formatting

Flake lock file updates:

• Updated input 'impermanence':
    'github:nix-community/impermanence/e337457502571b23e449bf42153d7faa10c0a562?narHash=sha256-C2sGRJl1EmBq0nO98TNd4cbUy20ABSgnHWXLIJQWRFA%3D' (2024-10-16)
  → 'github:nix-community/impermanence/0d09341beeaa2367bac5d718df1404bf2ce45e6f?narHash=sha256-W1FH5aJ/GpRCOA7DXT/sJHFpa5r8sq2qAUncWwRZ3Gg%3D' (2024-10-31)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/2768c7d042a37de65bb1b5b3268fc987e534c49d?narHash=sha256-AlcmCXJZPIlO5dmFzV3V2XF6x/OpNWUV8Y/FMPGd8Z4%3D' (2024-10-23)
  → 'github:NixOS/nixpkgs/7ffd9ae656aec493492b44d0ddfb28e79a1ea25d?narHash=sha256-Dqg6si5CqIzm87sp57j5nTaeBbWhHFaVyG7V6L8k3lY%3D' (2024-11-02)

.editorconfig

@@ -1,10 +0,0 @@
-[*]
-indent_style = tab
-
-[*.{nix,yaml}]
-indent_style = space
-indent_size = 2
-
-[*.py]
-indent_style = space
-indent_size = 4

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "impermanence": {
       "locked": {
-        "lastModified": 1729068498,
+        "lastModified": 1730403150,
-        "narHash": "sha256-C2sGRJl1EmBq0nO98TNd4cbUy20ABSgnHWXLIJQWRFA=",
+        "narHash": "sha256-W1FH5aJ/GpRCOA7DXT/sJHFpa5r8sq2qAUncWwRZ3Gg=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "e337457502571b23e449bf42153d7faa10c0a562",
+        "rev": "0d09341beeaa2367bac5d718df1404bf2ce45e6f",
         "type": "github"
       },
       "original": {
@@ -17,11 +17,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1729665710,
+        "lastModified": 1730531603,
-        "narHash": "sha256-AlcmCXJZPIlO5dmFzV3V2XF6x/OpNWUV8Y/FMPGd8Z4=",
+        "narHash": "sha256-Dqg6si5CqIzm87sp57j5nTaeBbWhHFaVyG7V6L8k3lY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2768c7d042a37de65bb1b5b3268fc987e534c49d",
+        "rev": "7ffd9ae656aec493492b44d0ddfb28e79a1ea25d",
         "type": "github"
       },
       "original": {

flake.nix

@@ -2,13 +2,19 @@
   inputs.nixpkgs.url = "nixpkgs/nixos-unstable";
   inputs.impermanence.url = "github:nix-community/impermanence";
 
-  outputs = { self, nixpkgs, impermanence }:
+  outputs =
+    {
+      self,
+      nixpkgs,
+      impermanence,
+    }:
     let
       inherit (nixpkgs) lib;
 
-      mypkgs = pkgs:
+      mypkgs =
-        self.lib.dirToAttrs ./pkgs (x: pkgs.callPackage x { }) //
+        pkgs:
-        {
+        self.lib.dirToAttrs ./pkgs (x: pkgs.callPackage x { })
+        // {
           iso = import lib/gen-iso.nix lib pkgs.system;
         };
 
@@ -30,43 +36,39 @@
 
     in
     {
-      formatter = forAllSystems (system:
-        nixpkgs.legacyPackages.${system}.nixpkgs-fmt);
-
       lib = {
         base64 = import lib/base64.nix;
         gen-ssh-config = import lib/gen-ssh-config.nix lib;
         ssh-keys = import lib/ssh-keys.nix;
 
-        dirToAttrs = dir: f: lib.mapAttrs'
+        dirToAttrs =
-          (name: _: {
+          dir: f:
+          lib.mapAttrs' (name: _: {
             name = lib.removeSuffix ".nix" name;
             value = f "${toString dir}/${name}";
-          })
+          }) (builtins.readDir dir);
-          (builtins.readDir dir);
       };
 
-      nixosModules =
+      nixosModules = self.lib.dirToAttrs ./modules import // {
-        {
+        inherit pins;
-          inherit pins;
+        inherit (impermanence.nixosModules) impermanence;
-          inherit (impermanence.nixosModules) impermanence;
+        pkgs.nixpkgs.overlays = [ (_: mypkgs) ];
-          pkgs.nixpkgs.overlays = [ (_: mypkgs) ];
+      };
-        } //
-        self.lib.dirToAttrs ./modules import;
 
-      nixosConfigurations = self.lib.dirToAttrs ./hosts
+      nixosConfigurations = self.lib.dirToAttrs ./hosts (
-        (dir:
+        dir:
-          let cfg = import dir;
+        let
-          in lib.nixosSystem {
+          cfg = import dir;
-            inherit (cfg) system;
+        in
-            modules =
+        lib.nixosSystem {
-              cfg.modules ++
+          inherit (cfg) system;
-              [{ networking.hostName = builtins.baseNameOf dir; }] ++
+          modules =
-              (builtins.attrValues self.nixosModules);
+            cfg.modules
-          }
+            ++ [ { networking.hostName = builtins.baseNameOf dir; } ]
-        );
+            ++ (builtins.attrValues self.nixosModules);
+        }
+      );
 
-      packages = forAllSystems (system:
+      packages = forAllSystems (system: mypkgs nixpkgs.legacyPackages.${system});
-        mypkgs nixpkgs.legacyPackages.${system});
     };
 }

hosts/hp/configuration.nix

@@ -20,7 +20,10 @@ in
   ];
 
   services.openssh.hostKeys = [
-    { type = "ed25519"; path = "${persist}/ssh_host_ed25519_key"; }
+    {
+      type = "ed25519";
+      path = "${persist}/ssh_host_ed25519_key";
+    }
   ];
 
   users.mutableUsers = false;
@@ -36,11 +39,27 @@ in
   hardware.enableRedistributableFirmware = true;
 
   fileSystems = {
-    "/" = { device = "tmpfs"; fsType = "tmpfs"; options = [ "mode=755" ]; };
+    "/" = {
-    "/boot" = { device = "/dev/disk/by-partlabel/EFI\\x20system\\x20partition"; fsType = "vfat"; };
+      device = "tmpfs";
-    "/home" = { device = "zroot/locker/home"; fsType = "zfs"; };
+      fsType = "tmpfs";
-    "/nix" = { device = "zroot/locker/nix"; fsType = "zfs"; };
+      options = [ "mode=755" ];
-    "/var/log" = { device = "zroot/locker/log"; fsType = "zfs"; };
+    };
+    "/boot" = {
+      device = "/dev/disk/by-partlabel/EFI\\x20system\\x20partition";
+      fsType = "vfat";
+    };
+    "/home" = {
+      device = "zroot/locker/home";
+      fsType = "zfs";
+    };
+    "/nix" = {
+      device = "zroot/locker/nix";
+      fsType = "zfs";
+    };
+    "/var/log" = {
+      device = "zroot/locker/log";
+      fsType = "zfs";
+    };
   };
 
   system.stateVersion = "22.05";

hosts/levi/configuration.nix

@@ -8,7 +8,10 @@ in
   };
 
   services.openssh.hostKeys = [
-    { type = "ed25519"; path = "${persist}/ssh_host_ed25519_key"; }
+    {
+      type = "ed25519";
+      path = "${persist}/ssh_host_ed25519_key";
+    }
   ];
 
   # services.ollama = {
@@ -22,7 +25,10 @@ in
   sconfig = {
     gnome = true;
     desktop.enable = true;
-    wg-home = { enable = true; path = "${persist}/wireguard_home.conf"; };
+    wg-home = {
+      enable = true;
+      path = "${persist}/wireguard_home.conf";
+    };
   };
 
   environment.persistence."${persist}/system".directories = [
@@ -49,14 +55,32 @@ in
   boot = {
     loader.systemd-boot.enable = true;
     loader.efi.canTouchEfiVariables = true;
-    initrd.availableKernelModules = [ "xhci_pci" "vmd" "nvme" "sd_mod" ];
+    initrd.availableKernelModules = [
+      "xhci_pci"
+      "vmd"
+      "nvme"
+      "sd_mod"
+    ];
   };
 
   fileSystems = {
-    "/" = { device = "tmpfs"; fsType = "tmpfs"; options = [ "mode=755" ]; };
+    "/" = {
-    "/boot" = { fsType = "vfat"; device = "/dev/nvme0n1p1"; };
+      device = "tmpfs";
-    "/nix" = { device = "levi/nix"; fsType = "zfs"; };
+      fsType = "tmpfs";
-    "/home" = { device = "levi/home"; fsType = "zfs"; };
+      options = [ "mode=755" ];
+    };
+    "/boot" = {
+      fsType = "vfat";
+      device = "/dev/nvme0n1p1";
+    };
+    "/nix" = {
+      device = "levi/nix";
+      fsType = "zfs";
+    };
+    "/home" = {
+      device = "levi/home";
+      fsType = "zfs";
+    };
   };
 
   users.mutableUsers = false;

hosts/levi/gpu_notes.txt

@@ -0,0 +1,62 @@
+{
+hardware.nvidia.prime.intelBusId = "PCI:0:2:0";
+hardware.nvidia.prime.nvidiaBusId = "PCI:1:0:0";
+}
+
+### Nothing here has been tested since 2022
+
+################################################################################
+
+### "sync mode"
+#
+# good:
+#   max performance on external displays
+#   no BIOS settings change needed
+#
+# bad:
+#   graphics performance overhead on internal display
+#   internal display capped at 60hz
+#
+# hardware.nvidia.prime.sync.enable = true;
+# hardware.nvidia.modesetting.enable = true;
+# services.xserver.displayManager.gdm.wayland = false;
+# services.xserver.videoDrivers = [ "nvidia" ];
+# # xrandr workaround for laptop panel not showing up with GDM. Reference:
+# # https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/hardware/video/nvidia.nix
+# services.xserver.displayManager.sessionCommands = ''
+#   ${pkgs.xorg.xrandr}/bin/xrandr --setprovideroutputsource modesetting NVIDIA-0
+# '';
+
+################################################################################
+
+### nvidia drivers disabled
+#
+# Not well tested. Possibly Incomplete.
+# Won't allow external displays connected to nvidia GPU.
+#
+# Shutting off Nvidia GPU would theoretically save power.
+# I do not think this actually powers down the Nvidia GPU, just stops using it.
+#
+# boot.kernelParams = [ "module_blacklist=nouveau" ];
+
+################################################################################
+
+### hybrid graphics
+#
+# Not well tested. Possibly Incomplete.
+# Won't allow external displays connected to nvidia GPU.
+#
+# Everything would use intel by default,
+# but specific apps would run on the nvidia GPU under the script.
+#
+# hardware.nvidia.prime.offload.enable = true;
+# services.xserver.videoDrivers = [ "nvidia" ];
+# environment.systemPackages = [
+#   (pkgs.writeShellScriptBin "nv" ''
+#     export __NV_PRIME_RENDER_OFFLOAD=1
+#     export __NV_PRIME_RENDER_OFFLOAD_PROVIDER=NVIDIA-G0
+#     export __GLX_VENDOR_LIBRARY_NAME=nvidia
+#     export __VK_LAYER_NV_optimus=NVIDIA_only
+#     exec "$@"
+#   '')
+# ];

hosts/levi/xorg.nix

@@ -1,16 +1,5 @@
 {
-  hardware.nvidia.prime.intelBusId = "PCI:0:2:0";
-  hardware.nvidia.prime.nvidiaBusId = "PCI:1:0:0";
-
   ### NVIDIA-only using MUX switch in BIOS.
-  #
-  # good:
-  #   simple, always works.
-  #   max performance everywhere.
-  #
-  # bad:
-  #   requires BIOS setting changes, which is annoying.
-  #
   boot.kernelParams = [ "module_blacklist=i915" ];
   services.xserver.displayManager.gdm.wayland = false;
   services.xserver.videoDrivers = [ "nvidia" ];
@@ -19,61 +8,3 @@
     Option "metamodes" "DP-2: 2560x1440_165 +0+0 {AllowGSYNCCompatible=On}"
   '';
 }
-
-### Nothing below this line has been tested since 2022
-
-################################################################################
-
-### "sync mode"
-#
-# good:
-#   max performance on external displays
-#   no BIOS settings change needed
-#
-# bad:
-#   graphics performance overhead on internal display
-#   internal display capped at 60hz
-#
-# hardware.nvidia.prime.sync.enable = true;
-# hardware.nvidia.modesetting.enable = true;
-# services.xserver.displayManager.gdm.wayland = false;
-# services.xserver.videoDrivers = [ "nvidia" ];
-# # xrandr workaround for laptop panel not showing up with GDM. Reference:
-# # https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/hardware/video/nvidia.nix
-# services.xserver.displayManager.sessionCommands = ''
-#   ${pkgs.xorg.xrandr}/bin/xrandr --setprovideroutputsource modesetting NVIDIA-0
-# '';
-
-################################################################################
-
-### nvidia drivers disabled
-#
-# Not well tested. Possibly Incomplete.
-# Won't allow external displays connected to nvidia GPU.
-#
-# Shutting off Nvidia GPU would theoretically save power.
-# I do not think this actually powers down the Nvidia GPU, just stops using it.
-#
-# boot.kernelParams = [ "module_blacklist=nouveau" ];
-
-################################################################################
-
-### hybrid graphics
-#
-# Not well tested. Possibly Incomplete.
-# Won't allow external displays connected to nvidia GPU.
-#
-# Everything would use intel by default,
-# but specific apps would run on the nvidia GPU under the script.
-#
-# hardware.nvidia.prime.offload.enable = true;
-# services.xserver.videoDrivers = [ "nvidia" ];
-# environment.systemPackages = [
-#   (pkgs.writeShellScriptBin "nv" ''
-#     export __NV_PRIME_RENDER_OFFLOAD=1
-#     export __NV_PRIME_RENDER_OFFLOAD_PROVIDER=NVIDIA-G0
-#     export __GLX_VENDOR_LIBRARY_NAME=nvidia
-#     export __VK_LAYER_NV_optimus=NVIDIA_only
-#     exec "$@"
-#   '')
-# ];

lib/base64.nix

@@ -1,15 +1,20 @@
-{ runCommand }: {
+{ runCommand }:
+{
 
-  b64decode = input:
+  b64decode =
-    builtins.readFile
+    input:
-      (runCommand "b64decode" { } ''
+    builtins.readFile (
+      runCommand "b64decode" { } ''
         base64 -d >$out <${builtins.toFile "input" input}
-      '');
+      ''
+    );
 
-  b64encode = input:
+  b64encode =
-    builtins.readFile
+    input:
-      (runCommand "b64encode" { } ''
+    builtins.readFile (
+      runCommand "b64encode" { } ''
         base64 -w0 >$out <${builtins.toFile "input" input}
-      '');
+      ''
+    );
 
 }

lib/gen-iso.nix

@@ -1,16 +1,18 @@
-lib:
+lib: system:
-system:
 
 let
   sys = lib.nixosSystem {
     inherit system;
     modules = [
-      ({ modulesPath, ... }: {
+      (
-        imports = [
+        { modulesPath, ... }:
-          "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix"
+        {
-        ];
+          imports = [
-        isoImage.squashfsCompression = "gzip -Xcompression-level 1";
+            "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix"
-      })
+          ];
+          isoImage.squashfsCompression = "gzip -Xcompression-level 1";
+        }
+      )
     ];
   };
 

lib/gen-ssh-config.nix

@@ -1,23 +1,22 @@
-lib:
+lib: nixosConfigurations:
-nixosConfigurations:
 
 let
-  sshKnownHostsTxt = builtins.toFile "known_hosts" (lib.concatMapStrings
+  sshKnownHostsTxt = builtins.toFile "known_hosts" (
-    (hostName:
+    lib.concatMapStrings (
-      let d = nixosConfigurations.${hostName}.config.deploy;
+      hostName:
-      in lib.concatMapStrings (key: "${d.ssh.HostName} ${key}\n") d.sshPublicKeys
+      let
-    )
+        d = nixosConfigurations.${hostName}.config.deploy;
-    (builtins.attrNames nixosConfigurations)
+      in
+      lib.concatMapStrings (key: "${d.ssh.HostName} ${key}\n") d.sshPublicKeys
+    ) (builtins.attrNames nixosConfigurations)
   );
 
   attrsToList = lib.mapAttrsToList (n: v: "${n} ${v}");
   attrsToLines = a: lib.concatLines (attrsToList a);
 
 in
-lib.concatMapStrings
+lib.concatMapStrings (host: ''
-  (host: ''
+  Host ${host}
-    Host ${host}
+  UserKnownHostsFile ${sshKnownHostsTxt}
-    UserKnownHostsFile ${sshKnownHostsTxt}
+  ${attrsToLines nixosConfigurations.${host}.config.deploy.ssh}
-    ${attrsToLines nixosConfigurations.${host}.config.deploy.ssh}
+'') (builtins.attrNames nixosConfigurations)
-  '')
-  (builtins.attrNames nixosConfigurations)

modules/ad-domain.nix

@@ -1,10 +1,17 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.sconfig.ad-domain;
 in
 {
-  options.sconfig.ad-domain = with lib; with types;
+  options.sconfig.ad-domain =
+    with lib;
+    with types;
     {
       enable = mkEnableOption "Join Domain with SSSD";
       longname = mkOption {
@@ -17,58 +24,57 @@ in
       };
     };
 
-  config = lib.mkIf cfg.enable
+  config = lib.mkIf cfg.enable {
-    {
+    networking.domain = cfg.longname;
-      networking.domain = cfg.longname;
+    networking.search = [ (cfg.longname) ];
-      networking.search = [ (cfg.longname) ];
+    security.pam.services.sshd.makeHomeDir = true;
-      security.pam.services.sshd.makeHomeDir = true;
+    security.krb5 = {
-      security.krb5 = {
+      # These settings have been updated for NixOS 24.05.
-        # These settings have been updated for NixOS 24.05.
+      # Breaking changes happenned since 23.11.
-        # Breaking changes happenned since 23.11.
+      enable = true;
-        enable = true;
+      settings.libdefaults.default_realm = lib.toUpper cfg.longname;
-        settings.libdefaults.default_realm = lib.toUpper cfg.longname;
-      };
-      services.sssd = {
-        enable = true;
-        sshAuthorizedKeysIntegration = true;
-        config = ''
-          [sssd]
-          services = nss, pam, ssh
-          config_file_version = 2
-          domains = ${cfg.longname}
-          [domain/${cfg.longname}]
-          id_provider = ad
-          ldap_sasl_mech = gssapi
-          access_provider = ad
-          override_homedir = /home/%u.%d
-          override_shell = /run/current-system/sw/bin/bash
-          ad_gpo_access_control = permissive
-          ad_gpo_ignore_unreadable = True
-          ldap_user_extra_attrs = altSecurityIdentities:altSecurityIdentities
-          ldap_user_ssh_public_key = altSecurityIdentities
-          ldap_use_tokengroups = True
-        '';
-      };
-      # Samba is configured, but just for the "net" command, to
-      # join the domain. A better join method probably exists.
-      # `net ads join -U Administrator`
-      environment.systemPackages = [ pkgs.samba4Full ];
-      systemd.services.samba-smbd.enable = lib.mkDefault false;
-      services.samba = {
-        enable = true;
-        enableNmbd = lib.mkDefault false;
-        enableWinbindd = lib.mkDefault false;
-        package = pkgs.samba4Full;
-        securityType = "ads";
-        extraConfig = ''
-          realm = ${lib.toUpper cfg.longname}
-          workgroup = ${lib.toUpper cfg.shortname}
-          client use spnego = yes
-          restrict anonymous = 2
-          server signing = mandatory
-          client signing = mandatory
-          kerberos method = secrets and keytab
-        '';
-      };
     };
+    services.sssd = {
+      enable = true;
+      sshAuthorizedKeysIntegration = true;
+      config = ''
+        [sssd]
+        services = nss, pam, ssh
+        config_file_version = 2
+        domains = ${cfg.longname}
+        [domain/${cfg.longname}]
+        id_provider = ad
+        ldap_sasl_mech = gssapi
+        access_provider = ad
+        override_homedir = /home/%u.%d
+        override_shell = /run/current-system/sw/bin/bash
+        ad_gpo_access_control = permissive
+        ad_gpo_ignore_unreadable = True
+        ldap_user_extra_attrs = altSecurityIdentities:altSecurityIdentities
+        ldap_user_ssh_public_key = altSecurityIdentities
+        ldap_use_tokengroups = True
+      '';
+    };
+    # Samba is configured, but just for the "net" command, to
+    # join the domain. A better join method probably exists.
+    # `net ads join -U Administrator`
+    environment.systemPackages = [ pkgs.samba4Full ];
+    systemd.services.samba-smbd.enable = lib.mkDefault false;
+    services.samba = {
+      enable = true;
+      enableNmbd = lib.mkDefault false;
+      enableWinbindd = lib.mkDefault false;
+      package = pkgs.samba4Full;
+      securityType = "ads";
+      extraConfig = ''
+        realm = ${lib.toUpper cfg.longname}
+        workgroup = ${lib.toUpper cfg.shortname}
+        client use spnego = yes
+        restrict anonymous = 2
+        server signing = mandatory
+        client signing = mandatory
+        kerberos method = secrets and keytab
+      '';
+    };
+  };
 }

modules/backport.nix

@@ -1,24 +1,24 @@
 let
 
-  brave = (final: prev: {
+  brave = (
-    brave =
+    final: prev: {
-      let
+      brave =
-        # updates to the newer version before it hits the channels
+        let
-        version = "1";
+          # updates to the newer version before it hits the channels
-        hash = "";
+          version = "1";
-      in
+          hash = "";
-      if
+        in
-        prev.lib.versionAtLeast prev.brave.version version
+        if prev.lib.versionAtLeast prev.brave.version version then
-      then
+          prev.brave
-        prev.brave
+        else
-      else
+          prev.brave.overrideAttrs {
-        prev.brave.overrideAttrs {
+            src = prev.fetchurl {
-          src = prev.fetchurl {
+              inherit hash;
-            inherit hash;
+              url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-            url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
+            };
           };
-        };
+    }
-  });
+  );
 
 in
 {

modules/cli/default.nix

@@ -18,9 +18,9 @@
     lm_sensors
     ncdu
     nix-diff
+    nixfmt-rfc-style
     nix-index
     nix-prefetch-github
-    nixpkgs-fmt
     nodejs
     openssl
     parted
@@ -42,9 +42,11 @@
 
     (writeShellScriptBin "dirt" "while sleep 1; do grep '^Dirty:' /proc/meminfo ; done")
 
-    (lib.hiPrio (writeShellScriptBin "iftop" ''
+    (lib.hiPrio (
-      exec ${iftop}/bin/iftop -P -m100M "$@"
+      writeShellScriptBin "iftop" ''
-    ''))
+        exec ${iftop}/bin/iftop -P -m100M "$@"
+      ''
+    ))
 
     (writeShellScriptBin "bat" ''
       ${bat}/bin/bat --pager=never --color=always --wrap=never --terminal-width=80 "$@"
@@ -85,7 +87,11 @@
       update_process_names = 1;
     };
     package = pkgs.htop.overrideAttrs (
-      { patches ? [ ], ... }: {
+      {
+        patches ? [ ],
+        ...
+      }:
+      {
         patches = patches ++ [
           # This patch fixes process sort order while in tree view.
           # Started in 3.3.0. Should be fixed in 3.4.0.

modules/cli/powerline.nix

@@ -1,7 +1,7 @@
 { pkgs, ... }:
 let
-  left_hard_divider = builtins.fromJSON '' "\uE0B0" '';
+  left_hard_divider = builtins.fromJSON ''"\uE0B0" '';
-  upper_left_triangle = builtins.fromJSON '' "\uE0BC" '';
+  upper_left_triangle = builtins.fromJSON ''"\uE0BC" '';
 
   theme = {
     BoldForeground = true;
@@ -11,16 +11,20 @@ let
     SeparatorFg = 16;
   };
 
-  customEnd = [{
+  customEnd = [
-    Content = "$";
+    {
-    Foreground = 231;
+      Content = "$";
-    Background = 102;
+      Foreground = 231;
-    Separator = left_hard_divider;
+      Background = 102;
-  }];
+      Separator = left_hard_divider;
+    }
+  ];
 
-  plconfig = builtins.toFile "powerline-config.json" (builtins.toJSON {
+  plconfig = builtins.toFile "powerline-config.json" (
-    modes.patched.Separator = upper_left_triangle;
+    builtins.toJSON {
-  });
+      modes.patched.Separator = upper_left_triangle;
+    }
+  );
 
   args = [
     "-modules=\${remote:+'user,host,'}nix-shell,git,jobs,cwd,newline,customend"
@@ -37,9 +41,7 @@ in
   environment.systemPackages = [
     pkgs.powerline-go
 
-    (pkgs.writeShellScriptBin
+    (pkgs.writeShellScriptBin "powerline-go-customend" "echo '${builtins.toJSON customEnd}'")
-      "powerline-go-customend"
-      "echo '${builtins.toJSON customEnd}'")
   ];
 
   environment.etc."powerline-theme.json".text = builtins.toJSON theme;

modules/desktop/alacritty.nix

@@ -1,27 +1,50 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
-  aconfig = (pkgs.formats.toml { }).generate "alacritty.toml"
+  aconfig = (pkgs.formats.toml { }).generate "alacritty.toml" {
-    {
+    env.TERM = "xterm-256color";
-      env.TERM = "xterm-256color";
+    font.size = 12;
-      font.size = 12;
+    window = {
-      window = {
+      dynamic_padding = true;
-        dynamic_padding = true;
+      resize_increments = true;
-        resize_increments = true;
+      dimensions = {
-        dimensions = { columns = 120; lines = 40; };
+        columns = 120;
+        lines = 40;
       };
-      keyboard.bindings = [
-        { action = "ScrollHalfPageDown"; mods = "Shift"; key = "PageDown"; }
-        { action = "ScrollHalfPageUp"; mods = "Shift"; key = "PageUp"; }
-        { action = "SpawnNewInstance"; mods = "Control|Shift"; key = "N"; }
-        { action = "SpawnNewInstance"; mods = "Control|Shift"; key = "T"; }
-      ];
-      colors = {
-        primary.background = "0x1e1e1e";
-        primary.foreground = "0xffffff";
-      };
-      import = [ "${pkgs.alacritty-theme}/tango_dark.toml" ];
     };
+    keyboard.bindings = [
+      {
+        action = "ScrollHalfPageDown";
+        mods = "Shift";
+        key = "PageDown";
+      }
+      {
+        action = "ScrollHalfPageUp";
+        mods = "Shift";
+        key = "PageUp";
+      }
+      {
+        action = "SpawnNewInstance";
+        mods = "Control|Shift";
+        key = "N";
+      }
+      {
+        action = "SpawnNewInstance";
+        mods = "Control|Shift";
+        key = "T";
+      }
+    ];
+    colors = {
+      primary.background = "0x1e1e1e";
+      primary.foreground = "0xffffff";
+    };
+    general.import = [ "${pkgs.alacritty-theme}/tango_dark.toml" ];
+  };
 
   # Alacritty seems to not communicate well with gnome-shell. Quick fix:
   notify-fix = pkgs.runCommand "alacritty-fix" { } ''

modules/desktop/chromium.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 {
   config = lib.mkIf (config.sconfig.desktop.enable) {
     environment.systemPackages = [
@@ -26,8 +31,14 @@
         ShowFullUrlsInAddressBar = true;
         SyncDisabled = true; # required for BrowsingDataLifetime
         BrowsingDataLifetime = [
-          { data_types = [ "browsing_history" ]; time_to_live_in_hours = 24 * 7; }
+          {
-          { data_types = [ "download_history" ]; time_to_live_in_hours = 6; }
+            data_types = [ "browsing_history" ];
+            time_to_live_in_hours = 24 * 7;
+          }
+          {
+            data_types = [ "download_history" ];
+            time_to_live_in_hours = 6;
+          }
         ];
       };
     };

modules/desktop/default.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 with lib;
 {
   options.sconfig.desktop = {

modules/desktop/firefox.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 {
   config = lib.mkIf (config.sconfig.desktop.enable) {
     environment.systemPackages = [
@@ -12,25 +17,31 @@
           OfferToSaveLogins = false;
           DisableFormHistory = true;
           SearchSuggestEnabled = false;
-          Preferences = builtins.mapAttrs
+          Preferences =
-            (n: v: { Value = v; Status = "locked"; })
-            {
-              "accessibility.force_disabled" = 1;
-              "browser.aboutConfig.showWarning" = false;
-              "browser.contentblocking.category" = "strict";
-              "browser.tabs.firefox-view" = false;
-              "browser.uitour.enabled" = false;
-              "browser.zoom.siteSpecific" = false;
-              "extensions.formautofill.addresses.enabled" = false;
-              "extensions.formautofill.creditCards.enabled" = false;
-              "extensions.formautofill.heuristics.enabled" = false;
-              "network.IDN_show_punycode" = true;
-              "places.history.expiration.max_pages" = 2048;
-              "ui.key.menuAccessKeyFocuses" = false;
-            };
-          ExtensionSettings =
-            { "*".installation_mode = "blocked"; } //
             builtins.mapAttrs
+              (n: v: {
+                Value = v;
+                Status = "locked";
+              })
+              {
+                "accessibility.force_disabled" = 1;
+                "browser.aboutConfig.showWarning" = false;
+                "browser.contentblocking.category" = "strict";
+                "browser.tabs.firefox-view" = false;
+                "browser.uitour.enabled" = false;
+                "browser.zoom.siteSpecific" = false;
+                "extensions.formautofill.addresses.enabled" = false;
+                "extensions.formautofill.creditCards.enabled" = false;
+                "extensions.formautofill.heuristics.enabled" = false;
+                "network.IDN_show_punycode" = true;
+                "places.history.expiration.max_pages" = 2048;
+                "ui.key.menuAccessKeyFocuses" = false;
+              };
+          ExtensionSettings =
+            {
+              "*".installation_mode = "blocked";
+            }
+            // builtins.mapAttrs
               (n: v: {
                 installation_mode = "force_installed";
                 install_url = "https://addons.mozilla.org/firefox/downloads/latest/${v}/latest.xpi";

modules/desktop/vscode.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 {
   config = lib.mkIf (config.sconfig.desktop.enable) {
     environment.systemPackages = with pkgs; [
@@ -22,9 +27,8 @@
 
     environment.etc."vscode-keybindings.json".source = ./vscode-keybindings.json;
     environment.etc."vscode-settings.json".text = builtins.toJSON (
-      (
+      (builtins.fromJSON (builtins.readFile ./vscode-settings.json))
-        builtins.fromJSON (builtins.readFile ./vscode-settings.json)
+      // {
-      ) // {
         # NixOS-specific vscode settings:
         "extensions.autoCheckUpdates" = false;
         "extensions.autoUpdate" = false;

modules/devtools.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   cfg = config.sconfig.devtools;
 in
@@ -6,37 +11,35 @@ in
   options.sconfig.devtools.enable = lib.mkEnableOption "Development Tools";
 
   config = lib.mkIf cfg.enable {
-    environment.systemPackages = with pkgs;
+    environment.systemPackages = with pkgs; [
-      [
+      black
-        black
+      cargo
-        cargo
+      efm-langserver
-        efm-langserver
+      errcheck
-        errcheck
+      go
-        go
+      gopls
-        gopls
+      kubectl
-        kubectl
+      kubernetes-helm
-        kubernetes-helm
+      lua-language-server
-        lua-language-server
+      nil
-        nil
+      nodePackages.prettier
-        nodePackages.prettier
+      nodePackages.typescript-language-server
-        nodePackages.typescript-language-server
+      pyright
-        pyright
+      rust-analyzer
-        rust-analyzer
+      rustc
-        rustc
+      rustc.llvmPackages.lld
-        rustc.llvmPackages.lld
+      rustfmt
-        rustfmt
+      stern
-        stern
+      terraform
-        terraform
+      terraform-ls
-        terraform-ls
+      vscode-langservers-extracted
-        vscode-langservers-extracted
+      yaml-language-server
-        yaml-language-server
 
-        # dedicated script, because bash aliases dont work with `watch`
+      # dedicated script, because bash aliases dont work with `watch`
-        (writeShellScriptBin "k" "exec kubectl \"$@\"")
+      (writeShellScriptBin "k" "exec kubectl \"$@\"")
 
-        (google-cloud-sdk.withExtraComponents
+      (google-cloud-sdk.withExtraComponents [ google-cloud-sdk.components.gke-gcloud-auth-plugin ])
-          [ google-cloud-sdk.components.gke-gcloud-auth-plugin ])
+    ];
-      ];
     programs.bash.interactiveShellInit = ''
       alias t=terraform
       complete -C terraform t

modules/gnome.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   cfg = config.sconfig.gnome;
 in

modules/helix/default.nix

@@ -4,90 +4,115 @@ let
     exec prettier --stdin-filepath "$HX_FILE"
   '';
 
-  prettier-formats = map
+  prettier-formats =
-    (name: {
+    map
-      inherit name;
+      (name: {
-      auto-format = true;
+        inherit name;
-      indent = { tab-width = 4; unit = "\t"; };
+        auto-format = true;
-      formatter.command = hx-pretty;
+        indent = {
-    })
+          tab-width = 4;
-    [
+          unit = "\t";
-      "css"
+        };
-      "html"
+        formatter.command = hx-pretty;
-      "javascript"
+      })
-      "json"
+      [
-      "typescript"
+        "css"
-    ];
+        "html"
+        "javascript"
+        "json"
+        "typescript"
+      ];
 
 in
 {
-  environment.etc."bck-helix/config.toml".source =
+  environment.etc."bck-helix/config.toml".source = (pkgs.formats.toml { }).generate "config.toml" {
-    (pkgs.formats.toml { }).generate "config.toml" {
+    theme = "dark_plus";
-      theme = "dark_plus";
+    editor = {
-      editor = {
+      auto-format = true;
-        auto-format = true;
+      bufferline = "multiple";
-        bufferline = "multiple";
+      indent-guides.render = true;
-        indent-guides.render = true;
+      line-number = "relative";
-        line-number = "relative";
+      mouse = false;
-        mouse = false;
+      scrolloff = 10;
-        scrolloff = 10;
+      true-color = true;
-        true-color = true;
-      };
-      keys = {
-        normal.A-j = ":buffer-previous";
-        normal.A-k = ":buffer-next";
-        normal.space.e = ":w";
-        normal.space.x = ":q";
-        normal.space.backspace = ":reset-diff-change";
-      };
     };
+    keys = {
+      normal.A-j = ":buffer-previous";
+      normal.A-k = ":buffer-next";
+      normal.space.e = ":w";
+      normal.space.x = ":q";
+      normal.space.backspace = ":reset-diff-change";
+    };
+  };
 
   environment.etc."bck-helix/languages.toml".source =
-    (pkgs.formats.toml { }).generate "languages.toml" {
+    (pkgs.formats.toml { }).generate "languages.toml"
-      language = prettier-formats ++ [
+      {
-        {
+        language = prettier-formats ++ [
-          name = "bash";
+          {
-          auto-format = true;
+            name = "bash";
-          indent = { tab-width = 4; unit = "\t"; };
+            auto-format = true;
-        }
+            indent = {
-        {
+              tab-width = 4;
-          name = "lua";
+              unit = "\t";
-          auto-format = true;
+            };
-          indent = { tab-width = 4; unit = "\t"; };
+          }
-        }
+          {
-        {
+            name = "lua";
-          name = "nix";
+            auto-format = true;
-          auto-format = true;
+            indent = {
-          formatter.command = "nixpkgs-fmt";
+              tab-width = 4;
-        }
+              unit = "\t";
-        {
+            };
-          name = "python";
+          }
-          auto-format = true;
+          {
-          language-servers = [ "pyright" ];
+            name = "nix";
-          formatter = { command = "black"; args = [ "--quiet" "-" ]; };
+            auto-format = true;
-        }
+            formatter = {
-        {
+              command = "nixfmt";
-          name = "yaml";
+              args = [ "--verify" ];
-          auto-format = true;
+            };
-          formatter.command = hx-pretty;
+          }
-        }
+          {
-      ];
+            name = "python";
-      language-server = {
+            auto-format = true;
-        pyright = {
+            language-servers = [ "pyright" ];
-          command = "pyright-langserver";
+            formatter = {
-          args = [ "--stdio" ];
+              command = "black";
+              args = [
+                "--quiet"
+                "-"
+              ];
+            };
+          }
+          {
+            name = "yaml";
+            auto-format = true;
+            formatter.command = hx-pretty;
+          }
+        ];
+        language-server = {
+          pyright = {
+            command = "pyright-langserver";
+            args = [ "--stdio" ];
+          };
         };
       };
-    };
 
   environment.systemPackages = with pkgs; [
-    (helix.overrideAttrs ({ patches ? [ ], ... }: {
+    (helix.overrideAttrs (
-      # Patch required for .editorconfig to work properly with formatters
+      {
-      patches = patches ++ [ ./format-filepath.patch ];
+        patches ? [ ],
-      postPatch = ''
+        ...
-        sed 's/tab-width = .,/tab-width = 4,/' -i languages.toml
+      }:
-      '';
+      {
-    }))
+        # Patch required for .editorconfig to work properly with formatters
+        patches = patches ++ [ ./format-filepath.patch ];
+        postPatch = ''
+          sed 's/tab-width = .,/tab-width = 4,/' -i languages.toml
+        '';
+      }
+    ))
   ];
 
   environment.etc."bck-settings.sh".text = ''

modules/plasma.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   cfg = config.sconfig.plasma;
 in

modules/security-tools.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
 
   cfg = config.sconfig.security-tools;

modules/swapspace.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.sconfig.swapspace;
 in

modules/wg-home.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.sconfig.wg-home;
 in

pkgs/bck-authorized-keys.nix

@@ -1,5 +1,6 @@
-{ lib
+{
-, writeTextDir
+  lib,
+  writeTextDir,
 }:
 
 writeTextDir "authorized_keys" (lib.concatLines (import ../lib/ssh-keys.nix))

pkgs/bck-nvim/default.nix

@@ -1,20 +1,17 @@
-{ lib
+{
-, extraBinPaths ? [ ]
+  lib,
-, neovim-unwrapped
+  extraBinPaths ? [ ],
-, vimPlugins
+  neovim-unwrapped,
-, wrapNeovim
+  vimPlugins,
+  wrapNeovim,
 }:
 
 let
-  luafiles = lib.concatLines (map
+  luafiles = lib.concatLines (
-    (x: "luafile ${./lua}/${x}")
+    map (x: "luafile ${./lua}/${x}") (builtins.attrNames (builtins.readDir ./lua))
-    (builtins.attrNames (builtins.readDir ./lua))
   );
 
-  extraPath = lib.concatLines (map
+  extraPath = lib.concatLines (map (p: "let $PATH .= ':${p}/bin'") (extraBinPaths));
-    (p: "let $PATH .= ':${p}/bin'")
-    (extraBinPaths)
-  );
 
 in
 wrapNeovim neovim-unwrapped {

pkgs/bck-nvim/lua/5-lsp.lua

@@ -56,7 +56,7 @@ lspconfig.nil_ls.setup({
 	settings = {
 		['nil'] = {
 			formatting = {
-				command = { "nixpkgs-fmt" },
+				command = { "nixfmt", "--verify" },
 			},
 		},
 	},

pkgs/binaryninja/default.nix

@@ -1,11 +1,12 @@
-{ stdenv
+{
-, autoPatchelfHook
+  stdenv,
-, libglvnd
+  autoPatchelfHook,
-, makeWrapper
+  libglvnd,
-, python3
+  makeWrapper,
-, qt6
+  python3,
-, requireFile
+  qt6,
-, unzip
+  requireFile,
+  unzip,
 }:
 
 let

pkgs/deploy/default.nix

@@ -1,6 +1,7 @@
-{ nixos-rebuild
+{
-, python3
+  nixos-rebuild,
-, writeShellScriptBin
+  python3,
+  writeShellScriptBin,
 }:
 
 writeShellScriptBin "deploy" ''

pkgs/firecracker-vm/default.nix

@@ -1,34 +1,39 @@
-{ callPackage
+{
-, firecracker
+  callPackage,
-, writeShellApplication
+  firecracker,
-, writeText
+  writeShellApplication,
+  writeText,
 }:
 
 let
   kernel = callPackage ./kernel.nix { };
   rootfs = callPackage ./rootfs.nix { };
 
-  vmconfig = writeText "vmconfig.json" (builtins.toJSON {
+  vmconfig = writeText "vmconfig.json" (
-    boot-source = {
+    builtins.toJSON {
-      kernel_image_path = "${kernel}/vmlinux";
+      boot-source = {
-      boot_args = "panic=1 console=ttyS0 ro";
+        kernel_image_path = "${kernel}/vmlinux";
-    };
+        boot_args = "panic=1 console=ttyS0 ro";
-    drives = [
+      };
-      {
+      drives = [
-        drive_id = "rootfs";
+        {
-        path_on_host = rootfs;
+          drive_id = "rootfs";
-        is_root_device = true;
+          path_on_host = rootfs;
-        is_read_only = true;
+          is_root_device = true;
-      }
+          is_read_only = true;
-    ];
+        }
-    machine-config.vcpu_count = 2;
+      ];
-    machine-config.mem_size_mib = 1024;
+      machine-config.vcpu_count = 2;
-    network-interfaces = [ ];
+      machine-config.mem_size_mib = 1024;
-  });
+      network-interfaces = [ ];
+    }
+  );
 
 in
 writeShellApplication {
   name = "firecracker-vm";
   text = "${firecracker}/bin/firecracker --no-api --config-file ${vmconfig}";
-  derivationArgs.passthru = { inherit kernel rootfs; };
+  derivationArgs.passthru = {
+    inherit kernel rootfs;
+  };
 }

pkgs/firecracker-vm/kernel.nix

@@ -1,7 +1,8 @@
-{ fetchFromGitHub
+{
-, linuxManualConfig
+  fetchFromGitHub,
-, linux_6_1
+  linuxManualConfig,
-, kernel ? linux_6_1
+  linux_6_1,
+  kernel ? linux_6_1,
 }:
 
 let
@@ -12,23 +13,21 @@ let
     hash = "sha256-NuVH12cy38uu+8oms66p9k0xoMOJSl5AvY5pD1FCKkI=";
   };
 
-  shortVer = builtins.head (
+  shortVer = builtins.head (builtins.match "([0-9]+\.[0-9]+).*" kernel.version);
-    builtins.match
-      "([0-9]+\.[0-9]+).*"
-      kernel.version
-  );
 
 in
 (linuxManualConfig {
 
   inherit (kernel) src version;
-  configfile =
+  configfile = "${fcsrc}/resources/guest_configs/microvm-kernel-ci-x86_64-${shortVer}.config";
-    "${fcsrc}/resources/guest_configs/microvm-kernel-ci-x86_64-${shortVer}.config";
 
-}).overrideAttrs (o: {
+}).overrideAttrs
+  (o: {
 
-  postInstall = (o.postInstall or "") + ''
+    postInstall =
-    cp vmlinux $out/
+      (o.postInstall or "")
-  '';
+      + ''
+        cp vmlinux $out/
+      '';
 
-})
+  })

pkgs/firecracker-vm/rootfs.nix

@@ -1,8 +1,9 @@
-{ e2fsprogs
+{
-, pkgsStatic
+  e2fsprogs,
-, runCommand
+  pkgsStatic,
-, util-linux
+  runCommand,
-, writeShellScript
+  util-linux,
+  writeShellScript,
 }:
 
 let

pkgs/ftb.nix

@@ -1,8 +1,9 @@
-{ lib
+{
-, dpkg
+  lib,
-, fetchurl
+  dpkg,
-, stdenv
+  fetchurl,
-, steam-run
+  stdenv,
+  steam-run,
 }:
 
 stdenv.mkDerivation rec {

pkgs/mp4grep.nix

@@ -1,11 +1,12 @@
-{ stdenv
+{
-, autoPatchelfHook
+  stdenv,
-, fetchFromGitHub
+  autoPatchelfHook,
-, fetchzip
+  fetchFromGitHub,
-, gcc-unwrapped
+  fetchzip,
-, makeWrapper
+  gcc-unwrapped,
-, ocamlPackages
+  makeWrapper,
-, model ? "small"
+  ocamlPackages,
+  model ? "small",
 }:
 
 let
@@ -30,8 +31,7 @@ let
   '';
 
 in
-stdenv.mkDerivation rec
+stdenv.mkDerivation rec {
-{
   pname = "mp4grep";
   version = "0.1.4";
 

pkgs/weevely.nix

@@ -1,4 +1,9 @@
-{ stdenv, python3, fetchFromGitHub, makeWrapper }:
+{
+  stdenv,
+  python3,
+  fetchFromGitHub,
+  makeWrapper,
+}:
 
 stdenv.mkDerivation rec {
   pname = "weevely";
@@ -11,14 +16,16 @@ stdenv.mkDerivation rec {
     sha256 = "0sgjf7ihgipb33k73d84dcx7snv2fvbzyd0f4468k1w5w6zqm9xj";
   };
 
-  pythonWithPkgs = python3.withPackages (ps: with ps; [
+  pythonWithPkgs = python3.withPackages (
-    Mako
+    ps: with ps; [
-    prettytable
+      Mako
-    pyopenssl
+      prettytable
-    pysocks
+      pyopenssl
-    python-dateutil
+      pysocks
-    pyyaml
+      python-dateutil
-  ]);
+      pyyaml
+    ]
+  );
 
   buildInputs = [ makeWrapper ];