Add support for DisplayLink docks at work.

Fix lexical binding issue loading python language server.
Use lexical binding in elisp files.
2026-09-23 09:43:58 -04:00 · 2026-09-13 23:47:20 -04:00 · 2026-09-12 21:00:26 -04:00 · 2026-09-12 17:27:33 -04:00 · 2026-09-12 17:27:33 -04:00 · 2026-09-12 17:26:41 -04:00
258 changed files with 10741 additions and 303 deletions
--- a/nix/configuration/README.org
+++ b/nix/configuration/README.org
@@ -0,0 +1,12 @@
+* To-do
+** Perhaps use overlay for /etc for speedup
+#+begin_src nix
+  system.etc.overlay.enable = true;
+#+end_src
+** read https://nixos.org/manual/nixos/stable/
+** Performance for mini pc
+#+begin_src nix
+  security.pam.loginLimits = [
+    { domain = "@users"; item = "rtprio"; type = "-"; value = 1; }
+  ];
+#+end_src
--- a/nix/configuration/configuration.nix
+++ b/nix/configuration/configuration.nix
@@ -1,9 +1,16 @@
 {
  config,
  lib,
+  pkgs,
  ...
 }:

+let
+  alias_nix_pin_revision = pkgs.writeShellScriptBin "nix-pin-revision" ''
+    # Usage: nix-pin-revision nixpkgs 'github:NixOS/nixpkgs/00c21e4c93d963c50d4c0c89bfa84ed6e0694df2'
+    exec nix flake lock --override-input "''${@}"
+  '';
+in
 {
  imports = [
    ./roles/2ship2harkinian
@@ -21,6 +28,7 @@
    ./roles/d2
    ./roles/direnv
    ./roles/disko
+    ./roles/displaylink
    ./roles/distributed_build
    ./roles/doas
    ./roles/docker
@@ -29,6 +37,7 @@
    ./roles/emacs
    ./roles/emulate_isa
    ./roles/esim
+    ./roles/exfat
    ./roles/firefox
    ./roles/firewall
    ./roles/flux
@@ -47,6 +56,7 @@
    ./roles/iso_mount
    ./roles/jujutsu
    ./roles/kanshi
+    ./roles/kernel
    ./roles/kodi
    ./roles/kubernetes
    ./roles/latex
@@ -55,6 +65,7 @@
    ./roles/media
    ./roles/memtest86
    ./roles/minimal_base
+    ./roles/mitmproxy
    ./roles/network
    ./roles/nix_index
    ./roles/nix_repl
@@ -109,16 +120,19 @@
    nix.settings.experimental-features = [
      "nix-command"
      "flakes"
-      "ca-derivations"
+      # "ca-derivations"
      # "blake3-hashes"
      # "git-hashing"
    ];
    nix.settings.trusted-users = [ "@wheel" ];
    nix.settings.connect-timeout = 5;
-    nix.settings.min-free = 128000000;
-    nix.settings.max-free = 1000000000;
+    nix.settings.min-free = 5 * 1024 * 1024 * 1024; # Kick off garbage collect if space for nix store is less than 5 GiB
+    nix.settings.max-free = 10 * 1024 * 1024 * 1024; # Run that garbage collect until at least 10 GiB are free.
    nix.settings.fallback = true;
    nix.settings.warn-dirty = false;
+    nix.settings.fsync-metadata = true;
+    # Ensure store paths are durably written to disk before registering the paths so a crash mid-build does not leave us in a corrupted state.
+    nix.settings.fsync-store-paths = true;

    hardware.enableRedistributableFirmware = true;

@@ -129,7 +143,8 @@
    # Automatic garbage collection
    nix.gc = lib.mkIf (!config.me.buildingPortable) {
      # Runs nix-collect-garbage --delete-older-than 5d
-      automatic = true;
+      # automatic = true;
+      automatic = false;
      persistent = true;
      dates = "monthly";
      # randomizedDelaySec = "14m";
@@ -137,6 +152,10 @@
    };
    nix.settings.auto-optimise-store = !config.me.buildingPortable;

+    environment.systemPackages = [
+      alias_nix_pin_revision
+    ];
+
    environment.persistence."/persist" = lib.mkIf (config.me.mountPersistence) {
      hideMounts = true;
      directories = [
@@ -220,22 +239,42 @@
        );
      in
      [
-        (disableTests "coreutils")
-        (disableTests "coreutils-full")
-        (disableTests "libuv")
-        (final: prev: {
-          inherit (final.unoptimized) libtpms libjxl;
-        })
+        (disableTests "deno") # Tests use too much disk space
+        (disableOptimizations "libtpms")
        (disableOptimizationsPython3 "scipy")
-        # Works but probably sets python2's scipy to be python3:
-        #
-        # (final: prev: {
-        #   pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
-        #     (python-final: python-prev: {
-        #       scipy = final.unoptimized.python3Packages.scipy;
-        #     })
-        #   ];
-        # })
+        (disableOptimizations "assimp")
+        (disableOptimizations "gsl")
+        (final: prev: {
+          rpcs3 = prev.rpcs3.override {
+            glew = (final.glew.override { enableEGL = false; });
+          };
+        })
+        (disableTests "onetbb") # oneTBB tests hang forever on machines with a single core (like my build virtual machine) https://github.com/uxlfoundation/oneTBB/issues/1557
+        (disableTests "aws-c-common") # aws-c-common tests time out on my build virtual machine but run fine on my laptop.
+        (disableOptimizations "onnxruntime") # QuantizeLinearOpTest test failing.
+        (final: prev: {
+          rpcs3 = prev.rpcs3.overrideAttrs (
+            finalAttrs: prevAttrs: {
+              version = "0.0.42-19843";
+
+              src = final.fetchFromGitHub {
+                owner = "RPCS3";
+                repo = "rpcs3";
+                rev = "6567a5a2f8ab47a89db395d6b47a7b59b23d6960";
+                postCheckout = ''
+                  cd $out/3rdparty
+                  git submodule update --init \
+                    fusion/fusion asmjit/asmjit yaml-cpp/yaml-cpp SoundTouch/soundtouch stblib/stb \
+                    feralinteractive/feralinteractive wolfssl/wolfssl
+                '';
+                hash = "sha256-a1c1+Ui7XyHFTGEZAgRuJasCzQqr2PZNTlwaDUWVb18=";
+              };
+
+              patches = [ ];
+            }
+          );
+        })
+        (disableTests "ada") # test failing with http url is not idempotent.
      ];

    # This option defines the first version of NixOS you have installed on this particular machine,
--- a/nix/configuration/flake.lock
+++ b/nix/configuration/flake.lock
@@ -22,11 +22,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769524058,
-        "narHash": "sha256-zygdD6X1PcVNR2PsyK4ptzrVEiAdbMqLos7utrMDEWE=",
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "71a3fc97d80881e91710fe721f1158d3b96ae14d",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
        "type": "github"
      },
      "original": {
@@ -162,13 +162,34 @@
        "type": "github"
      }
    },
+    "nix_builder": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay_2"
+      },
+      "locked": {
+        "lastModified": 1788488145,
+        "narHash": "sha256-s1UY+kbLtb+5ye4GnE/HKh0idUQ0iiIkMMtGI7cDRHk=",
+        "ref": "refs/heads/main",
+        "rev": "8b28dfb583e094f52fd6ab70c709cc1981d8853d",
+        "revCount": 46,
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/nix_builder.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/nix_builder.git"
+      }
+    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1770197578,
-        "narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=",
+        "lastModified": 1788752844,
+        "narHash": "sha256-VaWGJ6+cIYN2erfSecbRV+4ljI185Ty2wUrXyvQbgOw=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2",
+        "rev": "dc5d91f840324650bac8c379428c7037a416959a",
        "type": "github"
      },
      "original": {
@@ -226,6 +247,7 @@
        "disko": "disko",
        "impermanence": "impermanence",
        "lanzaboote": "lanzaboote",
+        "nix_builder": "nix_builder",
        "nixpkgs": "nixpkgs"
      }
    },
@@ -249,6 +271,27 @@
        "repo": "rust-overlay",
        "type": "github"
      }
+    },
+    "rust-overlay_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nix_builder",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779506148,
+        "narHash": "sha256-OffE5yuMrSW71zIJNLvtl9MCO6WTAHEjlFPUCvkd/QM=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "d9973e2ab49747fada06ebbe26cda27eb0220cf1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
    }
  },
  "root": "root",
--- a/nix/configuration/flake.nix
+++ b/nix/configuration/flake.nix
@@ -28,6 +28,10 @@
      url = "github:nix-community/disko";
      inputs.nixpkgs.follows = "nixpkgs";
    };
+    nix_builder = {
+      url = "git+https://code.fizz.buzz/talexander/nix_builder.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
  };

  outputs =
@@ -37,6 +41,7 @@
      disko,
      impermanence,
      lanzaboote,
+      nix_builder,
      ...
    }:
    let
@@ -68,7 +73,7 @@
        hostname: nodeConfig: format:
        nixpkgs.lib.nixosSystem {
          specialArgs = {
-            inherit self;
+            inherit self nix_builder;

            this_nixos_config = self.nixosConfigurations."${hostname}";

--- a/nix/configuration/hosts/family_disks/DEPLOY_BOOT
+++ b/nix/configuration/hosts/family_disks/DEPLOY_BOOT
@@ -10,4 +10,4 @@ TARGET=family_disks

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done

-nixos-rebuild boot --flake "$DIR/../../#family_disks" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --flake "$DIR/../../#family_disks" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/family_disks/DEPLOY_SWITCH
+++ b/nix/configuration/hosts/family_disks/DEPLOY_SWITCH
@@ -10,4 +10,4 @@ TARGET=family_disks

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done

-nixos-rebuild switch --flake "$DIR/../../#family_disks" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --flake "$DIR/../../#family_disks" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/family_disks/ISO
+++ b/nix/configuration/hosts/family_disks/ISO
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#family_disks.iso" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#family_disks.iso" --repair --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/family_disks/SELF_BOOT
+++ b/nix/configuration/hosts/family_disks/SELF_BOOT
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#family_disks" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#family_disks" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/family_disks/SELF_BUILD
+++ b/nix/configuration/hosts/family_disks/SELF_BUILD
@@ -9,4 +9,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done

-nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#family_disks" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#family_disks" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/family_disks/SELF_SWITCH
+++ b/nix/configuration/hosts/family_disks/SELF_SWITCH
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#family_disks" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#family_disks" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/family_disks/distributed_build.nix
+++ b/nix/configuration/hosts/family_disks/distributed_build.nix
@@ -4,16 +4,19 @@
  config = {
    me.distributed_build.enable = true;
    me.distributed_build.machines.quark = {
-      enable = false;
+      enable_build = false;
+      enable_substituter = false;
      additional_config = {
        speedFactor = 2;
      };
    };
    me.distributed_build.machines.hydra = {
-      enable = true;
+      enable_build = false;
+      enable_substituter = true;
      additional_config = {
        speedFactor = 2;
      };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
    };
  };
 }
--- a/nix/configuration/hosts/hydra/DEPLOY_BOOT
+++ b/nix/configuration/hosts/hydra/DEPLOY_BOOT
@@ -10,4 +10,4 @@ TARGET=hydra

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done

-nixos-rebuild boot --flake "$DIR/../../#hydra" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --flake "$DIR/../../#hydra" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/hydra/DEPLOY_SWITCH
+++ b/nix/configuration/hosts/hydra/DEPLOY_SWITCH
@@ -10,4 +10,4 @@ TARGET=hydra

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done

-nixos-rebuild switch --flake "$DIR/../../#hydra" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --flake "$DIR/../../#hydra" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/hydra/ISO
+++ b/nix/configuration/hosts/hydra/ISO
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#hydra.iso" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#hydra.iso" --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/hydra/SELF_BOOT
+++ b/nix/configuration/hosts/hydra/SELF_BOOT
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#hydra" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#hydra" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/hydra/SELF_BUILD
+++ b/nix/configuration/hosts/hydra/SELF_BUILD
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#hydra" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#hydra" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/hydra/SELF_SWITCH
+++ b/nix/configuration/hosts/hydra/SELF_SWITCH
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#hydra" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#hydra" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/hydra/VM_ISO
+++ b/nix/configuration/hosts/hydra/VM_ISO
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#hydra.vm_iso" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#hydra.vm_iso" --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/hydra/default.nix
+++ b/nix/configuration/hosts/hydra/default.nix
@@ -20,7 +20,7 @@
  config = {
    networking =
      let
-        interface = "enp0s2";
+        interface = "enp0s10";
      in
      {
        # Generate with `head -c4 /dev/urandom | od -A none -t x4`
@@ -129,6 +129,8 @@
    # systemd.user.extraConfig = "DefaultLimitNOFILE=8192";
    # systemd.services."user@11400".serviceConfig.LimitNOFILE = "8192";

+    nix.settings.secret-key-files = [ "/persist/manual/nix/nix-cache-key.sec" ];
+
    me.build_in_ram.enable = true;
    me.dont_use_substituters.enable = true;
    me.hydra.enable = true;
--- a/nix/configuration/hosts/i_only_boot_zfs/DEPLOY_BOOT
+++ b/nix/configuration/hosts/i_only_boot_zfs/DEPLOY_BOOT
@@ -10,4 +10,4 @@ TARGET=i_only_boot_zfs

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done

-nixos-rebuild boot --flake "$DIR/../../#i_only_boot_zfs" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --flake "$DIR/../../#i_only_boot_zfs" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/i_only_boot_zfs/DEPLOY_SWITCH
+++ b/nix/configuration/hosts/i_only_boot_zfs/DEPLOY_SWITCH
@@ -10,4 +10,4 @@ TARGET=i_only_boot_zfs

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done

-nixos-rebuild switch --flake "$DIR/../../#i_only_boot_zfs" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --flake "$DIR/../../#i_only_boot_zfs" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/i_only_boot_zfs/ISO
+++ b/nix/configuration/hosts/i_only_boot_zfs/ISO
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#i_only_boot_zfs.iso" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#i_only_boot_zfs.iso" --repair --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/i_only_boot_zfs/SELF_BOOT
+++ b/nix/configuration/hosts/i_only_boot_zfs/SELF_BOOT
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#i_only_boot_zfs" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#i_only_boot_zfs" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/i_only_boot_zfs/SELF_BUILD
+++ b/nix/configuration/hosts/i_only_boot_zfs/SELF_BUILD
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#i_only_boot_zfs" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#i_only_boot_zfs" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/i_only_boot_zfs/SELF_SWITCH
+++ b/nix/configuration/hosts/i_only_boot_zfs/SELF_SWITCH
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#i_only_boot_zfs" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#i_only_boot_zfs" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/i_only_boot_zfs/distributed_build.nix
+++ b/nix/configuration/hosts/i_only_boot_zfs/distributed_build.nix
@@ -4,10 +4,19 @@
  config = {
    me.distributed_build.enable = true;
    me.distributed_build.machines.quark = {
-      enable = true;
+      enable_build = false;
+      enable_substituter = false;
      additional_config = {
        speedFactor = 2;
      };
    };
+    me.distributed_build.machines.hydra = {
+      enable_build = false;
+      enable_substituter = true;
+      additional_config = {
+        speedFactor = 2;
+      };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
+    };
  };
 }
--- a/nix/configuration/hosts/neelix/DEPLOY_BOOT
+++ b/nix/configuration/hosts/neelix/DEPLOY_BOOT
@@ -12,6 +12,6 @@ TARGET=neelix

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done

-nixos-rebuild boot --flake "$DIR/../../#neelix" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --flake "$DIR/../../#neelix" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json

 # rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild boot --flake /persist/manual/configuration#neelix'
--- a/nix/configuration/hosts/neelix/DEPLOY_SWITCH
+++ b/nix/configuration/hosts/neelix/DEPLOY_SWITCH
@@ -12,6 +12,6 @@ TARGET=neelix

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done

-nixos-rebuild switch --flake "$DIR/../../#neelix" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --flake "$DIR/../../#neelix" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json

 # rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild switch --flake /persist/manual/configuration#neelix'
--- a/nix/configuration/hosts/odo/DEPLOY_BOOT
+++ b/nix/configuration/hosts/odo/DEPLOY_BOOT
@@ -10,4 +10,4 @@ TARGET=odo

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done

-nixos-rebuild boot --flake "$DIR/../../#odo" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --flake "$DIR/../../#odo" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/odo/DEPLOY_SWITCH
+++ b/nix/configuration/hosts/odo/DEPLOY_SWITCH
@@ -10,4 +10,4 @@ TARGET=odo

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done

-nixos-rebuild switch --flake "$DIR/../../#odo" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --flake "$DIR/../../#odo" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/odo/ISO
+++ b/nix/configuration/hosts/odo/ISO
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#odo.iso" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#odo.iso" --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/odo/SELF_BOOT
+++ b/nix/configuration/hosts/odo/SELF_BOOT
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/odo/SELF_BUILD
+++ b/nix/configuration/hosts/odo/SELF_BUILD
@@ -5,8 +5,7 @@ IFS=$'\n\t'
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

 : "${JOBS:="1"}"
-: "${NOM:="true"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done

-nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/odo/SELF_SWITCH
+++ b/nix/configuration/hosts/odo/SELF_SWITCH
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/odo/default.nix
+++ b/nix/configuration/hosts/odo/default.nix
@@ -94,6 +94,7 @@
    me.emacs_flavor = "full";
    me.emulate_isa.enable = true;
    me.esim.enable = true;
+    me.exfat.enable = true;
    me.firefox.enable = true;
    me.firewall.enable = true;
    me.flux.enable = true;
@@ -110,12 +111,14 @@
    me.jujutsu.config = ../../roles/jujutsu/files/jujutsu_config_home.toml;
    me.jujutsu.enable = true;
    me.kanshi.enable = false;
+    me.kernel.enable = true;
    me.kubernetes.enable = true;
    me.latex.enable = true;
    me.launch_keyboard.enable = true;
    me.lvfs.enable = true;
    me.media.enable = true;
    me.memtest.enable = true;
+    me.mitmproxy.enable = true;
    me.network.enable = true;
    me.nix_index.enable = true;
    me.nix_repl.enable = true;
@@ -163,8 +166,8 @@
    me.zrepl.enable = true;
    me.zsh.enable = true;

-    me.sm64ex.enable = true;
-    me.shipwright.enable = true;
+    me.sm64ex.enable = false;
+    me.shipwright.enable = false;
    me.ship2harkinian.enable = true;
  };
 }
--- a/nix/configuration/hosts/odo/distributed_build.nix
+++ b/nix/configuration/hosts/odo/distributed_build.nix
@@ -4,16 +4,19 @@
  config = {
    me.distributed_build.enable = true;
    me.distributed_build.machines.quark = {
-      enable = false;
+      enable_build = true;
+      enable_substituter = false;
      additional_config = {
        speedFactor = 2;
      };
    };
    me.distributed_build.machines.hydra = {
-      enable = true;
+      enable_build = false;
+      enable_substituter = true;
      additional_config = {
        speedFactor = 2;
      };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
    };
  };
 }
--- a/nix/configuration/hosts/odowork/DEPLOY_BOOT
+++ b/nix/configuration/hosts/odowork/DEPLOY_BOOT
@@ -8,4 +8,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

 TARGET=odowork

-nixos-rebuild boot --flake "$DIR/../../#odowork" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --flake "$DIR/../../#odowork" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/odowork/DEPLOY_SWITCH
+++ b/nix/configuration/hosts/odowork/DEPLOY_SWITCH
@@ -8,4 +8,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

 TARGET=odowork

-nixos-rebuild switch --flake "$DIR/../../#odowork" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --flake "$DIR/../../#odowork" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/odowork/INSTALLER
+++ b/nix/configuration/hosts/odowork/INSTALLER
@@ -6,4 +6,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

 : "${JOBS:="1"}"

-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#odowork.installer" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#odowork.installer" --repair --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/odowork/ISO
+++ b/nix/configuration/hosts/odowork/ISO
@@ -6,4 +6,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

 : "${JOBS:="1"}"

-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#odowork.iso" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#odowork.iso" --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/odowork/SELF_BOOT
+++ b/nix/configuration/hosts/odowork/SELF_BOOT
@@ -6,4 +6,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

 : "${JOBS:="1"}"

-nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odowork" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odowork" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/odowork/SELF_BUILD
+++ b/nix/configuration/hosts/odowork/SELF_BUILD
@@ -6,4 +6,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

 : "${JOBS:="1"}"

-nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odowork" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odowork" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/odowork/SELF_SWITCH
+++ b/nix/configuration/hosts/odowork/SELF_SWITCH
@@ -6,4 +6,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

 : "${JOBS:="1"}"

-nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odowork" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odowork" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/odowork/default.nix
+++ b/nix/configuration/hosts/odowork/default.nix
@@ -92,6 +92,7 @@
    me.chromium.enable = true;
    me.d2.enable = true;
    me.direnv.enable = true;
+    me.displaylink.enable = true;
    me.doas.enable = true;
    me.docker.enable = false;
    me.dont_use_substituters.enable = true;
@@ -111,6 +112,7 @@
    me.iso_mount.enable = true;
    me.jujutsu.config = ../../roles/jujutsu/files/jujutsu_config_home.toml;
    me.jujutsu.enable = true;
+    me.kernel.enable = true;
    me.latex.enable = true;
    me.launch_keyboard.enable = true;
    me.lvfs.enable = true;
--- a/nix/configuration/hosts/odowork/distributed_build.nix
+++ b/nix/configuration/hosts/odowork/distributed_build.nix
@@ -4,16 +4,19 @@
  config = {
    me.distributed_build.enable = true;
    me.distributed_build.machines.quark = {
-      enable = false;
+      enable_build = false;
+      enable_substituter = false;
      additional_config = {
        speedFactor = 2;
      };
    };
    me.distributed_build.machines.hydra = {
-      enable = true;
+      enable_build = false;
+      enable_substituter = true;
      additional_config = {
        speedFactor = 2;
      };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
    };
  };
 }
--- a/nix/configuration/hosts/quark/DEPLOY_BOOT
+++ b/nix/configuration/hosts/quark/DEPLOY_BOOT
@@ -10,4 +10,4 @@ TARGET=quark

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done

-nixos-rebuild boot --flake "$DIR/../../#quark" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --flake "$DIR/../../#quark" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/quark/DEPLOY_SWITCH
+++ b/nix/configuration/hosts/quark/DEPLOY_SWITCH
@@ -10,4 +10,4 @@ TARGET=quark

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done

-nixos-rebuild switch --flake "$DIR/../../#quark" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --flake "$DIR/../../#quark" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/quark/ISO
+++ b/nix/configuration/hosts/quark/ISO
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#quark.iso" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#quark.iso" --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/quark/SELF_BOOT
+++ b/nix/configuration/hosts/quark/SELF_BOOT
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/quark/SELF_BUILD
+++ b/nix/configuration/hosts/quark/SELF_BUILD
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/quark/SELF_SWITCH
+++ b/nix/configuration/hosts/quark/SELF_SWITCH
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/quark/default.nix
+++ b/nix/configuration/hosts/quark/default.nix
@@ -104,12 +104,14 @@
    me.jujutsu.config = ../../roles/jujutsu/files/jujutsu_config_home.toml;
    me.jujutsu.enable = true;
    me.kanshi.enable = false;
+    me.kernel.enable = true;
    me.kubernetes.enable = true;
    me.latex.enable = true;
    me.launch_keyboard.enable = true;
    me.lvfs.enable = true;
    me.media.enable = true;
    me.memtest.enable = true;
+    me.mitmproxy.enable = true;
    me.network.enable = true;
    me.nix_index.enable = true;
    me.nix_repl.enable = true;
@@ -158,8 +160,8 @@
    me.zrepl.enable = true;
    me.zsh.enable = true;

-    me.sm64ex.enable = true;
-    me.shipwright.enable = true;
+    me.sm64ex.enable = false;
+    me.shipwright.enable = false;
    me.ship2harkinian.enable = true;
  };
 }
--- a/nix/configuration/hosts/quark/distributed_build.nix
+++ b/nix/configuration/hosts/quark/distributed_build.nix
@@ -3,11 +3,20 @@

  config = {
    me.distributed_build.enable = true;
-    me.distributed_build.machines.hydra = {
-      enable = true;
+    me.distributed_build.machines.quark = {
+      enable_build = false;
+      enable_substituter = false;
      additional_config = {
        speedFactor = 2;
      };
    };
+    me.distributed_build.machines.hydra = {
+      enable_build = false;
+      enable_substituter = true;
+      additional_config = {
+        speedFactor = 2;
+      };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
+    };
  };
 }
--- a/nix/configuration/hosts/recovery/DEPLOY_BOOT
+++ b/nix/configuration/hosts/recovery/DEPLOY_BOOT
@@ -10,4 +10,4 @@ TARGET=recovery

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done

-nixos-rebuild boot --flake "$DIR/../../#recovery" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --flake "$DIR/../../#recovery" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/recovery/DEPLOY_SWITCH
+++ b/nix/configuration/hosts/recovery/DEPLOY_SWITCH
@@ -10,4 +10,4 @@ TARGET=recovery

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done

-nixos-rebuild switch --flake "$DIR/../../#recovery" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --flake "$DIR/../../#recovery" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/recovery/ISO
+++ b/nix/configuration/hosts/recovery/ISO
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#recovery.iso" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#recovery.iso" --max-jobs "$JOBS" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/recovery/SELF_BOOT
+++ b/nix/configuration/hosts/recovery/SELF_BOOT
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#recovery" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#recovery" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/recovery/SELF_BUILD
+++ b/nix/configuration/hosts/recovery/SELF_BUILD
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#recovery" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#recovery" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/recovery/SELF_SWITCH
+++ b/nix/configuration/hosts/recovery/SELF_SWITCH
@@ -7,4 +7,4 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 : "${JOBS:="1"}"

 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#recovery" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#recovery" --repair --log-format internal-json -v "${@}" |& nom --json
--- a/nix/configuration/hosts/recovery/distributed_build.nix
+++ b/nix/configuration/hosts/recovery/distributed_build.nix
@@ -4,10 +4,19 @@
  config = {
    me.distributed_build.enable = true;
    me.distributed_build.machines.quark = {
-      enable = true;
+      enable_build = false;
+      enable_substituter = false;
      additional_config = {
        speedFactor = 2;
      };
    };
+    me.distributed_build.machines.hydra = {
+      enable_build = false;
+      enable_substituter = true;
+      additional_config = {
+        speedFactor = 2;
+      };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
+    };
  };
 }
--- a/nix/configuration/roles/base/default.nix
+++ b/nix/configuration/roles/base/default.nix
@@ -14,7 +14,13 @@ let
  cleanup_temporary_files = (
    patchScriptBin "cleanup_temporary_files" (builtins.readFile ./files/cleanup_temporary_files.bash)
  );
-  alias_rga = pkgs.writeShellScriptBin "ks" ''
+  decode_jwt = (patchScriptBin "decode_jwt" (builtins.readFile ./files/decode_jwt.bash));
+  git_find_merged_branches = (
+    patchScriptBin "git_find_merged_branches" (builtins.readFile ./files/git_find_merged_branches.bash)
+  );
+  git_fix_author = (patchScriptBin "git_fix_author" (builtins.readFile ./files/git_fix_author.bash));
+  rsync_clone = (patchScriptBin "rsync_clone" (builtins.readFile ./files/rsync_clone.bash));
+  alias_rga = pkgs.writeShellScriptBin "rga" ''
    exec ${pkgs.ripgrep}/bin/rg -uuu "''${@}"
  '';
 in
@@ -59,8 +65,16 @@ in
      nix-output-monitor # For better view into nixos-rebuild
      # nix-serve-ng # Serve nix store over http
      cleanup_temporary_files
+      decode_jwt
      jq
      inetutils # For whois
+      git_find_merged_branches
+      git_fix_author
+      rsync_clone
    ];
+
+    # Disable installing documentation.
+    documentation.doc.enable = false;
+    documentation.nixos.enable = false;
  };
 }
--- a/nix/configuration/roles/base/files/cleanup_temporary_files.bash
+++ b/nix/configuration/roles/base/files/cleanup_temporary_files.bash
@@ -1,4 +1,7 @@
 #!/usr/bin/env bash
 #
 # Delete temporary files on entire disk
-find / -type f '(' -name '*.orig' -or -name '*~' -or -name '*.core' ')' -delete -print 2>/dev/null
+set -euo pipefail
+IFS=$'\n\t'
+
+exec find / -type f '(' -name '*.orig' -or -name '*~' -or -name '*.core' ')' -delete -print 2>/dev/null
--- a/nix/configuration/roles/base/files/decode_jwt.bash
+++ b/nix/configuration/roles/base/files/decode_jwt.bash
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#
+# Decode the contents of a JWT
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+exec jq -R 'split(".") | .[0],.[1] | gsub("-"; "+") | gsub("_"; "/") | gsub("%3D"; "=")| @base64d | fromjson'
--- a/nix/configuration/roles/base/files/git_find_merged_branches.bash
+++ b/nix/configuration/roles/base/files/git_find_merged_branches.bash
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+#
+# Find local branches that have been merged
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+: ${MAIN_BRANCH:="main"}
+
+git checkout -q ${MAIN_BRANCH} && git for-each-ref refs/heads/ "--format=%(refname:short)" | while read branch; do mergeBase=$(git merge-base ${MAIN_BRANCH} $branch) && [[ $(git cherry ${MAIN_BRANCH} $(git commit-tree $(git rev-parse "$branch^{tree}") -p $mergeBase -m _)) == "-"* ]] && echo "$branch"; done
--- a/nix/configuration/roles/base/files/git_fix_author.bash
+++ b/nix/configuration/roles/base/files/git_fix_author.bash
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+#
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+git filter-branch --env-filter '
+WRONG_EMAIL="old@email.foo"
+NEW_NAME="New Name"
+NEW_EMAIL="new@email.bar"
+
+if [ "$GIT_COMMITTER_EMAIL" = "$WRONG_EMAIL" ]
+then
+    export GIT_COMMITTER_NAME="$NEW_NAME"
+    export GIT_COMMITTER_EMAIL="$NEW_EMAIL"
+fi
+if [ "$GIT_AUTHOR_EMAIL" = "$WRONG_EMAIL" ]
+then
+    export GIT_AUTHOR_NAME="$NEW_NAME"
+    export GIT_AUTHOR_EMAIL="$NEW_EMAIL"
+fi
+' --tag-name-filter cat --commit-filter 'git commit-tree -S "$@";' -- --branches --tags
--- a/nix/configuration/roles/base/files/rsync_clone.bash
+++ b/nix/configuration/roles/base/files/rsync_clone.bash
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#
+# Wrapper to set rsync flags for cloning a folder preserving attributes
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+exec rsync -aHAXS "$@"
--- a/nix/configuration/roles/displaylink/default.nix
+++ b/nix/configuration/roles/displaylink/default.nix
@@ -0,0 +1,40 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    displaylink.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install displaylink.";
+    };
+  };
+
+  config = lib.mkIf config.me.displaylink.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+          displaylink
+        ];
+
+        allowedUnfree = [ "displaylink" ];
+
+        boot = {
+          extraModulePackages = [ config.boot.kernelPackages.evdi ];
+          initrd.kernelModules = [
+            "evdi"
+          ];
+        };
+      }
+      (lib.mkIf config.me.graphical {
+      })
+    ]
+  );
+}
--- a/nix/configuration/roles/distributed_build/default.nix
+++ b/nix/configuration/roles/distributed_build/default.nix
@@ -10,7 +10,14 @@

 let
  make_machine_config = name: {
-    enable = lib.mkOption {
+    enable_build = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to use the ${name} machine during distributed builds.";
+    };
+
+    enable_substituter = lib.mkOption {
      type = lib.types.bool;
      default = false;
      example = true;
@@ -56,28 +63,38 @@ let
        # "aarch64-linux"
      ];

-      hostName = lib.mkForce "hydra?remote-store=local?root=/home/nixworker/persist/root";
+      hostName = lib.mkForce "hydra?remote-store=local?root=/.disk/root";
    };
  };
-  joined_configs =
-    lib.genAttrs
-      (builtins.filter (hostname: config.me.distributed_build.machines."${hostname}".enable) (
-        builtins.attrNames all_nixos_configs
-      ))
-      (
-        hostname:
-        (lib.mkMerge [
+  build_machine_list = (
+    map (
+      hostname:
+      (lib.mkIf config.me.distributed_build.machines."${hostname}".enable_build (
+        lib.mkMerge [
          {
            hostName = hostname;
            sshUser = "nixworker";
            sshKey = "/persist/manual/ssh/root/keys/id_ed25519";
            maxJobs = 1;
            supportedFeatures = all_nixos_configs."${hostname}".config.me.optimizations.system_features;
+            protocol = "ssh-ng";
          }
          static_host_configs."${hostname}"
          config.me.distributed_build.machines."${hostname}".additional_config
-        ])
-      );
+        ]
+      ))
+    ) (builtins.attrNames all_nixos_configs)
+  );
+  substituters_list = (
+    map (
+      hostname:
+      (lib.mkIf (
+        config.me.distributed_build.machines."${hostname}".enable_substituter
+        && config.me.distributed_build.machines."${hostname}".substituter_url != null
+      ) (config.me.distributed_build.machines."${hostname}".substituter_url))
+    ) (builtins.attrNames all_nixos_configs)
+  );
+  has_any_substituters = substituters_list != [ ];
 in
 {
  imports = [ ];
@@ -101,7 +118,7 @@ in
        # Using an ssh-based substituter slows down the build because querying the remote store for paths takes ages.
        #
        # nix.settings.substituters = lib.mkForce [
-        #   "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=/home/nixworker/persist/root"
+        #   "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=/.disk/root"
        # ];
        # nix.settings.substitute = lib.mkForce true;

@@ -117,35 +134,17 @@ in
          "odo:0S/XKSFjjIrihQ7lbHEIebXk/c/xuoodhm0Gz26YhjA="
          "odowork:zg3UKBAyLy3xtZkL0hMtbxHjxgn5A2QY8NNAgyRT6Yo="
          "quark:Eb6ygkIiVlcUqb5hOjEVIQcfYLpCz40YVYA3/rxrgBc="
+          "hydra:1s4Cy9YJLgw4jWx5jdSCfJmIm0hfya7WEy/EwJYI5Ys="
+          "garak:8nUS6/aHl+FmF518WZlG4DzDToQ3fSNnpHR+aFQmkqc="
        ];
      }
      {
-        nix.buildMachines = (
-          map (
-            hostname:
-            (lib.mkIf config.me.distributed_build.machines."${hostname}".enable (
-              lib.mkMerge [
-                {
-                  hostName = hostname;
-                  sshUser = "nixworker";
-                  sshKey = "/persist/manual/ssh/root/keys/id_ed25519";
-                  maxJobs = 1;
-                  supportedFeatures = all_nixos_configs."${hostname}".config.me.optimizations.system_features;
-                  protocol = "ssh-ng";
-                }
-                static_host_configs."${hostname}"
-                config.me.distributed_build.machines."${hostname}".additional_config
-              ]
-            ))
-          ) (builtins.attrNames all_nixos_configs)
-        );
+        nix.buildMachines = build_machine_list;
      }
-      # {
-      #   nix.settings.substitute = lib.mkForce true;
-      #   nix.settings.substituters = lib.mkForce (
-      #     lib.mapAttrsToList (hostname: joined_config: "ssh-ng://${joined_config.hostName}") joined_configs
-      #   );
-      # }
+      (lib.mkIf has_any_substituters {
+        nix.settings.substitute = lib.mkForce true;
+        nix.settings.substituters = lib.mkForce substituters_list;
+      })
    ]
  );
 }
--- a/nix/configuration/roles/emacs/files/emacs/early-init.el
+++ b/nix/configuration/roles/emacs/files/emacs/early-init.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (setq gc-cons-threshold (* 128 1024 1024)) ;; 128MiB Increase garbage collection threshold for performance (default 800000)
 ;; Increase amount of data read from processes, default 4k
 (when (version<= "27.0" emacs-version)
--- a/nix/configuration/roles/emacs/files/emacs/elisp/base-extensions.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/base-extensions.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (use-package diminish)

 ;; Eglot recommends pulling the latest of the standard libraries it
--- a/nix/configuration/roles/emacs/files/emacs/elisp/base-functions.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/base-functions.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 ;; ========== Function to reload current file =================

 (defun reload-file ()
@@ -11,10 +12,9 @@
  "Run a command using the current buffer as stdin and replacing its contents if the command succeeds with the stdout from the command. This is useful for code formatters."
  (let (
        (stdout-buffer (generate-new-buffer "tmp-stdout" t))
-        (full-cmd (append '(call-process-region nil nil cmd nil stdout-buffer nil) args))
        )
    (unwind-protect
-        (let ((exit-status (eval full-cmd)))
+        (let ((exit-status (apply #'call-process-region nil nil cmd nil (list stdout-buffer nil) nil args)))
          (if (eq exit-status 0)
              (save-excursion
                (replace-buffer-contents stdout-buffer)
@@ -27,15 +27,36 @@
    )
  )

+(defun run-command-on-buffer-require-output (cmd &rest args)
+  "Run a command using the current buffer as stdin and replacing its contents if the command succeeds with the stdout from the command. This is useful for code formatters. This version only replaces the buffer contents if the command output some text."
+  (let (
+        (stdout-buffer (generate-new-buffer "tmp-stdout" t))
+        )
+    (unwind-protect
+        (let ((exit-status (apply #'call-process-region nil nil cmd nil (list stdout-buffer nil) nil args)))
+          (if (eq exit-status 0)
+              (if (> (buffer-size stdout-buffer) 0)
+                  (save-excursion
+                    (replace-buffer-contents stdout-buffer)
+                    )
+                (message "No output from command on buffer %s" (append (list cmd) args))
+                )
+            (message "FAILED running command on buffer %s" (append (list cmd) args))
+            )
+          )
+      (kill-buffer stdout-buffer)
+      )
+    )
+  )
+
 (defun run-command-in-directory (dir cmd &rest args)
  "Run a command in the specified directory. If the directory is nil, the directory of the file is used. The stdout result is trimmed of whitespace and returned."
  (let (
        (default-directory (or dir default-directory))
        (stdout-buffer (generate-new-buffer "tmp-stdout" t))
-        (full-cmd (append '(call-process cmd nil (list stdout-buffer nil) nil) args))
        )
    (unwind-protect
-        (let ((exit-status (condition-case nil (eval full-cmd) (file-missing nil))))
+        (let ((exit-status (condition-case nil (apply #'call-process cmd nil (list stdout-buffer nil) nil args) (file-missing nil))))
          (if (eq exit-status 0)
              (progn
                (with-current-buffer stdout-buffer
--- a/nix/configuration/roles/emacs/files/emacs/elisp/base-global-keys.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/base-global-keys.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 ;; Add your keys here, as such

 ;; Disable the suspend frame hotkeys
--- a/nix/configuration/roles/emacs/files/emacs/elisp/base-theme.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/base-theme.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 ;; Set theme
 (load-theme 'tango-dark t)
 (set-face-attribute 'default nil :background "black")
--- a/nix/configuration/roles/emacs/files/emacs/elisp/base.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/base.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (package-initialize)
 (use-package use-package
  :custom
--- a/nix/configuration/roles/emacs/files/emacs/elisp/common-lsp.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/common-lsp.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (use-package eglot
  ;; This is an emacs built-in but we're pulling the latest version
  :pin gnu
--- a/nix/configuration/roles/emacs/files/emacs/elisp/lang-bash.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/lang-bash.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (require 'util-tree-sitter)

 (use-package bash-ts-mode
--- a/nix/configuration/roles/emacs/files/emacs/elisp/lang-c.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/lang-c.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (require 'common-lsp)
 (require 'util-tree-sitter)

--- a/nix/configuration/roles/emacs/files/emacs/elisp/lang-cmake.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/lang-cmake.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (require 'common-lsp)

 (use-package cmake-mode
--- a/nix/configuration/roles/emacs/files/emacs/elisp/lang-d2.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/lang-d2.el
@@ -1,14 +1,15 @@
+;; -*- lexical-binding: t; -*-
 (defun d2-format-buffer ()
  "Run prettier."
  (interactive)
-  (run-command-on-buffer "d2" "fmt" "-")
+  (run-command-on-buffer-require-output "d2" "fmt" "-")
  )

 (use-package d2-mode
  :commands (d2-mode)
  :hook (
         (d2-mode . (lambda ()
-                      ;; (add-hook 'before-save-hook 'd2-format-buffer nil 'local)
+                      (add-hook 'before-save-hook 'd2-format-buffer nil 'local)
                      ))
         )
  )
--- a/nix/configuration/roles/emacs/files/emacs/elisp/lang-dockerfile.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/lang-dockerfile.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (use-package dockerfile-ts-mode
  :pin manual
  :mode (
--- a/nix/configuration/roles/emacs/files/emacs/elisp/lang-go.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/lang-go.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (require 'common-lsp)
 (require 'util-tree-sitter)

--- a/nix/configuration/roles/emacs/files/emacs/elisp/lang-javascript.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/lang-javascript.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (require 'common-lsp)
 (require 'util-tree-sitter)

--- a/nix/configuration/roles/emacs/files/emacs/elisp/lang-lua.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/lang-lua.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (defun lua-format-buffer ()
  "Run stylua."
  (interactive)
--- a/nix/configuration/roles/emacs/files/emacs/elisp/lang-markdown.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/lang-markdown.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (use-package markdown-mode
  :ensure t
  :commands (markdown-mode gfm-mode)
--- a/nix/configuration/roles/emacs/files/emacs/elisp/lang-nft.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/lang-nft.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (use-package nftables-mode
  :commands nftables-mode
  )
--- a/nix/configuration/roles/emacs/files/emacs/elisp/lang-nix.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/lang-nix.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (require 'common-lsp)
 (require 'util-tree-sitter)

--- a/nix/configuration/roles/emacs/files/emacs/elisp/lang-org.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/lang-org.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (require 'color)
 (let ((bg (face-attribute 'default :background)))
  (use-package org
--- a/nix/configuration/roles/emacs/files/emacs/elisp/lang-python.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/lang-python.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (require 'common-lsp)
 (require 'util-tree-sitter)

--- a/nix/configuration/roles/emacs/files/emacs/elisp/lang-rust.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/lang-rust.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (require 'common-lsp)
 (require 'util-tree-sitter)

--- a/nix/configuration/roles/emacs/files/emacs/elisp/lang-terraform.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/lang-terraform.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (require 'common-lsp)
 (require 'util-tree-sitter)

--- a/nix/configuration/roles/emacs/files/emacs/elisp/lang-xml.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/lang-xml.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (defun xml-fmt ()
  "Run xmllint --format."
  (run-command-on-buffer "xmllint" "--format" "-")
--- a/nix/configuration/roles/emacs/files/emacs/elisp/lang-yaml.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/lang-yaml.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (defun yaml-format-buffer ()
  "Run prettier."
  (interactive)
--- a/nix/configuration/roles/emacs/files/emacs/elisp/util-flymake.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/util-flymake.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (use-package flymake
  :pin manual
  :ensure nil
--- a/nix/configuration/roles/emacs/files/emacs/elisp/util-tree-sitter.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/util-tree-sitter.el
@@ -1,3 +1,5 @@
+;; -*- lexical-binding: t; -*-
+
 ;; (add-to-list 'major-mode-remap-alist '(c-mode . c-ts-mode))

 (use-package treesit
@@ -13,6 +15,8 @@
  ;;   :custom
  ;;   (treesit-font-lock-level 3)
  (setq treesit-font-lock-level 4)
+  ;; (setq treesit-auto-install-grammar t)
+  ;; (setq treesit-enabled-modes t)
  )

 (provide 'util-tree-sitter)
--- a/nix/configuration/roles/emacs/files/emacs/elisp/util-vertico.el
+++ b/nix/configuration/roles/emacs/files/emacs/elisp/util-vertico.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (defun my/minibuffer-delete (arg)
  "When looking for files, go up an entire directory with the backspace button if theres no text after the directory."
  (interactive "p")
--- a/nix/configuration/roles/emacs/files/emacs/init.el
+++ b/nix/configuration/roles/emacs/files/emacs/init.el
@@ -1,3 +1,4 @@
+;; -*- lexical-binding: t; -*-
 (add-to-list 'load-path (concat user-emacs-directory "elisp"))

 (require 'base)
--- a/nix/configuration/roles/exfat/default.nix
+++ b/nix/configuration/roles/exfat/default.nix
@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    exfat.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install exfat.";
+    };
+  };
+
+  config = lib.mkIf config.me.exfat.enable {
+    # boot.supportedFilesystems = [ "exfat" ];
+    environment.systemPackages = with pkgs; [
+      exfatprogs
+    ];
+  };
+}
--- a/nix/configuration/roles/firefox/default.nix
+++ b/nix/configuration/roles/firefox/default.nix
@@ -20,7 +20,7 @@
  config = lib.mkIf (config.me.firefox.enable && config.me.graphical) {
    programs.firefox = {
      enable = true;
-      package = (pkgs.wrapFirefox (pkgs.firefox-unwrapped.override { pipewireSupport = true; }) { });
+      package = (pkgs.wrapFirefox (pkgs.firefox-unwrapped.override { withPipewire = true; }) { });
      languagePacks = [ "en-US" ];
      preferences = {
        # "identity.sync.tokenserver.uri": "https://ffsync.fizz.buzz/token/1.0/sync/1.5";
@@ -66,8 +66,18 @@
        "privacy.fingerprintingProtection" = true;
        # Allow sending dark mode preference to websites.
        # Allow sending timezone to websites.
-        "privacy.fingerprintingProtection.overrides" =
-          "+AllTargets,-CSSPrefersColorScheme,-JSDateTimeUTC,-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt,-CanvasExtractionFromThirdPartiesIsBlocked";
+        "privacy.fingerprintingProtection.overrides" = (
+          builtins.concatStringsSep "," [
+            "+AllTargets" # Enable all protections
+            "-CSSPrefersColorScheme" # Don't hide light/dark preference
+            "-JSDateTimeUTC" # Allow sending timezone to websites.
+            "-CanvasExtractionBeforeUserInputIsBlocked" # Canvas image extraction needed by google maps to avoid names looking like barcodes.
+            # Google meet's auto-framing results in random flashing colored bars unless the following two are allowed:
+            "-CanvasImageExtractionPrompt"
+            "-CanvasExtractionFromThirdPartiesIsBlocked"
+            "-WebGLRenderCapability" # Needed for smooth zooming on google maps
+          ]
+        );
        # Disable weather on new tab page
        "browser.newtabpage.activity-stream.showWeather" = false;
        # Disable AI stuff that wastes battery life
@@ -124,7 +134,7 @@
      users.talexander = {
        directories = [
          {
-            directory = ".mozilla";
+            directory = ".config/mozilla";
            user = "talexander";
            group = "talexander";
            mode = "0700";
--- a/nix/configuration/roles/firewall/default.nix
+++ b/nix/configuration/roles/firewall/default.nix
@@ -24,7 +24,16 @@
    networking.firewall.allowedUDPPorts = [
      5353 # mDNS
    ];
+
+    # networking.firewall.enable = true;
+    # networking.nftables.enable = true;
+
    # Or disable the firewall altogether.
-    # networking.firewall.enable = false;
+    networking.firewall.enable = false;
+
+    # Debugging
+    # networking.firewall.logRefusedConnections = true;
+    # networking.firewall.logRefusedPackets = true;
+    # networking.firewall.logReversePathDrops = true;
  };
 }
--- a/nix/configuration/roles/graphics/default.nix
+++ b/nix/configuration/roles/graphics/default.nix
@@ -34,7 +34,7 @@
        environment.systemPackages = with pkgs; [
          mesa-demos # for glxgears
          vulkan-tools # for vkcube
-          xorg.xeyes # to test which windows are using x11
+          xeyes # to test which windows are using x11
        ];
        hardware.graphics.enable = true;
        # hardware.graphics.enable32Bit = true;
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Tom Alexander	a5e17590a7	Add support for DisplayLink docks at work.	2026-09-23 09:43:58 -04:00
Tom Alexander	ffbd3847e7	Fix lexical binding issue loading python language server.	2026-09-13 23:47:20 -04:00
Tom Alexander	4a6cbfad67	Use lexical binding in elisp files. This silences a warning for each of these files. Lexical binding will become the default in a future version of emacs.	2026-09-12 21:00:26 -04:00
Tom Alexander	450478cff4	I changed bhyverc to use pci slot 10 for network, so update the network interface.	2026-09-12 17:27:33 -04:00
Tom Alexander	82d460e08e	Update packages.	2026-09-12 17:27:33 -04:00
Tom Alexander	24853ba6a2	Add secret for private images pulled in tekton steps.	2026-09-12 17:26:41 -04:00
Tom Alexander	f2bde9ffea	Disable installing documentation.	2026-09-07 15:41:38 -04:00
Tom Alexander	0d6001d655	Add parted to debugging role on kubernetes. This is to support expanding the storage.	2026-09-07 13:24:39 -04:00
Tom Alexander	a0e8a74906	Update packages.	2026-09-05 19:07:41 -04:00
Tom Alexander	e719948a3e	Switch to quad9 for DNS. Mullvad is shutting down their public DNS. ref: https://mullvad.net/en/blog/shutting-down-our-public-encrypted-dns-servers-and-sponsoring-quad9-instead	2026-09-05 09:46:36 -04:00
Tom Alexander	3f281f1980	Clean up nix_builder directories at the start of a build.	2026-09-03 22:21:07 -04:00
Tom Alexander	6ed4aa08f6	Add a role for mitmproxy.	2026-08-29 09:40:21 -04:00
Tom Alexander	9bfa21368b	Update to Linux 7.2. This is to pull in the drivers for the mt7927 wireless chipset in my desktop. Normally, I would keep the rest of my machines on LTS but since Linux 7 significantly changed the kernel preemption, maintaining two configs would be more trouble than it is worth.	2026-08-29 06:50:47 -04:00
Tom Alexander	4eb7749967	Update persist directory for the latest firefox.	2026-08-29 06:50:45 -04:00
Tom Alexander	d0504bf98f	Update rpcs3.	2026-08-28 09:02:47 -04:00
Tom Alexander	f1d6ae3f1b	Merge branch 'update' into nix	2026-08-28 06:55:11 -04:00
Tom Alexander	85815fddfd	Update deprecated podman settings.	2026-08-28 06:53:56 -04:00
Tom Alexander	5680e566bc	Update packages.	2026-08-28 06:53:56 -04:00
Tom Alexander	3bbaeaf2af	Install Arial font with rpcs3.	2026-08-26 17:16:22 -04:00
Tom Alexander	1845b1ac30	Increase thresholds for automatic garbage collection.	2026-08-10 22:38:26 -04:00
Tom Alexander	4a772b7276	Disable ca-derivations for the kubernetes cluster also.	2026-08-10 18:30:58 -04:00
Tom Alexander	0e231428df	Disable ca-derivations. Seeing if this is what is causing all my issues with files/directories in the nix store going missing.	2026-08-10 15:27:18 -04:00
Tom Alexander	27b5c0c9ab	Disable build of sm64ex.	2026-08-09 17:18:26 -04:00
Tom Alexander	54e97da71d	Enable building on quark.	2026-08-09 16:23:47 -04:00
Tom Alexander	58c78c50e6	Add The Lord of the Rings The War in the North to RPCS3.	2026-08-09 16:23:47 -04:00
Tom Alexander	e2ed4013c5	Add support for exfat.	2026-08-09 16:23:47 -04:00
Tom Alexander	3aefe7c0b5	Update nix builder to gracefully handle errors during setup.	2026-08-09 00:45:41 -04:00
Tom Alexander	a2485dcfe0	Update NixBSD build target to my repo and add a wip branch build target.	2026-08-08 18:36:06 -04:00
Tom Alexander	d4dc7e1f59	Trust garak's signing key.	2026-08-07 15:48:09 -04:00
Tom Alexander	3c17d56664	Separate enabling distributed build vs substituters.	2026-08-05 17:54:38 -04:00
Tom Alexander	adff9fcd29	Update nix_builder to support tar in the flake lockfile.	2026-08-04 21:39:54 -04:00
Tom Alexander	649e4033fd	Update nix_builder to record the revisions of the flake inputs.	2026-07-28 10:20:18 -04:00
Tom Alexander	1b38004e03	Add more hosts to /etc/hosts.	2026-07-28 08:22:47 -04:00
Tom Alexander	d8ef4356a0	Enable some more builds in nix_builder.	2026-07-23 20:25:42 -04:00
Tom Alexander	5dd5f2e4e0	Fix docker credential generation.	2026-07-23 20:08:40 -04:00
Tom Alexander	84e8983974	Update nix_builder.	2026-07-18 23:30:39 -04:00
Tom Alexander	24f4a8c2d9	Tweak the containerd garbage collect threshold on kubelets. Pods were getting evicted due to disk pressure, so this causes garbage collection to trigger sooner.	2026-07-18 13:59:56 -04:00
Tom Alexander	a3cdaa9128	Increase subuid/subgid range to support running buildkit inside podman.	2026-07-18 08:42:02 -04:00
Tom Alexander	51295a23dc	Enable the build VM as a substituter. This should enable me to have local build jobs without rebuilding stuff that already exists on the build VM server.	2026-07-18 08:41:11 -04:00
Tom Alexander	11d8b93551	Add an /etc/hosts entry for google's metadata server. gcloud was reaching out to this address which was causing delays. Pointing it to localhost to speed the failure up.	2026-07-14 11:53:38 -04:00
Tom Alexander	40b8742a80	Add nix pull-through cache secrets.	2026-07-13 20:35:11 -04:00
Tom Alexander	32080e0e01	Add chown for nix pull through cache database.	2026-07-12 17:25:12 -04:00
Tom Alexander	41668506cd	Retire the kubernetes branch now that it is merged into nix.	2026-07-06 18:28:58 -04:00
Tom Alexander	63a988d1da	Merge branch 'kubernetes' into nix	2026-07-06 18:23:07 -04:00
Tom Alexander	7c8d278923	Configure kernel preemption.	2026-07-06 18:12:15 -04:00
Tom Alexander	297577471e	Update kubernetes packages and update to gateway API 1.5.1.	2026-07-06 18:12:15 -04:00
Tom Alexander	345ecfc7cf	Add secret for homepage-staging.	2026-07-06 18:12:14 -04:00
Tom Alexander	889de9dbf6	Add a secret for the harbor webhooks to flux.	2026-07-06 18:12:14 -04:00
Tom Alexander	65c2021473	Update flux and install the image automation controller.	2026-07-06 18:12:14 -04:00
Tom Alexander	b0f025d340	Add IP addresses to worker certs for the metrics server.	2026-07-06 18:12:14 -04:00
Tom Alexander	a00115fb4e	Delete images after 24 hours of being unused.	2026-07-06 18:12:14 -04:00
Tom Alexander	058f0cd59b	Set up containerd use harbor.fizz.buzz.	2026-07-06 18:12:14 -04:00
Tom Alexander	c8c18bde88	Add secrets for archive-box, webhook-bridge, and tekton.	2026-07-06 18:12:14 -04:00
Tom Alexander	a36016e631	Allow node-to-node communication.	2026-07-06 18:12:13 -04:00
Tom Alexander	deaea6954e	Use numbers for folder order.	2026-07-06 18:12:13 -04:00
Tom Alexander	c1ec96044e	Add harbor secrets.	2026-07-06 18:12:13 -04:00
Tom Alexander	cdb2994447	Switch to the experimental gateway CRDs for TCPRoute support.	2026-07-06 18:12:13 -04:00
Tom Alexander	7416e412df	Add oauth2 proxy secrets.	2026-07-06 18:12:13 -04:00
Tom Alexander	d14d8fe4a4	Add dex secrets.	2026-07-06 18:12:13 -04:00
Tom Alexander	a4b20c1ead	Enable the firewall.	2026-07-06 18:12:12 -04:00
Tom Alexander	b593fdc8a7	Add gitea secrets.	2026-07-06 18:12:12 -04:00
Tom Alexander	8f5f59ee87	Add generation for in-repo secrets.	2026-07-06 18:12:12 -04:00
Tom Alexander	fc32a42750	Enforce cilium network policies.	2026-07-06 18:12:12 -04:00
Tom Alexander	1d3d178fc8	Downgrade to gateway 1.4.1. 1.5 came out recently, so no gateway providers support it.	2026-07-06 18:12:12 -04:00
Tom Alexander	e54f272a69	Update packages in kubernetes/keys.	2026-07-06 18:12:12 -04:00
Tom Alexander	e09e659d91	Fix network for updated nix.	2026-07-06 18:12:12 -04:00
Tom Alexander	3cc0fb1d3f	Fix proxy auth tls	2026-07-06 18:12:11 -04:00
Tom Alexander	92727aa1f7	Generate certificates for the aggregation layer.	2026-07-06 18:12:11 -04:00
Tom Alexander	2a319deea0	Add a note for the cilium connectivity test.	2026-07-06 18:12:11 -04:00
Tom Alexander	d6f089bdb4	Temporarily disable the firewall for debugging.	2026-07-06 18:12:11 -04:00
Tom Alexander	cce4f98125	Enable gateway support.	2026-07-06 18:12:11 -04:00
Tom Alexander	612158c3e1	Enable hubble.	2026-07-06 18:12:11 -04:00
Tom Alexander	1ed3832730	Temporarily drop flux interval to 1 minute during early development. This is to reduce waiting time.	2026-07-06 18:12:10 -04:00
Tom Alexander	f3b969642c	Install deferred manifests.	2026-07-06 18:12:10 -04:00
Tom Alexander	23d9bbb8a1	Add a custom nftables firewall config.	2026-07-06 18:12:10 -04:00
Tom Alexander	9e729a8cc6	Enable the firewall. Now that we have networking working, I can enable the firewall and confirm nothing breaks.	2026-07-06 18:12:10 -04:00
Tom Alexander	3169822726	Fix CoreDNS IPv4 connectivity.	2026-07-06 18:12:10 -04:00
Tom Alexander	9b5fbadc44	Increase timeout for coredns cache.	2026-07-06 18:12:10 -04:00
Tom Alexander	ab1b2a70f3	More changes to try to fix coredns.	2026-07-06 18:12:10 -04:00
Tom Alexander	4061d14651	Move the kubelet yaml config into nix.	2026-07-06 18:12:09 -04:00
Tom Alexander	361ec69a8b	Implement a generic helm templater package.	2026-07-06 18:12:09 -04:00
Tom Alexander	f545376aec	Switch to generating the coredns manifests via nix.	2026-07-06 18:12:09 -04:00
Tom Alexander	dc80c06ee9	Use CoreDNS for in-cluster DNS requests and caching.	2026-07-06 18:12:09 -04:00
Tom Alexander	5d58d550d3	Enable native routing.	2026-07-06 18:12:09 -04:00
Tom Alexander	51e027ba67	Build the cilium manifest automatically in nix.	2026-07-06 18:12:09 -04:00
Tom Alexander	37efcdb367	Allow pods to directly speak to the public internet on their own public IPv6 addresses.	2026-07-06 18:12:08 -04:00
Tom Alexander	01d230bde6	Enable ipv4 and tunnel routing.	2026-07-06 18:12:08 -04:00
Tom Alexander	383acd4fd2	Switch to kubernetes ipam mode.	2026-07-06 18:12:08 -04:00
Tom Alexander	7df824da6a	Fix service cluster ip range. Kubernetes only allows a /112 for service ip range.	2026-07-06 18:12:08 -04:00
Tom Alexander	efbfe865e0	Fix trailing line break in kubernetes encryption config.	2026-07-06 18:12:08 -04:00
Tom Alexander	2314bef2ad	Move the yaml functions to their own file.	2026-07-06 18:12:08 -04:00
Tom Alexander	8e9bd9acc1	Introduce functions to generate yaml. The toYAML function is just an alias to toJSON which is technically fine since YAML is a superset of JSON, but these new functions will generate actual YAML.	2026-07-06 18:12:08 -04:00
Tom Alexander	d924aa3a81	Add missing cidr declarations.	2026-07-06 18:12:07 -04:00
Tom Alexander	2bbf44e528	Fix DNS resolution.	2026-07-06 18:12:07 -04:00
Tom Alexander	c289f46cc5	Apply the git repo to the cluster.	2026-07-06 18:12:07 -04:00
Tom Alexander	88b1c36c0d	Trust flux's ssh key in the yaml git repo.	2026-07-06 18:12:07 -04:00
Tom Alexander	dbd82b998d	Generic secrets for ssh keys.	2026-07-06 18:12:07 -04:00
Tom Alexander	1700c42926	Generic secrets for pgp keys.	2026-07-06 18:12:07 -04:00
Tom Alexander	3c20fd49f0	Generate kubernetes secrets for ssh keys.	2026-07-06 18:12:06 -04:00
Tom Alexander	903c1c1f41	Install CoreDNS.	2026-07-06 18:12:06 -04:00
Tom Alexander	158c622840	Generate pgp keys for sops.	2026-07-06 18:12:06 -04:00
Tom Alexander	ceb627bb35	Generate ssh keys for flux bootstrap.	2026-07-06 18:12:06 -04:00
Tom Alexander	a3f1dff351	Move the cluster bootstrap into the keys flake. Bootstrapping the cluster needs access to secrets, so I am moving it into the keys flake.	2026-07-06 18:12:06 -04:00
Tom Alexander	46c8f5e0ce	Set up flux.	2026-07-06 18:12:06 -04:00
Tom Alexander	3760bca64b	Add a bootstrap role.	2026-07-06 18:12:05 -04:00
Tom Alexander	3396a4f482	Add a bootstrap role to load manifests into the cluster.	2026-07-06 18:12:05 -04:00
Tom Alexander	773db6e567	Fix launching of containers.	2026-07-06 18:12:05 -04:00
Tom Alexander	6010867796	Create a debugging role.	2026-07-06 18:12:05 -04:00
Tom Alexander	e9db45fb61	Some networking fixes.	2026-07-06 18:12:05 -04:00
Tom Alexander	10cb394dde	Add cilium bootstrap.	2026-07-06 18:12:05 -04:00
Tom Alexander	14787d6730	Installing the cni plugins.	2026-07-06 18:12:05 -04:00
Tom Alexander	19b2da0d40	Add kube-proxy.	2026-07-06 18:12:04 -04:00
Tom Alexander	95ec23126a	Add kubelet.	2026-07-06 18:12:04 -04:00
Tom Alexander	6897915455	Add worker nodes.	2026-07-06 18:12:04 -04:00
Tom Alexander	868b9b9889	Add kube-scheduler.	2026-07-06 18:12:04 -04:00
Tom Alexander	d0439a6d2f	Add kube-controller-manager.	2026-07-06 18:12:04 -04:00
Tom Alexander	fd15dc5bef	Fix launching kube-apiserver.	2026-07-06 18:12:04 -04:00
Tom Alexander	380ac011f1	Move the encryption config into a package.	2026-07-06 18:12:03 -04:00
Tom Alexander	f4891f345e	Switch to generating certs with openssl.	2026-07-06 18:12:03 -04:00
Tom Alexander	f8ad309c0b	Add controller proxy certs.	2026-07-06 18:12:03 -04:00
Tom Alexander	6c07157f21	Add requestheader-client-ca.	2026-07-06 18:12:03 -04:00
Tom Alexander	6aa87faecb	Add service account.	2026-07-06 18:12:03 -04:00
Tom Alexander	732e2cd296	Install kubernetes.	2026-07-06 18:12:03 -04:00
Tom Alexander	ac07941b8e	Add additional controllers.	2026-07-06 18:12:02 -04:00
Tom Alexander	fa59f17df5	Add configs for a new kubernetes cluster on NixOS.	2026-07-06 18:12:00 -04:00
Tom Alexander	c7e7b2b06c	Fix ending video recording sessions.	2026-07-05 17:29:53 -04:00
Tom Alexander	c0b3cd0fd3	Switch to flake-based build on nix-builder for nightly rust.	2026-07-05 16:15:33 -04:00
Tom Alexander	ef21e0125e	Disable the nixbsd build due to onetbb test bugs. This can be re-enabled after I have a flake building nixbsd so I can specify overlays.	2026-06-23 15:08:44 -04:00
Tom Alexander	e30a2ddb9e	Disable oneTBB tests. oneTBB tests hang forever on machines with only one CPU core. Since my NixOS builder is a virtual machine with only one core, I am disabling the tests. ref: https://github.com/uxlfoundation/oneTBB/issues/1557	2026-06-21 22:14:14 -04:00
Tom Alexander	53b3717b6c	Fix branch for family disks target in nix_builder.	2026-06-18 17:11:02 -04:00
Tom Alexander	0cf4139392	Fix launching shikane. This was failing because the latest version of shikane opens the config file as read+write.	2026-06-18 10:38:23 -04:00
Tom Alexander	6094fee196	Enable the thunderbolt service.	2026-06-17 13:08:11 -04:00
Tom Alexander	9e4c079258	Update packages.	2026-06-13 22:05:23 -04:00
Tom Alexander	3ab7a6e460	Update packages.	2026-06-13 22:05:23 -04:00
Tom Alexander	49f75408ae	Move kernel config to its own role.	2026-06-13 22:05:23 -04:00
Tom Alexander	0fa170c57e	Preserve .vscode-shared. The latest vscode is storing data in ~/.vscode-shared that contains the "Open Recent" entries and the settings on which folders are trusted.	2026-05-27 13:24:16 -04:00
Tom Alexander	3050cece0c	Do not force import the root zfs pool.	2026-05-25 22:20:08 -04:00
Tom Alexander	6d070ddbb4	Update packages.	2026-05-25 22:20:08 -04:00
Tom Alexander	f99fa54d60	Revert "Update only the kernel." This reverts commit `d52b5db39b`.	2026-05-21 20:31:54 -04:00
Tom Alexander	d52b5db39b	Update only the kernel.	2026-05-21 20:31:27 -04:00
Tom Alexander	003c3cc41a	Fix rnnoise after latest update.	2026-05-07 17:00:03 -04:00
Tom Alexander	d83652bb9c	Add rsync_clone script.	2026-05-06 10:02:20 -04:00
Tom Alexander	6fd09a712e	Add git_fix_author script.	2026-05-06 10:00:02 -04:00
Tom Alexander	d9c4f824d2	Add git_find_merged_branches script.	2026-05-06 09:56:18 -04:00
Tom Alexander	856e4daee6	Add the decode_jwt script.	2026-05-06 09:49:47 -04:00
Tom Alexander	9a9268f8cc	Disable shipwright. The hash is not matching, so the build is broken.	2026-05-05 22:42:17 -04:00
Tom Alexander	8d3ebf7ba2	Update packages.	2026-05-01 20:16:45 -04:00
Tom Alexander	d35cfaacbd	Add nix-pin-revision script.	2026-04-26 08:32:17 -04:00
Tom Alexander	8b1212e182	Support hardware accelerated RNG in qemurc.	2026-04-26 08:32:17 -04:00
Tom Alexander	7f0250cb9d	Sync to the store before registering paths.	2026-04-26 08:32:17 -04:00
Tom Alexander	bc2636a54c	New VPN address for home server.	2026-04-26 08:32:17 -04:00
Tom Alexander	c8147b5e9e	Use direct paths for hydra's nix store. I was getting corrupted builds, so as a test I am using the direct path where the drive is mounted rather than going through bind mounts.	2026-04-26 08:32:17 -04:00
Tom Alexander	4115e95bb6	Add a build of nixbsd to nix_builder.	2026-04-26 08:32:17 -04:00
Tom Alexander	4c1465c8d0	Update packages.	2026-04-26 08:32:17 -04:00
Tom Alexander	791f67eb82	Update nix_builder.	2026-04-02 22:03:45 -04:00
Tom Alexander	bf27504a5a	Add repair flag to build scripts.	2026-04-02 14:14:11 -04:00
Tom Alexander	620c12eaa7	Add auto-formatting for d2.	2026-04-02 14:04:04 -04:00
Tom Alexander	e2658412ab	Fix stuttery zoom on google maps.	2026-03-29 19:40:51 -04:00
Tom Alexander	a86e8c3a18	Fix rga alias.	2026-03-29 19:40:51 -04:00