28
- RawFile: amd-ucode/microcode_amd_fam17h.bin
--Version: 2023-07-19
-+Version: 2023-04-13
- RawFile: amd-ucode/microcode_amd_fam19h.bin
- Version: 2023-08-08
- File: amd-ucode/README
-diff --git a/amd-ucode/README b/amd-ucode/README
-index f47743c..5dc5108 100644
---- a/amd-ucode/README
-+++ b/amd-ucode/README
-@@ -32,9 +32,8 @@ Microcode patches in microcode_amd_fam16h.bin:
- 
- Microcode patches in microcode_amd_fam17h.bin:
-   Family=0x17 Model=0x08 Stepping=0x02: Patch=0x0800820d Length=3200 bytes
--  Family=0x17 Model=0x31 Stepping=0x00: Patch=0x0830107a Length=3200 bytes
--  Family=0x17 Model=0xa0 Stepping=0x00: Patch=0x08a00008 Length=3200 bytes
-   Family=0x17 Model=0x01 Stepping=0x02: Patch=0x0800126e Length=3200 bytes
-+  Family=0x17 Model=0x31 Stepping=0x00: Patch=0x08301072 Length=3200 bytes
- 
- Microcode patches in microcode_amd_fam19h.bin:
-   Family=0x19 Model=0x11 Stepping=0x01: Patch=0x0a10113e Length=5568 bytes
-diff --git a/amd-ucode/microcode_amd_fam17h.bin.asc b/amd-ucode/microcode_amd_fam17h.bin.asc
-index 34a4024..27da52c 100644
---- a/amd-ucode/microcode_amd_fam17h.bin.asc
-+++ b/amd-ucode/microcode_amd_fam17h.bin.asc
-@@ -1,11 +1,11 @@
- -----BEGIN PGP SIGNATURE-----
- 
--iQEzBAABCgAdFiEE/HxsUF2vzBRxg1fK5L5TOfMornMFAmS4Mm4ACgkQ5L5TOfMo
--rnN35wgAkllCunxE6J5hQyLMx5o4WTHZkbNvXmu6nV1Y3vjiL1oeaK+pmx8BlkPt
--fGZJCe/068kqmp3N4EtOZLxXn55t3jNBYectPr0RmFqpjMsEJEcfXfuXROA4N9Ti
--Zd/o6X21eHEsm0kK0q4YfppfgTd5Ze7k1jTkUuuU6/yh6uRk1MiFreEzkPO3Aayh
--iEWlYx33vq3HccTPgdY3D64Zr8gmgKG+8mdEvqb1jK4SVZ1/9vy4OKIIpUZB/eqx
--46h9Ejwn9pktnYkHi/A/zCREEcIQ10HXFF5bjxJTFQkM5S46/QEO7uuvnpMb+6Yy
--4V1/QIWMG6ixqCRx9GqbBK7GHdYODw==
--=+IsI
-+iQEzBAABCgAdFiEE/HxsUF2vzBRxg1fK5L5TOfMornMFAmQeEvgACgkQ5L5TOfMo
-+rnPOpAf/dYhPqq/ktg1muI/khV4EhDiguX6OXib3fmfSZdvPIAI0cRI77M3Lvf0b
-+nlV8D67e5HOQ5foJbix5tunz0sZjqr2QU8U9dNk/ut0KC7UiCRc8VH40aSi/OQBG
-+Y8c7tb6IJ+N+jyJ6Ii6koUuRO2Lk2MckcrWLRuLRV4bB+osyJrGjc/X54Z6UJ/Ma
-+VDg13Yxy5WvC7sMmlmnY42JLeLBKDVUvg0zDvJ4aOLLxRE2l3eiAKE+TV122LmxN
-+ca5WA/ESYQ9BjxHYIrpTd9nQaWa/TIZ+rOmJGLMtnQ1gGlW97zQuJR7zh+8vdLzC
-+iwVlS1cu7kcV7KYDytTkWJ+2gwb3uQ==
-+=lP2S
- -----END PGP SIGNATURE-----

system/hardware/msi-delta-15/revert-amd-ucode-update-fam19h.patch

@@ -1,64 +0,0 @@
-diff --git a/WHENCE b/WHENCE
-index dbcdced..dd7b8d5 100644
---- a/WHENCE
-+++ b/WHENCE
-@@ -3921,7 +3921,7 @@ Version: 2014-10-28
- RawFile: amd-ucode/microcode_amd_fam17h.bin
- Version: 2023-07-19
- RawFile: amd-ucode/microcode_amd_fam19h.bin
--Version: 2023-10-19
-+Version: 2023-07-18
- File: amd-ucode/README
- 
- License: Redistributable. See LICENSE.amd-ucode for details
-diff --git a/amd-ucode/README b/amd-ucode/README
-index f47743c..6a9ff1e 100644
---- a/amd-ucode/README
-+++ b/amd-ucode/README
-@@ -37,22 +37,9 @@ Microcode patches in microcode_amd_fam17h.bin:
-   Family=0x17 Model=0x01 Stepping=0x02: Patch=0x0800126e Length=3200 bytes
- 
- Microcode patches in microcode_amd_fam19h.bin:
--  Family=0x19 Model=0x11 Stepping=0x02: Patch=0x0a101244 Length=5568 bytes
-   Family=0x19 Model=0x01 Stepping=0x01: Patch=0x0a0011d1 Length=5568 bytes
-   Family=0x19 Model=0x01 Stepping=0x00: Patch=0x0a001079 Length=5568 bytes
--  Family=0x19 Model=0xa0 Stepping=0x02: Patch=0x0aa00213 Length=5568 bytes
-   Family=0x19 Model=0x01 Stepping=0x02: Patch=0x0a001234 Length=5568 bytes
--  Family=0x19 Model=0xa0 Stepping=0x01: Patch=0x0aa00116 Length=5568 bytes
--  Family=0x19 Model=0x11 Stepping=0x01: Patch=0x0a101144 Length=5568 bytes
--
--NOTE: For Genoa (Family=0x19 Model=0x11) and Bergamo (Family=0x19 Model=0xa0),
--either AGESA version >= 1.0.0.8 OR a kernel with the following commit is
--required:
--a32b0f0db3f3 ("x86/microcode/AMD: Load late on both threads too")
--
--When late loading the patches for Genoa or Bergamo, there may be one spurious
--NMI observed per physical core. These NMIs are benign and don't cause any
--functional issue but will result in kernel messages being logged.
- 
- NOTE: When running 5.19+ kernels on Genoa or Bergamo systems, some microcode
- patches are known to trigger warnings in the PMI handler. The following are
-diff --git a/amd-ucode/microcode_amd_fam19h.bin.asc b/amd-ucode/microcode_amd_fam19h.bin.asc
-index 8cff901..a32b4d6 100644
---- a/amd-ucode/microcode_amd_fam19h.bin.asc
-+++ b/amd-ucode/microcode_amd_fam19h.bin.asc
-@@ -1,11 +1,11 @@
- -----BEGIN PGP SIGNATURE-----
- 
--iQEzBAABCgAdFiEE/HxsUF2vzBRxg1fK5L5TOfMornMFAmUoW6AACgkQ5L5TOfMo
--rnMHAAf/SxaKEu5l7FGXR+QJYc2oSJDpf9ZsHTkVnxqF1I3ReItEGAR3iqSWrsRw
--KA4niP9Ihr8EqwhOaOtqkRKKF9D5yg+DksnRWbh2VTUECO4KQxjHNrPp3JWEzBwb
--Xn+vRVP02ZRi3u4MCYbnDC4AfUSnKnldY3TTlNi/6HUaGS2pcw8Vjli/C06zwfgh
--WwUAoFMQl4SDJhbGfC9cb93MKjBl/0Hv4uhK5W8fJ1iUkMvY8Ijna/oDTZCNPqP0
--0AgOwdAdzoyOYWjbUXcwofz2Umpz12xmJW8yXNwdv1pmaCvv9aCJz1L49lGwFH9E
--lhhoFQ1SQL3hhPjTXO6DbeeT9+fjOg==
--=9Xav
-+iQEzBAABCgAdFiEE/HxsUF2vzBRxg1fK5L5TOfMornMFAmS3F00ACgkQ5L5TOfMo
-+rnNEhQgAizSV8IFpvaYNytaJKLA4uevrZneGPV4czjCXnnj1yHpfQmCTyZQnoLnx
-+7gyzf7K5271zO51FBQ5z2Nm48a3XPUhMbQLNP4BZdekLiA3bRpMtSyHct6zD0ULm
-+xaFaOQ7MR1tGADhlon1bDvtnOuixUhwrZhEIlR9MzQAzERKDMOAVTbxn9ZhMfYiT
-+LhA791Blyyi+6Z9uh7BpaA8l8uvoxt+uuvlBTjQMR3ER/TEjgcsoy+XhhK4QKS0V
-+wJCtcDle/3pF+N6SAFWiXbNZ+P8p19afhcYddDl97xtpzA6/8b20a2eHkrqnu/Ds
-+jTozF9kmhiifYMYpXtXgSOwI3GRZbQ==
-+=t+j1
- -----END PGP SIGNATURE-----

system/hardware/oneplus-enchilada/config_fixes.patch

@@ -0,0 +1,28 @@
+diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
+index b60aa1f8934..0e3191950d5 100644
+--- a/arch/arm64/configs/defconfig
++++ b/arch/arm64/configs/defconfig
+@@ -1317,8 +1317,9 @@ CONFIG_QCOM_AOSS_QMP=y
+ CONFIG_QCOM_COMMAND_DB=y
+ CONFIG_QCOM_CPR=y
+ CONFIG_QCOM_GENI_SE=y
+-CONFIG_QCOM_LLCC=m
+-CONFIG_QCOM_OCMEM=m
++CONFIG_QCOM_LLCC=y
++CONFIG_QCOM_OCMEM=y
++CONFIG_BACKLIGHT_CLASS_DEVICE=y
+ CONFIG_QCOM_PMIC_GLINK=m
+ CONFIG_QCOM_RMTFS_MEM=m
+ CONFIG_QCOM_RPMH=y
+diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
+index 48845dc8fa8..5f503f9c99c 100644
+--- a/drivers/remoteproc/Kconfig
++++ b/drivers/remoteproc/Kconfig
+@@ -166,6 +166,7 @@ config QCOM_PIL_INFO
+ 
+ config QCOM_RPROC_COMMON
+ 	tristate
++	default y
+ 
+ config QCOM_Q6V5_COMMON
+ 	tristate

system/hardware/oneplus-enchilada/default.nix

@@ -0,0 +1,228 @@
+{ pkgs
+, lib
+, config
+, inputs
+, ...
+}:
+
+let
+  cfg = config.phone;
+in
+{
+  imports = [
+    "${inputs.mobile-nixos}/modules/quirks/qualcomm/sdm845-modem.nix"
+    "${inputs.mobile-nixos}/modules/quirks/audio.nix"
+  ];
+
+  options.phone = {
+    adb.enable = lib.mkEnableOption "adb";
+    rndis.enable = lib.mkEnableOption "rndis" // {
+      default = true;
+    };
+    buffyboard.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+    };
+  };
+
+  config = lib.mkMerge [
+    {
+      hardware.enableRedistributableFirmware = true;
+      mobile.quirks.qualcomm.sdm845-modem.enable = true;
+      mobile.quirks.audio.alsa-ucm-meld = true;
+      environment.systemPackages = [ pkgs.alsa-ucm-conf-enchilada ];
+      systemd.services.q6voiced = {
+        description = "QDSP6 driver daemon";
+        after = [ "ModemManager.service" "dbus.socket" ];
+        wantedBy = [ "ModemManager.service" ];
+        requires = [ "dbus.socket" ];
+        serviceConfig.ExecStart = "${pkgs.q6voiced}/bin/q6voiced hw:0,6";
+      };
+      systemd.user.services.wireplumber.environment.WIREPLUMBER_CONFIG_DIR = pkgs.runCommand "wireplumber-config" {} ''
+        cp -a "${pkgs.wireplumber}/share/wireplumber" "$out"
+        chmod +w "$out" "$out/main.lua.d"
+        ln -s ${pkgs.fetchurl {
+          url = "https://gitlab.com/postmarketOS/pmaports/-/raw/0aa9524204e9c9c002c860b87c972bc2ebf025f3/device/community/soc-qcom-sdm845/51-qcom-sdm845.lua";
+          hash = "sha256-56oNJJyuZZe1Iig1xskDuyazw3PbRZtmU/YRFUTqjwk=";
+        }} "$out/main.lua.d/51-qcom-sdm845.lua"
+      '';
+      systemd.services.wireplumber.environment.WIREPLUMBER_CONFIG_DIR = config.systemd.user.services.wireplumber.environment.WIREPLUMBER_CONFIG_DIR;
+      networking.modemmanager.enable = !config.networking.networkmanager.enable;
+      services.udev.extraRules = ''
+        SUBSYSTEM=="input", KERNEL=="event*", ENV{ID_INPUT}=="1", SUBSYSTEMS=="input", ATTRS{name}=="spmi_haptics", TAG+="uaccess", ENV{FEEDBACKD_TYPE}="vibra"
+        SUBSYSTEM=="misc", KERNEL=="fastrpc-*", ENV{ACCEL_MOUNT_MATRIX}+="-1, 0, 0; 0, -1, 0; 0, 0, -1"
+      '';
+      services.upower = {
+        enable = true;
+        percentageLow = 10;
+        percentageCritical = 5;
+        percentageAction = 3;
+        criticalPowerAction = "PowerOff";
+      };
+      hardware.firmware = lib.mkAfter [ pkgs.firmware-oneplus-sdm845 ];
+      boot.kernelPackages = lib.mkForce (pkgs.linuxPackagesFor pkgs.linux_enchilada_ccache);
+      hardware.deviceTree.enable = true;
+      hardware.deviceTree.name = "qcom/sdm845-oneplus-enchilada.dtb";
+      # loglevel=7 console=ttyMSM0,115200 is a way to delay boot
+      # see https://gitlab.freedesktop.org/drm/msm/-/issues/46
+      boot.consoleLogLevel = 7;
+      boot.kernelParams = [
+        "console=ttyMSM0,115200"
+        "console=tty0"
+        "dtb=/${config.hardware.deviceTree.name}"
+      ];
+      boot.loader.systemd-boot.extraFiles.${config.hardware.deviceTree.name} = "${config.hardware.deviceTree.package}/${config.hardware.deviceTree.name}";
+      nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
+        "firmware-oneplus-sdm845"
+        "firmware-oneplus-sdm845-xz"
+      ];
+      system.build.uboot = pkgs.ubootImageEnchilada;
+      boot.initrd.includeDefaultModules = false;
+      boot.initrd.availableKernelModules = [
+        "sd_mod"
+        "usbhid"
+        "ehci_hcd" "ohci_hcd" "xhci_hcd" "uhci_hcd"
+        "ehci_pci" "ohci_pci" "xhci_pci"
+        "hid_generic" "hid_lenovo" "hid_apple" "hid_roccat"
+        "hid_logitech_hidpp" "hid_logitech_dj" "hid_microsoft" "hid_cherry"
+      ];
+      boot.initrd.kernelModules = [
+        "i2c_qcom_geni"
+        "rmi_core"
+        "rmi_i2c"
+        "qcom_spmi_haptics"
+        "dm_mod"
+      ];
+    }
+    (lib.mkIf cfg.buffyboard.enable {
+      boot.initrd.kernelModules = [ "uinput" "evdev" ];
+      boot.initrd.extraUtilsCommands = ''
+        copy_bin_and_libs ${pkgs.buffyboard}/bin/buffyboard
+        cp -a ${pkgs.libinput.out}/share $out/
+      '';
+      boot.initrd.extraUdevRulesCommands = ''
+        cp -v ${config.systemd.package}/lib/udev/rules.d/60-input-id.rules $out/
+        cp -v ${config.systemd.package}/lib/udev/rules.d/60-persistent-input.rules $out/
+        cp -v ${config.systemd.package}/lib/udev/rules.d/70-touchpad.rules $out/
+      '';
+      boot.initrd.preLVMCommands = ''
+        mkdir -p /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-${pkgs.libinput.name}/
+        ln -s "$(dirname "$(dirname "$(which buffyboard)")")"/share /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-${pkgs.libinput.name}/
+        buffyboard 2>/dev/null &
+      '';
+      boot.initrd.postMountCommands = ''
+        pkill -x buffyboard
+      '';
+      common.gettyAutologin = true;
+      systemd.services.buffyboard = {
+        description = "buffyboard";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          ExecStart = "${pkgs.buffyboard}/bin/buffyboard";
+          Restart = "always";
+          RestartSec = "1";
+        };
+      };
+      security.sudo.extraRules = [
+        { groups = [ "users" ];
+          commands = [
+            { command = "/run/current-system/sw/bin/systemctl stop buffyboard"; options = [ "SETENV" "NOPASSWD" ]; }
+            { command = "/run/current-system/sw/bin/systemctl start buffyboard"; options = [ "SETENV" "NOPASSWD" ]; }
+          ]; }
+      ];
+    })
+    (lib.mkIf cfg.rndis.enable {
+      boot.initrd.kernelModules = [ "configfs" "libcomposite" ];
+
+      boot.specialFileSystems = {
+        "/sys/kernel/config" = {
+          device = "configfs";
+          fsType = "configfs";
+          options = [ "nosuid" "noexec" "nodev" ];
+        };
+      };
+
+      boot.initrd.preLVMCommands = ''
+        mkdir -p /sys/kernel/config/usb_gadget/g1/strings/0x409
+        cd /sys/kernel/config/usb_gadget/g1
+        echo 0x18D1 > idVendor
+        echo 0xD001 > idProduct
+        echo oneplus-enchilada > strings/0x409/product
+        echo NixOS > strings/0x409/manufacturer
+        echo 0123456789 > strings/0x409/serialnumber
+
+        mkdir -p configs/c.1/strings/0x409
+        echo "USB network" > configs/c.1/strings/0x409/configuration
+
+        mkdir -p functions/ncm.usb0 || mkdir -p functions/rndis.usb0
+        ln -s functions/ncm.usb0 configs/c.1/ || ln -s functions/rndis.usb0 configs/c.1/
+
+        ls /sys/class/udc/ | head -n1 > UDC
+        cd /
+
+        ifconfig rndis0 172.16.42.1 || ifconfig usb0 172.16.42.1 || ifconfig eth0 172.16.42.1
+      '';
+
+      boot.initrd.network.enable = true;
+      boot.initrd.network.udhcpc.enable = false;
+      boot.initrd.network.ssh = {
+        enable = true;
+        port = 22;
+        authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys;
+        hostKeys = [ "/secrets/initrd/ssh_host_ed25519_key" "/secrets/initrd/ssh_host_rsa_key" ];
+      };
+    })
+    (lib.mkIf cfg.adb.enable {
+      boot.initrd.kernelModules = [ "configfs" "libcomposite" "g_ffs" ];
+
+      boot.specialFileSystems = {
+        "/sys/kernel/config" = {
+          device = "configfs";
+          fsType = "configfs";
+          options = [ "nosuid" "noexec" "nodev" ];
+        };
+      };
+
+      boot.initrd.extraUtilsCommands = ''
+        copy_bin_and_libs ${pkgs.adbd}/bin/adbd
+        cp -pv ${pkgs.glibc.out}/lib/libnss_files.so.* $out/lib
+      '';
+
+      boot.initrd.preLVMCommands = ''
+        mkdir -p /sys/kernel/config/usb_gadget/g1/strings/0x409
+        cd /sys/kernel/config/usb_gadget/g1
+        echo 0x18D1 > idVendor
+        echo 0xD001 > idProduct
+        echo oneplus-enchilada > strings/0x409/product
+        echo NixOS > strings/0x409/manufacturer
+        echo 0123456789 > strings/0x409/serialnumber
+
+        mkdir -p configs/c.1/strings/0x409
+        echo adb > configs/c.1/strings/0x409/configuration
+
+        mkdir -p functions/ffs.adb
+        ln -s functions/ffs.adb configs/c.1/adb
+
+        mkdir -p /dev/usb-ffs/adb
+        mount -t functionfs adb /dev/usb-ffs/adb
+        adbd &
+
+        ls /sys/class/udc/ | head -n1 > UDC
+        cd /
+      '';
+
+      boot.initrd.postMountCommands = ''
+        pkill -x adbd
+      '';
+
+      systemd.services.adbd = {
+        description = "adb daemon";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          ExecStart = "${pkgs.adbd}/bin/adbd";
+          Restart = "always";
+        };
+      };
+    })
+  ];
+}

system/hardware/oneplus-enchilada/pkgs.nix

@@ -0,0 +1,631 @@
+{ pkgs
+, pkgs'
+, lib
+, inputs
+, ... }:
+
+let
+  inherit (inputs) mobile-nixos;
+  mobile-pkgs = import "${mobile-nixos}/overlay/overlay.nix" pkgs' pkgs;
+in {
+  inherit (mobile-pkgs) mkbootimg qrtr;
+  pd-mapper = pkgs'.callPackage "${mobile-nixos}/overlay/qrtr/pd-mapper.nix" { };
+  tqftpserv = pkgs'.callPackage "${mobile-nixos}/overlay/qrtr/tqftpserv.nix" { };
+  rmtfs = pkgs'.callPackage "${mobile-nixos}/overlay/qrtr/rmtfs.nix" {
+    inherit (mobile-pkgs) qmic;
+  };
+  adbd = pkgs'.callPackage "${mobile-nixos}/overlay/adbd" {
+    libhybris = pkgs'.callPackage "${mobile-nixos}/overlay/libhybris" {
+      inherit (mobile-pkgs) android-headers;
+    };
+  };
+  q6voiced = pkgs.stdenv.mkDerivation {
+    pname = "q6voiced";
+    version = "unstable-2022-07-08";
+    src = pkgs.fetchFromGitLab {
+      owner = "postmarketOS";
+      repo = "q6voiced";
+      rev = "736138bfc9f7b455a96679e2d67fd922a8f16464";
+      hash = "sha256-7k5saedIALHlsFHalStqzKrqAyFKx0ZN9FhLTdxAmf4=";
+    };
+    buildInputs = with pkgs; [ dbus tinyalsa ];
+    nativeBuildInputs = with pkgs; [ pkg-config ];
+    buildPhase = ''cc $(pkg-config --cflags --libs dbus-1) -ltinyalsa -o q6voiced q6voiced.c'';
+    installPhase = ''install -m555 -Dt "$out/bin" q6voiced'';
+    meta.license = lib.licenses.mit;
+  };
+
+  alsa-ucm-conf-enchilada = pkgs.stdenvNoCC.mkDerivation {
+    pname = "alsa-ucm-conf-enchilada";
+    version = "unstable-2022-12-08";
+    src = pkgs.fetchFromGitLab {
+      owner = "sdm845-mainline";
+      repo = "alsa-ucm-conf";
+      rev = "9ed12836b269764c4a853411d38ccb6abb70b383";
+      hash = "sha256-QvGZGLEmqE+sZpd15fHb+9+MmoD5zoGT+pYqyWZLdkM=";
+    };
+    installPhase = ''
+      substituteInPlace ucm2/lib/card-init.conf --replace '"/bin' '"/run/current-system/sw/bin'
+      mkdir -p "$out"/share/alsa/ucm2/{OnePlus,conf.d/sdm845,lib}
+      mv ucm2/lib/card-init.conf "$out/share/alsa/ucm2/lib/"
+      mv ucm2/OnePlus/enchilada "$out/share/alsa/ucm2/OnePlus/"
+      ln -s ../../OnePlus/enchilada/enchilada.conf "$out/share/alsa/ucm2/conf.d/sdm845/oneplus-OnePlus6-Unknown.conf"
+    '';
+    # to overwrite card-init.conf
+    meta.priority = -10;
+  };
+
+  ubootEnchilada = pkgs.buildUBoot {
+    defconfig = "qcom_defconfig";
+    version = "unstable-2023-12-11";
+    src = pkgs.fetchFromGitLab {
+      owner = "sdm845-mainline";
+      repo = "u-boot";
+      rev = "977b9279c610b862f9ef84fb3addbebb7c42166a";
+      hash = "sha256-ksI7qxozIjJ5E8uAJkX8ZuaaOHdv76XOzITaA8Vp/QA=";
+    };
+    makeFlags = [ "DEVICE_TREE=sdm845-oneplus-enchilada" ];
+    extraConfig = ''
+      CONFIG_BOOTDELAY=5
+    '';
+    extraMeta.platforms = [ "aarch64-linux" ];
+    patches = [ ];
+    filesToInstall = [ "u-boot-nodtb.bin" "u-boot-dtb.bin" "u-boot.dtb" ];
+  };
+
+  ubootImageEnchilada = pkgs.stdenvNoCC.mkDerivation {
+    name = "u-boot-enchilada.img";
+    nativeBuildInputs = [
+      # available from mobile-nixos's overlay
+      pkgs'.mkbootimg
+      pkgs'.gzip
+    ];
+    src = pkgs'.ubootEnchilada;
+    dontBuild = true;
+    dontFixup = true;
+    installPhase = ''
+      gzip u-boot-nodtb.bin
+      cat u-boot.dtb >> u-boot-nodtb.bin.gz
+      mkbootimg \
+        --base 0x0 \
+        --kernel_offset 0x8000 \
+        --ramdisk_offset 0x01000000 \
+        --tags_offset 0x100 \
+        --pagesize 4096 \
+        --kernel u-boot-nodtb.bin.gz \
+        -o "$out"
+    '';
+  };
+
+  firmware-oneplus-sdm845 = pkgs.stdenvNoCC.mkDerivation {
+    name = "firmware-oneplus-sdm845";
+    src = pkgs.fetchFromGitLab {
+      owner = "sdm845-mainline";
+      repo = "firmware-oneplus-sdm845";
+      rev = "dc9c77f220d104d7224c03fcbfc419a03a58765e";
+      hash = "sha256-jrbWIS4T9HgBPYOV2MqPiRQCxGMDEfQidKw9Jn5pgBI=";
+    };
+    installPhase = ''
+      cp -a . "$out"
+      cd "$out/lib/firmware/postmarketos"
+      find . -type f,l | xargs -i bash -c 'mkdir -p "$(dirname "../$1")" && mv "$1" "../$1"' -- {}
+      cd "$out/usr"
+      find . -type f,l | xargs -i bash -c 'mkdir -p "$(dirname "../$1")" && mv "$1" "../$1"' -- {}
+      cd ..
+      find "$out/lib/firmware/postmarketos" "$out/usr" | tac | xargs rmdir
+    '';
+    dontStrip = true;
+    # not actually redistributable, but who cares
+    meta.license = lib.licenses.unfreeRedistributableFirmware;
+  };
+
+  linux_enchilada = pkgs.linux_latest.override {
+    # TODO: uncomment
+    # ignoreConfigErrors = false;
+    kernelPatches = [
+      {
+        name = "linux_6_7";
+        patch = ./linux_6_7.patch;
+      }
+      {
+        name = "config_fixes";
+        patch = ./config_fixes.patch;
+      }
+    ];
+
+    stdenv = lib.recursiveUpdate pkgs.stdenv {
+      hostPlatform.linux-kernel.extraConfig = "";
+    };
+
+    structuredExtraConfig = with lib.kernel; {
+      # fix build
+      LENOVO_YOGA_C630_EC = no;
+      RPMSG_QCOM_GLINK_SMEM = yes;
+      # useless lines, remove on update
+      DM_MIRROR = no;
+      DM_ZERO = no;
+      # for adb and stuff (doesn't have to be built-in, but it's easier that way)
+      USB_FUNCTIONFS = yes;
+      USB_LIBCOMPOSITE = yes;
+      USB_F_ACM = yes;
+      USB_U_SERIAL = yes;
+      USB_U_ETHER = yes;
+      USB_F_SERIAL = yes;
+      USB_F_OBEX = yes;
+      USB_F_NCM = yes;
+      USB_F_ECM = yes;
+      USB_F_EEM = yes;
+      USB_F_SUBSET = yes;
+      USB_F_RNDIS = yes;
+      USB_F_MASS_STORAGE = yes;
+      USB_F_FS = yes;
+      USB_F_HID = yes;
+      USB_CONFIGFS = yes;
+      USB_CONFIGFS_F_HID = yes;
+
+      # adapted from https://gitlab.com/sdm845-mainline/linux/-/blob/caf9d678d34f70173bf236584dfb819164283833/arch/arm64/configs/sdm845.config
+      # enchilada-specific
+      DRM_PANEL_SAMSUNG_SOFEF00 = yes;
+      BATTERY_BQ27XXX = module;
+      HID_RMI = module;
+      RMI4_CORE = module;
+      RMI4_I2C = module;
+      RMI4_F55 = yes;
+      # common sdm845
+      HIBERNATION = lib.mkForce no;
+      QCOM_RPROC_COMMON = yes;
+      FORCE_NR_CPUS = yes;
+      NR_CPUS = lib.mkForce (freeform "8");
+      SCSI_UFS_QCOM = yes;
+      QCOM_GSBI = yes;
+      QCOM_LLCC = yes;
+      QCOM_OCMEM = yes;
+      QCOM_RMTFS_MEM = yes;
+      QCOM_SOCINFO = yes;
+      QCOM_WCNSS_CTRL = yes;
+      QCOM_APR = yes;
+      POWER_RESET_QCOM_PON = yes;
+      QCOM_SPMI_TEMP_ALARM = yes;
+      QCOM_LMH = yes;
+      SCHED_CLUSTER = yes;
+      SND_SOC_QDSP6_Q6VOICE = module;
+      SCSI_UFS_BSG = yes;
+      PHY_QCOM_QMP_PCIE = yes;
+      BACKLIGHT_CLASS_DEVICE = yes;
+      INTERCONNECT_QCOM_OSM_L3 = yes;
+      LEDS_TRIGGER_PATTERN = yes;
+      LEDS_CLASS_MULTICOLOR = module;
+      LEDS_QCOM_LPG = module;
+      LEDS_QCOM_FLASH = module;
+      SLIMBUS = yes;
+      SLIM_QCOM_CTRL = yes;
+      SLIM_QCOM_NGD_CTRL = yes;
+      REMOTEPROC_CDEV = yes;
+      BATTERY_QCOM_FG = module;
+      CHARGER_QCOM_SMB2 = module;
+      QCOM_SPMI_RRADC = module;
+      DRM = yes;
+      DRM_MSM = yes;
+      REGULATOR_QCOM_LABIBB = yes;
+      BACKLIGHT_QCOM_WLED = yes;
+      INPUT_QCOM_SPMI_HAPTICS = module;
+      PM_AUTOSLEEP = yes;
+      SCSI_SCAN_ASYNC = yes;
+      DMABUF_HEAPS = yes;
+      UDMABUF = yes;
+      DMABUF_HEAPS_CMA = yes;
+      DMABUF_HEAPS_SYSTEM = yes;
+      HZ_1000 = yes;
+      RPMSG_CHAR = yes;
+      QCOM_Q6V5_ADSP = module;
+      BT_RFCOMM = yes;
+      BT_RFCOMM_TTY = yes;
+      BT_BNEP = yes;
+      BT_BNEP_MC_FILTER = yes;
+      BT_BNEP_PROTO_FILTER = yes;
+      BT_HS = yes;
+      BT_LE = yes;
+      QCOM_COINCELL = module;
+      QCOM_FASTRPC = module;
+      QCOM_SPMI_VADC = yes;
+      QCOM_SPMI_ADC5 = yes;
+      PHY_QCOM_QMP = yes;
+      PHY_QCOM_QUSB2 = yes;
+      PHY_QCOM_QMP_UFS = yes;
+      TYPEC = yes;
+      PHY_QCOM_QMP_COMBO = yes;
+      LEDS_CLASS_FLASH = yes;
+      TCP_CONG_WESTWOOD = yes;
+      DEFAULT_WESTWOOD = yes;
+      BLK_DEV_RAM = yes;
+      BLK_DEV_RAM_SIZE = freeform "8192";
+      CPU_FREQ_GOV_POWERSAVE = yes;
+      SYN_COOKIES = yes;
+      INPUT_UINPUT = module;
+      U_SERIAL_CONSOLE = yes;
+      USB_ANNOUNCE_NEW_DEVICES = yes;
+      BLK_INLINE_ENCRYPTION = yes;
+      PHY_QCOM_SNPS_EUSB2 = module;
+      MFD_QCOM_RPM = yes;
+      USB_DWC3_ULPI = yes;
+      SCSI_UFS_CRYPTO = yes;
+      PHY_QCOM_USB_HS = yes;
+      PHY_QCOM_USB_SNPS_FEMTO_V2 = yes;
+      INTERCONNECT_QCOM_SM6115 = yes;
+      SM_DISPCC_6115 = yes;
+      FS_ENCRYPTION_INLINE_CRYPT = yes;
+      CRYPTO_USER_API_AEAD = yes;
+      CRYPTO_DEV_QCE = yes;
+      DMA_CMA = yes;
+      SM_GPUCC_6115 = yes;
+      USB_ONBOARD_HUB = no; # breaks USB on qualcomm rb2... which i don't need, but i guess this won't hurt either way
+      INTERCONNECT_QCOM_QCM2290 = yes;
+      BRIDGE_NETFILTER = module;
+      # CONFIG END (essentially)
+
+      # the rest of the config is just disabling unneeded stuff, feel free to ignore this
+      ARCH_SPARX5 = no;
+      ARCH_MA35 = no;
+      ARCH_REALTEK = no;
+      ARCH_STM32 = no;
+      BLK_DEV_NVME = no;
+      ATA = no;
+      MTD = no;
+      SRAM = no;
+      MEGARAID_SAS = no;
+      EEPROM_AT25 = no;
+      USB_DWC2 = no;
+      USB_CHIPIDEA = no;
+      USB_MUSB_HDRC = no;
+      USB_ISP1760 = no;
+      USB_HSIC_USB3503 = no;
+      USB_NET_PLUSB = no;
+      TYPEC_FUSB302 = no;
+      EXTCON_PTN5150 = no;
+      NET_VENDOR_NI = no;
+      NET_9P = no;
+      CAN = no;
+      BNX2X = no;
+      MACB = no;
+      IGB = no;
+      IGBVF = no;
+      SMC91X = no;
+      MLX4_EN = no;
+      MLX5_CORE = no;
+      STMMAC_ETH = no;
+      ATL1C = no;
+      BRCMFMAC = no;
+      WL18XX = no;
+      ATH10K_PCI = no;
+      NET_SCH_CBS = no;
+      NET_SCH_ETF = no;
+      NET_SCH_TAPRIO = no;
+      NET_SCH_MQPRIO = no;
+      NET_CLS_BASIC = no;
+      NET_CLS_FLOWER = no;
+      NET_CLS_ACT = no;
+      MDIO_BUS_MUX_MMIOREG = no;
+      MDIO_BUS_MUX_MULTIPLEXER = no;
+      SND_SOC_ES7134 = no;
+      SND_SOC_ES7241 = no;
+      SND_SOC_TAS571X = no;
+      SND_SOC_SIMPLE_AMPLIFIER = no;
+      GPIO_DWAPB = no;
+      COMMON_CLK_XGENE = no;
+      SENSORS_ARM_SCPI = no;
+      TCG_TPM = no;
+      BATTERY_SBS = no;
+      REGULATOR_VCTRL = no;
+      CAVIUM_ERRATUM_22375 = no;
+      CAVIUM_ERRATUM_23154 = no;
+      CAVIUM_ERRATUM_27456 = no;
+      CAVIUM_ERRATUM_30115 = no;
+      CAVIUM_TX2_ERRATUM_219 = no;
+      EEPROM_AT24 = no;
+      NET_DSA = no;
+      AQUANTIA_PHY = no;
+      MICROSEMI_PHY = no;
+      VITESSE_PHY = no;
+      I2C_MUX_PCA954x = no;
+      SND_SOC_PCM3168A_I2C = no;
+      SENSORS_LM90 = no;
+      SENSORS_INA2XX = no;
+      RTC_DRV_DS3232 = no;
+      GPIO_MAX732X = no;
+      SENSORS_ISL29018 = no;
+      MPL3115 = no;
+      MFD_ROHM_BD718XX = no;
+      ARM_SBSA_WATCHDOG = no;
+      ARM_SMC_WATCHDOG = no;
+      REGULATOR_PCA9450 = no;
+      REGULATOR_PFUZE100 = no;
+      DRM_PANEL_ABT_Y030XX067A = no;
+      DRM_PANEL_ARM_VERSATILE = no;
+      DRM_PANEL_ASUS_Z00T_TM5P5_NT35596 = no;
+      DRM_PANEL_AUO_A030JTN01 = no;
+      DRM_PANEL_BOE_BF060Y8M_AJ0 = no;
+      DRM_PANEL_BOE_HIMAX8279D = no;
+      DRM_PANEL_ELIDA_KD35T133 = no;
+      DRM_PANEL_FEIXIN_K101_IM2BA02 = no;
+      DRM_PANEL_FEIYANG_FY07024DI26A30D = no;
+      DRM_PANEL_HIMAX_HX8394 = no;
+      DRM_PANEL_ILITEK_IL9322 = no;
+      DRM_PANEL_ILITEK_ILI9341 = no;
+      DRM_PANEL_ILITEK_ILI9881C = no;
+      DRM_PANEL_ILITEK_ILI9882T = no;
+      DRM_PANEL_INNOLUX_EJ030NA = no;
+      DRM_PANEL_INNOLUX_P079ZCA = no;
+      DRM_PANEL_JADARD_JD9365DA_H3 = no;
+      DRM_PANEL_JDI_LPM102A188A = no;
+      DRM_PANEL_JDI_LT070ME05000 = no;
+      DRM_PANEL_JDI_R63452 = no;
+      DRM_PANEL_KHADAS_TS050 = no;
+      DRM_PANEL_KINGDISPLAY_KD097D04 = no;
+      DRM_PANEL_LEADTEK_LTK050H3146W = no;
+      DRM_PANEL_LEADTEK_LTK500HD1829 = no;
+      DRM_PANEL_LG_LB035Q02 = no;
+      DRM_PANEL_LG_LG4573 = no;
+      DRM_PANEL_MAGNACHIP_D53E6EA8966 = no;
+      DRM_PANEL_NEC_NL8048HL11 = no;
+      DRM_PANEL_NEWVISION_NV3051D = no;
+      DRM_PANEL_NEWVISION_NV3052C = no;
+      DRM_PANEL_NOVATEK_NT35510 = no;
+      DRM_PANEL_NOVATEK_NT35560 = no;
+      DRM_PANEL_NOVATEK_NT35950 = no;
+      DRM_PANEL_NOVATEK_NT36523 = no;
+      DRM_PANEL_NOVATEK_NT39016 = no;
+      DRM_PANEL_OLIMEX_LCD_OLINUXINO = no;
+      DRM_PANEL_ORISETECH_OTA5601A = no;
+      DRM_PANEL_ORISETECH_OTM8009A = no;
+      DRM_PANEL_OSD_OSD101T2587_53TS = no;
+      DRM_PANEL_PANASONIC_VVX10F034N00 = no;
+      DRM_PANEL_RASPBERRYPI_TOUCHSCREEN = no;
+      DRM_PANEL_RAYDIUM_RM67191 = no;
+      DRM_PANEL_RAYDIUM_RM68200 = no;
+      DRM_PANEL_RAYDIUM_RM692E5 = no;
+      DRM_PANEL_RONBO_RB070D30 = no;
+      DRM_PANEL_SAMSUNG_ATNA33XC20 = no;
+      DRM_PANEL_SAMSUNG_DB7430 = no;
+      DRM_PANEL_SAMSUNG_LD9040 = no;
+      DRM_PANEL_SAMSUNG_S6D16D0 = no;
+      DRM_PANEL_SAMSUNG_S6D27A1 = no;
+      DRM_PANEL_SAMSUNG_S6D7AA0 = no;
+      DRM_PANEL_SAMSUNG_S6E3HA2 = no;
+      DRM_PANEL_SAMSUNG_S6E63J0X03 = no;
+      DRM_PANEL_SAMSUNG_S6E63M0 = no;
+      DRM_PANEL_SAMSUNG_S6E88A0_AMS452EF01 = no;
+      DRM_PANEL_SAMSUNG_S6E8AA0 = no;
+      DRM_PANEL_SEIKO_43WVF1G = no;
+      DRM_PANEL_SHARP_LQ101R1SX01 = no;
+      DRM_PANEL_SHARP_LS037V7DW01 = no;
+      DRM_PANEL_SHARP_LS043T1LE01 = no;
+      DRM_PANEL_SHARP_LS060T1SX01 = no;
+      DRM_PANEL_SITRONIX_ST7701 = no;
+      DRM_PANEL_SITRONIX_ST7703 = no;
+      DRM_PANEL_SITRONIX_ST7789V = no;
+      DRM_PANEL_SONY_ACX565AKM = no;
+      DRM_PANEL_SONY_TD4353_JDI = no;
+      DRM_PANEL_SONY_TULIP_TRULY_NT35521 = no;
+      DRM_PANEL_STARTEK_KD070FHFID015 = no;
+      DRM_PANEL_TDO_TL070WSH30 = no;
+      DRM_PANEL_TPO_TD028TTEC1 = no;
+      DRM_PANEL_TPO_TD043MTEA1 = no;
+      DRM_PANEL_TPO_TPG110 = no;
+      DRM_PANEL_VISIONOX_R66451 = no;
+      DRM_PANEL_VISIONOX_RM69299 = no;
+      DRM_PANEL_WIDECHIPS_WS2401 = no;
+      DRM_PANEL_XINPENG_XPP055C272 = no;
+      DRM_NWL_MIPI_DSI = no;
+      SND_SOC_FSL_SAI = no;
+      SND_SOC_FSL_ASRC = no;
+      SND_SOC_FSL_MICFIL = no;
+      SND_SOC_FSL_AUDMIX = no;
+      SND_SOC_FSL_SPDIF = no;
+      SND_SOC_WM8904 = no;
+      RTC_DRV_RV8803 = no;
+      RTC_DRV_DS1307 = no;
+      RTC_DRV_PCF85363 = no;
+      RTC_DRV_PCF2127 = no;
+      FUJITSU_ERRATUM_010001 = no;
+      PCI_PASID = no;
+      UACCE = no;
+      SPI_CADENCE_QUADSPI = no;
+      DW_WATCHDOG = no;
+      NOP_USB_XCEIV = no;
+      SURFACE_PLATFORMS = no;
+      GPIO_PCA953X = no;
+      BACKLIGHT_LP855X = no;
+      MFD_MAX77620 = no;
+      SENSORS_PWM_FAN = no;
+      SENSORS_INA3221 = no;
+      REGULATOR_MAX8973 = no;
+      USB_CONN_GPIO = no;
+      MFD_BD9571MWV = no;
+      DRM_PANEL_LVDS = no;
+      COMMON_CLK_VC5 = no;
+      CRYPTO_DEV_CCREE = no;
+      VIDEO_IMX219 = no;
+      VIDEO_OV5645 = no;
+      SND_SOC_AK4613 = no;
+      SND_SIMPLE_CARD = no;
+      SND_AUDIO_GRAPH_CARD = no;
+      TYPEC_HD3SS3220 = no;
+      RTC_DRV_RX8581 = no;
+      COMMON_CLK_CS2000_CP = no;
+      KEYBOARD_ADC = no;
+      REGULATOR_FAN53555 = no;
+      TOUCHSCREEN_ATMEL_MXT = no;
+      RTC_DRV_HYM8563 = no;
+      MFD_SEC_CORE = no;
+      PL330_DMA = no;
+      GPIO_MB86S7X = no;
+      MMC_SDHCI_F_SDH30 = no;
+      MMC_SDHCI_CADENCE = no;
+      SOCIONEXT_SYNQUACER_PREITS = no;
+      NET_VENDOR_SOCIONEXT = no;
+      ARCH_ACTIONS = no;
+      ARCH_SUNXI = no;
+      ARCH_ALPINE = no;
+      ARCH_APPLE = no;
+      ARCH_BERLIN = no;
+      ARCH_EXYNOS = no;
+      ARCH_K3 = no;
+      ARCH_LG1K = no;
+      ARCH_HISI = no;
+      ARCH_KEEMBAY = no;
+      ARCH_MEDIATEK = no;
+      ARCH_MESON = no;
+      ARCH_MVEBU = no;
+      ARCH_RENESAS = no;
+      ARCH_ROCKCHIP = no;
+      ARCH_SEATTLE = no;
+      ARCH_INTEL_SOCFPGA = no;
+      ARCH_SYNQUACER = no;
+      ARCH_TEGRA = no;
+      ARCH_SPRD = no;
+      ARCH_THUNDER = no;
+      ARCH_THUNDER2 = no;
+      ARCH_UNIPHIER = no;
+      ARCH_VEXPRESS = no;
+      ARCH_VISCONTI = no;
+      ARCH_XGENE = no;
+      ARCH_ZYNQMP = no;
+      PCI_XGENE = no;
+      PCIE_ALTERA = no;
+      PCI_HOST_THUNDER_PEM = no;
+      PCI_HOST_THUNDER_ECAM = no;
+      PCI_HISI = no;
+      PCIE_KIRIN = no;
+      SERIAL_XILINX_PS_UART = no;
+      SERIAL_FSL_LPUART = no;
+      SERIAL_FSL_LINFLEXUART = no;
+      I2C_RK3X = no;
+      SPI_PL022 = no;
+      GPIO_ALTERA = no;
+      GPIO_PL061 = no;
+      GPIO_XGENE = no;
+      POWER_RESET_XGENE = no;
+      POWER_RESET_SYSCON = no;
+      GNSS_MTK_SERIAL = no;
+      ARM_SP805_WATCHDOG = no;
+      MFD_AXP20X_I2C = no;
+      MFD_HI6421_PMIC = no;
+      MFD_MT6397 = no;
+      REGULATOR_RK808 = no;
+      REGULATOR_TPS65132 = no;
+      MEDIA_ANALOG_TV_SUPPORT = lib.mkForce no;
+      MEDIA_DIGITAL_TV_SUPPORT = lib.mkForce no;
+      MEDIA_SDR_SUPPORT = no;
+      DRM_AMDGPU = no;
+      DRM_ETNAVIV = no;
+      DRM_HISI_KIRIN = no;
+      DRM_NOUVEAU = no;
+      SND_SOC_GTM601 = no;
+      SND_SOC_RT5659 = no;
+      SND_SOC_WM8960 = no;
+      SND_SOC_WM8962 = no;
+      USB_XHCI_PCI_RENESAS = no;
+      MMC_SDHCI_OF_ARASAN = no;
+      MMC_DW_EXYNOS = no;
+      MMC_DW_HI3798CV200 = no;
+      MMC_DW_K3 = no;
+      MMC_MTK = no;
+      MMC_SDHCI_XENON = no;
+      MMC_SDHCI_AM654 = no;
+      RTC_DRV_MAX77686 = no;
+      RTC_DRV_RK808 = no;
+      RTC_DRV_M41T80 = no;
+      RTC_DRV_RV3028 = no;
+      RTC_DRV_PL031 = no;
+      COMMON_CLK_RK808 = no;
+      FSL_RCPM = no;
+      HISI_PMU = no;
+      INTERCONNECT_QCOM_MSM8996 = no;
+      INTERCONNECT_QCOM_QCS404 = no;
+      INTERCONNECT_QCOM_SC7180 = no;
+      INTERCONNECT_QCOM_SM8150 = no;
+      INTERCONNECT_QCOM_SM8350 = no;
+      INTERCONNECT_QCOM_SM8450 = no;
+      INTERCONNECT_QCOM_SM8550 = no;
+      INTERCONNECT_QCOM_SC8280XP = no;
+      ARCH_NPCM = no;
+      PINCTRL_SC8280XP = no;
+      BCM_SBA_RAID = no;
+      SENSORS_GPIO_FAN = no;
+      ARCH_BCM = no;
+      ARCH_NXP = no;
+      NET_VENDOR_ADI = no;
+      PINCTRL_SC8180X = no;
+      SND_SOC_SC7180 = no;
+      SND_SOC_SC7280 = no;
+      SND_SOC_WCD938X_SDW = no;
+      MMC_SDHCI_OF_DWCMSHC = no;
+      SC_GCC_8180X = no;
+      IOMMU_IO_PGTABLE_DART = no;
+      INTERCONNECT_QCOM_SC8180X = no;
+      MEMORY_HOTPLUG = lib.mkForce no;
+      MELLANOX_PLATFORM = no;
+      CHROME_PLATFORMS = lib.mkForce no;
+      PINCTRL_SM8150 = no;
+      SM_GCC_8150 = no;
+      SM_VIDEOCC_8150 = no;
+      SM_GPUCC_8150 = no;
+      SM_GPUCC_8350 = no;
+      SM_VIDEOCC_8350 = no;
+      PINCTRL_SM8350 = no;
+      SM_GCC_8350 = no;
+      SM_DISPCC_8450 = no;
+      PINCTRL_SM8550 = no;
+      PINCTRL_SM8550_LPASS_LPI = no;
+      SM_DISPCC_8550 = no;
+      SM_TCSRCC_8550 = no;
+
+      # keys that are unused in this case
+      # (builtin aarch64-linux config is unused too, but i cant disable it)
+      ACPI_HOTPLUG_MEMORY.tristate = lib.mkForce null; BCM2835_MBOX.tristate = lib.mkForce null; BCM2835_WDT.tristate = lib.mkForce null;
+      CHROMEOS_TBMC.tristate = lib.mkForce null; CROS_EC.tristate = lib.mkForce null; CROS_EC_I2C.tristate = lib.mkForce null;
+      CROS_EC_SPI.tristate = lib.mkForce null; CROS_KBD_LED_BACKLIGHT.tristate = lib.mkForce null;
+      FSL_MC_UAPI_SUPPORT.tristate = lib.mkForce null; MEDIA_ATTACH.tristate = lib.mkForce null;
+      MEMORY_HOTREMOVE.tristate = lib.mkForce null; MTD_COMPLEX_MAPPINGS.tristate = lib.mkForce null; NET_ACT_BPF.tristate = lib.mkForce null;
+      PCI_TEGRA.tristate = lib.mkForce null; RASPBERRYPI_FIRMWARE.tristate = lib.mkForce null; RASPBERRYPI_POWER.tristate = lib.mkForce null;
+      SCSI_SAS_ATA.tristate = lib.mkForce null; SUN8I_DE2_CCU.tristate = lib.mkForce null;
+      TCG_TIS_SPI_CR50.tristate = lib.mkForce null; USB_XHCI_TEGRA = lib.mkForce no; ZONE_DEVICE.tristate = lib.mkForce null;
+      "9P_FSCACHE".tristate = lib.mkForce null; CROS_EC_ISHTP.tristate = lib.mkForce null; CROS_EC_LPC.tristate = lib.mkForce null;
+      DRM_AMDGPU_CIK.tristate = lib.mkForce null; DRM_AMDGPU_SI.tristate = lib.mkForce null; DRM_AMDGPU_USERPTR.tristate = lib.mkForce null;
+      DRM_AMD_DC_FP.tristate = lib.mkForce null; DRM_AMD_DC_SI.tristate = lib.mkForce null; DRM_DP_AUX_CHARDEV.tristate = lib.mkForce null;
+      DRM_FBDEV_EMULATION.tristate = lib.mkForce null; DRM_GMA500.tristate = lib.mkForce null; DRM_LEGACY.tristate = lib.mkForce null;
+      DRM_LOAD_EDID_FIRMWARE.tristate = lib.mkForce null; DRM_VBOXVIDEO.tristate = lib.mkForce null;
+      DRM_VC4_HDMI_CEC.tristate = lib.mkForce null; FB_3DFX_ACCEL.tristate = lib.mkForce null; FB_ATY_CT.tristate = lib.mkForce null;
+      FB_ATY_GX.tristate = lib.mkForce null; FB_EFI.tristate = lib.mkForce null; FB_NVIDIA_I2C.tristate = lib.mkForce null;
+      FB_RIVA_I2C.tristate = lib.mkForce null; FB_SAVAGE_ACCEL.tristate = lib.mkForce null; FB_SAVAGE_I2C.tristate = lib.mkForce null;
+      FB_SIS_300.tristate = lib.mkForce null; FB_SIS_315.tristate = lib.mkForce null;
+      FB_VESA.tristate = lib.mkForce null; FONTS.tristate = lib.mkForce null; FONT_8x8.tristate = lib.mkForce null;
+      FONT_TER16x32.tristate = lib.mkForce null; FRAMEBUFFER_CONSOLE.tristate = lib.mkForce null;
+      FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER.tristate = lib.mkForce null;
+      FRAMEBUFFER_CONSOLE_DETECT_PRIMARY.tristate = lib.mkForce null; FRAMEBUFFER_CONSOLE_ROTATION.tristate = lib.mkForce null;
+      HMM_MIRROR.tristate = lib.mkForce null; HSA_AMD.tristate = lib.mkForce null; HYPERVISOR_GUEST.tristate = lib.mkForce null;
+      INFINIBAND_IPOIB.tristate = lib.mkForce null; INFINIBAND_IPOIB_CM.tristate = lib.mkForce null;
+      IP_MROUTE_MULTIPLE_TABLES.tristate = lib.mkForce null; JOYSTICK_PSXPAD_SPI_FF.tristate = lib.mkForce null;
+      KERNEL_ZSTD.tristate = lib.mkForce null; KEYBOARD_APPLESPI.tristate = lib.mkForce null; KVM_ASYNC_PF.tristate = lib.mkForce null;
+      KVM_GENERIC_DIRTYLOG_READ_PROTECT.tristate = lib.mkForce null; KVM_GUEST.tristate = lib.mkForce null; KVM_MMIO.tristate = lib.mkForce null;
+      KVM_VFIO.tristate = lib.mkForce null; LOGO.tristate = lib.mkForce null; MICROCODE.tristate = lib.mkForce null;
+      MOUSE_PS2_VMMOUSE.tristate = lib.mkForce null; MTRR_SANITIZER.tristate = lib.mkForce null; NFS_FSCACHE.tristate = lib.mkForce null;
+      PINCTRL_BAYTRAIL.tristate = lib.mkForce null;
+      PINCTRL_CHERRYVIEW.tristate = lib.mkForce null; PM_ADVANCED_DEBUG.tristate = lib.mkForce null; PM_TRACE_RTC.tristate = lib.mkForce null;
+      SND_AC97_POWER_SAVE.tristate = lib.mkForce null; SND_DYNAMIC_MINORS.tristate = lib.mkForce null;
+      SND_HDA_INPUT_BEEP.tristate = lib.mkForce null; SND_HDA_PATCH_LOADER.tristate = lib.mkForce null;
+      SND_HDA_RECONFIG.tristate = lib.mkForce null; SND_OSSEMUL.tristate = lib.mkForce null; SND_USB_CAIAQ_INPUT.tristate = lib.mkForce null;
+      VFIO_PCI_VGA.tristate = lib.mkForce null; VGA_SWITCHEROO.tristate = lib.mkForce null; X86_AMD_PLATFORM_DEVICE.tristate = lib.mkForce null;
+      X86_CHECK_BIOS_CORRUPTION.tristate = lib.mkForce null; X86_MCE.tristate = lib.mkForce null;
+      X86_PLATFORM_DRIVERS_DELL.tristate = lib.mkForce null; X86_PLATFORM_DRIVERS_HP.tristate = lib.mkForce null;
+      JOYSTICK_XPAD_FF.tristate = lib.mkForce null; JOYSTICK_XPAD_LEDS.tristate = lib.mkForce null; KEXEC_JUMP.tristate = lib.mkForce null;
+      PERF_EVENTS_AMD_BRS.tristate = lib.mkForce null; HVC_XEN.tristate = lib.mkForce null; HVC_XEN_FRONTEND.tristate = lib.mkForce null;
+      PARAVIRT_SPINLOCKS.tristate = lib.mkForce null; PCI_XEN.tristate = lib.mkForce null; SWIOTLB_XEN.tristate = lib.mkForce null;
+      VBOXGUEST.tristate = lib.mkForce null; XEN_BACKEND.tristate = lib.mkForce null; XEN_BALLOON.tristate = lib.mkForce null;
+      XEN_BALLOON_MEMORY_HOTPLUG.tristate = lib.mkForce null; XEN_DOM0.tristate = lib.mkForce null; XEN_EFI.tristate = lib.mkForce null;
+      XEN_HAVE_PVMMU.tristate = lib.mkForce null; XEN_MCE_LOG.tristate = lib.mkForce null; XEN_PVH.tristate = lib.mkForce null;
+      XEN_PVHVM.tristate = lib.mkForce null; XEN_SAVE_RESTORE.tristate = lib.mkForce null; XEN_SYS_HYPERVISOR.tristate = lib.mkForce null;
+    };
+  };
+  linux_enchilada_ccache = pkgs'.buildLinuxWithCcache pkgs'.linux_enchilada;
+}

system/hardware/radxa-rock5a/default.nix

@@ -3,17 +3,13 @@
 , ... }:
 
 {
-  boot.initrd.availableKernelModules = [ "ahci" "usbhid" "usb_storage" ];
-
-  # TODO: switch to mainline when PCIe support works
-  boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.buildLinuxWithCcache pkgs.linux_testing);
-  boot.kernelPatches = [
-    {
-      name = "linux_6.7.patch";
-      patch = ./linux_6.7.patch;
-    }
+  boot.initrd.availableKernelModules = [
+    "ahci" "usbhid" "usb_storage"
+    "phy-rockchip-naneng-combphy"
   ];
 
+  boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_testing;
+
   boot.kernelParams = [ "dtb=/${config.hardware.deviceTree.name}" ];
   hardware.deviceTree.enable = true;
   hardware.deviceTree.name = "rockchip/rk3588s-rock-5a.dtb";

system/hosts/nixmsi.nix

@@ -1,11 +1,12 @@
 { lib
 , pkgs
 , config
+, inputs
 , ... }:
 
 /*
   # for old kernel versions
-  zenKernels = pkgs.callPackage "${nixpkgs}/pkgs/os-specific/linux/kernel/zen-kernels.nix";
+  zenKernels = pkgs.callPackage "${pkgs.path}/pkgs/os-specific/linux/kernel/zen-kernels.nix";
   zenKernel = (version: sha256: (zenKernels {
     kernelPatches = [
       pkgs.linuxKernel.kernelPatches.bridge_stp_helper
@@ -26,6 +27,8 @@
 */
 
 {
+  imports = [ inputs.nix-gaming.nixosModules.pipewireLowLatency ];
+
   system.stateVersion = "22.11";
 
   ### SECTION 1: HARDWARE/BOOT PARAMETERS ###
@@ -122,26 +125,15 @@
   # users.groups.wireshark.members = [ config.common.mainUsername ];
   services.printing.enable = true;
   services.printing.drivers = [ pkgs.hplip ];
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    alsa.support32Bit = true;
-    pulse.enable = true;
-    jack.enable = true;
-
-    # from nix-gaming
-    lowLatency = {
-      enable = true;
-      # 96 is mostly fine but has some xruns
-      # 128 has xruns every now and then too, but is overall fine
-      quantum = 128;
-      rate = 48000;
-    };
+  # from nix-gaming
+  services.pipewire.lowLatency = {
+    enable = false;
+    # 96 is mostly fine but has some xruns
+    # 128 has xruns every now and then too
+    quantum = 128;
+    rate = 48000;
   };
-  security.polkit.enable = true;
-  security.rtkit.enable = true;
 
-  services.dbus.enable = true;
   programs.sway.enable = true;
   xdg.portal = {
     enable = true;
@@ -189,6 +181,5 @@
 
   impermanence.directories = [
     /secrets
-    /etc/nixos
   ];
 }

system/hosts/phone/default.nix

@@ -1,12 +1,50 @@
-# WIP (I don't even have the phone yet)
-
 { pkgs
+, lib
 , config
-, ... }:
+, ...
+}:
 
 {
+  imports = [ ./options.nix ];
+
   system.stateVersion = "23.11";
 
+  systemd.network.links."40-wlan0" = {
+    matchConfig.OriginalName = "wlan0";
+    linkConfig.MACAddressPolicy = "none";
+    linkConfig.MACAddress = config.phone.mac;
+  };
+
+  sound.enable = true;
+  services.logind.powerKey = "ignore";
+  services.logind.powerKeyLongPress = "poweroff";
+  hardware.sensor.iio.enable = true;
+  services.pipewire.enable = false;
+  hardware.pulseaudio.enable = lib.mkForce true;
+  users.users.${config.common.mainUsername}.extraGroups = [
+    "dialout"
+    "feedbackd"
+    "video"
+  ] ++ lib.optional (config.networking.modemmanager.enable || config.networking.networkmanager.enable) "networkmanager";
+
+        
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if ((action.id.indexOf("org.freedesktop.login1.suspend" == 0)
+        || action.id.indexOf("org.freedesktop.login1.reboot" == 0)
+        || action.id.indexOf("org.freedesktop.login1.power-off" == 0)
+        || action.id.indexOf("org.freedesktop.inhibit") == 0)
+      && subject.user == "${config.common.mainUsername}")
+      {
+        return polkit.Result.YES;
+      }
+    });
+  '';
+
+  common.minimal = false;
+  services.sshd.enable = true;
+  services.tlp.enable = true;
+
   # kde connect
   networking.firewall.allowedTCPPortRanges = [
     { from = 1714; to = 1764; }
@@ -15,26 +53,20 @@
     { from = 1714; to = 1764; }
   ];
 
-  networking.wireless.iwd.enable = true;
-  common.minimal = false;
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    alsa.support32Bit = true;
-    pulse.enable = true;
-    jack.enable = true;
-  };
-  security.polkit.enable = true;
-  security.rtkit.enable = true;
+  programs.calls.enable = true;
+  environment.systemPackages = with pkgs; [
+    # IM and SMS
+    chatty
+  ];
+
+  programs.sway.enable = true;
   xdg.portal = {
     enable = true;
     extraPortals = with pkgs; [ xdg-desktop-portal-gtk xdg-desktop-portal-wlr ];
   };
-  services.sshd.enable = true;
-  users.users.${config.common.mainUsername}.extraGroups = [ "video" "feedbackd" "dialout" ];
-
-  mobile.generatedFilesystems.rootfs = {
-    filesystem = "btrfs";
-    btrfs.partitionID = "44444444-4444-4444-8888-888888888888";
-  };
+  # services.xserver.desktopManager.phosh = {
+  #   enable = true;
+  #   group = "users";
+  #   user = config.common.mainUsername;
+  # };
 }

system/hosts/phone/options.nix

@@ -0,0 +1,12 @@
+{ lib
+, ...
+}:
+
+{
+  options.phone = {
+    mac = lib.mkOption {
+      description = "mac address";
+      type = lib.types.str;
+    };
+  };
+}

system/hosts/router/default.nix

@@ -297,6 +297,8 @@ in {
     bannedPorts = [
       631 9100 # printing
       5353 # avahi
+      # pass it through to VPN rather than WAN
+      server-config.services.qbittorrent-nox.torrent.port
     ];
     inherit (server-config.networking.firewall) allowedTCPPorts allowedTCPPortRanges allowedUDPPorts allowedUDPPortRanges;
 
@@ -328,6 +330,9 @@ in {
   }) ++ lib.toList {
     port = 24; tcp = true; udp = true; target4.port = 22; target6.port = 22;
     target4.address = serverInitrdAddress4; target6.address = serverInitrdAddress6;
+  } ++ lib.toList {
+    inVpn = true; port = server-config.services.qbittorrent-nox.torrent.port; tcp = true; udp = true;
+    target4.address = serverAddress4; target6.address = serverAddress6;
   };
 
   router.enable = true;
@@ -362,6 +367,14 @@ in {
       vht_capab = "[RXLDPC][SHORT-GI-80][SHORT-GI-160][TX-STBC-2BY1][SU-BEAMFORMER][SU-BEAMFORMEE][MU-BEAMFORMER][MU-BEAMFORMEE][RX-ANTENNA-PATTERN][TX-ANTENNA-PATTERN][RX-STBC-1][SOUNDING-DIMENSION-4][BF-ANTENNA-4][VHT160][MAX-MPDU-11454][MAX-A-MPDU-LEN-EXP7]";
     } // hapdConfig;
   };
+  # Unfortunately, this router's networking hardware is highly prone to breakage
+  # Many people have reported their routers' TCP offloading being faulty, with an error
+  # like this being thrown at random (it can be shortly after boot, or in a few days):
+  # NETDEV WATCHDOG: eth0 (mtk_soc_eth): transmit queue 3 timed out 5388 ms
+  # My hardware broke after a few months of use as well, so here's a potential fix
+  router.interfaces.eth0.extraInitCommands = ''
+    ${pkgs.ethtool}/bin/ethtool --offload eth0 tso off
+  '';
   # ethernet lan0-3
   router.interfaces.lan0 = {
     bridge = "br0";

system/hosts/router/metrics.nix

@@ -31,6 +31,18 @@ in {
       ];
       listenAddress = netAddresses.lan4;
     };
+    ping = {
+      enable = true;
+      listenAddress = netAddresses.lan4;
+      port = 9380;
+      config = {
+        type = "raw";
+        targets = [
+          "8.8.8.8"
+          { target = "8.8.8.8"; netns = "wan"; }
+        ];
+      };
+    };
   };
   router.interfaces.br0 = let
     # all of this just to avoid logging commands...

system/hosts/server/certspotter.nix

@@ -33,7 +33,7 @@ in {
   services.certspotter = {
     enable = true;
     extraFlags = [ ];
-    watchlist = [ ".pavluk.org" ];
+    watchlist = [ ".${cfg.domainName}" ];
     hooks = lib.toList (pkgs.writeShellScript "certspotter-hook" ''
       if [[ "$EVENT" == discovered_cert ]]; then
         ${pkgs.gnugrep}/bin/grep -r "$TBS_SHA256" /var/lib/certspotter/tbs-hashes/ && exit

system/hosts/server/default.nix

@@ -84,7 +84,7 @@ in {
   networking.hosts."::1" = hostedDomains;
 
   services.postgresql.enable = true;
-  services.postgresql.package = pkgs.postgresql_13;
+  services.postgresql.package = pkgs.postgresql_16;
 
   # SSH
   services.openssh.enable = true;
@@ -134,13 +134,12 @@ in {
       })}'')}
     real_ip_header CF-Connecting-IP;
   '';
-  # brotli and zstd requires recompilation so I don't enable it
-  # services.nginx.recommendedBrotliSettings = true;
-  # services.nginx.recommendedZstdSettings = true;
+  services.nginx.recommendedBrotliSettings = true;
   services.nginx.recommendedGzipSettings = true;
   services.nginx.recommendedOptimisation = true;
   services.nginx.recommendedProxySettings = true;
   services.nginx.recommendedTlsSettings = true;
+  services.nginx.recommendedZstdSettings = true;
 
   # BLOG
   services.nginx.virtualHosts.${cfg.domainName} = {

system/hosts/server/files.nix

@@ -11,6 +11,13 @@ in {
     enableACME = true;
     forceSSL = true;
     locations."/".proxyPass = "http://${lib.quoteListenAddr settings.server.HTTP_ADDR}:${toString settings.server.HTTP_PORT}";
+    locations."= /robots.txt".extraConfig = ''
+      return 200 ${builtins.toJSON ''
+        User-agent: *
+        Disallow: /mirrors/nixpkgs
+        Disallow: /chayleaf/nixpkgs
+      ''};
+    '';
   };
   services.forgejo = {
     enable = true;
@@ -79,4 +86,28 @@ in {
     hostName = "cloud.${cfg.domainName}";
     https = true;
   };
+
+  services.qbittorrent-nox.enable = true;
+  services.qbittorrent-nox.ui.port = 19642;
+  services.qbittorrent-nox.torrent.port = 45522;
+
+  services.jellyfin.enable = true;
+
+  services.nginx.virtualHosts."home.${cfg.domainName}".locations = {
+    "/torrent/" = {
+      extraConfig = ''
+        proxy_pass         http://127.0.0.1:${toString config.services.qbittorrent-nox.ui.port}/;
+        proxy_http_version 1.1;
+
+        proxy_set_header   Host               127.0.0.1:30000;
+        proxy_set_header   X-Forwarded-Host   $http_host;
+        proxy_set_header   X-Forwarded-For    $remote_addr;
+        proxy_cookie_path  /                  "/; Secure";
+      '';
+    };
+    "/jelly/" = {
+      proxyPass = "http://127.0.0.1:8096";
+      proxyWebsockets = true;
+    };
+  };
 }

system/hosts/server/home.nix

@@ -1,6 +1,7 @@
 { config
 , lib
 , pkgs
+, inputs
 , ... }:
 
 let
@@ -16,6 +17,8 @@ let
     withQt5 = false;
   };
 in {
+  imports = [ inputs.coop-ofd.nixosModules.default ];
+
   # a bunch of services for personal use not intended for the public
   # TODO: keycloakify this
   services.grafana = {
@@ -42,6 +45,11 @@ in {
   # services.keycloak.plugins = [ pkgs.keycloak.plugins.keycloak-metrics-spi ];
   services.keycloak.settings.metrics-enabled = true;
 
+  services.coop-ofd = {
+    enable = true;
+    config.listener = "127.0.0.1:25783";
+  };
+
   services.nginx.virtualHosts."home.${cfg.domainName}" = {
     quic = true;
     enableACME = true;
@@ -65,6 +73,9 @@ in {
       proxyPass = "http://127.0.0.1:631/";
       proxyWebsockets = true;
     };
+    locations."/money/" = {
+      proxyPass = "http://${config.services.coop-ofd.config.listener}/";
+    };
   };
   services.nginx.virtualHosts."hydra.${cfg.domainName}" = {
     quic = true;
@@ -95,10 +106,7 @@ in {
   nix.settings.allowed-users = [ "nix-serve" "harmonia" ] ++ lib.optionals config.services.hydra.enable [ "hydra" "hydra-www" ];
   # make sure only hydra has access to this file
   # so normal nix evals don't have access to builtins
-  nix.settings.extra-builtins-file = "/etc/nixos/extra-builtins.nix";
-  impermanence.directories = lib.mkIf config.services.hydra.enable [
-    { directory = /etc/nixos; user = "hydra"; group = "hydra"; mode = "0700"; }
-  ];
+  nix.settings.extra-builtins-file = "/secrets/nixos/extra-builtins.nix";
   nix.settings.allowed-uris = [
     # required for home-manager
     "https://git.sr.ht/~rycee/nmd/"
@@ -307,6 +315,7 @@ in {
             "retracker.local:9101"
             "retracker.local:9256"
             "retracker.local:9167"
+            "retracker.local:9380"
           ];
           labels.machine = "router";
         } ];

system/hosts/server/mailserver.nix

@@ -1,10 +1,13 @@
 { config
 , pkgs
+, inputs
 , ... }:
 
 let
   cfg = config.server;
 in {
+  imports = [ inputs.nixos-mailserver.nixosModules.default ];
+
   impermanence.directories = [
     { directory = config.mailserver.dkimKeyDirectory; user = "opendkim"; group = "opendkim"; mode = "0755"; }
     { directory = config.mailserver.mailDirectory; user = "virtualMail"; group = "virtualMail"; mode = "0700"; }

system/hosts/server/matrix.nix

@@ -8,17 +8,17 @@ let
     "m.server" = "matrix.${cfg.domainName}:443";
   };
   matrixClientJson = {
-    "m.homeserver" = { base_url = "https://matrix.${cfg.domainName}"; };
-    "m.identity_server" = { base_url = "https://vector.im"; };
+    "m.homeserver".base_url = "https://matrix.${cfg.domainName}";
+    "m.identity_server".base_url = "https://vector.im";
   };
   matrixServerConfigResponse = ''
     add_header Content-Type application/json;
-    return 200 '${builtins.toJSON matrixServerJson}';
+    return 200 ${builtins.toJSON (builtins.toJSON matrixServerJson)};
   '';
   matrixClientConfigResponse = ''
     add_header Content-Type application/json;
     add_header Access-Control-Allow-Origin *;
-    return 200 '${builtins.toJSON matrixClientJson}';
+    return 200 ${builtins.toJSON (builtins.toJSON matrixClientJson)};
   '';
   matrixAddr = "::1";
   matrixPort = 8008;

system/hosts/server/maubot.nix

@@ -1,52 +1,22 @@
 { config
 , lib
 , pkgs
+, inputs
 , ... }:
 
 let
   cfg = config.server;
-  # i've yet to create a maubot module so this is hardcoded
-  maubotAddr = "127.0.0.1";
-  maubotPort = 29316;
 in {
-  impermanence.directories = [
-    { directory = /var/lib/maubot; user = "maubot"; group = "maubot"; mode = "0755"; }
-  ];
-  services.nginx.virtualHosts."matrix.${cfg.domainName}".locations = {
+  imports = [ inputs.maubot.nixosModules.default ];
+
+  services.nginx.virtualHosts."matrix.${cfg.domainName}".locations = let
+    inherit (config.services.maubot) settings;
+  in {
     "/_matrix/maubot/" = {
-      proxyPass = "http://${lib.quoteListenAddr maubotAddr}:${toString maubotPort}";
+      proxyPass = "http://${lib.quoteListenAddr settings.server.hostname}:${toString settings.server.port}";
       proxyWebsockets = true;
     };
   };
-  /*users.users.maubot = {
-    home = "/var/lib/maubot";
-    group = "maubot";
-    isSystemUser = true;
-  };
-  users.groups.maubot = { };*/
-  /*systemd.services.maubot = {
-    description = "Maubot";
-    wants = [ "matrix-synapse.service" "nginx.service" ];
-    after = [ "matrix-synapse.service" "nginx.service" ];
-    wantedBy = [ "multi-user.target" ];
-    environment = {
-      LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib";
-    };
-    serviceConfig = {
-      User = "maubot";
-      Group = "maubot";
-      WorkingDirectory = "/var/lib/maubot/data";
-    };
-    script = "${pkgs.python3.withPackages (pks: with pks; [
-      pkgs.maubot (pkgs.pineapplebot.override {
-        magic = cfg.pizzabotMagic;
-      }) feedparser levenshtein python-dateutil pytz
-    ])}/bin/python3 -m maubot";
-  };*/
-  systemd.services.maubot = {
-    after = [ "nginx.service" ];
-    requires = [ "nginx.service" ];
-  };
   services.maubot.enable = true;
   services.maubot.settings = {
     database = "postgresql://maubot@localhost/maubot";

system/modules/common.nix

@@ -1,11 +1,13 @@
 { lib
 , pkgs
 , config
+, inputs
 , ... }:
 
 let
   # force some defaults even if they were set with mkDefault already...
   mkForceDefault = lib.mkOverride 999;
+  cfg = config.common;
 in {
   options.common = with lib; mkOption {
     type = types.submodule {
@@ -34,9 +36,8 @@ in {
     };
     default = { };
   };
-  config = let
-    cfg = config.common;
-  in {
+  config = lib.mkMerge [
+  {
     nix = {
       # nix.channel.enable is needed for NIX_PATH to work for some reason
       # channel.enable = false;
@@ -58,15 +59,35 @@ in {
         options = "--delete-older-than 30d";
       };
       package = pkgs.nixForNixPlugins;
+      extraOptions = ''
+        plugin-files = ${pkgs.nix-plugins.override { nix = config.nix.package; }}/lib/nix/plugins/libnix-extra-builtins.so
+      '';
     };
     systemd.services.nix-daemon.serviceConfig.LimitSTACKSoft = "infinity";
     nix.daemonCPUSchedPolicy = lib.mkDefault "idle";
     nix.daemonIOSchedClass = lib.mkDefault "idle";
+
+    # registry is used for the new flaky nix command
+    nix.registry =
+      builtins.mapAttrs
+      (_: v: { flake = v; })
+      (lib.filterAttrs (_: v: v?outputs) inputs);
+
+    # add import'able flake inputs (like nixpkgs) to nix path
+    # nix path is used for old nix commands (like nix-build, nix-shell)
+    environment.etc = lib.mapAttrs'
+      (name: value: {
+        name = "nix/inputs/${name}";
+        value.source = value.outPath or "${value}";
+      })
+      (lib.filterAttrs (_: v: builtins.pathExists "${v}/default.nix") inputs);
+    nix.nixPath = [ "/etc/nix/inputs" ];
+
     boot.kernelParams = lib.optionals (cfg.resolution != null) [
       "consoleblank=60"
-    ] ++ (lib.optionals (cfg.resolution == "1920x1080") [
+    ] ++ lib.optionals (cfg.resolution == "1920x1080") [
       "fbcon=font:TER16x32"
-    ]);
+    ];
     console.font =
       lib.mkIf (cfg.resolution == "1920x1080" || cfg.resolution == "1366x768") {
         "1920x1080" = "${pkgs.terminus_font}/share/consolefonts/ter-v32n.psf.gz";
@@ -81,9 +102,11 @@ in {
 
     hardware.enableRedistributableFirmware = true;
     services.openssh.settings.PasswordAuthentication = false;
+
     services.tlp.settings.USB_EXCLUDE_PHONE = 1;
     services.tlp.settings.START_CHARGE_THRESH_BAT0 = 75;
     services.tlp.settings.STOP_CHARGE_THRESH_BAT0 = 80;
+
     i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
     i18n.supportedLocales = lib.mkDefault [
       "C.UTF-8/UTF-8"
@@ -92,50 +115,18 @@ in {
     ];
     # ISO-8601
     i18n.extraLocaleSettings.LC_TIME = "en_DK.UTF-8";
-    environment.systemPackages = with pkgs; ([
+    environment.systemPackages = with pkgs; [
       bottom
-      wget
       git
+      rsync
       tmux
-    ] ++ lib.optionals cfg.minimal [
+      wget
+
       kitty.terminfo
+      foot.terminfo
       # rxvt-unicode-unwrapped.terminfo
-    ]);
-    programs.fish.interactiveShellInit = lib.mkIf cfg.minimal ''
-      set -gx SHELL ${pkgs.zsh}/bin/zsh
-      set -g fish_color_autosuggestion 777 brblack
-      set -g fish_color_command green
-      set -g fish_color_operator white
-      set -g fish_color_param white
-      set -g fish_key_bindings fish_vi_key_bindings
-      set -g fish_cursor_insert line
-      set -g fish_cursor_replace underscore
-    '';
-    programs.vim = lib.mkIf cfg.minimal {
-      defaultEditor = lib.mkDefault true;
-      package = pkgs.vim-full.customize {
-        vimrcConfig.customRC = ''
-          syntax on
-          au FileType markdown set colorcolumn=73 textwidth=72
-          au FileType gitcommit set colorcolumn=73
-          au BufReadPre * set foldmethod=syntax
-          au BufReadPost * folddoc foldopen!
-          autocmd BufReadPost * if @% !~# '\.git[\/\\]COMMIT_EDITMSG$' && line("'\"") > 1 && line("'\"") <= line("$") | exe "normal! g`\"" | endif
-        '';
-        vimrcConfig.packages.myVimPackage = with pkgs.vimPlugins; {
-          start = [ vim-sleuth ];
-        };
-      };
-    };
-    # this is supposed to default to false, but it doesn't because of nixos fish module
-    documentation.man.generateCaches = lib.mkIf cfg.minimal (mkForceDefault false);
-    # we don't need stuff like html files (NixOS manual and so on) on minimal machines
-    documentation.doc.enable = lib.mkIf cfg.minimal (lib.mkDefault false);
+    ];
     programs.fish.enable = true;
-    # conflicts with bash module's mkDefault
-    # only override on minimal systems because on non-minimal systems
-    # because my fish config doesn't work well in fb/drm console
-    users.defaultUserShell = lib.mkIf cfg.minimal (mkForceDefault pkgs.fish);
     users.users.${cfg.mainUsername} = {
       uid = 1000;
       isNormalUser = true;
@@ -143,17 +134,6 @@ in {
     };
     # nixos-hardware uses mkDefault here, so we use slightly higher priority
     services.xserver.libinput.enable = mkForceDefault (!cfg.minimal);
-    /*
-    services.xserver = {
-      enable = true;
-      libinput.enable = true;
-      desktopManager.xterm.enable = false;
-      # I couldn't get lightdm to start sway, so let's just do this
-      displayManager.startx.enable = true;
-      windowManager.i3.enable = true;
-    };
-    */
-    # pipewire:
     programs.fuse.userAllowOther = true;
     # autologin once after boot
     # --skip-login means directly call login instead of first asking for username
@@ -169,5 +149,60 @@ in {
         exec ${shadow}/bin/login -f user
       fi
     '');
-  };
+  }
+
+  (lib.mkIf cfg.minimal {
+    programs.fish.interactiveShellInit = ''
+      set -gx SHELL ${pkgs.zsh}/bin/zsh
+      set -g fish_color_autosuggestion 777 brblack
+      set -g fish_color_command green
+      set -g fish_color_operator white
+      set -g fish_color_param white
+      set -g fish_key_bindings fish_vi_key_bindings
+      set -g fish_cursor_insert line
+      set -g fish_cursor_replace underscore
+    '';
+    # this is supposed to default to false, but it doesn't because of nixos fish module
+    documentation.man.generateCaches = mkForceDefault false;
+    # we don't need stuff like html files (NixOS manual and so on) on minimal machines
+    documentation.doc.enable = lib.mkDefault false;
+    # conflicts with bash module's mkDefault
+    # only override on minimal systems because on non-minimal systems
+    # my fish config doesn't work well in fb/drm console
+    users.defaultUserShell = lib.mkIf cfg.minimal (mkForceDefault pkgs.fish);
+
+    programs.vim = {
+      defaultEditor = lib.mkDefault true;
+      package = pkgs.vim-full.customize {
+        vimrcConfig.customRC = ''
+          syntax on
+          au FileType markdown set colorcolumn=73 textwidth=72
+          au FileType gitcommit set colorcolumn=73
+          au BufReadPre * set foldmethod=syntax
+          au BufReadPost * folddoc foldopen!
+          autocmd BufReadPost * if @% !~# '\.git[\/\\]COMMIT_EDITMSG$' && line("'\"") > 1 && line("'\"") <= line("$") | exe "normal! g`\"" | endif
+        '';
+        vimrcConfig.packages.myVimPackage = with pkgs.vimPlugins; {
+          start = [ vim-sleuth ];
+        };
+      };
+    };
+  })
+
+  (lib.mkIf (!cfg.minimal) {
+    hardware.pulseaudio.enable = false;
+    services.pipewire = {
+      enable = lib.mkDefault true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+      jack.enable = true;
+    };
+    security.polkit.enable = true;
+    security.rtkit.enable = true;
+    services.dbus.enable = true;
+    programs.dconf.enable = true;
+  })
+
+  ];
 }

system/modules/impermanence.nix

@@ -61,78 +61,94 @@ in {
         { directory = /var/spool; user = "root"; group = "root"; mode = "0777"; }
       ] ++ lib.optionals cfg.persistTmp [
         { directory = /tmp; user = "root"; group = "root"; mode = "1777"; }
+      ] ++ lib.optionals config.networking.wireless.iwd.enable [
+        { directory = /var/lib/iwd; user = "root"; group = "root"; mode = "0700"; }
+      ] ++ lib.optionals (builtins.any (x: x.useDHCP != false) (builtins.attrValues config.networking.interfaces) || config.networking.useDHCP) [
+        { directory = /var/db/dhcpcd; user = "root"; group = "root"; mode = "0755"; }
+      ] ++ lib.optionals config.security.acme.acceptTerms [
+        { directory = /var/lib/acme; user = "acme"; group = "acme"; mode = "0755"; }
+      ] ++ lib.optionals config.services.akkoma.enable [
+        { directory = /var/lib/akkoma; user = "akkoma"; group = "akkoma"; mode = "0700"; }
+      ] ++ lib.optionals config.services.botamusique.enable [
+        { directory = /var/lib/private/botamusique; user = "root"; group = "root"; mode = "0750"; }
+      ] ++ lib.optionals config.programs.ccache.enable [
+        { directory = config.programs.ccache.cacheDir; user = "root"; group = "nixbld"; mode = "0770"; }
+        { directory = /var/cache/sccache; user = "root"; group = "nixbld"; mode = "0770"; }
+      ] ++ lib.optionals config.services.certspotter.enable [
+        { directory = /var/lib/certspotter; user = "certspotter"; group = "certspotter"; mode = "0755"; }
+      ] ++ lib.optionals (config.services.coop-ofd.enable or false) [
+        { directory = /var/lib/private/coop-ofd; mode = "0750"; }
+      ] ++ lib.optionals config.services.dovecot2.enable [
+        { directory = /var/lib/dhparams; user = "root"; group = "root"; mode = "0755"; }
+        { directory = /var/lib/dovecot; user = "root"; group = "root"; mode = "0755"; }
+      ] ++ lib.optionals config.services.fail2ban.enable [
+        { directory = /var/lib/fail2ban; user = "root"; group = "root"; mode = "0700"; }
+      ] ++ lib.optionals config.services.forgejo.enable [
+        { directory = /var/lib/forgejo; user = "forgejo"; group = "forgejo"; mode = "0755"; }
+      ] ++ lib.optionals config.services.gitea.enable [
+        { directory = /var/lib/gitea; user = "gitea"; group = "gitea"; mode = "0755"; }
+      ] ++ lib.optionals config.services.grafana.enable [
+        { directory = /var/lib/grafana; user = "grafana"; group = "grafana"; mode = "0755"; }
+      ] ++ lib.optionals config.services.heisenbridge.enable [
+        { directory = /var/lib/heisenbridge; user = "heisenbridge"; group = "heisenbridge"; mode = "0755"; }
+      ] ++ lib.optionals config.services.hydra.enable [
+        { directory = /var/lib/hydra; user = "hydra"; group = "hydra"; mode = "0755"; }
+      ] ++ lib.optionals config.services.jellyfin.enable [
+        { directory = /var/lib/jellyfin; user = "jellyfin"; group = "jellyfin"; mode = "0750"; }
+      ] ++ lib.optionals config.services.matrix-synapse.enable [
+        { directory = /var/lib/matrix-synapse; user = "matrix-synapse"; group = "matrix-synapse"; mode = "0700"; }
+      ] ++ lib.optionals (config.services.maubot.enable or false) [
+        { directory = /var/lib/maubot; user = "maubot"; group = "maubot"; mode = "0750"; }
+      ] ++ lib.optionals config.services.monero.enable [
+        { directory = config.services.monero.dataDir; user = "monero"; group = "monero"; mode = "0750"; }
       ] ++ lib.optionals config.services.mullvad-vpn.enable [
         { directory = /etc/mullvad-vpn; user = "root"; group = "root"; mode = "0700"; }
         { directory = /var/cache/mullvad-vpn; user = "root"; group = "root"; mode = "0755"; }
+      ] ++ lib.optionals config.services.murmur.enable [
+        { directory = /var/lib/murmur; user = "murmur"; group = "murmur"; mode = "0700"; }
+      ] ++ lib.optionals config.services.nextcloud.enable [
+        { directory = /var/lib/nextcloud; user = "nextcloud"; group = "nextcloud"; mode = "0750"; }
+      ] ++ lib.optionals config.networking.networkmanager.enable [
+        { directory = /etc/NetworkManager/system-connections; mode = "0700"; }
+        { directory = /var/lib/NetworkManager; mode = "0755"; }
+        { directory = /var/lib/NetworkManager-fortisslvpn; mode = "0700"; }
+      ] ++ lib.optionals config.services.opendkim.enable [
+        { directory = /var/lib/opendkim; user = "opendkim"; group = "opendkim"; mode = "0700"; }
+      ] ++ lib.optionals config.services.openldap.enable [
+        { directory = /var/lib/openldap; inherit (config.services.openldap) user group; mode = "0755"; }
+      ] ++ lib.optionals config.services.pleroma.enable [
+        { directory = /var/lib/pleroma; user = "pleroma"; group = "pleroma"; mode = "0700"; }
+      ] ++ lib.optionals config.services.postfix.enable [
+        { directory = /var/lib/postfix; user = "root"; group = "root"; mode = "0755"; }
+      ] ++ lib.optionals config.services.postgresql.enable [
+        { directory = /var/lib/postgresql; user = "postgres"; group = "postgres"; mode = "0755"; }
+      ] ++ lib.optionals config.services.printing.enable [
+        { directory = /var/lib/cups; user = "root"; group = "root"; mode = "0755"; }
+        { directory = /var/cache/cups; user = "root"; group = "lp"; mode = "0770"; }
+      ] ++ lib.optionals config.services.prometheus.enable [
+        { directory = /var/lib/${config.services.prometheus.stateDir}; user = "prometheus"; group = "prometheus"; mode = "0755"; }
+      ] ++ lib.optionals (config.services.qbittorrent-nox.enable or false) [
+        { directory = /var/lib/qbittorrent-nox; mode = "0755"; }
+      ] ++ lib.optionals (config.services.redis.servers.rspamd.enable or false) [
+        { directory = /var/lib/redis-rspamd; user = "redis-rspamd"; group = "redis-rspamd"; mode = "0700"; }
+      ] ++ lib.optionals config.services.roundcube.enable [
+        { directory = /var/lib/roundcube; user = "roundcube"; group = "roundcube"; mode = "0700"; }
+      ] ++ lib.optionals config.services.rspamd.enable [
+        { directory = /var/lib/rspamd; user = "rspamd"; group = "rspamd"; mode = "0700"; }
+      ] ++ lib.optionals (config.services.scanservjs.enable or false) [
+        { directory = /var/lib/scanservjs; user = "scanservjs"; group = "scanservjs"; mode = "0750"; }
+      ] ++ lib.optionals config.services.searx.enable [
+        { directory = /var/lib/searx; user = "searx"; group = "searx"; mode = "0700"; }
+      ] ++ lib.optionals config.security.sudo.enable [
+        { directory = /var/db/sudo/lectured; user = "root"; group = "root"; mode = "0700"; }
+      ] ++ lib.optionals config.services.unbound.enable [
+        { directory = /var/lib/unbound; user = "unbound"; group = "unbound"; mode = "0755"; }
       ] ++ lib.optionals config.virtualisation.libvirtd.enable ([
         # { directory = /var/cache/libvirt; user = "root"; group = "root"; mode = "0755"; }
         { directory = /var/lib/libvirt; user = "root"; group = "root"; mode = "0755"; }
       ] ++ lib.optionals config.virtualisation.libvirtd.qemu.swtpm.enable [
         { directory = /var/lib/swtpm-localca; user = "root"; group = "root"; mode = "0750"; }
-      ]) ++ lib.optionals config.networking.wireless.iwd.enable [
-        { directory = /var/lib/iwd; user = "root"; group = "root"; mode = "0700"; }
-      ] ++ lib.optionals (builtins.any (x: x.useDHCP != false) (builtins.attrValues config.networking.interfaces) || config.networking.useDHCP) [
-        { directory = /var/db/dhcpcd; user = "root"; group = "root"; mode = "0755"; }
-      ] ++ lib.optionals config.services.gitea.enable [
-        { directory = /var/lib/gitea; user = "gitea"; group = "gitea"; mode = "0755"; }
-      ] ++ lib.optionals config.services.forgejo.enable [
-        { directory = /var/lib/forgejo; user = "forgejo"; group = "forgejo"; mode = "0755"; }
-      ] ++ lib.optionals config.services.matrix-synapse.enable [
-        { directory = /var/lib/matrix-synapse; user = "matrix-synapse"; group = "matrix-synapse"; mode = "0700"; }
-      ] ++ lib.optionals config.services.heisenbridge.enable [
-        { directory = /var/lib/heisenbridge; user = "heisenbridge"; group = "heisenbridge"; mode = "0755"; }
-      ] ++ lib.optionals config.services.murmur.enable [
-        { directory = /var/lib/murmur; user = "murmur"; group = "murmur"; mode = "0700"; }
-      ] ++ lib.optionals config.services.nextcloud.enable [
-        { directory = /var/lib/nextcloud; user = "nextcloud"; group = "nextcloud"; mode = "0750"; }
-      ] ++ lib.optionals config.services.botamusique.enable [
-        { directory = /var/lib/private/botamusique; user = "root"; group = "root"; mode = "0750"; }
-      ] ++ lib.optionals config.security.acme.acceptTerms [
-        { directory = /var/lib/acme; user = "acme"; group = "acme"; mode = "0755"; }
-      ] ++ lib.optionals config.services.printing.enable [
-        { directory = /var/lib/cups; user = "root"; group = "root"; mode = "0755"; }
-        { directory = /var/cache/cups; user = "root"; group = "lp"; mode = "0770"; }
-      ] ++ lib.optionals config.services.fail2ban.enable [
-        { directory = /var/lib/fail2ban; user = "root"; group = "root"; mode = "0700"; }
-      ] ++ lib.optionals config.services.opendkim.enable [
-        { directory = /var/lib/opendkim; user = "opendkim"; group = "opendkim"; mode = "0700"; }
-      ] ++ lib.optionals config.services.pleroma.enable [
-        { directory = /var/lib/pleroma; user = "pleroma"; group = "pleroma"; mode = "0700"; }
-      ] ++ lib.optionals config.services.akkoma.enable [
-        { directory = /var/lib/akkoma; user = "akkoma"; group = "akkoma"; mode = "0700"; }
-      ] ++ lib.optionals config.services.hydra.enable [
-        { directory = /var/lib/hydra; user = "hydra"; group = "hydra"; mode = "0755"; }
-      ] ++ lib.optionals config.services.grafana.enable [
-        { directory = /var/lib/grafana; user = "grafana"; group = "grafana"; mode = "0755"; }
-      ] ++ lib.optionals config.services.prometheus.enable [
-        { directory = /var/lib/${config.services.prometheus.stateDir}; user = "prometheus"; group = "prometheus"; mode = "0755"; }
-      ] ++ lib.optionals config.services.postfix.enable [
-        { directory = /var/lib/postfix; user = "root"; group = "root"; mode = "0755"; }
-      ] ++ lib.optionals config.services.postgresql.enable [
-        { directory = /var/lib/postgresql; user = "postgres"; group = "postgres"; mode = "0755"; }
-      ] ++ lib.optionals config.services.unbound.enable [
-        { directory = /var/lib/unbound; user = "unbound"; group = "unbound"; mode = "0755"; }
-      ] ++ lib.optionals config.services.searx.enable [
-        { directory = /var/lib/searx; user = "searx"; group = "searx"; mode = "0700"; }
-      ] ++ lib.optionals config.services.roundcube.enable [
-        { directory = /var/lib/roundcube; user = "roundcube"; group = "roundcube"; mode = "0700"; }
-      ] ++ lib.optionals config.services.rspamd.enable [
-        { directory = /var/lib/rspamd; user = "rspamd"; group = "rspamd"; mode = "0700"; }
-      ] ++ lib.optionals (config.services.redis.servers.rspamd.enable or false) [
-        { directory = /var/lib/redis-rspamd; user = "redis-rspamd"; group = "redis-rspamd"; mode = "0700"; }
-      ] ++ lib.optionals config.services.dovecot2.enable [
-        { directory = /var/lib/dhparams; user = "root"; group = "root"; mode = "0755"; }
-        { directory = /var/lib/dovecot; user = "root"; group = "root"; mode = "0755"; }
-      ] ++ lib.optionals config.security.sudo.enable [
-        { directory = /var/db/sudo/lectured; user = "root"; group = "root"; mode = "0700"; }
-      ] ++ lib.optionals config.services.openldap.enable [
-        { directory = /var/lib/openldap; inherit (config.services.openldap) user group; mode = "0755"; }
-      ] ++ lib.optionals (config.services.scanservjs.enable or false) [
-        { directory = /var/lib/scanservjs; user = "scanservjs"; group = "scanservjs"; mode = "0750"; }
-      ] ++ lib.optionals config.programs.ccache.enable [
-        { directory = config.programs.ccache.cacheDir; user = "root"; group = "nixbld"; mode = "0770"; }
-        { directory = /var/cache/sccache; user = "root"; group = "nixbld"; mode = "0770"; }
-      ] ++ cfg.directories);
+      ]) ++ cfg.directories);
       files = map (x:
         if builtins.isPath x then toString x
         else if builtins.isPath (x.file or null) then x // { file = toString x.file; }

system/modules/modemmanager.nix

@@ -0,0 +1,41 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.networking.modemmanager;
+  packages = [ pkgs.modemmanager ];
+in
+{
+  options.networking.modemmanager = {
+    enable = lib.mkEnableOption "ModemManager";
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !config.networking.networkmanager.enable;
+        message = "If you use NetworkManager, this module is redundant";
+      }
+    ];
+
+    environment.etc = builtins.listToAttrs
+      (map ({ id, path }: { name = "ModemManager/fcc-unlock.d/${id}"; value.source = path; })
+        config.networking.networkmanager.fccUnlockScripts);
+
+    users.groups.networkmanager.gid = config.ids.gids.networkmanager;
+
+    systemd.services.ModemManager.aliases = [ "dbus-org.freedesktop.ModemManager1.service" ];
+
+    security.polkit.enable = true;
+    security.polkit.extraConfig = ''
+      polkit.addRule(function(action, subject) {
+        if (subject.isInGroup("networkmanager") && (action.id.indexOf("org.freedesktop.ModemManager") == 0)) {
+          return polkit.Result.YES;
+        }
+      });
+    '';
+
+    environment.systemPackages = packages;
+    systemd.packages = packages;
+    services.udev.packages = packages;
+  };
+}

system/modules/ping-exporter.nix

@@ -0,0 +1,151 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+
+let
+  cfg = config.services.prometheus.exporters.ping;
+  inherit (lib) concatStrings literalExpression mkMerge mkDefault mkEnableOption mkIf mkOption types;
+  # copied from nixpkgs/nixos/modules/services/monitoring/prometheus/exporters
+  mkExporterOpts = { name, port }: {
+    enable = mkEnableOption (lib.mdDoc "the prometheus ${name} exporter");
+    port = mkOption {
+      type = types.port;
+      default = port;
+      description = lib.mdDoc ''
+        Port to listen on.
+      '';
+    };
+    listenAddress = mkOption {
+      type = types.str;
+      default = "0.0.0.0";
+      description = lib.mdDoc ''
+        Address to listen on.
+      '';
+    };
+    extraFlags = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      description = lib.mdDoc ''
+        Extra commandline options to pass to the ${name} exporter.
+      '';
+    };
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Open port in firewall for incoming connections.
+      '';
+    };
+    firewallFilter = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = literalExpression ''
+        "-i eth0 -p tcp -m tcp --dport ${toString port}"
+      '';
+      description = lib.mdDoc ''
+        Specify a filter for iptables to use when
+        {option}`services.prometheus.exporters.${name}.openFirewall`
+        is true. It is used as `ip46tables -I nixos-fw firewallFilter -j nixos-fw-accept`.
+      '';
+    };
+    user = mkOption {
+      type = types.str;
+      default = "${name}-exporter";
+      description = lib.mdDoc ''
+        User name under which the ${name} exporter shall be run.
+      '';
+    };
+    group = mkOption {
+      type = types.str;
+      default = "${name}-exporter";
+      description = lib.mdDoc ''
+        Group under which the ${name} exporter shall be run.
+      '';
+    };
+  };
+  mkExporterConf = { name, conf, serviceOpts }:
+    let
+      enableDynamicUser = serviceOpts.serviceConfig.DynamicUser or true;
+    in
+    mkIf conf.enable {
+      warnings = conf.warnings or [];
+      users.users."${name}-exporter" = (mkIf (conf.user == "${name}-exporter" && !enableDynamicUser) {
+        description = "Prometheus ${name} exporter service user";
+        isSystemUser = true;
+        inherit (conf) group;
+      });
+      users.groups = (mkIf (conf.group == "${name}-exporter" && !enableDynamicUser) {
+        "${name}-exporter" = {};
+      });
+      networking.firewall.extraCommands = mkIf conf.openFirewall (concatStrings [
+        "ip46tables -A nixos-fw ${conf.firewallFilter} "
+        "-m comment --comment ${name}-exporter -j nixos-fw-accept"
+      ]);
+      systemd.services."prometheus-${name}-exporter" = mkMerge ([{
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig.Restart = mkDefault "always";
+        serviceConfig.PrivateTmp = mkDefault true;
+        serviceConfig.WorkingDirectory = mkDefault /tmp;
+        serviceConfig.DynamicUser = mkDefault enableDynamicUser;
+        serviceConfig.User = mkDefault conf.user;
+        serviceConfig.Group = conf.group;
+        # Hardening
+        serviceConfig.CapabilityBoundingSet = mkDefault [ "" ];
+        serviceConfig.DeviceAllow = [ "" ];
+        serviceConfig.LockPersonality = true;
+        serviceConfig.MemoryDenyWriteExecute = true;
+        serviceConfig.NoNewPrivileges = true;
+        serviceConfig.PrivateDevices = mkDefault true;
+        serviceConfig.ProtectClock = mkDefault true;
+        serviceConfig.ProtectControlGroups = true;
+        serviceConfig.ProtectHome = true;
+        serviceConfig.ProtectHostname = true;
+        serviceConfig.ProtectKernelLogs = true;
+        serviceConfig.ProtectKernelModules = true;
+        serviceConfig.ProtectKernelTunables = true;
+        serviceConfig.ProtectSystem = mkDefault "strict";
+        serviceConfig.RemoveIPC = true;
+        serviceConfig.RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        serviceConfig.RestrictNamespaces = true;
+        serviceConfig.RestrictRealtime = true;
+        serviceConfig.RestrictSUIDSGID = true;
+        serviceConfig.SystemCallArchitectures = "native";
+        serviceConfig.UMask = "0077";
+      } serviceOpts ]);
+  };
+  format = pkgs.formats.toml { };
+in {
+  options.services.prometheus.exporters.ping = mkExporterOpts { name = "ping"; port = 9390; } // {
+    config = mkOption {
+      type = format.type;
+      default = { };
+      description = "Exporter config";
+    };
+  };
+  config = mkExporterConf {
+    name = "ping";
+    conf = cfg;
+    serviceOpts = {
+      serviceConfig = rec {
+        # netns switching
+        AmbientCapabilities = [
+          # set network namespace
+          "CAP_SYS_ADMIN"
+          # open icmp socket
+          "CAP_NET_RAW"
+        ];
+        CapabilityBoundingSet = AmbientCapabilities;
+        RestrictNamespaces = lib.mkForce false;
+        ExecStart = ''
+          ${pkgs.ping-exporter}/bin/ping-exporter \
+            --listen ${cfg.listenAddress}:${toString cfg.port} \
+            --config ${format.generate "ping-exporter-config.toml" cfg.config} \
+            ${lib.escapeShellArgs cfg.extraFlags}
+        '';
+      };
+    };
+  };
+}

system/modules/qbittorrent.nix

@@ -0,0 +1,77 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+
+let
+  cfg = config.services.qbittorrent-nox;
+in {
+  options.services.qbittorrent-nox = {
+    enable = lib.mkEnableOption "qbittorrent-nox";
+
+    package = lib.mkPackageOptionMD pkgs "qbittorrent-nox" { };
+
+    ui.addToFirewall = lib.mkOption {
+      description = "Add the web UI port to firewall";
+      type = lib.types.bool;
+      default = false;
+    };
+    ui.port = lib.mkOption {
+      description = "Web UI port";
+      type = lib.types.port;
+      default = 8080;
+    };
+
+    torrent.addToFirewall = lib.mkOption {
+      description = "Add the torrenting port to firewall";
+      type = lib.types.bool;
+      default = true;
+    };
+    torrent.port = lib.mkOption {
+      description = "Torrenting port";
+      type = with lib.types; nullOr port;
+      default = null;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts =
+      lib.optional (cfg.torrent.addToFirewall && cfg.torrent.port != null) cfg.torrent.port
+      ++ lib.optional cfg.ui.addToFirewall cfg.ui.port;
+    networking.firewall.allowedUDPPorts =
+      lib.optional (cfg.torrent.addToFirewall && cfg.torrent.port != null) cfg.torrent.port;
+
+    users.users.qbittorrent-nox = {
+      isSystemUser = true;
+      group = "qbittorrent-nox";
+      home = "/var/lib/qbittorrent-nox";
+    };
+    users.groups.qbittorrent-nox = { };
+
+    systemd.services.qbittorrent-nox = {
+      description = "qBittorrent-nox service";
+      wants = [ "network-online.target" ];
+      after = [ "local-fs.target" "network-online.target" "nss-lookup.target" ];
+      wantedBy = [ "multi-user.target" ];
+      unitConfig.Documentation = "man:qbittorrent-nox(1)";
+      # required for reverse proxying
+      preStart = ''
+        if [[ ! -f /var/lib/qbittorrent-nox/qBittorrent/config/qBittorrent.conf ]]; then
+          mkdir -p /var/lib/qbittorrent-nox/qBittorrent/config
+          echo "Preferences\WebUI\HostHeaderValidation=false" >> /var/lib/qbittorrent-nox/qBittorrent/config/qBittorrent.conf
+        fi
+      '';
+      serviceConfig = {
+        User = "qbittorrent-nox";
+        Group = "qbittorrent-nox";
+        StateDirectory = "qbittorrent-nox";
+        WorkingDirectory = "/var/lib/qbittorrent-nox";
+        ExecStart = ''
+          ${cfg.package}/bin/qbittorrent-nox ${lib.optionalString (cfg.torrent.port != null) "--torrenting-port=${toString cfg.torrent.port}"} \
+            --webui-port=${toString cfg.ui.port} --profile=/var/lib/qbittorrent-nox
+        '';
+      };
+    };
+  };
+}

system/modules/vfio.nix

@@ -1,86 +1,79 @@
 { config
+, options
 , lib
 , pkgs
 , ... }:
 
 let
   cfg = config.vfio;
+  enableIvshmem = cfg.lookingGlass.enable && (builtins.length cfg.lookingGlass.ivshmem) > 0;
 in {
-  options.vfio = with lib; mkOption {
-    type = types.submodule {
-      options = {
-        enable = mkOption {
-          type = types.bool;
-          default = false;
-          description = "Enable GPU passthrough + VM config (probably no intel/nvidia support since I can't test it)";
-        };
-        libvirtdGroup = mkOption {
-          type = with types; listOf str;
-          default = [ ];
-          description = "Users to add to libvirtd group";
-        };
-        intelCpu = mkOption {
-          type = types.bool;
-          default = false;
-          description = "Whether the CPU is Intel (untested)";
-        };
-        nvidiaGpu = mkOption {
-          type = types.bool;
-          default = false;
-          description = "Whether the GPU is Nvidia (disables AMD-specific workarounds)";
-        };
-        passGpuAtBoot = mkOption {
-          type = types.bool;
-          default = false;
-          description = "Whether to pass the GPU at boot (can be more stable). If false, a bootloader entry to do it will still be available.";
-        };
-        pciIDs = mkOption {
-          type = with types; listOf str;
-          default = [ ];
-          description = "PCI passthrough IDs";
-        };
-        lookingGlass = mkOption {
-          default = { };
-          type = types.submodule {
-            options = {
-              enable = mkOption {
-                type = types.bool;
-                default = true;
-                description = "Enable Looking Glass integration";
-              };
-              ivshmem = mkOption {
-                type = with types; listOf (submodule {
-                  options = {
-                    size = mkOption {
-                      type = types.int;
-                      default = 32;
-                      description = "IVSHMEM size in MB: https://looking-glass.io/docs/B6/install/#determining-memory";
-                    };
-                    owner = mkOption {
-                      type = types.str;
-                      description = "IVSHMEM device owner";
-                    };
-                  };
-                });
-                default = if builtins.length cfg.libvirtdGroup == 1 then [
-                  { owner = builtins.head cfg.libvirtdGroup; }
-                ] else [ ];
-                example = [ { size = 32; owner = "user"; } ];
-                description = "IVSHMEM/kvmfr config (multiple devices can be created: /dev/kvmfr0, /dev/kvmfr1, and so on)";
-              };
-            };
+  options.vfio = with lib; {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable GPU passthrough + VM config (probably no intel/nvidia support since I can't test it)";
+    };
+    libvirtdGroup = mkOption {
+      type = with types; listOf str;
+      default = [ ];
+      description = "Users to add to libvirtd group";
+    };
+    intelCpu = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether the CPU is Intel (untested)";
+    };
+    nvidiaGpu = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether the GPU is Nvidia (disables AMD-specific workarounds)";
+    };
+    passGpuAtBoot = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to pass the GPU at boot (can be more stable). If false, a bootloader entry to do it will still be available.";
+    };
+    pciIDs = mkOption {
+      type = with types; listOf str;
+      default = [ ];
+      description = "PCI passthrough IDs";
+    };
+    lookingGlass = mkOption {
+      default = { };
+      type = types.submodule {
+        options = {
+          enable = mkOption {
+            type = types.bool;
+            default = true;
+            description = "Enable Looking Glass integration";
+          };
+          ivshmem = mkOption {
+            type = with types; listOf (submodule {
+              options = {
+                size = mkOption {
+                  type = types.int;
+                  default = 32;
+                  description = "IVSHMEM size in MB: https://looking-glass.io/docs/B6/install/#determining-memory";
+                };
+                owner = mkOption {
+                  type = types.str;
+                  description = "IVSHMEM device owner";
+                };
+              };
+            });
+            default = if builtins.length cfg.libvirtdGroup == 1 then [
+              { owner = builtins.head cfg.libvirtdGroup; }
+            ] else [ ];
+            example = [ { size = 32; owner = "user"; } ];
+            description = "IVSHMEM/kvmfr config (multiple devices can be created: /dev/kvmfr0, /dev/kvmfr1, and so on)";
           };
-          description = "Looking glass config";
         };
       };
+      description = "Looking glass config";
     };
-    description = "VFIO settings";
-    default = { };
   };
-  # compatibility so this module loads on non-amd hardware
-  config = let
-    enableIvshmem = cfg.lookingGlass.enable && (builtins.length cfg.lookingGlass.ivshmem) > 0;
-  in lib.mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     # add a custom kernel param for early loading vfio drivers
     # because if we change boot.initrd options in a specialization, two initrds will be built
     # and we don't want to build two initrds
@@ -120,11 +113,11 @@ in {
       '';
       initrd.kernelModules = [
         (if cfg.intelCpu then "kvm-intel" else "kvm-amd")
-      ] ++ (if cfg.passGpuAtBoot then [
+      ] ++ lib.optionals cfg.passGpuAtBoot [
         "vfio"
         "vfio_iommu_type1"
         "vfio_pci"
-      ] else []);
+      ];
       initrd.availableKernelModules = lib.mkIf (!cfg.passGpuAtBoot) [
         "vfio"
         "vfio_iommu_type1"
@@ -137,9 +130,9 @@ in {
       extraModprobeConfig = ''
           options vfio-pci ids=${builtins.concatStringsSep "," cfg.pciIDs} disable_idle_d3=1
           options kvm ignore_msrs=1
-          ${if enableIvshmem then ''
-          options kvmfr static_size_mb=${builtins.concatStringsSep "," (map (x: toString x.size) cfg.lookingGlass.ivshmem)}''
-          else ""}
+          ${lib.optionalString enableIvshmem ''
+          options kvmfr static_size_mb=${builtins.concatStringsSep "," (map (x: toString x.size) cfg.lookingGlass.ivshmem)}
+          ''}
         '';
       kernelParams = [
         (if cfg.intelCpu then "intel_iommu=on" else "amd_iommu=on")
@@ -147,7 +140,7 @@ in {
       ];
       kernelModules = [
         "vhost-net"
-      ] ++ (if enableIvshmem then [ "kvmfr" ] else []);
+      ] ++ lib.optional enableIvshmem "kvmfr";
     };
     services.udev.extraRules = lib.mkIf enableIvshmem
       (builtins.concatStringsSep
@@ -159,11 +152,11 @@ in {
           cfg.lookingGlass.ivshmem));
     hardware = {
       opengl.enable = true;
-    } // (lib.optionalAttrs (cfg.enable && !(cfg.nvidiaGpu)) {
+    } // lib.optionalAttrs (cfg.enable && !cfg.nvidiaGpu && options?hardware.amdgpu.loadInInitrd) {
       # disable early KMS so GPU can be properly unbound
       # can't use mkif because the option may not even exist
       amdgpu.loadInInitrd = false;
-    });
+    };
     # needed for virt-manager
     programs.dconf.enable = true;
     virtualisation.libvirtd = {

update.sh

@@ -7,9 +7,9 @@ mozilla-addons-to-nix \
   ./pkgs/firefox-addons/addons.json \
   ./pkgs/firefox-addons/generated.nix || echo "failed to update firefox addons"
 nix flake update
-if [ -z ${SUDO_ASKPASS+x} ]; then
-  sudo nixos-rebuild switch --flake . --option extra-builtins-file "$(pwd)/extra-builtins.nix"
-else
-  sudo -A nixos-rebuild switch --flake . --option extra-builtins-file "$(pwd)/extra-builtins.nix"
-fi
-home-manager switch --flake . --option extra-builtins-file "$(pwd)/extra-builtins.nix"
+#if [ -z ${SUDO_ASKPASS+x} ]; then
+#  sudo nixos-rebuild switch --flake . --option extra-builtins-file "$(pwd)/extra-builtins.nix"
+#else
+#  sudo -A nixos-rebuild switch --flake . --option extra-builtins-file "$(pwd)/extra-builtins.nix"
+#fi
+#home-manager switch --flake . --option extra-builtins-file "$(pwd)/extra-builtins.nix"