repair flake.lock, update disko

Signed-off-by: ahuston-0 <aliceghuston@gmail.com>

.github/settings.yml

@@ -1,204 +1,173 @@
 # Have borrowed this config from nix-community/infra
 repository:
-  # See https://developer.github.com/v3/repos/#edit for all available settings.
+    # See https://developer.github.com/v3/repos/#edit for all available settings.
 
-  # The name of the repository. Changing this will rename the repository
+    # The name of the repository. Changing this will rename the repository
-  name: nix-dotfiles
+    name: nix-dotfiles
-
+    # A short description of the repository that will show up on GitHub
-  # A short description of the repository that will show up on GitHub
+    description: RAD-Dev Infra
-  description: RAD-Dev Infra
+    # A URL with more information about the repository
-
+    # homepage: "https://nix-community.org"
-  # A URL with more information about the repository
-  # homepage: "https://nix-community.org"
-
-  # A comma-separated list of topics to set on the repository
-  topics: "nixos"
-
-  # Either `true` to make the repository private, or `false` to make it public.
-  private: false
-
-  # Either `true` to enable issues for this repository, `false` to disable them.
-  has_issues: true
-
-  # Either `true` to enable projects for this repository, or `false` to disable them.
-  # If projects are disabled for the organization, passing `true` will cause an API error.
-  has_projects: true
-
-  # Either `true` to enable the wiki for this repository, `false` to disable it.
-  has_wiki: false
-
-  # Either `true` to enable downloads for this repository, `false` to disable them.
-  has_downloads: false
-
-  # Updates the default branch for this repository.
-  default_branch: main
-
-  # Either `true` to allow squash-merging pull requests, or `false` to prevent
-  # squash-merging.
-  allow_squash_merge: true
-
-  # Either `true` to allow merging pull requests with a merge commit, or `false`
-  # to prevent merging pull requests with merge commits.
-  allow_merge_commit: false
-
-  # Either `true` to allow rebase-merging pull requests, or `false` to prevent
-  # rebase-merging.
-  allow_rebase_merge: true
-
-  # Either `true` to enable automatic deletion of branches on merge, or `false` to disable
-  delete_branch_on_merge: true
-
-  # Either `true` to enable automated security fixes, or `false` to disable
-  # automated security fixes.
-  enable_automated_security_fixes: true
-
-  # Either `true` to enable vulnerability alerts, or `false` to disable
-  # vulnerability alerts.
-  enable_vulnerability_alerts: true
-
-  allow_auto_merge: true
 
+    # A comma-separated list of topics to set on the repository
+    topics: "nixos"
+    # Either `true` to make the repository private, or `false` to make it public.
+    private: false
+    # Either `true` to enable issues for this repository, `false` to disable them.
+    has_issues: true
+    # Either `true` to enable projects for this repository, or `false` to disable them.
+    # If projects are disabled for the organization, passing `true` will cause an API error.
+    has_projects: true
+    # Either `true` to enable the wiki for this repository, `false` to disable it.
+    has_wiki: false
+    # Either `true` to enable downloads for this repository, `false` to disable them.
+    has_downloads: false
+    # Updates the default branch for this repository.
+    default_branch: main
+    # Either `true` to allow squash-merging pull requests, or `false` to prevent
+    # squash-merging.
+    allow_squash_merge: true
+    # Either `true` to allow merging pull requests with a merge commit, or `false`
+    # to prevent merging pull requests with merge commits.
+    allow_merge_commit: false
+    # Either `true` to allow rebase-merging pull requests, or `false` to prevent
+    # rebase-merging.
+    allow_rebase_merge: true
+    # Either `true` to enable automatic deletion of branches on merge, or `false` to disable
+    delete_branch_on_merge: true
+    # Either `true` to enable automated security fixes, or `false` to disable
+    # automated security fixes.
+    enable_automated_security_fixes: true
+    # Either `true` to enable vulnerability alerts, or `false` to disable
+    # vulnerability alerts.
+    enable_vulnerability_alerts: true
+    allow_auto_merge: true
 # Labels: define labels for Issues and Pull Requests
 #
 labels:
-  - name: bug
+    - name: bug
-    color: '#d73a4a'
+      color: '#d73a4a'
-    description: Something isn't working
+      description: Something isn't working
-  - name: CI/CD
+    - name: CI/CD
-    # If including a `#`, make sure to wrap it with quotes!
+      # If including a `#`, make sure to wrap it with quotes!
-    color: '#0e8a16'
+      color: '#0e8a16'
-    description: Related to GH Actions or Hydra
+      description: Related to GH Actions or Hydra
-  - name: documentation
+    - name: documentation
-    color: '#0075ca'
+      color: '#0075ca'
-    description: Improvements or additions to documentation
+      description: Improvements or additions to documentation
-  - name: duplicate
+    - name: duplicate
-    color: '#cfd3d7'
+      color: '#cfd3d7'
-    description: This issue or pull request already exists
+      description: This issue or pull request already exists
-  - name: enhancement
+    - name: enhancement
-    color: '#a2eeef'
+      color: '#a2eeef'
-    description: New feature or request
+      description: New feature or request
-  - name: good first issue
+    - name: good first issue
-    color: '#7057ff'
+      color: '#7057ff'
-    description: Good for newcomers
+      description: Good for newcomers
-  - name: help wanted
+    - name: help wanted
-    color: '#008672'
+      color: '#008672'
-    description: Extra attention is needed
+      description: Extra attention is needed
-  - name: high priority
+    - name: high priority
-    color: '#BF480A'
+      color: '#BF480A'
-    description: A major vurnability was detected
+      description: A major vurnability was detected
-  - name: invalid
+    - name: invalid
-    color: '#e4e669'
+      color: '#e4e669'
-    description: This doesn't seem right
+      description: This doesn't seem right
-  - name: new user
+    - name: new user
-    color: '#C302A1'
+      color: '#C302A1'
-    description: A new user was added to the Flake
+      description: A new user was added to the Flake
-  - name: question
+    - name: question
-    color: '#d876e3'
+      color: '#d876e3'
-    description: Further information is requested
+      description: Further information is requested
-  - name: wontfix
+    - name: wontfix
-    color: '#ffffff'
+      color: '#ffffff'
-    description: This will not be worked on
+      description: This will not be worked on
-  - name: dependencies
+    - name: dependencies
-    color: '#cb4ed5'
+      color: '#cb4ed5'
-    description: Used for PR's related to flake.lock updates
+      description: Used for PR's related to flake.lock updates
-  - name: automated
+    - name: automated
-    color: '#42b528'
+      color: '#42b528'
-    description: PR was automatically generated (through a bot or CI/CD)
+      description: PR was automatically generated (through a bot or CI/CD)
-
 # Milestones: define milestones for Issues and Pull Requests
 milestones:
-  - title: Go-Live
+    - title: Go-Live
-    description: >-
+      description: >-
-      All requirements for official go-live:
+        All requirements for official go-live: - Automated testing via Hydra/Actions - Automated deployments via Hydra/Actions - 90+% testing coverage - Functional formatter with custom rules - palatine-hill is fully stable, enough so that jeeves can be migrated
-      - Automated testing via Hydra/Actions
+      # The state of the milestone. Either `open` or `closed`
-      - Automated deployments via Hydra/Actions
+      state: open
-      - 90+% testing coverage
+    - title: Jeeves Migration
-      - Functional formatter with custom rules
+      description: >-
-      - palatine-hill is fully stable, enough so that jeeves can be migrated
+        Test common use-cases for Jeeves - Quadro GPU support - Multi-GPU support - Plex support - Docker support - ZFS support
-    # The state of the milestone. Either `open` or `closed`
-    state: open
-  - title: Jeeves Migration
-    description: >-
-      Test common use-cases for Jeeves
-      - Quadro GPU support
-      - Multi-GPU support
-      - Plex support
-      - Docker support
-      - ZFS support
-
-
 # Collaborators: give specific users access to this repository.
 # See https://docs.github.com/en/rest/reference/repos#add-a-repository-collaborator for available options
 collaborators:
-  # - username: numtide-bot
+# - username: numtide-bot
-  # Note: `permission` is only valid on organization-owned repositories.
+# Note: `permission` is only valid on organization-owned repositories.
-  # The permission to grant the collaborator. Can be one of:
+# The permission to grant the collaborator. Can be one of:
-  # * `pull` - can pull, but not push to or administer this repository.
+# * `pull` - can pull, but not push to or administer this repository.
-  # * `push` - can pull and push, but not administer this repository.
+# * `push` - can pull and push, but not administer this repository.
-  # * `admin` - can pull, push and administer this repository.
+# * `admin` - can pull, push and administer this repository.
-  # * `maintain` - Recommended for project managers who need to manage the repository without access to sensitive or destructive actions.
+# * `maintain` - Recommended for project managers who need to manage the repository without access to sensitive or destructive actions.
-  # * `triage` - Recommended for contributors who need to proactively manage issues and pull requests without write access.
+# * `triage` - Recommended for contributors who need to proactively manage issues and pull requests without write access.
-  # permission: push
+# permission: push
 
 # See https://docs.github.com/en/rest/reference/teams#add-or-update-team-repository-permissions for available options
 teams:
-  # - name: admin
+# - name: admin
-    # The permission to grant the team. Can be one of:
+# The permission to grant the team. Can be one of:
-    # * `pull` - can pull, but not push to or administer this repository.
+# * `pull` - can pull, but not push to or administer this repository.
-    # * `push` - can pull and push, but not administer this repository.
+# * `push` - can pull and push, but not administer this repository.
-    # * `admin` - can pull, push and administer this repository.
+# * `admin` - can pull, push and administer this repository.
-    # * `maintain` - Recommended for project managers who need to manage the repository without access to sensitive or destructive actions.
+# * `maintain` - Recommended for project managers who need to manage the repository without access to sensitive or destructive actions.
-    # * `triage` - Recommended for contributors who need to proactively manage issues and pull requests without write access.
+# * `triage` - Recommended for contributors who need to proactively manage issues and pull requests without write access.
-    # permission: admin
+# permission: admin
-
 branches:
-  # gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" /repos/nix-community/infra/branches/master/protection
+    # gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" /repos/nix-community/infra/branches/master/protection
 
-  # not available in the api yet
+    # not available in the api yet
-  # `Require merge queue`: true
+    # `Require merge queue`: true
-  # `Merge method`: Rebase and merge
+    # `Merge method`: Rebase and merge
-  # `Maximum pull requests to build`: 1
+    # `Maximum pull requests to build`: 1
-  # `Maximum pull requests to merge`: 1
+    # `Maximum pull requests to merge`: 1
-  # defaults:
+    # defaults:
-  # `Maximum pull requests to build`: 5
+    # `Maximum pull requests to build`: 5
-  # `Minimum pull requests to merge`: 1 or 5 minutes
+    # `Minimum pull requests to merge`: 1 or 5 minutes
-  # `Maximum pull requests to merge`: 5
+    # `Maximum pull requests to merge`: 5
-  # `Only merge non-failing pull requests`: true
+    # `Only merge non-failing pull requests`: true
-  # `Consider check failed after`: 60 minutes
+    # `Consider check failed after`: 60 minutes
+    - name: main
+      # https://docs.github.com/en/rest/reference/repos#update-branch-protection
+      # Branch Protection settings. Set to null to disable
+      protection:
+        # Required. Require at least one approving review on a pull request, before merging. Set to null to disable.
 
-  - name: main
+        # these settings are the same as manually enabling "Require a pull request before merging" but not setting any other restrictions
-    # https://docs.github.com/en/rest/reference/repos#update-branch-protection
+        required_pull_request_reviews:
-    # Branch Protection settings. Set to null to disable
+            # # The number of approvals required. (1-6)
-    protection:
+            required_approving_review_count: 1
-      # Required. Require at least one approving review on a pull request, before merging. Set to null to disable.
+            # # Dismiss approved reviews automatically when a new commit is pushed.
-
+            dismiss_stale_reviews: true
-      # these settings are the same as manually enabling "Require a pull request before merging" but not setting any other restrictions
+            # # Blocks merge until code owners have reviewed.
-      required_pull_request_reviews:
+            require_code_owner_reviews: false
-        # # The number of approvals required. (1-6)
+            # # Specify which users and teams can dismiss pull request reviews. Pass an empty dismissal_restrictions object to disable. User and team dismissal_restrictions are only available for organization-owned repositories. Omit this parameter for personal repositories.
-        required_approving_review_count: 1
+            # dismissal_restrictions:
-        # # Dismiss approved reviews automatically when a new commit is pushed.
+            #   users: []
-        dismiss_stale_reviews: true
+            #   teams: []
-        # # Blocks merge until code owners have reviewed.
+            require_last_push_approval: false
-        require_code_owner_reviews: false
+        # Required. Require status checks to pass before merging. Set to null to disable
-        # # Specify which users and teams can dismiss pull request reviews. Pass an empty dismissal_restrictions object to disable. User and team dismissal_restrictions are only available for organization-owned repositories. Omit this parameter for personal repositories.
+        # required_status_checks:
-        # dismissal_restrictions:
-        #   users: []
-        #   teams: []
-        require_last_push_approval: false
-      # Required. Require status checks to pass before merging. Set to null to disable
-      # required_status_checks:
         # Required. Require branches to be up to date before merging.
         # strict: false
         # Required. The list of status checks to require in order to merge into this branch
         # contexts:
         #   - buildbot/nix-eval
-      # Required. Enforce all configured restrictions for administrators. Set to true to enforce required status checks for repository administrators. Set to null to disable.
+        # Required. Enforce all configured restrictions for administrators. Set to true to enforce required status checks for repository administrators. Set to null to disable.
-      enforce_admins: true
+        enforce_admins: true
-      # Disabled for bors to work
+        # Disabled for bors to work
-      required_linear_history: true
+        required_linear_history: true
-      # Required. Restrict who can push to this branch. Team and user restrictions are only available for organization-owned repositories. Set to null to disable.
+        # Required. Restrict who can push to this branch. Team and user restrictions are only available for organization-owned repositories. Set to null to disable.
-      restrictions:
+        restrictions:
-        apps: []
+            apps: []
-        # TODO: make a buildbot instance
+            # TODO: make a buildbot instance
-        # users: ["nix-infra-bot"]
+            # users: ["nix-infra-bot"]
-        teams: []
+            teams: []

.github/workflows/flake-health-checks.yml

@@ -1,27 +1,41 @@
 name: "Check Nix flake"
 on:
-  push:
+    push:
-    branches: ["main"]
+        branches: ["main"]
-  pull_request:
+    pull_request:
-    branches: ["main"]
+        branches: ["main"]
-  merge_group:
+    merge_group:
-
 jobs:
-  health-check:
+    health-check:
-    name: "Perform Nix flake checks"
+        name: "Perform Nix flake checks"
-    runs-on: ${{ matrix.os }}
+        runs-on: ubuntu-latest
-    strategy:
+        steps:
-      matrix:
+            - uses: DeterminateSystems/nix-installer-action@main
-        os: [ubuntu-latest]
+            - name: Setup Attic cache
-    steps:
+              uses: ryanccn/attic-action@v0
-      - uses: DeterminateSystems/nix-installer-action@main
+              with:
-      - name: Setup Attic cache
+                endpoint: ${{ secrets.ATTIC_ENDPOINT }}
-        uses: ryanccn/attic-action@v0
+                cache: ${{ secrets.ATTIC_CACHE }}
-        with:
+                token: ${{ secrets.ATTIC_TOKEN }}
-          endpoint: ${{ secrets.ATTIC_ENDPOINT }}
+                skip-push: "true"
-          cache: ${{ secrets.ATTIC_CACHE }}
+            - uses: actions/checkout@v4
-          token: ${{ secrets.ATTIC_TOKEN }}
+            - run: nix flake check --accept-flake-config
-          skip-push: "true"
+            - run: nix ./utils/attic-push.bash
-      - uses: actions/checkout@v4
+    # build-checks:
-      - run: nix flake check --accept-flake-config
+    #     name: "Build nix outputs"
-      - run: nix ./utils/attic-push.bash
+    #     runs-on: ubuntu-latest
+    #     steps:
+    #         - uses: DeterminateSystems/nix-installer-action@main
+    #         - name: Setup Attic cache
+    #           uses: ryanccn/attic-action@v0
+    #           with:
+    #             endpoint: ${{ secrets.ATTIC_ENDPOINT }}
+    #             cache: ${{ secrets.ATTIC_CACHE }}
+    #             token: ${{ secrets.ATTIC_TOKEN }}
+    #             skip-push: "true"
+    #         - uses: actions/checkout@v4
+    #         - name: Build all outputs
+    #           run: nix run git+https://nayeonie.com/ahuston-0/flake-update-diff -- --build .
+    #         - name: Push to Attic
+    #           run: nix ./utils/attic-push.bash
+    #           continue-on-error: true

.github/workflows/flake-update.yml

@@ -1,72 +1,112 @@
 name: "Update flakes"
 on:
-  repository_dispatch:
+    repository_dispatch:
-  workflow_dispatch:
+    workflow_dispatch:
-  schedule:
+    schedule:
-    - cron: "00 12 * * *"
+        - cron: "00 12 * * *"
 jobs:
-  createPullRequest:
+    update_lockfile:
-    runs-on: ubuntu-latest
+        runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/main' # ensure workflow_dispatch only runs on main
+        #if: github.ref == 'refs/heads/main' # ensure workflow_dispatch only runs on main
-    steps:
+        steps:
-      - uses: actions/checkout@v4
+            - name: Checkout repository
-      # - name: Login to Docker Hub
+              uses: actions/checkout@v4
-        # uses: docker/login-action@v3
+            - name: Install nix
-        # with:
+              uses: https://github.com/DeterminateSystems/nix-installer-action@main
-        #   username: ${{ secrets.DOCKERHUB_USERNAME }}
+            - name: Setup Attic cache
-        #   password: ${{ secrets.DOCKERHUB_TOKEN }}
+              uses: ryanccn/attic-action@v0
-      - name: Install Nix
+              with:
-        uses: cachix/install-nix-action@v24
+                endpoint: ${{ secrets.ATTIC_ENDPOINT }}
-        with:
+                cache: ${{ secrets.ATTIC_CACHE }}
-          extra_nix_config: |
+                token: ${{ secrets.ATTIC_TOKEN }}
-            experimental-features = nix-command flakes
+                skip-push: "true"
-          install_url: https://releases.nixos.org/nix/nix-2.19.0/install
+            - name: Get pre-snapshot of evaluations
-      - name: Setup Attic cache
+              run: nix ./utils/eval-to-drv.sh pre
-        uses: ryanccn/attic-action@v0
+            - name: Update flake.lock
-        with:
+              id: update
-          endpoint: ${{ secrets.ATTIC_ENDPOINT }}
+              run: |
-          cache: ${{ secrets.ATTIC_CACHE }}
+                nix flake update 2> >(tee /dev/stderr) | awk '
-          token: ${{ secrets.ATTIC_TOKEN }}
+                  /^• Updated input/ {in_update = 1; print; next}
-      - name: Calculate pre-drv
+                  in_update && !/^warning:/ {print}
-        run: nix ./utils/eval-to-drv.sh pre
+                  /^$/ {in_update = 0}
-      # - name: Pull latest docker images
+                ' > update.log
-      #   run: nix ./utils/fetch-docker.sh
-      - name: Update flake.lock (part 1)
-        run: nix flake update
-      - name: Calculate post-drv
-        run: nix ./utils/eval-to-drv.sh post
-      - name: Calculate diff
-        run: nix ./utils/diff-evals.sh
-      - name: Read diff into environment
-        run: |
-          delimiter="$(openssl rand -hex 8)"
-          {
-          echo "POSTDIFF<<${delimiter}"
-          cat post-diff
-          echo "${delimiter}"
-          } >> $GITHUB_ENV
 
+                echo "UPDATE_LOG<<EOF" >> $GITHUB_ENV
+                cat update.log >> $GITHUB_ENV
+                echo "EOF" >> $GITHUB_ENV
 
-      - name: Restore flake.lock for next step
+                rm update.log
-        run: git restore flake.lock
+            - name: Get post-snapshot of evaluations
-      - name: Update flake.lock
+              run: nix ./utils/eval-to-drv.sh post
-        id: update
+            - name: Calculate diff
-        uses: DeterminateSystems/update-flake-lock@main
+              run: nix ./utils/diff-evals.sh
-        with:
+            - name: Read file contents
-          token: ${{ secrets.GH_TOKEN_FOR_UPDATES }}
+              id: read_file
-          pr-body: |
+              uses: guibranco/github-file-reader-action-v2@latest
-            Automated changes by the [update-flake-lock](https://github.com/DeterminateSystems/update-flake-lock) GitHub Action.
+              with:
+                path: "post-diff"
+            - name: Write PR body template
+              uses: https://github.com/DamianReeves/write-file-action@v1.3
+              with:
+                path: pr_body.template
+                contents: |
+                    - The following Nix Flake inputs were updated:
 
-            ```
+                    ```
-            {{ env.GIT_COMMIT_MESSAGE }}
+                    ${{ env.UPDATE_LOG }}
-            ```
+                    ```
 
-            ```
+                    ```
-            {{ env.POSTDIFF }}
+                    ${{ steps.read_file.outputs.contents }}
-            ```
+                    ```
-          pr-labels: |                  # Labels to be set on the PR
+
-            dependencies
+                    Auto-generated by [update.yml][1] with the help of
-            automated
+                    [create-pull-request][2].
+
+                    [1]: https://nayeonie.com/ahuston-0/nix-dotfiles/src/branch/main/.github/workflows/flake-update.yml
+                    [2]: https://forgejo.stefka.eu/jiriks74/create-pull-request
+            - name: Generate PR body
+              uses: pedrolamas/handlebars-action@v2.4.0 # v2.4.0
+              with:
+                files: "pr_body.template"
+                output-filename: "pr_body.md"
+            - name: Save PR body
+              id: pr_body
+              uses: juliangruber/read-file-action@v1
+              with:
+                path: "pr_body.md"
+            - name: Remove temporary files
+              run: |
+                rm pr_body.template
+                rm pr_body.md
+                rm pre.json
+                rm post.json
+                rm post-diff
+            - name: Create Pull Request
+              id: create-pull-request
+              # uses: https://forgejo.stefka.eu/jiriks74/create-pull-request@7174d368c2e4450dea17b297819eb28ae93ee645
+              uses: https://nayeonie.com/ahuston-0/create-pull-request@main
+              with:
+                token: ${{ secrets.GH_TOKEN_FOR_UPDATES  }}
+                body: ${{ steps.pr_body.outputs.content }}
+                author: '"github-actions[bot]" <github-actions[bot]@users.noreply.github.com>'
+                title: 'automated: Update `flake.lock`'
+                commit-message: |
+                    automated: Update `flake.lock`
+
+                    ${{ steps.pr_body.outputs.content }}
+                branch: update-flake-lock
+                delete-branch: true
+                pr-labels: | # Labels to be set on the PR
+                    dependencies
+                    automated
+            - name: Push to Attic
+              run: nix ./utils/attic-push.bash
+              continue-on-error: true
+            - name: Print PR number
+              run: |
+                echo "Pull request number is ${{ steps.create-pull-request.outputs.pull-request-number }}."
+                echo "Pull Request URL - ${{ steps.cpr.outputs.pull-request-url }}"
 permissions:
-  pull-requests: write
+    pull-requests: write
-  contents: write
+    contents: write

.github/workflows/lock-health-checks.yml

@@ -1,17 +1,16 @@
 name: "Check flake.lock"
 on:
-  push:
+    push:
-    branches: ["main"]
+        branches: ["main"]
-  pull_request:
+    pull_request:
-    branches: ["main"]
+        branches: ["main"]
-  merge_group:
+    merge_group:
-
 jobs:
-  health-check:
+    health-check:
-    name: "Check health of `flake.lock`"
+        name: "Check health of `flake.lock`"
-    runs-on: ubuntu-latest
+        runs-on: ubuntu-latest
-    steps:
+        steps:
-      - uses: actions/checkout@v4
+            - uses: actions/checkout@v4
-      - uses: DeterminateSystems/flake-checker-action@main
+            - uses: DeterminateSystems/flake-checker-action@main
-        with:
+              with:
-          fail-mode: true
+                fail-mode: true

.github/workflows/nix-fmt.yml

@@ -1,22 +1,25 @@
 name: "Check Nix formatting"
 on:
-  push:
+    push:
-    branches: ["main"]
+        branches: ["main"]
-  pull_request:
+    pull_request:
-    branches: ["main"]
+        branches: ["main"]
-  merge_group:
+    merge_group:
-
 jobs:
-  health-check:
+    health-check:
-    name: "Perform Nix format checks"
+        name: "Perform Nix format checks"
-    runs-on: ubuntu-latest
+        runs-on: ubuntu-latest
-    steps:
+        steps:
-      - uses: DeterminateSystems/nix-installer-action@main
+            - uses: DeterminateSystems/nix-installer-action@main
-      - name: Setup Attic cache
+            - name: Setup Attic cache
-        uses: ryanccn/attic-action@v0
+              uses: ryanccn/attic-action@v0
-        with:
+              with:
-          endpoint: ${{ secrets.ATTIC_ENDPOINT }}
+                endpoint: ${{ secrets.ATTIC_ENDPOINT }}
-          cache: ${{ secrets.ATTIC_CACHE }}
+                cache: ${{ secrets.ATTIC_CACHE }}
-          token: ${{ secrets.ATTIC_TOKEN }}
+                token: ${{ secrets.ATTIC_TOKEN }}
-      - uses: actions/checkout@v4
+                skip-push: "true"
-      - run: nix fmt -- --check .
+            - uses: actions/checkout@v4
+            - run: nix fmt -- --check .
+            - name: Push to Attic
+              run: nix ./utils/attic-push.bash
+              continue-on-error: true

.sops.yaml

@@ -1,51 +1,46 @@
 keys:
-  # The PGP keys in keys/
+    # The PGP keys in keys/
-  - &admin_alice 5EFFB75F7C9B74EAA5C4637547940175096C1330
+    - &admin_alice 5EFFB75F7C9B74EAA5C4637547940175096C1330
-
+    # Generate AGE keys from SSH keys with:
-  # Generate AGE keys from SSH keys with:
+    #   ssh-keygen -A
-  #   ssh-keygen -A
+    #   nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
-  #   nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
+    # cspell:disable
-  # cspell:disable
+    - &artemision age1jd2dcpykagz20kpk2kkchte3augqncwfn6nywursx0dkfyze6feqdzxkq2
-  - &artemision age1jd2dcpykagz20kpk2kkchte3augqncwfn6nywursx0dkfyze6feqdzxkq2
+    - &artemision-home age1t29a6z6cfy8m3cnc8uva0ey833vhcppue8psyumts7mtyf0zufcqvfshuc
-  - &artemision-home age1t29a6z6cfy8m3cnc8uva0ey833vhcppue8psyumts7mtyf0zufcqvfshuc
     #- &palatine-hill age1z8q02wdp0a2ep5uuffgfeqlfam4ztl95frhw5qhnn6knn0rrmcnqk5evej
-  - &palatine-hill age1qw5k8h72k3fjg5gmlxx8q8gwlc2k6n6u08d8hdzpm2pk9r0fnfxsmw33nh
+    - &palatine-hill age1qw5k8h72k3fjg5gmlxx8q8gwlc2k6n6u08d8hdzpm2pk9r0fnfxsmw33nh
-  # cspell:enable
+    # cspell:enable
-
 servers: &servers
-  - *palatine-hill
+    - *palatine-hill
-
 # add new users by executing: sops users/<user>/secrets.yaml
 # then have someone already in the repo run the below
 #
 # update keys by executing: sops updatekeys secrets.yaml
 # note: add .* before \.yaml if you'd like to use the mergetool config
 creation_rules:
-  - path_regex: users/alice/secrets.*\.yaml$
+    - path_regex: users/alice/secrets.*\.yaml$
-    key_groups:
+      key_groups:
-      - pgp:
+        - pgp:
-          - *admin_alice
+            - *admin_alice
-        age:
+          age:
-          - *palatine-hill
+            - *palatine-hill
-          - *artemision
+            - *artemision
-          - *artemision-home
+            - *artemision-home
-
+    - path_regex: systems/palatine-hill/secrets.*\.yaml$
-  - path_regex: systems/palatine-hill/secrets.*\.yaml$
+      key_groups:
-    key_groups:
+        - pgp:
-      - pgp: 
+            - *admin_alice
-          - *admin_alice
+          age:
-        age:
+            - *palatine-hill
-          - *palatine-hill
+    - path_regex: systems/artemision/secrets.*\.yaml$
-
+      key_groups:
-  - path_regex: systems/artemision/secrets.*\.yaml$
+        - pgp:
-    key_groups:
+            - *admin_alice
-      - pgp:
+          age:
-          - *admin_alice
+            - *artemision
-        age:
+    - path_regex: systems/palatine-hill/docker/wg/.*\.conf$
-          - *artemision
+      key_groups:
-  - path_regex: systems/palatine-hill/docker/wg/.*\.conf$
+        - pgp:
-    key_groups:
+            - *admin_alice
-      - pgp:
+          age:
-          - *admin_alice
+            - *palatine-hill
-        age:
-          - *palatine-hill

.vscode/settings.json

@@ -1,5 +1,7 @@
 {
-  "cSpell.enableFiletypes": ["nix"],
+  "cSpell.enableFiletypes": [
+    "nix"
+  ],
   "cSpell.words": [
     "aarch",
     "abmlevel",

disko/hetzner.nix

@@ -0,0 +1,47 @@
+# USAGE in your configuration.nix.
+# Update devices to match your hardware.
+# {
+#  imports = [ ./disko-config.nix ];
+#  disko.devices.disk.main.device = "/dev/sda";
+# }
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              type = "EF00";
+              size = "500M";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+              priority = 1;
+            };
+            root = {
+              end = "-1G";
+              content = {
+                type = "filesystem";
+                format = "ext4";
+                mountpoint = "/";
+              };
+            };
+            encryptedSwap = {
+              size = "1G";
+              content = {
+                type = "swap";
+                randomEncryption = true;
+                priority = 100; # prefer to encrypt as long as we have space for it
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

docs/CONTRIBUTING.md

@@ -40,12 +40,12 @@ and will eventually trip a check when merging to main.
 | Branch Name      | Use Case                                                                                                                                                                                                                      |
 |------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | main             | protected branch which all machines pull from, do not try to push directly                                                                                                                                                    |
-| feature/\<item\> | \<item\> is a new feature added to the repo, for personal or common use                                                                                                                                                       |
+| feature/\<item> | \<item> is a new feature added to the repo, for personal or common use                                                                                                                                                       |
-| fixup/\<item\>   | \<item\> is a non-urgent bug, PRs merging from these branches should be merged when possible, but are not considered mission-critical                                                                                         |
+| fixup/\<item>   | \<item> is a non-urgent bug, PRs merging from these branches should be merged when possible, but are not considered mission-critical                                                                                         |
-| hotfix/\<item\>  | \<item\> is a mission-critical bug, either affecting all users or a breaking change on a user's machines. These PRs should be reviewed ASAP. This is automatically subject to the [Critical Issues](#critical-issues) process |
+| hotfix/\<item>  | \<item> is a mission-critical bug, either affecting all users or a breaking change on a user's machines. These PRs should be reviewed ASAP. This is automatically subject to the [Critical Issues](#critical-issues) process |
-| urgent/\<item\>  | Accepted as an alias for the above, due to dev's coming from multiple standards and the criticality of these issues                                                                                                           |
+| urgent/\<item>  | Accepted as an alias for the above, due to dev's coming from multiple standards and the criticality of these issues                                                                                                           |
-| exp/\<item\>     | \<item\> is a non-critical experiment. This is used for shipping around potential new features or fixes to multiple branches                                                                                                  |
+| exp/\<item>     | \<item> is a non-critical experiment. This is used for shipping around potential new features or fixes to multiple branches                                                                                                  |
-| merge/\<item\>   | \<item\> is a temporary branch and should never be merged directly to main. This is solely used for addressing merge conflicts which are too complex to be merged directly on branch                                          |
+| merge/\<item>   | \<item> is a temporary branch and should never be merged directly to main. This is solely used for addressing merge conflicts which are too complex to be merged directly on branch                                          |
 
 ### Review Process
 
@@ -94,11 +94,11 @@ rules.
   PR has been tested on at least one machine
    - Issues which bypass the quorum process must have a second reviewer tagged
    - All critical issues which bypass the approval process must have an RCA issue
-    opened and the RCA logged into the `inc/` folder
+     opened and the RCA logged into the `inc/` folder
    - The second reviewer has 2 weeks to retroactively review and approve the PR
    - If the retro does not happen in the given window, an issue shall be opened
-    to either re-review the PR or to revert and replace the fix with a
+     to either re-review the PR or to revert and replace the fix with a
-    permanent solution
+     permanent solution
 - Critical issues must be tagged to `Nix Flake Features` project, and must have
   a priority of `High` and an estimate tagged. Start and end date are not needed
 

docs/sample-setup.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env nix
 #! nix shell nixpkgs#bash nixpkgs#git --command bash
 
-set -o errexit   # abort on nonzero exitstatus
+set -o errexit  # abort on nonzero exitstatus
-set -o nounset   # abort on unbound variable
+set -o nounset  # abort on unbound variable
-set -o pipefail  # don't hide errors within pipes
+set -o pipefail # don't hide errors within pipes
 
 PROCEED="N"
 
@@ -50,60 +50,58 @@ GITBASE="systems"
 FEATUREBRANCH="feature/adding-$MACHINENAME"
 
 if [ $PROCEED != "Y" ]; then
-    echo "PROCEED is not set correctly, please validate the below partitions and update the script accordingly"
+  echo "PROCEED is not set correctly, please validate the below partitions and update the script accordingly"
-    lsblk -ao NAME,FSTYPE,FSSIZE,FSUSED,SIZE,MOUNTPOINT
+  lsblk -ao NAME,FSTYPE,FSSIZE,FSUSED,SIZE,MOUNTPOINT
 fi
 
-
-
 if [ $CREATEPARTS = "Y" ]; then
-    # Create partition table
+  # Create partition table
-    sudo parted "/dev/$DRIVE" -- mklabel gpt
+  sudo parted "/dev/$DRIVE" -- mklabel gpt
 
-    # Create boot part
+  # Create boot part
-    sudo parted "/dev/$DRIVE" -- mkpart ESP fat32 1MB 1024MB
+  sudo parted "/dev/$DRIVE" -- mkpart ESP fat32 1MB 1024MB
-    sudo parted "/dev/$DRIVE" -- set 1 esp on
+  sudo parted "/dev/$DRIVE" -- set 1 esp on
-    sudo mkfs.fat -F 32 -n NIXBOOT "/dev/${DRIVE}1"
+  sudo mkfs.fat -F 32 -n NIXBOOT "/dev/${DRIVE}1"
 
-    # Create luks part
+  # Create luks part
-    sudo parted "/dev/$DRIVE" -- mkpart primary ext4 1024MB 100%
+  sudo parted "/dev/$DRIVE" -- mkpart primary ext4 1024MB 100%
-    sudo parted "/dev/$DRIVE" -- set 2 lvm on
+  sudo parted "/dev/$DRIVE" -- set 2 lvm on
 
-    LUKSPART="nixos-pv"
+  LUKSPART="nixos-pv"
-    sudo cryptsetup luksFormat "/dev/${DRIVE}p2"
+  sudo cryptsetup luksFormat "/dev/${DRIVE}p2"
-    sudo cryptsetup luksOpen "/dev/${DRIVE}p2" "$LUKSPART"
+  sudo cryptsetup luksOpen "/dev/${DRIVE}p2" "$LUKSPART"
 
-    # Create lvm part
+  # Create lvm part
-    sudo pvcreate "/dev/mapper/$LUKSPART"
+  sudo pvcreate "/dev/mapper/$LUKSPART"
-    sudo pvresize "/dev/mapper/$LUKSPART"
+  sudo pvresize "/dev/mapper/$LUKSPART"
-    sudo pvdisplay
+  sudo pvdisplay
 
-    # Create volume group
+  # Create volume group
-    sudo vgcreate "$VOLGROUP" "/dev/mapper/$LUKSPART"
+  sudo vgcreate "$VOLGROUP" "/dev/mapper/$LUKSPART"
-    sudo vgchange -a y "$VOLGROUP"
+  sudo vgchange -a y "$VOLGROUP"
-    sudo vgdisplay
+  sudo vgdisplay
 
-    # Create swap part on LVM
+  # Create swap part on LVM
-    if [ $SWAPSIZE != 0 ]; then
+  if [ $SWAPSIZE != 0 ]; then
-        sudo lvcreate -L "$SWAPSIZE" "$VOLGROUP" -n swap
+    sudo lvcreate -L "$SWAPSIZE" "$VOLGROUP" -n swap
-        sudo mkswap -L NIXSWAP -c "$SWAPPATH"
+    sudo mkswap -L NIXSWAP -c "$SWAPPATH"
-    fi
+  fi
 
-    # Create home part on LVM, leaving plenty of room for snapshots
+  # Create home part on LVM, leaving plenty of room for snapshots
-    sudo lvcreate -l 50%FREE "$VOLGROUP" -n home
+  sudo lvcreate -l 50%FREE "$VOLGROUP" -n home
-    sudo mkfs.ext4 -L NIXHOME -c "$HOMEPATH"
+  sudo mkfs.ext4 -L NIXHOME -c "$HOMEPATH"
 
-    # Create root part on LVM, keeping in mind most data will be on /home or /nix
+  # Create root part on LVM, keeping in mind most data will be on /home or /nix
-    sudo lvcreate -L 5G "$VOLGROUP" -n root
+  sudo lvcreate -L 5G "$VOLGROUP" -n root
-    sudo mkfs.ext4 -L NIXROOT -c "$ROOTPATH"
+  sudo mkfs.ext4 -L NIXROOT -c "$ROOTPATH"
 
-    # Create nix part on LVM
+  # Create nix part on LVM
-    sudo lvcreate -L 100G "$VOLGROUP" -n nix-store
+  sudo lvcreate -L 100G "$VOLGROUP" -n nix-store
-    sudo mkfs.ext4 -L NIXSTORE -c "$NIXSTOREPATH"
+  sudo mkfs.ext4 -L NIXSTORE -c "$NIXSTOREPATH"
 
-    sudo lvdisplay
+  sudo lvdisplay
 
-    lsblk -ao NAME,FSTYPE,FSSIZE,FSUSED,SIZE,MOUNTPOINT
+  lsblk -ao NAME,FSTYPE,FSSIZE,FSUSED,SIZE,MOUNTPOINT
 fi
 
 # Mount partitions
@@ -116,7 +114,7 @@ sudo mount $BOOTPART /mnt/boot
 
 # Enable swap if SWAPSIZE is non-zero
 if [ $SWAPSIZE != 0 ]; then
-    sudo swapon "/dev/$VOLGROUP/swap"
+  sudo swapon "/dev/$VOLGROUP/swap"
 fi
 
 # Clone the repo
@@ -135,31 +133,31 @@ read -r -p "get this into github so you can check everything in, then hit enter
 cat "$DOTS/id_ed25519_ghdeploy.pub"
 
 if [ $SOPS == "Y" ]; then
-    # Create ssh host-keys
+  # Create ssh host-keys
-    sudo ssh-keygen -A
+  sudo ssh-keygen -A
-    sudo mkdir -p /mnt/etc/ssh
+  sudo mkdir -p /mnt/etc/ssh
-    sudo cp "/etc/ssh/ssh_host_*" /mnt/etc/ssh
+  sudo cp "/etc/ssh/ssh_host_*" /mnt/etc/ssh
 
-    # Get line where AGE comment is and insert new AGE key two lines down
+  # Get line where AGE comment is and insert new AGE key two lines down
-    AGELINE=$(grep "Generate AGE keys from SSH keys with" "$DOTS/.sops.yaml" -n | awk -F ':' '{print ($1+2)}')
+  AGELINE=$(grep "Generate AGE keys from SSH keys with" "$DOTS/.sops.yaml" -n | awk -F ':' '{print ($1+2)}')
-    AGEKEY=$(nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age')
+  AGEKEY=$(nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age')
-    sudo sed -i "${AGELINE}i\\  - &${MACHINENAME} $AGEKEY\\" "$DOTS/.sops.yaml"
+  sudo sed -i "${AGELINE}i\\  - &${MACHINENAME} $AGEKEY\\" "$DOTS/.sops.yaml"
 
-    # Add server name
+  # Add server name
-    SERVERLINE=$(grep 'servers: &servers' "$DOTS/.sops.yaml" -n | awk -F ':' '{print ($1+1)}')
+  SERVERLINE=$(grep 'servers: &servers' "$DOTS/.sops.yaml" -n | awk -F ':' '{print ($1+1)}')
-    sudo sed -i "${SERVERLINE}i\\  - *${MACHINENAME}\\" "$DOTS/.sops.yaml"
+  sudo sed -i "${SERVERLINE}i\\  - *${MACHINENAME}\\" "$DOTS/.sops.yaml"
 
-    # Add creation rules
+  # Add creation rules
-    CREATIONLINE=$(grep 'creation_rules' "$DOTS/.sops.yaml" -n | awk -F ':' '{print ($1+1)}')
+  CREATIONLINE=$(grep 'creation_rules' "$DOTS/.sops.yaml" -n | awk -F ':' '{print ($1+1)}')
-    # TODO: below was not working when last attempted
+  # TODO: below was not working when last attempted
-    read -r -d '' PATHRULE <<-EOF
+  read -r -d '' PATHRULE <<-EOF
   - path_regex: $GITBASE/$MACHINENAME/secrets\.yaml$
     key_groups:
       - pgp: *$OWNERORADMINS
         age:
           - *$MACHINENAME
 EOF
-    sudo sed -i "${CREATIONLINE}i\\${PATHRULE}\\" "$DOTS/.sops.yaml"
+  sudo sed -i "${CREATIONLINE}i\\${PATHRULE}\\" "$DOTS/.sops.yaml"
 fi
 
 read -r -p "press enter to continue"

flake.lock

@@ -1,5 +1,93 @@
 {
   "nodes": {
+    "base16": {
+      "inputs": {
+        "fromYaml": "fromYaml"
+      },
+      "locked": {
+        "lastModified": 1732200724,
+        "narHash": "sha256-+R1BH5wHhfnycySb7Sy5KbYEaTJZWm1h+LW1OtyhiTs=",
+        "owner": "SenchoPens",
+        "repo": "base16.nix",
+        "rev": "153d52373b0fb2d343592871009a286ec8837aec",
+        "type": "github"
+      },
+      "original": {
+        "owner": "SenchoPens",
+        "repo": "base16.nix",
+        "type": "github"
+      }
+    },
+    "base16-fish": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1622559957,
+        "narHash": "sha256-PebymhVYbL8trDVVXxCvZgc0S5VxI7I1Hv4RMSquTpA=",
+        "owner": "tomyun",
+        "repo": "base16-fish",
+        "rev": "2f6dd973a9075dabccd26f1cded09508180bf5fe",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tomyun",
+        "repo": "base16-fish",
+        "type": "github"
+      }
+    },
+    "base16-helix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1736852337,
+        "narHash": "sha256-esD42YdgLlEh7koBrSqcT7p2fsMctPAcGl/+2sYJa2o=",
+        "owner": "tinted-theming",
+        "repo": "base16-helix",
+        "rev": "03860521c40b0b9c04818f2218d9cc9efc21e7a5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-helix",
+        "type": "github"
+      }
+    },
+    "base16-vim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1732806396,
+        "narHash": "sha256-e0bpPySdJf0F68Ndanwm+KWHgQiZ0s7liLhvJSWDNsA=",
+        "owner": "tinted-theming",
+        "repo": "base16-vim",
+        "rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-vim",
+        "rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
+        "type": "github"
+      }
+    },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1736864502,
+        "narHash": "sha256-ItkIZyebGvNH2dK9jVGzJHGPtb6BSWLN8Gmef16NeY0=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "0141aabed359f063de7413f80d906e1d98c0c123",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "latest",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "firefox-addons": {
       "inputs": {
         "flake-utils": [
@@ -11,11 +99,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1740212040,
+        "lastModified": 1743483509,
-        "narHash": "sha256-Gpvn9Z+ZgKPyb6qaAbahLbo6ZVj7VuLzSCmHZRvsACA=",
+        "narHash": "sha256-aHnOrBV4UpVQuv9RHmYaRb0jZRBpmeDWsZWBRoSCc5w=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "9a8a0914000e4453c99a4c12e9862a0a40075851",
+        "rev": "692aba39210127804151c9436e4b87fe1d0e0f2b",
         "type": "gitlab"
       },
       "original": {
@@ -25,6 +113,22 @@
         "type": "gitlab"
       }
     },
+    "firefox-gnome-theme": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1741628778,
+        "narHash": "sha256-RsvHGNTmO2e/eVfgYK7g+eYEdwwh7SbZa+gZkT24MEA=",
+        "owner": "rafaelmardojai",
+        "repo": "firefox-gnome-theme",
+        "rev": "5a81d390bb64afd4e81221749ec4bffcbeb5fa80",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rafaelmardojai",
+        "repo": "firefox-gnome-theme",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "locked": {
         "lastModified": 1733328505,
@@ -44,11 +148,33 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1738453229,
+        "lastModified": 1741352980,
-        "narHash": "sha256-7H9XgNiGLKN1G1CgRh0vUL4AheZSYzPm+zmZ7vxbJdo=",
+        "narHash": "sha256-+u2UunDA4Cl5Fci3m7S643HzKmIDAe+fiXrLqYsR2fs=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "32ea77a06711b758da0ad9bd6a844c5740a87abd",
+        "rev": "f4330d22f1c5d2ba72d3d22df5597d123fdb60a9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "stylix",
+          "nur",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
         "type": "github"
       },
       "original": {
@@ -77,6 +203,69 @@
         "type": "github"
       }
     },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": [
+          "stylix",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "fromYaml": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1731966426,
+        "narHash": "sha256-lq95WydhbUTWig/JpqiB7oViTcHFP8Lv41IGtayokA8=",
+        "owner": "SenchoPens",
+        "repo": "fromYaml",
+        "rev": "106af9e2f715e2d828df706c386a685698f3223b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "SenchoPens",
+        "repo": "fromYaml",
+        "type": "github"
+      }
+    },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": [
+          "stylix",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore_2",
+        "nixpkgs": [
+          "stylix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1741379162,
+        "narHash": "sha256-srpAbmJapkaqGRE3ytf3bj4XshspVR5964OX5LfjDWc=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "b5a62751225b2f62ff3147d0a334055ebadcd5cc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
     "gitignore": {
       "inputs": {
         "nixpkgs": [
@@ -98,6 +287,45 @@
         "type": "github"
       }
     },
+    "gitignore_2": {
+      "inputs": {
+        "nixpkgs": [
+          "stylix",
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "gnome-shell": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1732369855,
+        "narHash": "sha256-JhUWbcYPjHO3Xs3x9/Z9RuqXbcp5yhPluGjwsdE2GMg=",
+        "owner": "GNOME",
+        "repo": "gnome-shell",
+        "rev": "dadd58f630eeea41d645ee225a63f719390829dc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "GNOME",
+        "ref": "47.2",
+        "repo": "gnome-shell",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -105,11 +333,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740624780,
+        "lastModified": 1743482579,
-        "narHash": "sha256-8TP61AI3QBQsjzVUQFIV8NoB5nbYfJB3iHczhBikDkU=",
+        "narHash": "sha256-u81nqA4UuRatKDkzUuIfVYdLMw8birEy+99oXpdyXhY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b8869e4ead721bbd4f0d6b927e8395705d4f16e6",
+        "rev": "c21383b556609ce1ad901aa08b4c6fbd9e0c7af0",
         "type": "github"
       },
       "original": {
@@ -118,6 +346,27 @@
         "type": "github"
       }
     },
+    "hydra": {
+      "inputs": {
+        "nix": "nix",
+        "nix-eval-jobs": "nix-eval-jobs",
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1743447171,
+        "narHash": "sha256-5+lbBGlOmVa+dNY8L4ElDCkB7+VedZpPTcBOFIF+0TM=",
+        "ref": "add-gitea-pulls",
+        "rev": "a20f37b97fa43eea1570bf125ee95f19ba7e2674",
+        "revCount": 4327,
+        "type": "git",
+        "url": "https://nayeonie.com/ahuston-0/hydra"
+      },
+      "original": {
+        "ref": "add-gitea-pulls",
+        "type": "git",
+        "url": "https://nayeonie.com/ahuston-0/hydra"
+      }
+    },
     "hyprland-contrib": {
       "inputs": {
         "nixpkgs": [
@@ -125,11 +374,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1739465511,
+        "lastModified": 1743417258,
-        "narHash": "sha256-kXdVW89VJoG+W6N1u0m8hgK2VIWUAweQVzehRZwdNSo=",
+        "narHash": "sha256-YItzk1pj8Kz+b7VlC9zN1pSZ6CuX35asYy3HuMQ3lBQ=",
         "owner": "hyprwm",
         "repo": "contrib",
-        "rev": "59178a657b7e09ddf82b9e79681f482b6c2f378b",
+        "rev": "bc2ad24e0b2e66c3e164994c4897cd94a933fd10",
         "type": "github"
       },
       "original": {
@@ -138,6 +387,59 @@
         "type": "github"
       }
     },
+    "nix": {
+      "inputs": {
+        "flake-compat": [
+          "hydra"
+        ],
+        "flake-parts": [
+          "hydra"
+        ],
+        "git-hooks-nix": [
+          "hydra"
+        ],
+        "nixpkgs": [
+          "hydra",
+          "nixpkgs"
+        ],
+        "nixpkgs-23-11": [
+          "hydra"
+        ],
+        "nixpkgs-regression": [
+          "hydra"
+        ]
+      },
+      "locked": {
+        "lastModified": 1739899400,
+        "narHash": "sha256-q/RgA4bB7zWai4oPySq9mch7qH14IEeom2P64SXdqHs=",
+        "owner": "NixOS",
+        "repo": "nix",
+        "rev": "e310c19a1aeb1ce1ed4d41d5ab2d02db596e0918",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "2.26-maintenance",
+        "repo": "nix",
+        "type": "github"
+      }
+    },
+    "nix-eval-jobs": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1739500569,
+        "narHash": "sha256-3wIReAqdTALv39gkWXLMZQvHyBOc3yPkWT2ZsItxedY=",
+        "owner": "nix-community",
+        "repo": "nix-eval-jobs",
+        "rev": "4b392b284877d203ae262e16af269f702df036bc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-eval-jobs",
+        "type": "github"
+      }
+    },
     "nix-index-database": {
       "inputs": {
         "nixpkgs": [
@@ -145,11 +447,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740281615,
+        "lastModified": 1743306489,
-        "narHash": "sha256-dZWcbAQ1sF8oVv+zjSKkPVY0ebwENQEkz5vc6muXbKY=",
+        "narHash": "sha256-LROaIjSLo347cwcHRfSpqzEOa2FoLSeJwU4dOrGm55E=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "465792533d03e6bb9dc849d58ab9d5e31fac9023",
+        "rev": "b3696bfb6c24aa61428839a99e8b40c53ac3a82d",
         "type": "github"
       },
       "original": {
@@ -181,11 +483,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737057290,
+        "lastModified": 1742568034,
-        "narHash": "sha256-3Pe0yKlCc7EOeq1X/aJVDH0CtNL+tIBm49vpepwL1MQ=",
+        "narHash": "sha256-QaMEhcnscfF2MqB7flZr+sLJMMYZPnvqO4NYf9B4G38=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "d002ce9b6e7eb467cd1c6bb9aef9c35d191b5453",
+        "rev": "42ee229088490e3777ed7d1162cb9e9d8c3dbb11",
         "type": "github"
       },
       "original": {
@@ -196,11 +498,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1740387674,
+        "lastModified": 1743420942,
-        "narHash": "sha256-pGk/aA0EBvI6o4DeuZsr05Ig/r4uMlSaf5EWUZEWM10=",
+        "narHash": "sha256-b/exDDQSLmENZZgbAEI3qi9yHkuXAXCPbormD8CSJXo=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "d58f642ddb23320965b27beb0beba7236e9117b5",
+        "rev": "de6fc5551121c59c01e2a3d45b277a6d05077bc4",
         "type": "github"
       },
       "original": {
@@ -219,11 +521,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740603919,
+        "lastModified": 1743178092,
-        "narHash": "sha256-2zwtSnCI8QZfIOFOpjJ5w2bslQ5r/GYXZ1Pi7fMdrOo=",
+        "narHash": "sha256-fOMsQpcdIbj+wOexiCSEW2J4Erqd0LRV25aYiOx4QRw=",
         "owner": "SuperSandro2000",
         "repo": "nixos-modules",
-        "rev": "732ffa8e01e911428db96ff978d1e3876f649ef3",
+        "rev": "77ff511df92a9d4a828bdf032b8f48e7c3d99b50",
         "type": "github"
       },
       "original": {
@@ -234,11 +536,58 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1740557110,
+        "lastModified": 1739461644,
-        "narHash": "sha256-D2waFyJkaepTchTrGVAIfCd/YP+37bgXWg9cXwuxuT0=",
+        "narHash": "sha256-1o1qR0KYozYGRrnqytSpAhVBYLNBHX+Lv6I39zGRzKM=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "97a719c9f0a07923c957cf51b20b329f9fb9d43f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.11-small",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1740877520,
+        "narHash": "sha256-oiwv/ZK/2FhGxrCkQkB83i7GnWXPPLzoqFHpDD3uYpk=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "147dee35aab2193b174e4c0868bd80ead5ce755c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1743367904,
+        "narHash": "sha256-sOos1jZGKmT6xxPvxGQyPTApOunXvScV4lNjBCXd/CI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b89a821293c3872992137114d0db9a791243a41b",
+        "rev": "7ffe0edc685f14b8c635e3d6591b0bbb97365e6c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1743472173,
+        "narHash": "sha256-xwNv3FYTC5pl4QVZ79gUxqCEvqKzcKdXycpH5UbYscw=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "88e992074d86ad50249de12b7fb8dbaadf8dc0c5",
         "type": "github"
       },
       "original": {
@@ -248,31 +597,26 @@
         "type": "github"
       }
     },
-    "nixpkgs-lib": {
+    "nur": {
-      "locked": {
+      "inputs": {
-        "lastModified": 1738452942,
+        "flake-parts": "flake-parts_2",
-        "narHash": "sha256-vJzFZGaCpnmo7I6i416HaBLpC+hvcURh/BQwROcGIp8=",
+        "nixpkgs": [
-        "type": "tarball",
+          "stylix",
-        "url": "https://github.com/NixOS/nixpkgs/archive/072a6db25e947df2f31aab9eccd0ab75d5b2da11.tar.gz"
+          "nixpkgs"
+        ],
+        "treefmt-nix": "treefmt-nix"
       },
-      "original": {
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/072a6db25e947df2f31aab9eccd0ab75d5b2da11.tar.gz"
-      }
-    },
-    "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1735563628,
+        "lastModified": 1741693509,
-        "narHash": "sha256-OnSAY7XDSx7CtDoqNh8jwVwh4xNL/2HaJxGjryLWzX8=",
+        "narHash": "sha256-emkxnsZstiJWmGACimyAYqIKz2Qz5We5h1oBVDyQjLw=",
-        "owner": "nixos",
+        "owner": "nix-community",
-        "repo": "nixpkgs",
+        "repo": "NUR",
-        "rev": "b134951a4c9f3c995fd7be05f3243f8ecd65d798",
+        "rev": "5479646b2574837f1899da78bdf9a48b75a9fb27",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "nix-community",
-        "ref": "nixos-24.05",
+        "repo": "NUR",
-        "repo": "nixpkgs",
         "type": "github"
       }
     },
@@ -287,11 +631,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737465171,
+        "lastModified": 1742649964,
-        "narHash": "sha256-R10v2hoJRLq8jcL4syVFag7nIGE7m13qO48wRIukWNg=",
+        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "9364dc02281ce2d37a1f55b6e51f7c0f65a75f17",
+        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
         "type": "github"
       },
       "original": {
@@ -302,22 +646,25 @@
     },
     "root": {
       "inputs": {
+        "disko": "disko",
         "firefox-addons": "firefox-addons",
         "flake-compat": "flake-compat",
         "flake-parts": "flake-parts",
         "flake-utils": "flake-utils",
         "home-manager": "home-manager",
+        "hydra": "hydra",
         "hyprland-contrib": "hyprland-contrib",
         "nix-index-database": "nix-index-database",
         "nixos-generators": "nixos-generators",
         "nixos-hardware": "nixos-hardware",
         "nixos-modules": "nixos-modules",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
         "nixpkgs-stable": "nixpkgs-stable",
         "pre-commit-hooks": "pre-commit-hooks",
         "rust-overlay": "rust-overlay",
         "sops-nix": "sops-nix",
-        "systems": "systems",
+        "stylix": "stylix",
+        "systems": "systems_2",
         "wired-notify": "wired-notify"
       }
     },
@@ -328,11 +675,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740623427,
+        "lastModified": 1743475035,
-        "narHash": "sha256-3SdPQrZoa4odlScFDUHd4CUPQ/R1gtH4Mq9u8CBiK8M=",
+        "narHash": "sha256-uLjVsb4Rxnp1zmFdPCDmdODd4RY6ETOeRj0IkC0ij/4=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "d342e8b5fd88421ff982f383c853f0fc78a847ab",
+        "rev": "bee11c51c2cda3ac57c9e0149d94b86cc1b00d13",
         "type": "github"
       },
       "original": {
@@ -348,11 +695,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1739262228,
+        "lastModified": 1743502316,
-        "narHash": "sha256-7JAGezJ0Dn5qIyA2+T4Dt/xQgAbhCglh6lzCekTVMeU=",
+        "narHash": "sha256-zI2WSkU+ei4zCxT+IVSQjNM9i0ST++T2qSFXTsAND7s=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "07af005bb7d60c7f118d9d9f5530485da5d1e975",
+        "rev": "e7f4d7ed8bce8dfa7d2f2fe6f8b8f523e54646f8",
         "type": "github"
       },
       "original": {
@@ -361,6 +708,47 @@
         "type": "github"
       }
     },
+    "stylix": {
+      "inputs": {
+        "base16": "base16",
+        "base16-fish": "base16-fish",
+        "base16-helix": "base16-helix",
+        "base16-vim": "base16-vim",
+        "firefox-gnome-theme": "firefox-gnome-theme",
+        "flake-compat": [
+          "flake-compat"
+        ],
+        "flake-utils": "flake-utils_2",
+        "git-hooks": "git-hooks",
+        "gnome-shell": "gnome-shell",
+        "home-manager": [
+          "home-manager"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "nur": "nur",
+        "systems": "systems",
+        "tinted-foot": "tinted-foot",
+        "tinted-kitty": "tinted-kitty",
+        "tinted-schemes": "tinted-schemes",
+        "tinted-tmux": "tinted-tmux",
+        "tinted-zed": "tinted-zed"
+      },
+      "locked": {
+        "lastModified": 1743496321,
+        "narHash": "sha256-xhHg8ixBhZngvGOMb2SJuJEHhHA10n8pA02fEKuKzek=",
+        "owner": "danth",
+        "repo": "stylix",
+        "rev": "54721996d6590267d095f63297d9051e9342a33d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "danth",
+        "repo": "stylix",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -376,6 +764,125 @@
         "type": "github"
       }
     },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "tinted-foot": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1726913040,
+        "narHash": "sha256-+eDZPkw7efMNUf3/Pv0EmsidqdwNJ1TaOum6k7lngDQ=",
+        "owner": "tinted-theming",
+        "repo": "tinted-foot",
+        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "tinted-foot",
+        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
+        "type": "github"
+      }
+    },
+    "tinted-kitty": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1716423189,
+        "narHash": "sha256-2xF3sH7UIwegn+2gKzMpFi3pk5DlIlM18+vj17Uf82U=",
+        "owner": "tinted-theming",
+        "repo": "tinted-kitty",
+        "rev": "eb39e141db14baef052893285df9f266df041ff8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "tinted-kitty",
+        "rev": "eb39e141db14baef052893285df9f266df041ff8",
+        "type": "github"
+      }
+    },
+    "tinted-schemes": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1741468895,
+        "narHash": "sha256-YKM1RJbL68Yp2vESBqeZQBjTETXo8mCTTzLZyckCfZk=",
+        "owner": "tinted-theming",
+        "repo": "schemes",
+        "rev": "47c8c7726e98069cade5827e5fb2bfee02ce6991",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "schemes",
+        "type": "github"
+      }
+    },
+    "tinted-tmux": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1740877430,
+        "narHash": "sha256-zWcCXgdC4/owfH/eEXx26y5BLzTrefjtSLFHWVD5KxU=",
+        "owner": "tinted-theming",
+        "repo": "tinted-tmux",
+        "rev": "d48ee86394cbe45b112ba23ab63e33656090edb4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "tinted-tmux",
+        "type": "github"
+      }
+    },
+    "tinted-zed": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1725758778,
+        "narHash": "sha256-8P1b6mJWyYcu36WRlSVbuj575QWIFZALZMTg5ID/sM4=",
+        "owner": "tinted-theming",
+        "repo": "base16-zed",
+        "rev": "122c9e5c0e6f27211361a04fae92df97940eccf9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-zed",
+        "type": "github"
+      }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "stylix",
+          "nur",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1733222881,
+        "narHash": "sha256-JIPcz1PrpXUCbaccEnrcUS8jjEb/1vJbZz5KkobyFdM=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "49717b5af6f80172275d47a418c9719a31a78b53",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
     "wired-notify": {
       "inputs": {
         "flake-parts": [
@@ -389,11 +896,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1730615238,
+        "lastModified": 1743305055,
-        "narHash": "sha256-u/ZGtyEUvAkFOBgLo2YldOx0GKjE3/esWpWruRD376E=",
+        "narHash": "sha256-NIsi8Dno9YsOLUUTrLU4p+hxYeJr3Vkg1gIpQKVTaDs=",
         "owner": "Toqozz",
         "repo": "wired-notify",
-        "rev": "1632418aa15889343028261663e81d8b5595860e",
+        "rev": "75d43f54a02b15f2a15f5c1a0e1c7d15100067a6",
         "type": "github"
       },
       "original": {

flake.nix

@@ -18,6 +18,7 @@
       "nix-cache:trR+y5nwpQHR4hystoogubFmp97cewkjWeqqbygRQRs="
     ];
     trusted-users = [ "root" ];
+    allow-import-from-derivation = true;
   };
 
   inputs = {
@@ -26,7 +27,8 @@
     nixos-hardware.url = "github:NixOS/nixos-hardware";
     #nixpkgs.url = "github:nuschtos/nuschtpkgs/nixos-unstable";
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable-small";
-    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.05";
+    #nixpkgs.url = "github:nixos/nixpkgs/1d2fe0135f360c970aee1d57a53f816f3c9bddae?narHash=sha256-Up7YlXIupmT7fEtC4Oj676M91INg0HAoamiswAsA3rc%3D";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.11";
     systems.url = "github:nix-systems/default";
 
     # attic = {
@@ -38,6 +40,12 @@
     #     flake-parts.follows = "flake-parts";
     #   };
     # };
+    disko = {
+      url = "github:nix-community/disko/latest";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+      };
+    };
 
     firefox-addons = {
       url = "gitlab:rycee/nur-expressions?dir=pkgs/firefox-addons";
@@ -57,6 +65,13 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    hydra = {
+      url = "git+https://nayeonie.com/ahuston-0/hydra?ref=add-gitea-pulls";
+      # inputs = {
+      #   nixpkgs.follows = "nixpkgs";
+      # };
+    };
+
     hyprland-contrib = {
       url = "github:hyprwm/contrib";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -102,6 +117,15 @@
       };
     };
 
+    stylix = {
+      url = "github:danth/stylix";
+      inputs = {
+        flake-compat.follows = "flake-compat";
+        home-manager.follows = "home-manager";
+        nixpkgs.follows = "nixpkgs";
+      };
+    };
+
     wired-notify = {
       url = "github:Toqozz/wired-notify";
       inputs = {

hydra/jobsets.nix

@@ -19,7 +19,6 @@ let
 
   prs = readJSONFile pulls;
   refs = readJSONFile branches;
-  repo = "RAD-Development/nix-dotfiles";
 
   # template for creating a job
   makeJob =
@@ -28,6 +27,7 @@ let
       keepnr ? 3,
       description,
       flake,
+      enabled ? 1,
     }:
     {
       inherit
@@ -35,8 +35,8 @@ let
         flake
         schedulingshares
         keepnr
+        enabled
         ;
-      enabled = 1;
       type = 1;
       hidden = false;
       checkinterval = 300; # every 5 minutes
@@ -44,7 +44,9 @@ let
       emailoverride = "";
     };
 
-  # Create a hydra job for a branch
+  giteaHost = "ssh://gitea@nayeonie.com:2222";
+  repo = "ahuston-0/nix-dotfiles";
+  # # Create a hydra job for a branch
   jobOfRef =
     name:
     { ref, ... }:
@@ -55,7 +57,7 @@ let
         name = builtins.replaceStrings [ "/" ] [ "-" ] "branch-${name}";
         value = makeJob {
           description = "Branch ${name}";
-          flake = "git+ssh://git@github.com/${repo}?ref=${ref}";
+          flake = "git+${giteaHost}/${repo}?ref=${ref}";
         };
       };
 
@@ -64,7 +66,8 @@ let
     name = if info.draft then "draft-${id}" else "pr-${id}";
     value = makeJob {
       description = "PR ${id}: ${info.title}";
-      flake = "git+ssh://git@github.com/${info.head.repo.full_name}?ref=${info.head.ref}";
+      flake = "git+${giteaHost}/${repo}?ref=${info.head.ref}";
+      enabled = info.state == "open";
     };
   };
 

hydra/spec.json

@@ -1,7 +1,7 @@
 {
   "enabled": 1,
   "hidden": false,
-  "description": "RAD Development infrastructure",
+  "description": "ahuston-0's personal server infra",
   "nixexprinput": "nixexpr",
   "nixexprpath": "hydra/jobsets.nix",
   "checkinterval": 60,
@@ -12,7 +12,7 @@
   "type": 0,
   "inputs": {
     "nixexpr": {
-      "value": "https://github.com/RAD-Development/nix-dotfiles main",
+      "value": "ssh://gitea@nayeonie.com:2222/ahuston-0/nix-dotfiles.git main",
       "type": "git",
       "emailresponsible": false
     },
@@ -22,13 +22,13 @@
       "emailresponsible": false
     },
     "pulls": {
-      "type": "githubpulls",
+      "type": "giteapulls",
-      "value": "RAD-Development nix-dotfiles",
+      "value": "nayeonie.com ahuston-0 nix-dotfiles https",
       "emailresponsible": false
     },
     "branches": {
-      "type": "github_refs",
+      "type": "gitea_refs",
-      "value": "RAD-Development nix-dotfiles heads -",
+      "value": "nayeonie.com ahuston-0 nix-dotfiles heads https -",
       "emailresponsible": false
     }
   }

modules/update.nix

@@ -10,10 +10,10 @@
   };
 
   system.autoUpgrade = {
-    enable = lib.mkDefault false;
+    enable = lib.mkDefault true;
     flags = [ "--accept-flake-config" ];
     randomizedDelaySec = "1h";
     persistent = true;
-    flake = "github:RAD-Development/nix-dotfiles";
+    flake = "git+ssh://nayeonie.com/ahuston-0/nix-dotfiles.git";
   };
 }

shell.nix

@@ -45,6 +45,10 @@ forEachSystem (
         treefmt
         statix
         nixfmt-rfc-style
+        jsonfmt
+        mdformat
+        shfmt
+        yamlfmt
       ];
     };
   in

systems/artemision/configuration.nix

@@ -6,17 +6,18 @@
 }:
 {
   imports = [
-    ./programs.nix
-    ./desktop.nix
-    ./wifi.nix
-    ./zerotier.nix
-    ./fonts.nix
-    ./polkit.nix
     ./audio.nix
+    ./desktop.nix
     ./fingerprint.nix
-    ./steam.nix
+    ./fonts.nix
     ./graphics.nix
     ./libvirt.nix
+    ./polkit.nix
+    ./programs.nix
+    ./steam.nix
+    ./stylix.nix
+    ./wifi.nix
+    ./zerotier.nix
   ];
 
   time.timeZone = "America/New_York";
@@ -31,7 +32,7 @@
   };
 
   boot = {
-    kernelPackages = lib.mkForce pkgs.linuxPackages_6_6;
+    #kernelPackages = lib.mkForce pkgs.linuxPackages_6_6;
     useSystemdBoot = true;
     default = true;
   };
@@ -74,17 +75,6 @@
     fprintd.enable = lib.mkForce false;
     openssh.enable = lib.mkForce false;
 
-    spotifyd = {
-      enable = true;
-      settings = {
-        global = {
-          username = "snowinginwonderland@gmail.com";
-          password_cmd = "cat ${config.sops.secrets."apps/spotify".path}";
-          use_mpris = false;
-        };
-      };
-      #systemd.services.spotifyd.serviceConfig = systemd.services.spotifyd.
-    };
     rad-dev.yubikey = {
       enable = true;
       enable-desktop-app = true;
@@ -93,19 +83,22 @@
 
   users.users.alice.extraGroups = [ "calibre-web" ];
 
-  system.autoUpgrade.enable = false;
   system.stateVersion = "24.05";
 
   programs.adb.enable = true;
 
+  environment.variables = {
+    "KWIN_DRM_NO_DIRECT_SCANOUT" = "1";
+  };
+
   sops = {
     defaultSopsFile = ./secrets.yaml;
-    secrets = {
+    #secrets = {
-      "apps/spotify" = {
+    #  "apps/spotify" = {
-        group = "audio";
+    #    group = "audio";
-        restartUnits = [ "spotifyd.service" ];
+    #    restartUnits = [ "spotifyd.service" ];
-        mode = "0440";
+    #    mode = "0440";
-      };
+    #  };
-    };
+    #};
   };
 }

systems/artemision/default.nix

@@ -7,6 +7,7 @@
   users = [ "alice" ];
   modules = [
     inputs.nixos-hardware.nixosModules.framework-16-7040-amd
+    inputs.stylix.nixosModules.stylix
     {
       environment.systemPackages = [
         inputs.wired-notify.packages.x86_64-linux.default

systems/artemision/desktop.nix

@@ -7,6 +7,7 @@
     hyprland = {
       enable = true;
       xwayland.enable = true;
+      withUWSM = true;
     };
     hyprlock.enable = true;
     gnupg.agent = {

systems/artemision/programs.nix

@@ -18,8 +18,6 @@
     croc
     deadnix
     direnv
-    discord
-    discord-canary
     easyeffects
     eza
     fanficfare
@@ -44,6 +42,7 @@
     kitty
     kubectl
     kubernetes-helm
+    libreoffice-fresh
     libtool
     lsof
     lynis
@@ -111,6 +110,5 @@
     yt-dlp
     zoom-us
     zoxide
-    zoom
   ];
 }

systems/artemision/stylix.nix

@@ -0,0 +1,16 @@
+{ pkgs, ... }:
+# let
+# randWallpaper = pkgs.runCommand "stylix-wallpaper" { } ''
+#   numWallpapers =
+#   $((1 + $RANDOM % 10))
+
+# in
+{
+  stylix = {
+    enable = true;
+    image = "${pkgs.hyprland}/share/hypr/wall2.png";
+
+    #image = "/home/alice/Pictures/Screenshots/screenshot_2024-12-04-2030.png";
+    polarity = "dark";
+  };
+}

systems/hetzner-bridge/configuration.nix

@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [
+    ../../disko/hetzner.nix
+    ./networking.nix
+  ];
+  disko.devices.disk.main.device = "scsi-0QEMU_QEMU_HARDDISK_55513992";
+
+  boot = {
+    useSystemdBoot = true;
+  };
+
+  virtualisation.docker.enable = false;
+  services = {
+    locate.enable = false;
+    endlessh-go.enable = false;
+  };
+
+  #hardware.enableAllFirmware = true;
+
+  system.stateVersion = "24.05";
+}

systems/hetzner-bridge/default.nix

@@ -0,0 +1,8 @@
+{ inputs, ... }:
+{
+  users = [ "alice" ];
+  modules = [
+    # inputs.attic.nixosModules.atticd
+    inputs.disko.nixosModules.disko
+  ];
+}

systems/hetzner-bridge/hardware.nix

@@ -0,0 +1,39 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot = {
+    initrd.availableKernelModules = [
+      "ahci"
+      "xhci_pci"
+      "virtio_pci"
+      "virtio_scsi"
+      "sd_mod"
+      "sr_mod"
+    ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ ];
+    extraModulePackages = [ ];
+  };
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  # networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

systems/hetzner-bridge/networking.nix

@@ -0,0 +1,19 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  networking.useDHCP = false;
+
+  systemd.network = {
+    enable = true;
+    networks."10-wan" = {
+      #matchConfig.Name = "enp1s0"; # either ens3 or enp1s0 depending on system, check 'ip addr'
+      matchConfig.Name = "ether";
+      networkConfig.DHCP = "ipv4";
+    };
+  };
+}

systems/palatine-hill/attic/default.nix

@@ -62,58 +62,58 @@
 
   # borrowing from https://github.com/Shawn8901/nix-configuration/blob/4b8d1d44f47aec60feb58ca7b7ab5ed000506e90/modules/nixos/private/hydra.nix
   # configured default webstore for this on root user separately
-  # systemd = {
+  systemd = {
-  #   services = {
+    services = {
-  #     attic-watch-store = {
+      attic-watch-store = {
-  #       wantedBy = [ "multi-user.target" ];
+        wantedBy = [ "multi-user.target" ];
-  #       after = [
+        after = [
-  #         "network-online.target"
+          "network-online.target"
-  #         "docker.service"
+          "docker.service"
-  #         "atticd.service"
+          "atticd.service"
-  #       ];
+        ];
-  #       requires = [
+        requires = [
-  #         "network-online.target"
+          "network-online.target"
-  #         "docker.service"
+          "docker.service"
-  #         "atticd.service"
+          "atticd.service"
-  #       ];
+        ];
-  #       description = "Upload all store content to binary cache";
+        description = "Upload all store content to binary cache";
-  #       serviceConfig = {
+        serviceConfig = {
-  #         User = "root";
+          User = "root";
-  #         Restart = "always";
+          Restart = "always";
-  #         ExecStart = "${pkgs.attic-client}/bin/attic watch-store cache-nix-dot";
+          ExecStart = "${pkgs.attic-client}/bin/attic watch-store nix-cache";
-  #       };
+        };
-  #     };
+      };
-  #     attic-sync-hydra = {
+      attic-sync-hydra = {
-  #       after = [
+        after = [
-  #         "network-online.target"
+          "network-online.target"
-  #         "docker.service"
+          "docker.service"
-  #         "atticd.service"
+          "atticd.service"
-  #       ];
+        ];
-  #       requires = [
+        requires = [
-  #         "network-online.target"
+          "network-online.target"
-  #         "docker.service"
+          "docker.service"
-  #         "atticd.service"
+          "atticd.service"
-  #       ];
+        ];
-  #       description = "Force resync of hydra derivations with attic";
+        description = "Force resync of hydra derivations with attic";
-  #       serviceConfig = {
+        serviceConfig = {
-  #         Type = "oneshot";
+          Type = "oneshot";
-  #         User = "root";
+          User = "root";
-  #         ExecStart = "${config.nix.package}/bin/nix ${./sync-attic.bash}";
+          ExecStart = "${config.nix.package}/bin/nix ${./sync-attic.bash}";
-  #       };
+        };
-  #     };
+      };
-  #   };
+    };
 
-  #   timers = {
+    timers = {
-  #     attic-sync-hydra = {
+      attic-sync-hydra = {
-  #       wantedBy = [ "timers.target" ];
+        wantedBy = [ "timers.target" ];
-  #       timerConfig = {
+        timerConfig = {
-  #         OnBootSec = 600;
+          OnBootSec = 600;
-  #         OnUnitActiveSec = 86400;
+          OnUnitActiveSec = 86400;
-  #         Unit = "attic-sync-hydra.service";
+          Unit = "attic-sync-hydra.service";
-  #       };
+        };
-  #     };
+      };
-  #   };
+    };
-  # };
+  };
 
   sops = {
     secrets = {

systems/palatine-hill/attic/sync-attic.bash

@@ -2,9 +2,9 @@
 #! nix shell nixpkgs#bash nixpkgs#findutils nixpkgs#attic-client --command bash
 
 sync_directories=(
-    /ZFS/ZFS-primary/hydra
+  /ZFS/ZFS-primary/hydra
 )
 
 for dir in "${sync_directories[@]}"; do
-    find "$dir"  -regex ".*\.drv$" -exec attic push cache-nix-dot '{}' \;
+  find "$dir" -regex ".*\.drv$" -exec attic push nix-cache '{}' \;
 done

systems/palatine-hill/configuration.nix

@@ -17,8 +17,8 @@
     ./minio.nix
     ./networking.nix
     ./nextcloud.nix
-    ./samba.nix
     ./postgresql.nix
+    ./samba.nix
     ./zfs.nix
   ];
 

systems/palatine-hill/docker/act-runner.nix

@@ -6,10 +6,11 @@
 let
   vars = import ../vars.nix;
   act_path = vars.primary_act;
+  act_config_path = ./act_config.yaml;
 in
 {
   virtualisation.oci-containers.containers = {
-    act-stable-latest-1 = {
+    act-stable-latest-main = {
       image = "gitea/act_runner:latest";
       extraOptions = [
         "--stop-signal=SIGINT"
@@ -20,7 +21,29 @@ in
       };
       ports = [ "8088:8088" ];
       volumes = [
-        "${act_path}/stable-latest-1/config.yaml:/config.yaml"
+        "${act_config_path}:/config.yaml"
+        "${act_path}/stable-latest-main/data:/data"
+        "/var/run/docker.sock:/var/run/docker.sock"
+      ];
+      environment = {
+        CONFIG_FILE = "/config.yaml";
+        GITEA_RUNNER_NAME = "stable-latest-main";
+      };
+      environmentFiles = [ config.sops.secrets."docker/act-runner".path ];
+      log-driver = "local";
+    };
+
+    act-stable-latest-1 = {
+      image = "gitea/act_runner:latest";
+      extraOptions = [
+        "--stop-signal=SIGINT"
+      ];
+      labels = {
+        "com.centurylinklabs.watchtower.enable" = "true";
+        "com.centurylinklabs.watchtower.scope" = "act-runner";
+      };
+      volumes = [
+        "${./act_config.yaml}:/config.yaml"
         "${act_path}/stable-latest-1/data:/data"
         "/var/run/docker.sock:/var/run/docker.sock"
       ];
@@ -41,9 +64,8 @@ in
         "com.centurylinklabs.watchtower.enable" = "true";
         "com.centurylinklabs.watchtower.scope" = "act-runner";
       };
-      # ports = [ "8088:8088" ];
       volumes = [
-        "${act_path}/stable-latest-2/config.yaml:/config.yaml"
+        "${act_config_path}:/config.yaml"
         "${act_path}/stable-latest-2/data:/data"
         "/var/run/docker.sock:/var/run/docker.sock"
       ];
@@ -54,29 +76,6 @@ in
       environmentFiles = [ config.sops.secrets."docker/act-runner".path ];
       log-driver = "local";
     };
-
-    act-stable-latest-3 = {
-      image = "gitea/act_runner:latest";
-      extraOptions = [
-        "--stop-signal=SIGINT"
-      ];
-      labels = {
-        "com.centurylinklabs.watchtower.enable" = "true";
-        "com.centurylinklabs.watchtower.scope" = "act-runner";
-      };
-      # ports = [ "8088:8088" ];
-      volumes = [
-        "${act_path}/stable-latest-3/config.yaml:/config.yaml"
-        "${act_path}/stable-latest-3/data:/data"
-        "/var/run/docker.sock:/var/run/docker.sock"
-      ];
-      environment = {
-        CONFIG_FILE = "/config.yaml";
-        GITEA_RUNNER_NAME = "stable-latest-3";
-      };
-      environmentFiles = [ config.sops.secrets."docker/act-runner".path ];
-      log-driver = "local";
-    };
   };
 
   systemd = {
@@ -104,7 +103,9 @@ in
     "docker/act-runner" = {
       owner = "root";
       restartUnits = [
+        "docker-act-stable-latest-main.service"
         "docker-act-stable-latest-1.service"
+        "docker-act-stable-latest-2.service"
       ];
     };
   };

systems/palatine-hill/docker/act_config.yaml

@@ -0,0 +1,95 @@
+# Example configuration file, it's safe to copy this as the default config file without any modification.
+# You don't have to copy this file to your instance,
+# just run `./act_runner generate-config > config.yaml` to generate a config file.
+log:
+    # The level of logging, can be trace, debug, info, warn, error, fatal
+    level: debug
+runner:
+    # Where to store the registration result.
+    file: .runner
+    # Execute how many tasks concurrently at the same time.
+    capacity: 1
+    # Extra environment variables to run jobs.
+    envs:
+        A_TEST_ENV_NAME_1: a_test_env_value_1
+        A_TEST_ENV_NAME_2: a_test_env_value_2
+    # Extra environment variables to run jobs from a file.
+    # It will be ignored if it's empty or the file doesn't exist.
+    env_file: .env
+    # The timeout for a job to be finished.
+    # Please note that the Gitea instance also has a timeout (3h by default) for the job.
+    # So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
+    timeout: 3h
+    # The timeout for the runner to wait for running jobs to finish when shutting down.
+    # Any running jobs that haven't finished after this timeout will be cancelled.
+    shutdown_timeout: 30m
+    # Whether skip verifying the TLS certificate of the Gitea instance.
+    insecure: false
+    # The timeout for fetching the job from the Gitea instance.
+    fetch_timeout: 5s
+    # The interval for fetching the job from the Gitea instance.
+    fetch_interval: 2s
+    # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
+    # Like: "macos-arm64:host" or "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
+    # Find more images provided by Gitea at https://gitea.com/gitea/runner-images .
+    # If it's empty when registering, it will ask for inputting labels.
+    # If it's empty when execute `daemon`, will use labels in `.runner` file.
+    labels:
+        - "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
+        - "ubuntu-22.04:docker://gitea/runner-images:ubuntu-22.04"
+        - "ubuntu-20.04:docker://gitea/runner-images:ubuntu-20.04"
+        #cache:
+    # Enable cache server to use actions/cache.
+    #enabled: true
+    # The directory to store the cache data.
+    # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
+    #dir: ""
+    # The host of the cache server.
+    # It's not for the address to listen, but the address to connect from job containers.
+    # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
+    #host: ""
+    # The port of the cache server.
+    # 0 means to use a random available port.
+    #port: 0
+    # The external cache server URL. Valid only when enable is true.
+    # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
+    # The URL should generally end with "/".
+    #external_server: ""
+container:
+    # Specifies the network to which the container will connect.
+    # Could be host, bridge or the name of a custom network.
+    # If it's empty, act_runner will create a network automatically.
+    network: ""
+    # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
+    privileged: false
+    # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
+    options:
+    # The parent directory of a job's working directory.
+    # NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically. 
+    # If the path starts with '/', the '/' will be trimmed.
+    # For example, if the parent directory is /path/to/my/dir, workdir_parent should be path/to/my/dir
+    # If it's empty, /workspace will be used.
+    workdir_parent:
+    # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
+    # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
+    # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
+    # valid_volumes:
+    #   - data
+    #   - /src/*.json
+    # If you want to allow any volume, please use the following configuration:
+    # valid_volumes:
+    #   - '**'
+    valid_volumes: []
+    # overrides the docker client host with the specified one.
+    # If it's empty, act_runner will find an available docker host automatically.
+    # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
+    # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
+    docker_host: ""
+    # Pull docker image(s) even if already present
+    force_pull: true
+    # Rebuild docker image(s) even if already present
+    force_rebuild: false
+host:
+    # The parent directory of a job's working directory.
+    # If it's empty, $HOME/.cache/act/ will be used.
+    workdir_parent:

systems/palatine-hill/docker/default.nix

@@ -24,5 +24,56 @@
   ];
 
   virtualisation.oci-containers.backend = "docker";
-  virtualisation.docker.daemon.settings.data-root = "/var/lib/docker2";
+  virtualisation.docker.daemon.settings = {
+    data-root = "/var/lib/docker2";
+    bip = "169.254.253.254/23";
+    fixed-cidr = "169.254.252.0/23";
+    default-address-pools = [
+      {
+        base = "169.254.2.0/23";
+        size = 28;
+      }
+      {
+        base = "169.254.4.0/22";
+        size = 28;
+      }
+      {
+        base = "169.254.8.0/21";
+        size = 28;
+      }
+      {
+        base = "169.254.16.0/20";
+        size = 28;
+      }
+      {
+        base = "169.254.32.0/19";
+        size = 28;
+      }
+      {
+        base = "169.254.64.0/18";
+        size = 28;
+      }
+      {
+        base = "169.254.128.0/18";
+        size = 28;
+      }
+      {
+        base = "169.254.192.0/19";
+        size = 28;
+      }
+      {
+        base = "169.254.224.0/20";
+        size = 28;
+      }
+      {
+        base = "169.254.240.0/21";
+        size = 28;
+      }
+      {
+        base = "169.254.248.0/22";
+        size = 28;
+      }
+    ];
+    mtu = 9000;
+  };
 }

systems/palatine-hill/docker/minecraft.nix

@@ -9,31 +9,31 @@ let
     divinejourney = "dj.alicehuston.xyz";
     rlcraft = "rlcraft.alicehuston.xyz";
     arcanum-institute = "arcanum.alicehuston.xyz";
-    bcg-plus = "bcg.alicehuston.xyz";
+    # bcg-plus = "bcg.alicehuston.xyz";
   };
 
   defaultServer = "rlcraft";
 
-  defaultEnv = {
+  # defaultEnv = {
-    EULA = "true";
+  #   EULA = "true";
-    TYPE = "AUTO_CURSEFORGE";
+  #   TYPE = "AUTO_CURSEFORGE";
-    STOP_SERVER_ANNOUNCE_DELAY = "120";
+  #   STOP_SERVER_ANNOUNCE_DELAY = "120";
-    STOP_DURATION = "600";
+  #   STOP_DURATION = "600";
-    SYNC_CHUNK_WRITES = "false";
+  #   SYNC_CHUNK_WRITES = "false";
-    USE_AIKAR_FLAGS = "true";
+  #   USE_AIKAR_FLAGS = "true";
-    MEMORY = "8GB";
+  #   MEMORY = "8GB";
-    ALLOW_FLIGHT = "true";
+  #   ALLOW_FLIGHT = "true";
-    MAX_TICK_TIME = "-1";
+  #   MAX_TICK_TIME = "-1";
-  };
+  # };
 
-  defaultOptions = [
+  # defaultOptions = [
-    "--stop-signal=SIGTERM"
+  #   "--stop-signal=SIGTERM"
-    "--stop-timeout=1800"
+  #   "--stop-timeout=1800"
-    "--network=minecraft-net"
+  #   "--network=minecraft-net"
-  ];
+  # ];
 
-  vars = import ../vars.nix;
+  # vars = import ../vars.nix;
-  minecraft_path = "${vars.primary_games}/minecraft";
+  # minecraft_path = "${vars.primary_games}/minecraft";
 in
 {
   virtualisation.oci-containers.containers = {
@@ -67,24 +67,24 @@ in
     #   log-driver = "local";
     #   environmentFiles = [ config.sops.secrets."docker/minecraft".path ];
     # };
-    bcg-plus = {
+    # bcg-plus = {
-      image = "itzg/minecraft-server:java17";
+    #   image = "itzg/minecraft-server:java17";
-      volumes = [
+    #   volumes = [
-        "${minecraft_path}/bcg-plus/modpacks:/modpacks:ro"
+    #     "${minecraft_path}/bcg-plus/modpacks:/modpacks:ro"
-        "${minecraft_path}/bcg-plus/data:/data"
+    #     "${minecraft_path}/bcg-plus/data:/data"
-      ];
+    #   ];
-      hostname = "bcg-plus";
+    #   hostname = "bcg-plus";
-      environment = defaultEnv // {
+    #   environment = defaultEnv // {
-        VERSION = "1.17";
+    #     VERSION = "1.17";
-        CF_SLUG = "bcg";
+    #     CF_SLUG = "bcg";
-        DIFFICULTY = "normal";
+    #     DIFFICULTY = "normal";
-        DEBUG = "true";
+    #     DEBUG = "true";
-        # ENABLE_COMMAND_BLOCK = "true";
+    #     # ENABLE_COMMAND_BLOCK = "true";
-      };
+    #   };
-      extraOptions = defaultOptions;
+    #   extraOptions = defaultOptions;
-      log-driver = "local";
+    #   log-driver = "local";
-      environmentFiles = [ config.sops.secrets."docker/minecraft".path ];
+    #   environmentFiles = [ config.sops.secrets."docker/minecraft".path ];
-    };
+    # };
   };
 
   sops = {

systems/palatine-hill/docker/nextcloud.nix

@@ -100,7 +100,7 @@ in
       };
       "docker/collabora" = {
         owner = "www-data";
-        restartUnits = [ "docker-collabora.service" ];
+        restartUnits = [ "docker-collabora-code.service" ];
       };
     };
   };

systems/palatine-hill/docker/watchtower.bash

@@ -6,8 +6,8 @@ outdated_msg="Project code is out of date and needs to be upgraded. To remedy th
 label="$1"
 label_val="$2"
 
-if (( $# != 2 )); then
+if (($# != 2)); then
-    echo "usage: $0 label label_value"
+  echo "usage: $0 label label_value"
 fi
 
 containers=$(docker ps --format '{{.Names}}' -f "label=${label}=${label_val}")

systems/palatine-hill/hydra.nix

@@ -1,7 +1,6 @@
 {
   config,
-  lib,
+  inputs,
-  pkgs,
   ...
 }:
 let
@@ -43,6 +42,7 @@ in
   services = {
     hydra = {
       enable = true;
+      package = inputs.hydra.packages.x86_64-linux.hydra;
       hydraURL = "https://hydra.alicehuston.xyz";
       smtpHost = "alicehuston.xyz";
       notificationSender = "hydra@alicehuston.xyz";

systems/palatine-hill/secrets.yaml

@@ -21,12 +21,14 @@ docker:
     nextcloud: ENC[AES256_GCM,data:dm2Cha+CvFORgdcBvJAzzdOGcJ95vLJYTZcUJnjNp6HOQIIoJrDone1NOAYJh9rdWG/17/ntOmd+TysAj4AsD0dw/PatZmy3I+dcVghkt2XNTc7jD64QjctIHzR+om1joAbKemG1R3St7qDU68TWYxoxIfYZcJvg3ds/lJcYgFRh079UZ/IRlGVR6sWPEXyY+UUrwtk0Fr+y8UtwwWZiLp0akUbIV06huRGiAp/PeWETuPPuacl2++ayIgJFZkJjUl/a52RI1Q0nLG5iyK6QYpY1JSRJTOkiQQ4PB5GRdLCdoM5/ZXTQ6gGcoM5jXFllsTn+yRicNRucuBp7Z2achbk6eITCdjjdXVI7zM4YXpzVLu5fJckLAu07aEIGYCBT7ZXd7TRgfB68POwtwaJGBozg+nuhq8xEH04yi8jFODH6aFplIgJ+bbaP72zw+92lzZa33FEtOwKdtx+YUv0eLLDJs+8Z6Sn6RyN8prwIz1/9LuIMx39g4R7id9W2bV2MXqTU4nN8f0TXWqe+hnb5pDLBaZOBMkwbRka6Vptsi4dbL5Lnexa2DoIHZ2unyxZ+4SkRt9LH39j8fXf2w5JPFCSLstf7+Zu7xzRS0TTCug7k,iv:oOWcFdQJb/+KZKJmQChhJ5jOCcM3o+ojZSMyiRnO9n8=,tag:PWGQkwPe0juLgAdlKiWKpg==,type:str]
     redis: ENC[AES256_GCM,data:c+55cN6IpUNeKd+wC2zv3eunYjBsmZtXTczokqaxB2Q=,iv:M3pwNUlT9kUMv4JDE6bp/gub9CdBGxdApIvpOt3JpgE=,tag:3rPlV3U0AP9zAeF7xDouKw==,type:str]
     act-runner: ENC[AES256_GCM,data:gdrqXBBzdMW26MgNfP6P1c/m7pLANCXjcZLvVsxlWcgpAZd8IaO2FUqomL3xFI3UDPveQh0UvC3044ueoWhYJOq7ZmKJGvdf0ZrpP1MkXZKvjFjbTsuf/6/SYKhPqnP28HqznUWIVJYcRmP+A2oVeJY=,iv:/yOqJYDpxbqCm1whqcypp7Ba1Xlaebrv+h6lHr57Qa8=,tag:PzVqxP+QwQq69jqhmagj3w==,type:str]
-    collabora: ENC[AES256_GCM,data:r+BcGh3XNAEIB2VlSEf1wyVXNgO/QOV5KgqnYg5Sh4Uv4nyBmgkFBkZlM57WDkNnTQdwg7JUlFxHwBiGLw2v/MOL6czEEBdIVfD36hls0Z/34cerRxAesEQSp7ixTegItt8Z52mkUKsblSFlQW80JKbm2mTNVInY,iv:wS29mU/mPbgHuCIrGVwyh8om8UeBZG+vNHrfUPv2of0=,tag:/N8g7IuNVrGA7yiPuWxwbQ==,type:str]
+    collabora: ENC[AES256_GCM,data:LPRkzPEv5qfzeWSDbf+L+0asfmiK5Mhj8jCdfVyvVQAaD75Cbo4qLD0Nc80z,iv:/l2vAyYYJChhv6T+JkHT4I74ZpdhvbVqxlDWIM4Y4bw=,tag:/+uzn1vtd1RnO9/lGiQAKA==,type:str]
 acme:
     bunny: ENC[AES256_GCM,data:P2yROVUga9mORcq8VR/l0i4/2Vod1zvlYq+ZJLLNKow0SpblkwQX/i1ucQYAOkTTRddN+3C+t0zj1rMWkdLoaLjEUJJi3VsSxi+chV2FFiVKFQGEcg24,iv:aQvGgGLsgRGoEmwTgZHR8Jm/MYxmGtVTT/fZKaTLeMs=,tag:m3ssF4O8qs4yxvMu6yUcjw==,type:str]
     dnsimple: ENC[AES256_GCM,data:37FKyBibFtXZgI4EduJQ0z8F+shBc5Q6YlLa3YkVPh9XuJVS20eybi75bfJxiozcZ9d+YRaqcbkBQCSdFOCotDU=,iv:oq3JjqbfAm2C4jcL1lvUb2EOmnwlR07vPoO8H0BmydQ=,tag:E3NO/jMElL6Q817666gIyg==,type:str]
 server-validation:
     webhook: ENC[AES256_GCM,data:Lwqy4UhyFutpXjai7EJPKp8MDlI+ayDna4T8jluvC6qkeJ7o1UaaDCOsgLy4Fw7LC77tXhJtkcmep9w37JaiHp2CoDOfy2iAaq8o9CCSi/a0zqMJx+HdZYZNemvmpc6E/be0K+JDrFZLbjr3unSpCidQ3whccC6XyY013R12swN3bFZIu1gtzXCgUZ4U,iv:pVbrRwH3ziu4+R5BfimPV7N71QmyerJEc9M5K4eofOc=,tag:zNrCXrIioQWPEPVz/wMDpQ==,type:str]
+typhon:
+    hashedPassword: ENC[AES256_GCM,data:gMyY8gxUn3HzycQRu2cminqRFWghqWcjzZzTxAQZ5PJqn604iSwDiVdr7icHB7drJfCAfsE7L4oKRJgxaIAE32043oOkb2T7DDH8y2jxMzqmZCfbvrfMI4wdfRTHGqzxb6X/aZ5ai2rr1Q==,iv:4EsTo/lQld0o9iktDX9gobMlPUCitx1i9wn8EL16sIs=,tag:FgVDRHk2glDwpC/mprrPqQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -42,8 +44,8 @@ sops:
             cXNZWmZqd0R0SmhINExscHBKWmxvblUKEFEQvt/zQFARba4S8vHz/1SoKdKg69At
             LZ58XQGOmlGbBhPr7EzYQ2XSY4flWbnnD174cmCR8DNFm15DsNA5fw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-02T22:12:04Z"
+    lastmodified: "2025-03-26T05:47:58Z"
-    mac: ENC[AES256_GCM,data:bRjvsFSSZFHCdy6PWKyIDbNiCvfF6QbIGnBGQC+6xGt3EQW3Tjm7zHOxYDlI61/l+tIb+pH6/dP/HC3o/2qC2S1s4DQj+1oap8z3qcWpfya/yrzp9cr0l0LxO9PxneSWV5BD8msoJ4I4jDLoWAHkmS5i7DWV2Ye7qBFfEUX1PrM=,iv:HQhxTkXZepIud38YaHFLOs5nemggiVDoZ1AN+b2eEZ8=,tag:ZQAPpDZiYBxmOc8GXheUvA==,type:str]
+    mac: ENC[AES256_GCM,data:ZP9HglMmn9FDv6/vtQAxz/qP76QniPqM6bzMQVvVU/OhDmjuneGKZY7d1Es7LC9o5qmJ+T3Dh3/bkmuRdgdnd2TO6iuvM++DEPxwnoHis+0lbMxv5a6ibzvoXXm2CrL4HPETqLKbLahGJRmDNgnkCEWxAs16zrqe5kgDpD53R5c=,iv:DcCXNGyb41ToV9uSnrnrl0dWiw2pvykM8z86Yk814P4=,tag:T9PFl48qABwBSy7vIhSmLA==,type:str]
     pgp:
         - created_at: "2024-11-28T18:56:39Z"
           enc: |-

systems/palatine-hill/typhon.nix

@@ -0,0 +1,17 @@
+{ config, ... }:
+
+let
+  vars = import ./vars.nix;
+  typhon_path = vars.primary_typhon;
+in
+{
+  services.typhon = {
+    enable = true;
+    hashedPasswordFile = config.sops.secrets."typhon/hashedPassword".path;
+    home = typhon_path;
+  };
+
+  sops.secrets = {
+    "typhon/hashedPassword".owner = "root";
+  };
+}

treefmt.toml

@@ -12,3 +12,21 @@ command = "nixfmt"
 #options = []
 # Glob pattern of files to include
 includes = [ "*.nix" ]
+
+[formatter.jsonfmt]
+command = "jsonfmt"
+excludes = []
+includes = ["*.json"]
+options = ["-w"]
+
+[formatter.shfmt]
+command = "shfmt"
+excludes = []
+includes = ["*.sh", "*.bash", "*.envrc", "*.envrc.*"]
+options = ["-i", "2", "-s", "-w"]
+
+[formatter.yamlfmt]
+command = "yamlfmt"
+excludes = []
+includes = ["*.yaml", "*.yml"]
+options = ["-formatter","indent=4"]

users/alice/home.nix

@@ -16,6 +16,7 @@
       ./home/gammastep.nix
       ./home/doom
       ./home/hypr
+      ./home/waybar.nix
       ./non-server.nix
     ];
 
@@ -68,6 +69,7 @@
       diesel-cli
       tealdeer
       helix
+      ripunzip
 
       # nix specific packages
       nix-output-monitor

users/alice/home/doom/custom.el

@@ -22,3 +22,6 @@
 
 (setq! lsp-nix-nil-max-mem 20000)
 (setq! lsp-nix-nil-formatter ["nixfmt"])
+(add-hook 'python-mode-hook (lambda ()
+                                (require 'sphinx-doc)
+                                (sphinx-doc-mode t)))

users/alice/home/doom/packages.el

@@ -80,3 +80,10 @@
 
 (package! pacdiff.el
   :recipe (:host github :repo "fbrosda/pacdiff.el" :files ("pacdiff.el" "README.org" "LICENSE")))
+
+(package! python-docstring-mode
+  :recipe (:host github :repo "glyph/python-docstring-mode" :files ("python-docstring.el" "docstring_wrap.py")))
+
+(package! sphinx-doc)
+
+;; https://github.com/glyph/python-docstring-mode.git

users/alice/home/git.nix

@@ -11,15 +11,15 @@
     userName = "ahuston-0";
     aliases = {
       gone = ''
-        !git fetch -p && git for-each-ref --format '%(refname:short) %(upstream:track)' | # dump all branches
+        !git for-each-ref --format '%(refname:short) %(upstream)' | # dump all older branches
-                        awk '$2 == "[gone]" {print $1}' | # get nuked branches
+                        awk 'NF < 2 {print $1}' | # get nuked branches
+                        grep -Pv "(^origin/|^origin$|stash)" | # filter out remotes & stash
                         sed 's/\\x27/\\x5C\\x27/' | # remove single quotes, for xargs reasons
-                        xargs -r git branch -D; # nuke the branches
+                        xargs -r git branch -D # nuke the branches
-        # git for-each-ref --format '%(refname:short) %(upstream)' | # dump all older branches
+        # !git fetch -p && git for-each-ref --format '%(refname:short) %(upstream:track)' | # dump all branches
-        #                 awk 'NF < 2 {print $1}' | # get nuked branches
+        #                 awk '$2 == "[gone]" {print $1}' | # get nuked branches
-        #                 grep -Pv "(^origin/|^origin$|stash)" | # filter out remotes & stash
         #                 sed 's/\\x27/\\x5C\\x27/' | # remove single quotes, for xargs reasons
-        #                 xargs -r git branch -D # nuke the branches
+        #                 xargs -r git branch -D; # nuke the branches #
       '';
     };
     extraConfig = {
@@ -27,6 +27,7 @@
       pull.rebase = true;
       color.ui = true;
       init.defaultBranch = "main";
+      format.signoff = true;
     };
   };
 }

users/alice/home/hypr/default.nix

@@ -8,6 +8,7 @@
 {
   xdg.configFile = {
     "hypr/hyprland.conf".source = ./hyprland.conf;
+    "hypr/show-hide.sh".source = ./show-hide.sh;
   };
 
   imports = [

users/alice/home/hypr/hypridle.nix

@@ -18,14 +18,14 @@
       listener = [
         {
           timeout = 150; # 2.5min.
-          on-timeout = "brightnessctl -s set 1"; # set monitor backlight to minimum, avoid 0 on OLED monitor.
+          on-timeout = "${pkgs.brightnessctl}/bin/brightnessctl -s set 1"; # set monitor backlight to minimum, avoid 0 on OLED monitor.
-          on-resume = "brightnessctl -r"; # monitor backlight restore.
+          on-resume = "${pkgs.brightnessctl}/bin/brightnessctl -r"; # monitor backlight restore.
         }
         # turn off keyboard backlight, comment out this section if you dont have a keyboard backlight.
         {
           timeout = 150; # 2.5min.
-          on-timeout = "brightnessctl -sd rgb:kbd_backlight set 0"; # turn off keyboard backlight.
+          on-timeout = "${pkgs.brightnessctl}/bin/brightnessctl -sd rgb:kbd_backlight set 0"; # turn off keyboard backlight.
-          on-resume = "brightnessctl -rd rgb:kbd_backlight"; # turn on keyboard backlight.
+          on-resume = "${pkgs.brightnessctl}/bin/brightnessctl -rd rgb:kbd_backlight"; # turn on keyboard backlight.
         }
         {
           timeout = 300; # 5min

users/alice/home/hypr/hyprland.conf

@@ -22,6 +22,9 @@ monitor=,preferred,auto,auto
 # exec-once = waybar & hyprpaper & firefox
 exec-once = wired &
 
+exec-once = wired
+exec-once = systemctl --user start polkit-gnome-authentication-agent-1.service
+
 # Source a file (multi-file configs)
 # source = ~/.config/hypr/myColors.conf
 
@@ -207,3 +210,7 @@ bind = $mainMod, P, exec, bwm
 
 # lock screen
 bind = $mainMod, L, exec, loginctl lock-session
+# hide active window
+bind = $mainMod,H,exec,/home/alice/config/hypr/hide_unhide_window.sh h
+# show hide window
+bind = $mainMod,I,exec,/home/alice/config/hypr/hide_unhide_window.sh s

users/alice/home/hypr/hyprlock.nix

@@ -11,13 +11,15 @@
     settings = {
       general = {
         immediate_render = true;
-        no_fade_in = true;
+        # disabling as config doesn't exist
+        #no_fade_in = true;
       };
       background = {
         monitor = "";
-        #path = /home/me/someImage.png   # supports png, jpg, webp (no animations, though)
+        # path = /home/me/someImage.png   # supports png, jpg, webp (no animations, though)
-        path = "screenshot";
+        path = lib.mkForce "screenshot";
-        color = "rgba(25, 20, 20, 1.0)";
+        # disabling due to stylix
+        # color = "rgba(25, 20, 20, 1.0)";
 
         # all these options are taken from hyprland, see https://wiki.hyprland.org/Configuring/Variables/#blur for explanations
         blur_passes = 3; # 0 disables blurring
@@ -53,22 +55,25 @@
         dots_spacing = 0.15; # Scale of dots' absolute size, -1.0 - 1.0
         dots_center = false;
         dots_rounding = -1; # -1 default circle, -2 follow input-field rounding
-        dots_fade_time = 200; # Milliseconds until a dot fully fades in
+        # disabling as config doesn't exist
+        # dots_fade_time = 200; # Milliseconds until a dot fully fades in
         dots_text_format = ""; # Text character used for the input indicator. Leave empty for a rectangle that will be rounded via dots_rounding (default).
-        outer_color = "rgb(151515)";
+        # disabling due to stylix
-        inner_color = "rgb(200, 200, 200)";
+        # outer_color = "rgb(151515)";
-        font_color = "rgb(10, 10, 10)";
+        # inner_color = "rgb(200, 200, 200)";
+        # font_color = "rgb(10, 10, 10)";
         font_family = "Noto Sans"; # Font used for placeholder_text, fail_text and dots_text_format.
         fade_on_empty = false;
         fade_timeout = 1000; # Milliseconds before fade_on_empty is triggered.
         placeholder_text = "<i>Input Password...</i>"; # Text rendered in the input box when it's empty.
         hide_input = false;
         rounding = -1; # -1 means complete rounding (circle/oval)
-        check_color = "rgb(204, 136, 34)";
+        #check_color = "rgb(204, 136, 34)";
-        fail_color = "rgb(204, 34, 34)"; # if authentication failed, changes outer_color and fail message color
+        #fail_color = "rgb(204, 34, 34)"; # if authentication failed, changes outer_color and fail message color
         fail_text = "<i>$FAIL <b>($ATTEMPTS)</b></i>"; # can be set to empty
         fail_timeout = 2000; # milliseconds before fail_text and fail_color disappears
-        fail_transition = 300; # transition time in ms between normal outer_color and fail_color
+        # disabling as config doesn't exist
+        #fail_transition = 300; # transition time in ms between normal outer_color and fail_color
         capslock_color = -1;
         numlock_color = -1;
         bothlock_color = -1; # when both locks are active. -1 means don't change outer color (same for above)

users/alice/home/hypr/show-hide.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+stack_file="/tmp/hide_window_pid_stack.txt"
+
+function hide_window() {
+  pid=$(hyprctl activewindow -j | jq '.pid')
+  hyprctl dispatch movetoworkspacesilent "88,pid:$pid"
+  echo "$pid" >>$stack_file
+}
+
+function show_window() {
+  pid=$(tail -1 $stack_file && sed -i '$d' $stack_file)
+  [ -z "$pid" ] && exit
+
+  current_workspace=$(hyprctl activeworkspace -j | jq '.id')
+  hyprctl dispatch movetoworkspacesilent "$current_workspace,pid:$pid"
+}
+
+if [ -n "$1" ]; then
+  if [ "$1" == "h" ]; then
+    hide_window >>/dev/null
+  else
+    show_window >>/dev/null
+  fi
+fi

users/alice/home/waybar.json

@@ -0,0 +1,40 @@
+[
+  {
+    "height": 20,
+    "layer": "top",
+    "position": "top",
+    "output": [
+      "eDP-2",
+      "eDP-1",
+      "HDMI-0",
+      "DP-0"
+    ],
+    "hyprland/workspaces": {
+      "active-only": true,
+      "all-outputs": false,
+      "show-special": true,
+      "move-to-monitor": true,
+      "format": "{icon} {windows}",
+      "format-window-separator": " ",
+      "format-icons": {
+        "1": "󰎤",
+        "2": "󰎧",
+        "3": "󰎪",
+        "default": "",
+        "empty": "󱓼",
+        "urgent": "󱨇"
+      },
+      "persistent-workspaces": {
+        "1": "HDMI-0"
+      },
+      "on-scroll-down": "hyprctl dispatch workspace e-1",
+      "on-scroll-up": "hyprctl dispatch workspace e+1",
+      "window-rewrite": {
+        "title<Steam>": ""
+      },
+      "window-rewrite-default": "",
+      "window-rewrite-separator": " ",
+      "sort-by": "number"
+    }
+  }
+]

users/alice/home/waybar.nix

@@ -2,6 +2,6 @@
 lib.mkIf (!machineConfig.server) {
   programs.waybar = {
     enable = true;
-    #settings = builtins.fromJSON (import ./waybar.json);
+    settings = builtins.fromJSON (builtins.readFile ./waybar.json);
   };
 }

users/alice/home/zsh.nix

@@ -4,7 +4,6 @@
   programs.zsh = {
 
     enable = true;
-    # autosuggestion.enable = true;
     oh-my-zsh = {
       enable = true;
       plugins = [

users/alice/non-server.nix

@@ -3,7 +3,7 @@
 {
   programs.emacs = {
     enable = true;
-    package = pkgs.emacs29-pgtk;
+    package = pkgs.emacs30-pgtk;
   };
   home.packages = with pkgs; [
     cmake
@@ -64,5 +64,6 @@
     zathura
     obsidian
     libreoffice-qt-fresh
+    wlr-randr
   ];
 }

users/alice/secrets.yaml

@@ -2,12 +2,13 @@ alice:
     user-password: ENC[AES256_GCM,data:+cM85X1vapqfQdJ+Dv6YvT5qHlvsmaXPRbvKRHtCkPT3wdw4f7tLHLFmvWnak7CRezI00PxVEtCZL5mqLyN2HaU4OqIk/9fgqczIzemwBlMGJt+ndwG4oqBqE0ymtzmy8MA59wonRqoxzYKQfAGQsprdCIovrg==,iv:BtSDBgvQeZdTY1KUClnt9V8qHcS/gouaaQw342tk4Sg=,tag:T7tzyKuCo83s78ca7f4KDQ==,type:str]
     #ENC[AES256_GCM,data:6+dLs8opC27IrHJCPfL2c7KiLbaQTqI6oRKpIZLR4+P9gTupziAhCm/G7RY01gVPSgxdBpJ6L4xVbcMEg9hDKBMI4naF9arNrFsV6WXNc+LA5BYyT9L9G1nDea8fPFYDSF2537eLgLqWNE1WSsUOrz/WOxbE6g==,iv:AxsdKmGz6qEYlWY08q/2hqsm0EXaqodwD/7OJg4FAIY=,tag:EgfL3I1VBXtFgIdTOW5eBA==,type:comment]
     #ENC[AES256_GCM,data:vUMcowHjlQA0RWflfaQhZKkalO39epYi6N9PPW8=,iv:6DFqHlQR+mi+ZkfMUhlhwvpMwnxXNfQV6+sYgPzSj4I=,tag:Pz1zJayscGckPO8Q2ZVb4g==,type:comment]
-    gha-hydra-token: ENC[AES256_GCM,data:rYDYIn7MAF4pSZQj+Nln2z9J+AxvuSzumthL86njpKETutArrw+9iX2hHJt5t513NHH03tMtZOFqM60/pzWg4YXVQOSpQmq8QOelD7qCdfCr4Z2QSeOHqXqwKy21iWtoVbxOXWunVxLzkWMJrpHkpVsiBA75Nv66ftKEjN80QNGik6xQE1iPsCB2JHeqYNIr8gtPkCr7H5Pt4yBBO/1rsyONrbNlwmzVX78eqXxmc43XOiNVjEsk8ekJxJ9mn5S6JcPNehBcnZA0kWAIxvtDIPYKnz4YBIXoilBbjgytXL8nw3PkEX27x5yeg9KfxPxO/4CGoi5wfKsYuEynBdWbHtj6a3H0AvA9KIZzktTRNJFU3ZW8UveSCXY4YHl0NREJ8kbIUgkkE7PWeyzGenGFTPMahTA0rKSa+tWPQ1c00lvo9VS3/7pfeJfZEKS7R2xBaEDZrfffHyB5PLTQOGpWl5y40wTn4HdBlyQwoREvobOaKVZEyWtVvJcUeHDPepgEHGVDzwyTelX8Btb6ZNA0Fur8xvpkLZcLmMhbvCdkjq84ztJ36nQQ5JZthecyqcZTWPyfWtPeoUPVIaxn31oLjwsriDwdQmID6twTjC9PT8nBZD/u0JebOCdeYf8fm9q49SaN2w/ZMdSRWucHUsRXeN9O149vYoOqR28H+8v/tYJdqofJpHKrIBs=,iv:GcEV6f4rqkrpCafeaLNMqqU/vBNE0xHbqokL2gMXHYw=,tag:sCHvUgq1w8npedjIAninrA==,type:str]
+    gha-hydra-token: ENC[AES256_GCM,data:CXdOiW9oYaVj4oqfiXSz9O9xIsB5ZyUac2WFSFD1ankZpnmQpv9TwolJxb6h8r+UM7Q9QzCCWk7KHe80lolZhpHa79bpcj+wt9v51ydj0Zy+3sufHS+JnGwmqBbw6dVqJ2uBr4nW2NADzHEbG8N367uKYEq2vazB4y02JiopXL8DHsYcx+Z4u7GJC/gYbpm9vnt8OVdYmfYRQ9BGSiaJOghDzpmCisEZdLpCLXM3cULn8yVUXIFWx8yF/6JrWN+myeoZiUFCL2sZmeSIswFg9kwBKXIsjBrz+EDXZzDCEr88UrEJ0j2+egsrG9BNlstVwC8oscYdbXWmYUdsCBNVxK3xjJYm9gDdSyo0DfSvTzK1t+/s9L1zC8uqj2TXYdVd6QyH2TRXxiPeNLYClRHT2UljymSpIVXOn/Okuo7dte+ZZqZVndT1lwK//2y8V3Hng+5wixfFFsQAd5oJzfraRSnM+RLZtjI3TMoyc5no3pVwV6zsCqRd2nvr7gieXUMWtSLb6YrM6tvhRpeiieYUqQ8NwHV0Avqco0I838o5yywVGSnUflGxnwYoGQIX70qoTcxNPGuiiiqSynh64e3nrlC9xN6EWuFpUNVfkBibZNRi+EyDAhK7LKwiPbL2z919N54vyzzoWA1KUFqxow+JsX+Q8rpnfJtag44F5qFt3/Be5PIMYVU7acXTiVJvM3cKPMQIBPXpQFX5OshwGhttGFuB53aWPHCzlhT4NDQbcZ/rLQ3bcytVpnH55WWze0Oe0zUZYGFc/rV9Fc4QjhR7/8pAi9kGUlKy2MYBamjmnCWlOnHPIQQLpPs/oiW+,iv:KL2P3O8Fnbn56hLX8PWIrigoPTBfIvMUpizKy3C3RIA=,tag:G0M/9iT9IWUSJ5ktUc/g5A==,type:str]
     wakatime-api-key: ENC[AES256_GCM,data:ITu5pRySYGCJ6q9IQ35NfpGX2FyIJRYHGDeBiq0btzIrqitxcFox1Vc=,iv:HsXpyFHV7dG5qORk26BtD+kFo4Jdq2c4fozMpoqyDfU=,tag:uaQoXvvYqNfmRXVDVH8AoQ==,type:str]
     attic-nix-cache-creator: ENC[AES256_GCM,data:P0iBdy4IYrxcq7v4wTgwwZvAfVdRFo08pi0zvpY9cP9BDCwbBnp+3qDKWL29rC7OxsaLtmRkvPmbkF3ZX3Yu5OaptwVg2Xi0vNqhk3gu5Fdj8ygPigB0ZtimkfWv1QkctoVoXKXuLv6Xd4XKPCWOOIekWlJsBRcyfyzkyFURkU9tBBkXyEAWItho/J8hJr6r00eA3EN4rTe8Ge+PGpfTfpZVpnoGrC35xPnGLq19+b44DectHDTkMZrZKxiCaVIgKUZDLaFgi6a6PsX+L1HQAIZukXJu3m4BPdvzzby+zgX24pVJOYjAUB2BwO9jUlMS6+7qo0p6k01uLicryfKx/ajdAHcy39tFHX7naA4JriC2/FgI2HlFGp0Lc+g0pfdCYwLs5QBfRaOHyrbFWUDG,iv:OBrgnewqBaug00ygAXs0eFs3LqcHqo1EW96N5I38A0o=,tag:V+Gn47O6AH1RwL9qJLpAkw==,type:str]
     attic-nix-cache-reader: ENC[AES256_GCM,data:DWIkRri3lHJOVXIAbHWJL7cCV4FHjB91bbpPAib/5ZDKap3xjnxUjwswc7wjO1hCoV3+gmep1a64kma6MJts4bcAug5bPyrrPy//rVpCYvSbSmbPz5k4sW5GLU/Sf4NyBevsQo9KRrphpoSUQEFQB27vabYDjjkB051/qJo1B9B7nqmrSyd3np4YdyHAgUiMyJt0oqx8nXySz3XZU+DIM8/OhMZILpnEWIgyP2K7j8JNNpZZJ5sD/icUy6Vba/4LcKjtmYtfQ+HO1soyF6aMiQSjhp7fzJHktwa9kgB3oDzIg3KyCJYS2RNW7mW9Dd1T,iv:fvhGFU22KgknMpJbOkA3v29bKzRVX6hi7V7xJgSUjPg=,tag:TjGSUl0XXS7jlhP/NG4cvQ==,type:str]
     attic-nix-cache-writer: ENC[AES256_GCM,data:vxSeys7EJDyatZFpeyxeDzaKGqDtm3atpVly6+BPHUFTrlLaVl86roGZjpBB9wwOMuP007qJNva0HQcTONbSyNw/snUU5JpaFWLT87Eu81V8gdulzHwm61caQ4A/e1ylKkdtwalNymBSyWi9b+SOWXTgralrg9L3OHw+nVuZaAi8QXF2ImLoZ2vXl7MGNXParflV2KK2uqfRatDZMbSSFipT0tQpkNTBTA6l8woILK3BKrHdYq+D8n4EmRowSuMWuN1uknyctb4+Ap3AeBITvyJjKejocQ9qK9plP6CChiC4Z1mmt/HOrfXYXiJO+Va64rOYRywMga8=,iv:bAx7iR24dpIOudkiFOc/xmIG73rcaMDdhWjiBO4BsBM=,tag:gtTyldhdRV97YJREG5lPjA==,type:str]
     attic-nix-cache-admin: ENC[AES256_GCM,data:OP02nJTo0cx8M9cR+P7cpI1gEXCKqXWehlaL+dYGwGSUnQ6iSC25vpdZ5SSnjyhiBZe+VnYld+b5PO+OOt7NMGxVvQ0zcuvrG7qfhEpIfGrbx9S9cEV2eAMchG/Hua609MUTbFYKvpwWw6tFZD2dYYQv2gXI7mYSeN0Tw4i2x1f/+cKDtV+ak+UHRgEe/f5OdE8v5I6dRXUQGVOBSRAQkfYDFuI2JUz4oNJsz66YkdMtgudhqWi4mekODD3v2Gcg/zAv1PogaHaIH1BHNvLQ/DsNVcvLsnTb6inM3cTCyPpHcx+VwPO7g9kYNV8xcCRkAIvX6aFzRVT0tJcEXFWStMnKS8nr8HoKFQ==,iv:ftmN3jK5qa6SwrSyhhL3PZls2hTG6xGa0LW7ycdkYxQ=,tag:TQCELzJQjsMfAJseZ7tB4w==,type:str]
+    gitea-actions-token: ENC[AES256_GCM,data:QTEPMAh1RWWJ/O3yhkQkEBTdVL8XhIRGCDbiM0lLjfILKF4SpSJ2sA==,iv:mBaaB1JHb2KVc9n2pdeX4pSMvb7q5z3joMT7rR5Whgs=,tag:ef+58SI4AUeqUsk3RVDsRQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -41,8 +42,8 @@ sops:
             ZERFTlFyNjhOb3VCaW43ZXFHT1Vxc0UK7YV+BU7dCEOZxpqkQA394eDsnthvorj6
             7bqrCdeU+6DU7DmFs6++BrNO2tx8vvOa1im+ZGrM/gZAJdv/7R2d6Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-01-26T04:17:36Z"
+    lastmodified: "2025-03-26T15:28:13Z"
-    mac: ENC[AES256_GCM,data:BJ5d3iqdIBwqtnYOYfmsFqnJDXz67uzJ4UKWrjVUEgr4Nc95tE8mEyV40poZk/wAJGJMSDdRhsPmZI4H1xztkjkTsUCUJ2rR+SZ6gP1VhSEXu7bSvv63+bnajZQi9kZrfN0EZN8TLzzVHVvSVHcNEfbq9STWkZq6zCk9E2cUfhk=,iv:MQ/lQkNi/S3bfz1PegcVfwy06RsxdQwZIU6sdOjkhgU=,tag:l5tK1SUwjTolliPkbfNDHg==,type:str]
+    mac: ENC[AES256_GCM,data:BfEahKHAcnLc/PSagENBIVwxufJrjpMSC6U4hkkxNwcEJYDNAlrF0w00aiexLeX+UfVGIw19+SrNL5zuecEf+GaYzYNy9RE3c66KUM2B/cpuBuzkiwLaBCTfcWr7k8dW11BGFCmugRSG4w6wXKG5B/LyEKB6Vcvp0JRbCYSqZSY=,iv:97UzvdvQCtTLaLDrg6VEwiofHtSPGtaxuPLHfTAyIFA=,tag:r4r45OaV9ZRDzd56RGLFZw==,type:str]
     pgp:
         - created_at: "2024-09-05T06:10:22Z"
           enc: |-
@@ -57,4 +58,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: 5EFFB75F7C9B74EAA5C4637547940175096C1330
     unencrypted_suffix: _unencrypted
-    version: 3.9.3
+    version: 3.9.4

utils/attic-push.bash

@@ -6,17 +6,21 @@
 set -e
 
 # retrieve all paths under 2G
-nix_paths=$(nix path-info --json --all --closure-size \
+# nix_paths=$(nix path-info --json --all --closure-size \
-  | jq 'map_values(.closureSize | select(. < 2e9)) | to_entries | sort_by(.value)' \
+#   | jq 'map_values(.closureSize | select(. < 2e9)) | to_entries | sort_by(.value)' \
-  | jq 'map(.key) | join("\n")' | sed -E -e 's/\\n/\n/g;s/^"//g;s/"$//g')
+#   | jq 'map(.key) | join("\n")' | sed -E -e 's/\\n/\n/g;s/^"//g;s/"$//g')
+
+# retrieve all paths
+nix_paths=$(nix path-info --json --all --closure-size |
+  jq 'map_values(.closureSize | select(true)) | to_entries | sort_by(.value)' |
+  jq 'map(.key) | join("\n")' | sed -E -e 's/\\n/\n/g;s/^"//g;s/"$//g')
 
 readarray -t nix_path_array < <(echo "$nix_paths")
 
 batchsize=1000
 
-for((i=0; i < ${#nix_path_array[@]}; i+=batchsize))
+for ((i = 0; i < ${#nix_path_array[@]}; i += batchsize)); do
-do
+  part=("${nix_path_array[@]:i:batchsize}")
-    part=( "${nix_path_array[@]:i:batchsize}" )
 
-    attic push nix-cache "${part[@]}"
+  attic push nix-cache "${part[@]}"
 done

utils/attic-token.bash

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 
-if (( $# != 3 )); then
+if (($# != 3)); then
-   echo "usage: $0 <cache/cache group> <cache pattern> <token type>"
+  echo "usage: $0 <cache/cache group> <cache pattern> <token type>"
-   exit 1
+  exit 1
 fi
 
 cache="$1"
@@ -10,27 +10,27 @@ cache_pattern="$2"
 token_type="$3"
 
 case $token_type in
-    "cache-creator")
+"cache-creator")
-        atticd-atticadm make-token --sub "$cache-cache-creator" --validity "1y" \
+  atticd-atticadm make-token --sub "$cache-cache-creator" --validity "1y" \
-            --pull "$cache_pattern" --push "$cache_pattern" --delete "$cache_pattern" \
+    --pull "$cache_pattern" --push "$cache_pattern" --delete "$cache_pattern" \
-            --create-cache "$cache_pattern" --configure-cache "$cache_pattern" \
+    --create-cache "$cache_pattern" --configure-cache "$cache_pattern" \
-            --configure-cache-retention "$cache_pattern" --destroy-cache "$cache_pattern"
+    --configure-cache-retention "$cache_pattern" --destroy-cache "$cache_pattern"
-        ;;
+  ;;
-    "admin")
+"admin")
-        atticd-atticadm make-token --sub "$cache-admin" --validity "1y" --pull "$cache_pattern" \
+  atticd-atticadm make-token --sub "$cache-admin" --validity "1y" --pull "$cache_pattern" \
-            --push "$cache_pattern" --configure-cache "$cache_pattern" \
+    --push "$cache_pattern" --configure-cache "$cache_pattern" \
-            --configure-cache-retention "$cache_pattern"
+    --configure-cache-retention "$cache_pattern"
-        ;;
+  ;;
-    "writer")
+"writer")
-        atticd-atticadm make-token --sub "$cache-writer" --validity "1y" --pull "$cache_pattern" \
+  atticd-atticadm make-token --sub "$cache-writer" --validity "1y" --pull "$cache_pattern" \
-            --push "$cache_pattern"
+    --push "$cache_pattern"
-        ;;
+  ;;
-    "reader")
+"reader")
-        atticd-atticadm make-token --sub "$cache-reader" --validity "1y" --pull "$cache_pattern"
+  atticd-atticadm make-token --sub "$cache-reader" --validity "1y" --pull "$cache_pattern"
-        ;;
+  ;;
-    *)
+*)
-        echo "invalid token type: $token_type"
+  echo "invalid token type: $token_type"
-        echo "available options: cache-creator, admin, writer, reader"
+  echo "available options: cache-creator, admin, writer, reader"
-        exit 1
+  exit 1
-        ;;
+  ;;
 esac

utils/diff-evals.sh

@@ -10,15 +10,4 @@ set -e
 script_path=$(dirname "$(readlink -f $0)")
 parent_path=$(dirname "$script_path")
 
-readarray -t pre_drv < "$parent_path/pre-drv"
+nix run git+https://nayeonie.com/ahuston-0/flake-update-diff -- --compare-drvs --compare-output-to-file "$parent_path"
-readarray -t post_drv < "$parent_path/post-drv"
-
-post_drv_path="$parent_path/post-diff"
-# cleanup any files with the same name
-rm "$post_drv_path" || true
-touch "$post_drv_path"
-
-for i in $(seq 0 $(( "${#pre_drv[@]}" -1 ))); do
-    echo "Diffing updates to $(echo "${pre_drv[$i]}" | cut -f 2- -d '-')" >> "$post_drv_path"
-    nvd diff "${pre_drv[$i]}" "${post_drv[$i]}" >> "$post_drv_path"
-done

utils/eval-to-drv.sh

@@ -8,15 +8,12 @@ set -v
 set -e
 
 if [ "$#" -ne 1 ]; then
-    echo "$0 (pre|post)"
+  echo "$0 (pre|post)"
-    exit 1
+  exit 1
 fi
 
 script_path=$(dirname "$(readlink -f $0)")
 parent_path=$(dirname "$script_path")
-out_path="$parent_path/$1-drv"
+out_path="$parent_path/$1.json"
 
-
+nix run git+https://nayeonie.com/ahuston-0/flake-update-diff -- --evaluate --json "$out_path" "$parent_path"
-drv=$(nix flake check --verbose 2> >(grep -P -o "derivation evaluated to (/nix/store/.*\.drv)" | grep -P -o "/nix/store/.*\.drv"))
-
-echo "$drv" > "$out_path"

utils/fetch-docker.sh

@@ -14,10 +14,10 @@ parent_path=$(dirname "$script_path")
 # relpath is the relative path to the parent_path where you want the file written
 # format: <image name>,<image tag>,<image architecture>,<os>,<relpath>
 images=(
-    "nextcloud,apache,amd64,linux,/systems/palatine-hill/docker/nextcloud-image/nextcloud-apache.nix"
+  "nextcloud,apache,amd64,linux,/systems/palatine-hill/docker/nextcloud-image/nextcloud-apache.nix"
 )
 IFS=","
 while read -r name tag arch os relpath; do
-    nix-prefetch-docker --image-name "$name" --image-tag "$tag" --arch "$arch" --os "$os" --quiet > "$parent_path/$relpath"
+  nix-prefetch-docker --image-name "$name" --image-tag "$tag" --arch "$arch" --os "$os" --quiet >"$parent_path/$relpath"
-    git --no-pager diff "$parent_path/$relpath"
+  git --no-pager diff "$parent_path/$relpath"
-done<<< "${images[@]}"
+done <<<"${images[@]}"

utils/hetzner-install.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env nix
+#! nix shell nixpkgs#bash nixpkgs#git --command bash
+
+set -o errexit   # abort on nonzero exitstatus
+set -o nounset   # abort on unbound variable
+set -o pipefail  # don't hide errors within pipes
+
+MACHINENAME="hetzner-bridge"
+
+sudo mkdir /root/.ssh
+sudo chmod 700 /root/.ssh
+sudo ssh-keygen -t ed25519 -o -a 100 -f "/root/.ssh/id_ed25519_giteadeploy" -q -N "" -C "$MACHINENAME" || echo "key already exists"
+
+sudo cat /root/.ssh/id_ed25519_giteadeploy.pub
+
+sudo ssh-keygen -A
+
+nix --extra-experimental-features 'flakes nix-command' shell nixpkgs#git
+nix --extra-experimental-features 'flakes nix-command' store gc
+FLAKE="git+ssh://gitea@nayeonie.com:2222/ahuston-0/nix-dotfiles?ref=feature/hetzner-bridge#hetzner-bridge"
+DISK_DEVICE=/dev/sda
+sudo nix \
+    --extra-experimental-features 'flakes nix-command' \
+    run github:nix-community/disko#disko-install -- \
+    --flake "$FLAKE" \
+    --write-efi-boot-entries \
+    --disk main "$DISK_DEVICE"

utils/hetzner-nixos-anywhere.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env nix
+#! nix shell nixpkgs#bash nixpkgs#mktemp nixpkgs#openssh nixpkgs#nixos-anywhere nixpkgs#sops --command bash
+
+echoerr() { printf "%s\n" "$*" >&2; }
+
+if (( $# != 1 )); then
+    echoerr "usage: $0 <hostname>"
+fi
+
+HOSTNAME=$1
+
+# Create a temporary directory
+temp=$(mktemp -d)
+
+# Function to cleanup temporary directory on exit
+cleanup() {
+  rm -rf "$temp"
+}
+trap cleanup EXIT
+
+# Create the directory where sshd expects to find the host keys
+install -d -m755 "$temp/etc/ssh"
+
+# Create host keys
+ssh-keygen -A -f "$temp/etc/ssh/"
+
+# Set the correct permissions so sshd will accept the key
+chmod 600 "$temp/etc/ssh/ssh_host_ed25519_key"
+
+AGEKEY=$(ssh-to-age < "$temp/etc/ssh/ssh_host_ed25519_key.pub")
+
+echo "$AGEKEY" | tee "./$HOSTNAME.age"
+
+# Install NixOS to the host system with our secrets
+nixos-anywhere --extra-files "$temp" --flake '.#your-host' root@yourip

utils/sops-mergetool-new.sh

@@ -2,7 +2,10 @@
 
 # Rename CLI parameters to friendlier names
 # https://git-scm.com/docs/gitattributes#_defining_a_custom_merge_driver
-base="$1"; local_="$2"; remote="$3"; merged="$4"
+base="$1"
+local_="$2"
+remote="$3"
+merged="$4"
 
 # Load the mergetool scripts
 TOOL_MODE=merge
@@ -20,7 +23,7 @@ merged_decrypted="${base_decrypted/_BASE_/_MERGED_}"
 backup_decrypted="${base_decrypted/_BASE_/_BACKUP_}"
 
 # If anything goes wrong, then delete our decrypted files
-handle_trap_exit () {
+handle_trap_exit() {
   rm $base_decrypted || true
   rm $local_decrypted || true
   rm $remote_decrypted || true
@@ -30,12 +33,12 @@ handle_trap_exit () {
 trap handle_trap_exit EXIT
 
 # Decrypt our file contents
-sops --decrypt --show-master-keys "$base" > "$base_decrypted"
+sops --decrypt --show-master-keys "$base" >"$base_decrypted"
-sops --decrypt --show-master-keys "$local_" > "$local_decrypted"
+sops --decrypt --show-master-keys "$local_" >"$local_decrypted"
-sops --decrypt --show-master-keys "$remote" > "$remote_decrypted"
+sops --decrypt --show-master-keys "$remote" >"$remote_decrypted"
 
 # Create a merge-diff to compare against
-git merge-file -p "$local_decrypted" "$base_decrypted" "$remote_decrypted" > "$merged_decrypted"
+git merge-file -p "$local_decrypted" "$base_decrypted" "$remote_decrypted" >"$merged_decrypted"
 cp "$merged_decrypted" "$backup_decrypted"
 
 # Set up variables for the mergetool
@@ -48,7 +51,7 @@ MERGED="$merged_decrypted"
 BACKUP="$backup_decrypted"
 
 # Override `check_unchanged` with a custom script
-check_unchanged () {
+check_unchanged() {
   # If the contents haven't changed, then fail
   if test "$MERGED" -nt "$BACKUP"; then
     return 0
@@ -61,5 +64,4 @@ check_unchanged () {
 run_merge_tool "${mergetool}" true
 
 # Re-encrypt content
-sops --encrypt "$merged_decrypted" > "$merged"
+sops --encrypt "$merged_decrypted" >"$merged"
-

utils/sops-mergetool.sh

@@ -6,7 +6,10 @@ set -x
 
 # Rename our variables to friendlier equivalents
 # https://git-scm.com/docs/gitattributes#_defining_a_custom_merge_driver
-base="$1"; local_="$2"; remote="$3"; merged="$4"
+base="$1"
+local_="$2"
+remote="$3"
+merged="$4"
 
 echo "$base"
 echo "$local_"
@@ -18,7 +21,7 @@ echo "$merged"
 mergetool="$(git config --get merge.tool)"
 GIT_DIR="$(git --exec-path)"
 if test "$mergetool" = ""; then
-  echo "No default \`merge.tool\` was set for \`git\`. Please set one via \`git config --set merge.tool <tool>\`" 1>&2
+  echo 'No default `merge.tool` was set for `git`. Please set one via `git config --set merge.tool <tool>`' 1>&2
   exit 1
 fi
 
@@ -32,7 +35,7 @@ merged_decrypted="${base_decrypted/_BASE_/_MERGED_}"
 backup_decrypted="${base_decrypted/_BASE_/_BACKUP_}"
 
 # If anything goes wrong, then delete our decrypted files
-handle_trap_exit () {
+handle_trap_exit() {
   rm $base_decrypted || true
   rm $local_decrypted || true
   rm $remote_decrypted || true
@@ -42,13 +45,13 @@ handle_trap_exit () {
 trap handle_trap_exit EXIT
 
 # Decrypt our file contents
-sops --decrypt --show-master-keys "$base" > "$base_decrypted"
+sops --decrypt --show-master-keys "$base" >"$base_decrypted"
-sops --decrypt --show-master-keys "$local_" > "$local_decrypted"
+sops --decrypt --show-master-keys "$local_" >"$local_decrypted"
-sops --decrypt --show-master-keys "$remote" > "$remote_decrypted"
+sops --decrypt --show-master-keys "$remote" >"$remote_decrypted"
 
 # Create a merge-diff to compare against
 set +e
-git merge-file -p "$local_decrypted" "$base_decrypted" "$remote_decrypted" > "$merged_decrypted"
+git merge-file -p "$local_decrypted" "$base_decrypted" "$remote_decrypted" >"$merged_decrypted"
 set -e
 cp "$merged_decrypted" "$backup_decrypted"
 
@@ -66,7 +69,7 @@ source "$GIT_DIR/git-mergetool--lib"
 source "$GIT_DIR/mergetools/$mergetool"
 
 # Override `check_unchanged` with a custom script
-check_unchanged () {
+check_unchanged() {
   # If the contents haven't changed, then fail
   if test "$MERGED" -nt "$BACKUP"; then
     return 0
@@ -82,5 +85,4 @@ merge_cmd
 set -eu
 
 # Re-encrypt content
-sops --encrypt "$merged_decrypted" > "$merged"
+sops --encrypt "$merged_decrypted" >"$merged"
-