Add support for setting the group owning the file.

ansible/roles/base/files/gitconfig_home

@@ -8,7 +8,6 @@
 	lg = log --color --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit
 	bh = log --oneline --branches=* --remotes=* --graph --decorate
 	amend = commit --amend --no-edit
-	authorcount = shortlog --summary --numbered --all --no-merges
 [core]
 	excludesfile = ~/.gitignore_global
 [commit]

ansible/roles/base/files/gitconfig_work

@@ -8,7 +8,6 @@
 	lg = log --color --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit
 	bh = log --oneline --branches=* --remotes=* --graph --decorate
 	amend = commit --amend --no-edit
-	authorcount = shortlog --summary --numbered --all --no-merges
 [core]
 	excludesfile = ~/.gitignore_global
 [commit]

ansible/roles/sshd/files/keys/yubikey.pub

@@ -1 +1 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID0+4zi26M3eYWnIrciR54kOlGxzfgCXG+o4ea1zpzrk openpgp:0x7FF123C8
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGu+k5lrirokdW5zVdRVBOqEOAvAPlIkG/MdJNc9g5ky cardno:000611194908

nix/configuration/configuration.nix

@@ -1,6 +1,8 @@
 {
   config,
   lib,
+  pkgs,
+  home-manager,
   ...
 }:
 
@@ -8,30 +10,20 @@
   imports = [
     ./roles/2ship2harkinian
     ./roles/alacritty
-    ./roles/amd_s2idle
     ./roles/ansible
     ./roles/ares
-    ./roles/base
     ./roles/bluetooth
     ./roles/boot
-    ./roles/build_in_ram
     ./roles/chromecast
     ./roles/chromium
-    ./roles/d2
-    ./roles/direnv
-    ./roles/disko
     ./roles/distributed_build
-    ./roles/doas
     ./roles/docker
-    ./roles/dont_use_substituters
     ./roles/ecc
     ./roles/emacs
-    ./roles/emulate_isa
     ./roles/firefox
     ./roles/firewall
     ./roles/flux
     ./roles/fonts
-    ./roles/image_based_appliance
     ./roles/gcloud
     ./roles/git
     ./roles/global_options
@@ -41,7 +33,6 @@
     ./roles/hydra
     ./roles/iso
     ./roles/iso_mount
-    ./roles/jujutsu
     ./roles/kanshi
     ./roles/kodi
     ./roles/kubernetes
@@ -50,46 +41,34 @@
     ./roles/lvfs
     ./roles/media
     ./roles/memtest86
-    ./roles/minimal_base
     ./roles/network
     ./roles/nix_index
     ./roles/nix_worker
     ./roles/nvme
-    ./roles/openpgp_card_tools
     ./roles/optimized_build
     ./roles/pcsx2
-    ./roles/podman
     ./roles/python
     ./roles/qemu
-    ./roles/recovery
     ./roles/reset
     ./roles/rpcs3
     ./roles/rust
-    ./roles/sequoia
-    ./roles/shadps4
     ./roles/shikane
     ./roles/shipwright
     ./roles/sm64ex
     ./roles/sops
     ./roles/sound
-    ./roles/spaghettikart
     ./roles/ssh
-    ./roles/sshd
     ./roles/steam
     ./roles/steam_run_free
     ./roles/sway
     ./roles/tekton
     ./roles/terraform
     ./roles/thunderbolt
-    ./roles/user
-    ./roles/uutils
     ./roles/vnc_client
     ./roles/vscode
     ./roles/wasm
     ./roles/waybar
-    ./roles/wine
     ./roles/wireguard
-    ./roles/yubikey
     ./roles/zfs
     ./roles/zrepl
     ./roles/zsh
@@ -97,112 +76,216 @@
     ./util/unfree_polyfill
   ];
 
-  config = {
-    nix.settings.experimental-features = [
-      "nix-command"
-      "flakes"
-    ];
-    nix.settings.trusted-users = [ "@wheel" ];
-
-    hardware.enableRedistributableFirmware = true;
-
-    # Keep outputs so we can build offline.
-    nix.extraOptions = ''
-      keep-outputs = true
-      keep-derivations = true
-    '';
-
-    # Automatic garbage collection
-    nix.gc = lib.mkIf (!config.me.buildingPortable) {
-      # Runs nix-collect-garbage --delete-older-than 5d
-      automatic = true;
-      persistent = true;
-      dates = "monthly";
-      # randomizedDelaySec = "14m";
-      options = "--delete-older-than 30d";
-    };
-    nix.settings.auto-optimise-store = !config.me.buildingPortable;
-
-    environment.persistence."/persist" = lib.mkIf (config.me.mountPersistence) {
-      hideMounts = true;
-      directories = [
-        "/var/lib/nixos" # Contains user information (uids/gids)
-        "/var/lib/systemd" # Systemd state directory for random seed, persistent timers, core dumps, persist hardware state like backlight and rfkill
-        "/var/log/journal" # Logs, alternatively set `services.journald.storage = "volatile";` to write to /run/log/journal
-      ];
-      files = [
-        "/etc/machine-id" # Systemd unique machine id "otherwise, the system journal may fail to list earlier boots, etc"
-      ];
-    };
-
-    # Write a list of the currently installed packages to /etc/current-system-packages
-    # environment.etc."current-system-packages".text =
-    #   let
-    #     packages = builtins.map (p: "${p.name}") config.environment.systemPackages;
-    #     sortedUnique = builtins.sort builtins.lessThan (lib.unique packages);
-    #     formatted = builtins.concatStringsSep "\n" sortedUnique;
-    #   in
-    #   formatted;
-
-    # nixpkgs.overlays = [
-    #   (final: prev: {
-    #     foot = throw "foo";
-    #   })
-    # ];
-
-    nixpkgs.overlays =
-      let
-        disableTests = (
-          package_name:
-          (final: prev: {
-            "${package_name}" = prev."${package_name}".overrideAttrs (old: {
-              doCheck = false;
-              doInstallCheck = false;
-            });
-          })
-        );
-      in
-      [
-        (final: prev: {
-          imagemagick = prev.imagemagick.overrideAttrs (old: rec {
-            # 7.1.2-6 seems to no longer exist, so use 7.1.2-7
-            version = "7.1.2-7";
-
-            src = final.fetchFromGitHub {
-              owner = "ImageMagick";
-              repo = "ImageMagick";
-              tag = version;
-              hash = "sha256-9ARCYftoXiilpJoj+Y+aLCEqLmhHFYSrHfgA5DQHbGo=";
-            };
-          });
-        })
-        (final: prev: {
-          grub2 = (final.callPackage ./package/grub { });
-        })
-        (final: prev: {
-          rpcs3 = prev.rpcs3.override {
-            ffmpeg = final.ffmpeg_7;
-          };
-        })
-      ];
-
-    # This option defines the first version of NixOS you have installed on this particular machine,
-    # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
-    #
-    # Most users should NEVER change this value after the initial install, for any reason,
-    # even if you've upgraded your system to a new NixOS release.
-    #
-    # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
-    # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
-    # to actually do that.
-    #
-    # This value being lower than the current NixOS release does NOT mean your system is
-    # out of date, out of support, or vulnerable.
-    #
-    # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
-    # and migrated your data accordingly.
-    #
-    # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
-    system.stateVersion = "24.11"; # Did you read the comment?
+  me.install.user.talexander.file."/home/talexander/flake.nix" = {
+    source = ./flake.nix;
   };
+
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+  nix.settings.trusted-users = [ "@wheel" ];
+
+  # boot.kernelPackages = pkgs.linuxPackages_6_11;
+  hardware.enableRedistributableFirmware = true;
+
+  # Use nixos-rebuild-ng
+  # system.rebuild.enableNg = true;
+
+  # Keep outputs so we can build offline.
+  nix.extraOptions = ''
+    keep-outputs = true
+    keep-derivations = true
+  '';
+
+  # Technically only needed when building the ISO because nix detects ZFS in the filesystem list normally. I basically always want this so I'm just setting it to always be on.
+  boot.supportedFilesystems.zfs = true;
+  # TODO: Is this different from boot.supportedFilesystems = [ "zfs" ]; ?
+
+  services.getty = {
+    autologinUser = "talexander"; # I use full disk encryption so the user password is irrelevant.
+    autologinOnce = true;
+  };
+  users.mutableUsers = false;
+  users.users.talexander = {
+    isNormalUser = true;
+    createHome = true; # https://github.com/NixOS/nixpkgs/issues/6481
+    group = "talexander";
+    extraGroups = [ "wheel" ];
+    uid = 11235;
+    packages = with pkgs; [
+      tree
+    ];
+    # Generate with `mkpasswd -m scrypt`
+    hashedPassword = "$7$CU..../....VXvNQ8za3wSGpdzGXNT50/$HcFtn/yvwPMCw4888BelpiAPLAxe/zU87fD.d/N6U48";
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGu+k5lrirokdW5zVdRVBOqEOAvAPlIkG/MdJNc9g5ky"
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIEI6mu6I5Jp+Ib0vJxapGHbEShZjyvzV8jz5DnzDrI39AAAABHNzaDo="
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIAFNcSXwvy+brYTOGo56G93Ptuq2MmZsjvRWAfMqbmMLAAAABHNzaDo="
+    ];
+  };
+  users.groups.talexander.gid = 11235;
+  home-manager.users.talexander =
+    { pkgs, ... }:
+    {
+      # The state version is required and should stay at the version you
+      # originally installed.
+      home.stateVersion = "24.11";
+    };
+
+  home-manager.users.root =
+    { pkgs, ... }:
+    {
+      # The state version is required and should stay at the version you
+      # originally installed.
+      home.stateVersion = "24.11";
+    };
+
+  # Automatic garbage collection
+  nix.gc = lib.mkIf (!config.me.buildingIso) {
+    # Runs nix-collect-garbage --delete-older-than 5d
+    automatic = true;
+    randomizedDelaySec = "14m";
+    options = "--delete-older-than 30d";
+  };
+  nix.settings.auto-optimise-store = !config.me.buildingIso;
+
+  # Use doas instead of sudo
+  security.doas.enable = true;
+  security.doas.wheelNeedsPassword = false;
+  security.sudo.enable = false;
+  security.doas.extraRules = [
+    {
+      # Retain environment (for example NIX_PATH)
+      keepEnv = true;
+      persist = true; # Only ask for a password the first time.
+    }
+  ];
+
+  environment.systemPackages = with pkgs; [
+    wget
+    mg
+    rsync
+    libinput
+    htop
+    tmux
+    file
+    usbutils # for lsusb
+    pciutils # for lspci
+    ripgrep
+    strace
+    ltrace
+    trace-cmd # ftrace
+    tcpdump
+    git-crypt
+    gnumake
+    ncdu
+    nix-tree
+    libarchive # bsdtar
+    lsof
+    doas-sudo-shim # To support --use-remote-sudo for remote builds
+    dmidecode # Read SMBIOS information.
+    ipcalc
+    gptfdisk # for cgdisk
+    nix-output-monitor # For better view into nixos-rebuild
+    nix-serve-ng # Serve nix store over http
+  ];
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+    };
+    hostKeys = [
+      {
+        path = "/persist/ssh/ssh_host_ed25519_key";
+        type = "ed25519";
+      }
+      {
+        path = "/persist/ssh/ssh_host_rsa_key";
+        type = "rsa";
+        bits = 4096;
+      }
+    ];
+  };
+
+  environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+    hideMounts = true;
+    directories = [
+      "/var/lib/iwd" # Wifi settings
+      "/var/lib/nixos" # Contains user information (uids/gids)
+      "/var/lib/systemd" # Systemd state directory for random seed, persistent timers, core dumps, persist hardware state like backlight and rfkill
+      "/var/log/journal" # Logs, alternatively set `services.journald.storage = "volatile";` to write to /run/log/journal
+    ];
+    files = [
+      "/etc/machine-id" # Systemd unique machine id "otherwise, the system journal may fail to list earlier boots, etc"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+    ];
+    users.talexander = {
+      directories = [
+        {
+          directory = "persist";
+          user = "talexander";
+          group = "talexander";
+          mode = "0700";
+        }
+      ];
+    };
+  };
+
+  # Write a list of the currently installed packages to /etc/current-system-packages
+  environment.etc."current-system-packages".text =
+    let
+      packages = builtins.map (p: "${p.name}") config.environment.systemPackages;
+      sortedUnique = builtins.sort builtins.lessThan (lib.unique packages);
+      formatted = builtins.concatStringsSep "\n" sortedUnique;
+    in
+    formatted;
+
+  # environment.etc."system-packages-with-source".text = builtins.concatStringsSep "\n\n" (
+  #   builtins.map (
+  #     x: x.file + "\n" + builtins.concatStringsSep "\n" (builtins.map (s: "  " + s) x.value)
+  #   ) config.environment.systemPackages.definitionsWithLocations
+  # );
+
+  # nixpkgs.overlays = [
+  #   (final: prev: {
+  #     nix = pkgs-unstable.nix;
+  #   })
+  # ];
+
+  # nixpkgs.overlays = [
+  #   (final: prev: {
+  #     foot = throw "foo";
+  #   })
+  # ];
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "24.11"; # Did you read the comment?
+
 }

nix/configuration/flake.lock

@@ -1,5 +1,22 @@
 {
   "nodes": {
+    "ansible-sshjail": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "path": "flakes/ansible-sshjail",
+        "type": "path"
+      },
+      "original": {
+        "path": "flakes/ansible-sshjail",
+        "type": "path"
+      },
+      "parent": []
+    },
     "crane": {
       "locked": {
         "lastModified": 1731098351,
@@ -22,11 +39,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762276996,
-        "narHash": "sha256-TtcPgPmp2f0FAnc+DMEw4ardEgv1SGNR3/WFGH0N19M=",
+        "lastModified": 1746729224,
+        "narHash": "sha256-9R4sOLAK1w3Bq54H3XOJogdc7a6C2bLLmatOQ+5pf5w=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "af087d076d3860760b3323f6b583f4d828c1ac17",
+        "rev": "85555d27ded84604ad6657ecca255a03fd878607",
         "type": "github"
       },
       "original": {
@@ -72,6 +89,42 @@
         "type": "github"
       }
     },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "gitignore": {
       "inputs": {
         "nixpkgs": [
@@ -94,6 +147,26 @@
         "type": "github"
       }
     },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1746981801,
+        "narHash": "sha256-+Bfr0KqZV6gZdA7e2kupeoawozaLIHLuiPtC54uxbFc=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "ff915842e4a2e63c4c8c5c08c6870b9d5b3c3ee9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
     "impermanence": {
       "locked": {
         "lastModified": 1737831083,
@@ -137,11 +210,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1762977756,
-        "narHash": "sha256-4PqRErxfe+2toFJFgcRKZ0UI9NSIOJa+7RXVtBhy4KE=",
+        "lastModified": 1746663147,
+        "narHash": "sha256-Ua0drDHawlzNqJnclTJGf87dBmaO/tn7iZ+TCkTRpRc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c5ae371f1a6a7fd27823bc500d9390b38c05fa55",
+        "rev": "dda3dcd3fe03e991015e9a74b22d35950f264a54",
         "type": "github"
       },
       "original": {
@@ -151,6 +224,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-b93b4e9b5": {
+      "locked": {
+        "lastModified": 1713721570,
+        "narHash": "sha256-R0s+O5UjTePQRb72XPgtkTmEiOOW8n+1q9Gxt/OJnKU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b93b4e9b527904aadf52dba6ca35efde2067cbd4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b93b4e9b527904aadf52dba6ca35efde2067cbd4",
+        "type": "github"
+      }
+    },
     "nixpkgs-stable": {
       "locked": {
         "lastModified": 1730741070,
@@ -169,11 +258,11 @@
     },
     "nixpkgs-unoptimized": {
       "locked": {
-        "lastModified": 1762977756,
-        "narHash": "sha256-4PqRErxfe+2toFJFgcRKZ0UI9NSIOJa+7RXVtBhy4KE=",
+        "lastModified": 1746663147,
+        "narHash": "sha256-Ua0drDHawlzNqJnclTJGf87dBmaO/tn7iZ+TCkTRpRc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c5ae371f1a6a7fd27823bc500d9390b38c05fa55",
+        "rev": "dda3dcd3fe03e991015e9a74b22d35950f264a54",
         "type": "github"
       },
       "original": {
@@ -212,11 +301,15 @@
     },
     "root": {
       "inputs": {
+        "ansible-sshjail": "ansible-sshjail",
         "disko": "disko",
+        "home-manager": "home-manager",
         "impermanence": "impermanence",
         "lanzaboote": "lanzaboote",
         "nixpkgs": "nixpkgs",
-        "nixpkgs-unoptimized": "nixpkgs-unoptimized"
+        "nixpkgs-b93b4e9b5": "nixpkgs-b93b4e9b5",
+        "nixpkgs-unoptimized": "nixpkgs-unoptimized",
+        "zsh-histdb": "zsh-histdb"
       }
     },
     "rust-overlay": {
@@ -239,6 +332,53 @@
         "repo": "rust-overlay",
         "type": "github"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "zsh-histdb": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "path": "flakes/zsh-histdb",
+        "type": "path"
+      },
+      "original": {
+        "path": "flakes/zsh-histdb",
+        "type": "path"
+      },
+      "parent": []
     }
   },
   "root": "root",

nix/configuration/flake.nix

@@ -1,18 +1,41 @@
+# Build ISO image
+#   nix build --extra-experimental-features nix-command --extra-experimental-features flakes .#iso.odo
+#   output: result/iso/nixos.iso
+
+# Run the ISO image
+#   doas "$(nix-build '<nixpkgs>' --no-out-link -A 'qemu')/bin/qemu-system-x86_64" \
+#        -accel kvm \
+#        -cpu host \
+#        -smp cores=8 \
+#        -m 32768 \
+#        -drive "file=$(nix-build '<nixpkgs>' --no-out-link -A 'OVMF.fd')/FV/OVMF.fd,if=pflash,format=raw,readonly=on" \
+#        -drive if=pflash,format=raw,file="/tmp/OVMF_VARS.fd" \
+#        -nic user,hostfwd=tcp::60022-:22 \
+#        -boot order=d \
+#        -cdrom "$(readlink -f ./result/iso/nixos*.iso)" \
+#        -display vnc=127.0.0.1:0
+#
+# doas cp "$(nix-build '<nixpkgs>' --no-out-link -A 'OVMF.fd')/FV/OVMF_VARS.fd" /tmp/OVMF_VARS.fd
+# doas "$(nix-build '<nixpkgs>' --no-out-link -A 'qemu')/bin/qemu-system-x86_64" -accel kvm -cpu host -smp cores=8 -m 32768 -drive "file=$(nix-build '<nixpkgs>' --no-out-link -A 'OVMF.fd')/FV/OVMF.fd,if=pflash,format=raw,readonly=on" -drive if=pflash,format=raw,file="/tmp/OVMF_VARS.fd" -nic user,hostfwd=tcp::60022-:22 -boot order=d -cdrom /persist/machine_setup/nix/configuration/result/iso/nixos*.iso -display vnc=127.0.0.1:0
+
 # Get a repl for this flake
 #   nix repl --expr "builtins.getFlake \"$PWD\""
 
-# TODO maybe use `nix eval --raw .#odo.iso.outPath`
+# TODO maybe use `nix eval --raw .#iso.odo.outPath`
+# iso.odo.isoName == "nixos.iso"
+# full path = <outPath> / iso / <isoName>
 
 #
 # Install on a new machine:
 #
-# Set
-#   me.disko.enable = true;
-#   me.disko.offline.enable = true;
 #
-# Run
-#   doas disko --mode destroy,format,mount hosts/recovery/disk-config.nix
-#   doas nixos-install --substituters "http://10.0.2.2:8080?trusted=1 https://cache.nixos.org/" --flake ".#recovery"
+# doas nix --substituters "http://10.0.2.2:8080?trusted=1 https://cache.nixos.org/" --experimental-features "nix-command flakes" run github:nix-community/disko/latest -- --mode destroy,format,mount hosts/odo/disk-config.nix
+
+# nix flake update zsh-histdb --flake .
+# nix flake update ansible-sshjail --flake .
+# for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
+# nixos-install --substituters "http://10.0.2.2:8080?trusted=1 https://cache.nixos.org/" --flake ".#vm_ionlybootzfs"
+#
 
 {
   description = "My system configuration";
@@ -20,9 +43,26 @@
   inputs = {
     impermanence.url = "github:nix-community/impermanence";
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs-b93b4e9b5.url = "github:NixOS/nixpkgs/b93b4e9b527904aadf52dba6ca35efde2067cbd4";
     nixpkgs-unoptimized.url = "github:NixOS/nixpkgs/nixos-unstable";
+    home-manager.url = "github:nix-community/home-manager";
+    home-manager.inputs.nixpkgs.follows = "nixpkgs";
     lanzaboote = {
       url = "github:nix-community/lanzaboote/v0.4.2";
+
+      # Optional but recommended to limit the size of your system closure.
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    zsh-histdb = {
+      url = "path:flakes/zsh-histdb";
+
+      # Optional but recommended to limit the size of your system closure.
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    ansible-sshjail = {
+      url = "path:flakes/ansible-sshjail";
+
+      # Optional but recommended to limit the size of your system closure.
       inputs.nixpkgs.follows = "nixpkgs";
     };
     disko = {
@@ -36,69 +76,197 @@
       self,
       nixpkgs,
       nixpkgs-unoptimized,
-      disko,
+      nixpkgs-b93b4e9b5,
       impermanence,
+      home-manager,
       lanzaboote,
+      zsh-histdb,
+      ansible-sshjail,
       ...
-    }:
+    }@inputs:
     let
-      forAllSystems = nixpkgs.lib.genAttrs nixpkgs.lib.systems.flakeExposed;
-      nodes = {
-        odo = {
-          system = "x86_64-linux";
-        };
-        odowork = {
-          system = "x86_64-linux";
-        };
-        quark = {
-          system = "x86_64-linux";
-        };
-        recovery = {
-          system = "x86_64-linux";
-        };
-        i_only_boot_zfs = {
-          system = "x86_64-linux";
+      base_x86_64_linux = rec {
+        system = "x86_64-linux";
+        specialArgs = {
+          pkgs-b93b4e9b5 = import nixpkgs-b93b4e9b5 {
+            inherit system;
+          };
+          pkgs-unoptimized = import nixpkgs-unoptimized {
+            inherit system;
+            hostPlatform.gcc.arch = "default";
+            hostPlatform.gcc.tune = "default";
+          };
         };
+        modules = [
+          impermanence.nixosModules.impermanence
+          home-manager.nixosModules.home-manager
+          lanzaboote.nixosModules.lanzaboote
+          inputs.disko.nixosModules.disko
+          {
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+          }
+          {
+            nixpkgs.overlays = [
+              zsh-histdb.overlays.default
+              ansible-sshjail.overlays.default
+            ];
+          }
+          ./configuration.nix
+        ];
       };
-      nixosConfigs = builtins.mapAttrs (
-        hostname: nodeConfig: format:
-        nixpkgs.lib.nixosSystem {
-          inherit (nodeConfig) system;
-          specialArgs = {
-            inherit self;
-
-            this_nixos_config = self.nixosConfigurations."${hostname}";
-
-            pkgs-unoptimized = import nixpkgs-unoptimized {
-              inherit (nodeConfig) system;
-              hostPlatform.gcc.arch = "default";
-              hostPlatform.gcc.tune = "default";
+      systems =
+        let
+          additional_iso_modules = [
+            (nixpkgs + "/nixos/modules/installer/cd-dvd/iso-image.nix")
+            # TODO: Figure out how to do image based appliances
+            # (nixpkgs + "/nixos/modules/profiles/image-based-appliance.nix")
+            {
+              isoImage.makeEfiBootable = true;
+              isoImage.makeUsbBootable = true;
+              me.buildingIso = true;
+              me.optimizations.enable = nixpkgs.lib.mkForce false;
+            }
+            {
+              # These are big space hogs. The chance that I need them on an ISO is slim.
+              me.steam.enable = nixpkgs.lib.mkForce false;
+              me.pcsx2.enable = nixpkgs.lib.mkForce false;
+            }
+          ];
+          additional_vm_modules = [
+            (nixpkgs + "/nixos/modules/profiles/qemu-guest.nix")
+            {
+              networking.dhcpcd.enable = true;
+              networking.useDHCP = true;
+              me.optimizations.enable = nixpkgs.lib.mkForce false;
+            }
+            {
+              # I don't need games on a virtual machine.
+              me.steam.enable = nixpkgs.lib.mkForce false;
+              me.pcsx2.enable = nixpkgs.lib.mkForce false;
+              me.sm64ex.enable = nixpkgs.lib.mkForce false;
+              me.shipwright.enable = nixpkgs.lib.mkForce false;
+              me.ship2harkinian.enable = nixpkgs.lib.mkForce false;
+            }
+          ];
+        in
+        {
+          odo = rec {
+            main = base_x86_64_linux // {
+              modules = base_x86_64_linux.modules ++ [
+                ./hosts/odo
+              ];
+            };
+            iso = main // {
+              modules = main.modules ++ additional_iso_modules;
+            };
+            vm = main // {
+              modules = main.modules ++ additional_vm_modules;
+            };
+            vm_iso = main // {
+              modules = main.modules ++ additional_vm_modules ++ additional_iso_modules;
             };
           };
-          modules = [
-            impermanence.nixosModules.impermanence
-            lanzaboote.nixosModules.lanzaboote
-            disko.nixosModules.disko
-            ./configuration.nix
-            (./. + "/hosts/${hostname}")
-            (./. + "/formats/${format}.nix")
-          ];
-        }
-      ) nodes;
+          quark = rec {
+            main = base_x86_64_linux // {
+              modules = base_x86_64_linux.modules ++ [
+                ./hosts/quark
+              ];
+            };
+            iso = main // {
+              modules = main.modules ++ additional_iso_modules;
+            };
+            vm = main // {
+              modules = main.modules ++ additional_vm_modules;
+            };
+            vm_iso = main // {
+              modules = main.modules ++ additional_vm_modules ++ additional_iso_modules;
+            };
+          };
+          neelix = rec {
+            main = base_x86_64_linux // {
+              modules = base_x86_64_linux.modules ++ [
+                ./hosts/neelix
+              ];
+            };
+            iso = main // {
+              modules = main.modules ++ additional_iso_modules;
+            };
+            vm = main // {
+              modules = main.modules ++ additional_vm_modules;
+            };
+            vm_iso = main // {
+              modules = main.modules ++ additional_vm_modules ++ additional_iso_modules;
+            };
+          };
+          hydra =
+            let
+              additional_iso_modules = additional_iso_modules ++ [
+                {
+                  me.optimizations.enable = true;
+                }
+              ];
+            in
+            rec {
+              main = base_x86_64_linux // {
+                modules = base_x86_64_linux.modules ++ [
+                  ./hosts/hydra
+                ];
+              };
+              iso = main // {
+                modules = main.modules ++ additional_iso_modules;
+              };
+              vm = main // {
+                modules = main.modules ++ additional_vm_modules;
+              };
+              vm_iso = main // {
+                modules = main.modules ++ additional_vm_modules ++ additional_iso_modules;
+              };
+            };
+          ionlybootzfs = rec {
+            main = base_x86_64_linux // {
+              modules = base_x86_64_linux.modules ++ [
+                ./hosts/ionlybootzfs
+              ];
+            };
+            iso = main // {
+              modules = main.modules ++ additional_iso_modules;
+            };
+            vm = main // {
+              modules = main.modules ++ additional_vm_modules;
+            };
+            vm_iso = main // {
+              modules = main.modules ++ additional_vm_modules ++ additional_iso_modules;
+            };
+          };
+
+        };
     in
     {
-      nixosConfigurations = (builtins.mapAttrs (name: value: value "toplevel") nixosConfigs);
-    }
-    // {
-      packages = (
-        forAllSystems (
-          system:
-          (builtins.mapAttrs (hostname: nodeConfig: {
-            iso = (nixosConfigs."${hostname}" "iso").config.system.build.isoImage;
-            vm_iso = (nixosConfigs."${hostname}" "vm_iso").config.system.build.isoImage;
-            sd = (nixosConfigs."${hostname}" "sd").config.system.build.sdImage;
-          }) (nixpkgs.lib.attrsets.filterAttrs (hostname: nodeConfig: nodeConfig.system == system) nodes))
-        )
-      );
+      nixosConfigurations.odo = nixpkgs.lib.nixosSystem systems.odo.main;
+      iso.odo = (nixpkgs.lib.nixosSystem systems.odo.iso).config.system.build.isoImage;
+      nixosConfigurations.vm_odo = nixpkgs.lib.nixosSystem systems.odo.vm;
+      vm_iso.odo = (nixpkgs.lib.nixosSystem systems.odo.vm_iso).config.system.build.isoImage;
+
+      nixosConfigurations.quark = nixpkgs.lib.nixosSystem systems.quark.main;
+      iso.quark = (nixpkgs.lib.nixosSystem systems.quark.iso).config.system.build.isoImage;
+      nixosConfigurations.vm_quark = nixpkgs.lib.nixosSystem systems.quark.vm;
+      vm_iso.quark = (nixpkgs.lib.nixosSystem systems.quark.vm_iso).config.system.build.isoImage;
+
+      nixosConfigurations.neelix = nixpkgs.lib.nixosSystem systems.neelix.main;
+      iso.neelix = (nixpkgs.lib.nixosSystem systems.neelix.iso).config.system.build.isoImage;
+      nixosConfigurations.vm_neelix = nixpkgs.lib.nixosSystem systems.neelix.vm;
+      vm_iso.neelix = (nixpkgs.lib.nixosSystem systems.neelix.vm_iso).config.system.build.isoImage;
+
+      nixosConfigurations.hydra = nixpkgs.lib.nixosSystem systems.hydra.main;
+      iso.hydra = (nixpkgs.lib.nixosSystem systems.hydra.iso).config.system.build.isoImage;
+      nixosConfigurations.vm_hydra = nixpkgs.lib.nixosSystem systems.hydra.vm;
+      vm_iso.hydra = (nixpkgs.lib.nixosSystem systems.hydra.vm_iso).config.system.build.isoImage;
+
+      nixosConfigurations.ionlybootzfs = nixpkgs.lib.nixosSystem systems.ionlybootzfs.main;
+      iso.ionlybootzfs = (nixpkgs.lib.nixosSystem systems.ionlybootzfs.iso).config.system.build.isoImage;
+      nixosConfigurations.vm_ionlybootzfs = nixpkgs.lib.nixosSystem systems.ionlybootzfs.vm;
+      vm_iso.ionlybootzfs =
+        (nixpkgs.lib.nixosSystem systems.ionlybootzfs.vm_iso).config.system.build.isoImage;
     };
 }

nix/configuration/flakes/ansible-sshjail/flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1735141468,
+        "narHash": "sha256-VIAjBr1qGcEbmhLwQJD6TABppPMggzOvqFsqkDoMsAY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "4005c3ff7505313cbc21081776ad0ce5dfd7a3ce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

nix/configuration/flakes/ansible-sshjail/flake.nix

@@ -0,0 +1,34 @@
+{
+  description = "A slightly better history for zsh";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+  inputs.flake-utils.url = "github:numtide/flake-utils";
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      flake-utils,
+      ...
+    }:
+    let
+      out =
+        system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+          # Maybe pkgs = import nixpkgs { inherit system; }; ?
+          appliedOverlay = self.overlays.default pkgs pkgs;
+        in
+        {
+          packages = rec {
+            default = ansible-sshjail;
+            ansible-sshjail = appliedOverlay.ansible-sshjail;
+          };
+        };
+    in
+    flake-utils.lib.eachDefaultSystem out
+    // {
+      overlays.default = final: prev: {
+        ansible-sshjail = final.callPackage ./package.nix { };
+      };
+    };
+}

nix/configuration/flakes/zsh-histdb/flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1735141468,
+        "narHash": "sha256-VIAjBr1qGcEbmhLwQJD6TABppPMggzOvqFsqkDoMsAY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "4005c3ff7505313cbc21081776ad0ce5dfd7a3ce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

nix/configuration/flakes/zsh-histdb/flake.nix

@@ -0,0 +1,34 @@
+{
+  description = "A slightly better history for zsh";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+  inputs.flake-utils.url = "github:numtide/flake-utils";
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      flake-utils,
+      ...
+    }:
+    let
+      out =
+        system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+          # Maybe pkgs = import nixpkgs { inherit system; }; ?
+          appliedOverlay = self.overlays.default pkgs pkgs;
+        in
+        {
+          packages = rec {
+            default = zsh-histdb;
+            zsh-histdb = appliedOverlay.zsh-histdb;
+          };
+        };
+    in
+    flake-utils.lib.eachDefaultSystem out
+    // {
+      overlays.default = final: prev: {
+        zsh-histdb = final.callPackage ./package.nix { };
+      };
+    };
+}

nix/configuration/formats/iso.nix

@@ -1,31 +0,0 @@
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/cd-dvd/iso-image.nix")
-  ];
-
-  config = {
-    isoImage.makeEfiBootable = true;
-    isoImage.makeUsbBootable = true;
-
-    networking.dhcpcd.enable = true;
-    networking.useDHCP = true;
-
-    me.buildingPortable = true;
-    me.disko.enable = true;
-    me.disko.offline.enable = true;
-    me.mountPersistence = lib.mkForce false;
-    me.optimizations.enable = lib.mkForce false;
-
-    # Not doing image_based_appliance because this might be an install ISO, in which case we'd need nix to do the install.
-    # me.image_based_appliance.enable = true;
-
-    # TODO: Should I use this instead of doing a mkIf for the disk config?
-    # disko.enableConfig = false;
-  };
-}

nix/configuration/formats/sd.nix

@@ -1,32 +0,0 @@
-{
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/sd-card/sd-image.nix")
-  ];
-
-  config = {
-    isoImage.makeEfiBootable = true;
-    isoImage.makeUsbBootable = true;
-
-    boot.loader.grub.enable = false;
-    boot.loader.generic-extlinux-compatible.enable = true;
-
-    # TODO: image based appliance?
-
-    # TODO: Maybe this?
-    # fileSystems = {
-    #   "/" = {
-    #     device = "/dev/disk/by-label/NIXOS_SD";
-    #     fsType = "ext4";
-    #     options = [
-    #       "noatime"
-    #       "norelatime"
-    #     ];
-    #   };
-    # };
-  };
-}

nix/configuration/formats/toplevel.nix

@@ -1 +0,0 @@
-{ }

nix/configuration/formats/vm_iso.nix

@@ -1,22 +0,0 @@
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/cd-dvd/iso-image.nix")
-    (modulesPath + "/profiles/qemu-guest.nix") # VirtIO kernel modules
-  ];
-
-  config = {
-    isoImage.makeEfiBootable = true;
-    isoImage.makeUsbBootable = true;
-
-    networking.dhcpcd.enable = true;
-    networking.useDHCP = true;
-
-    me.image_based_appliance.enable = true;
-  };
-}

nix/configuration/hosts/hydra/DEPLOY_BOOT

@@ -10,8 +10,10 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 # TARGET=192.168.211.250
 TARGET=hydra
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild boot --flake "$DIR/../../#hydra" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --flake "$DIR/../../#hydra" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
 
 # rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild boot --flake /persist/manual/configuration#hydra'

nix/configuration/hosts/hydra/DEPLOY_SWITCH

@@ -10,8 +10,10 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 # TARGET=192.168.211.250
 TARGET=hydra
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild switch --flake "$DIR/../../#hydra" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --flake "$DIR/../../#hydra" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
 
 # rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild switch --flake /persist/manual/configuration#hydra'

nix/configuration/hosts/hydra/ISO

@@ -6,5 +6,7 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#iso.hydra" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#iso.hydra" --max-jobs "$JOBS" "${@}" |& nom

nix/configuration/hosts/hydra/VM_ISO

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#vm_iso.hydra" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
-
-install -m 0644 result/iso/nixos-*-x86_64-linux.iso ~/hydra.iso
-unlink ./result

nix/configuration/hosts/hydra/default.nix

@@ -14,65 +14,55 @@
 #      -display vnc=127.0.0.1:0
 #
 
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 {
   imports = [
     ./disk-config.nix
     ./hardware-configuration.nix
+    ./optimized_build.nix
     ./vm_disk.nix
   ];
 
-  config = {
-    # Generate with `head -c4 /dev/urandom | od -A none -t x4`
-    networking.hostId = "fbd233d8";
+  # Generate with `head -c4 /dev/urandom | od -A none -t x4`
+  networking.hostId = "fbd233d8";
 
-    networking.hostName = "hydra"; # Define your hostname.
+  networking.hostName = "hydra"; # Define your hostname.
 
-    time.timeZone = "America/New_York";
-    i18n.defaultLocale = "en_US.UTF-8";
+  time.timeZone = "America/New_York";
+  i18n.defaultLocale = "en_US.UTF-8";
 
-    me.boot.secure = false;
-    me.mountPersistence = true;
+  me.secureBoot.enable = false;
 
-    me.optimizations = {
-      enable = true;
-      arch = "znver4";
-      system_features = [
-        "gccarch-znver4"
-        "gccarch-skylake"
-        "gccarch-kabylake"
-        # "gccarch-alderlake" missing WAITPKG
-        "gccarch-x86-64-v3"
-        "gccarch-x86-64-v4"
-        "benchmark"
-        "big-parallel"
-        "kvm"
-        "nixos-test"
-      ];
-    };
-
-    # Mount tmpfs at /tmp
-    boot.tmp.useTmpfs = true;
-
-    me.base.enable = true;
-    me.boot.enable = true;
-    me.doas.enable = true;
-    me.emacs_flavor = "plainmacs";
-    me.firewall.enable = true;
-    me.font.enable = true;
-    me.git.enable = true;
-    me.graphical = false;
-    me.hydra.enable = false;
-    me.memtest.enable = true;
-    me.network.enable = true;
-    me.nix_worker.enable = true;
-    me.nvme.enable = true;
-    me.ssh.enable = true;
-    me.sshd.enable = true;
-    me.user.enable = true;
-    me.vm_disk.enable = true;
-    me.wireguard.activated = [ ];
-    me.wireguard.deactivated = [ ];
-    me.zfs.enable = true;
-    me.zsh.enable = true;
+  me.optimizations = {
+    enable = true;
+    arch = "znver4";
+    system_features = [
+      "gccarch-znver4"
+      "gccarch-skylake"
+      # "gccarch-alderlake" missing WAITPKG
+      "gccarch-x86-64-v3"
+      "gccarch-x86-64-v4"
+      "benchmark"
+      "big-parallel"
+      "kvm"
+      "nixos-test"
+    ];
   };
+
+  # Mount tmpfs at /tmp
+  boot.tmp.useTmpfs = true;
+
+  me.emacs_flavor = "plainmacs";
+  me.graphical = false;
+  me.hydra.enable = false;
+  me.nix_worker.enable = true;
+  me.vm_disk.enable = true;
+  me.wireguard.activated = [ ];
+  me.wireguard.deactivated = [ ];
+  me.zsh.enable = true;
 }

nix/configuration/hosts/hydra/disk-config.nix

@@ -4,6 +4,7 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
 

nix/configuration/hosts/hydra/hardware-configuration.nix

@@ -1,5 +1,10 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
 {
+  config,
   lib,
+  pkgs,
   modulesPath,
   ...
 }:
@@ -9,28 +14,26 @@
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  config = {
-    boot.initrd.availableKernelModules = [
-      "xhci_pci"
-      "nvme"
-      "usbhid"
-      "usb_storage"
-      "sd_mod"
-      "sdhci_pci"
-    ];
-    boot.initrd.kernelModules = [ ];
-    boot.kernelModules = [ ];
-    boot.extraModulePackages = [ ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+    "sdhci_pci"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
 
-    # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-    # (the default) this is the recommended approach. When using systemd-networkd it's
-    # still possible to use this option, but it's recommended to use it in conjunction
-    # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-    networking.dhcpcd.enable = lib.mkForce true;
-    networking.useDHCP = lib.mkForce true;
-    networking.interfaces.enp0s2.useDHCP = lib.mkForce true;
-    # systemd.network.enable = true;
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.dhcpcd.enable = lib.mkForce true;
+  networking.useDHCP = lib.mkForce true;
+  networking.interfaces.enp0s2.useDHCP = lib.mkForce true;
+  # systemd.network.enable = true;
 
-    nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  };
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

nix/configuration/hosts/hydra/vm_disk.nix

@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
 
@@ -16,57 +17,61 @@
     };
   };
 
-  config = lib.mkIf config.me.vm_disk.enable {
-    # Mount the local disk
-    fileSystems = {
-      "/.disk" = lib.mkForce {
-        device = "/dev/nvme0n1p1";
-        fsType = "ext4";
-        options = [
-          "noatime"
-          "discard"
-        ];
-        neededForBoot = true;
-      };
+  config = lib.mkIf config.me.vm_disk.enable (
+    lib.mkMerge [
+      {
+        # Mount the local disk
+        fileSystems = {
+          "/.disk" = lib.mkForce {
+            device = "/dev/nvme0n1p1";
+            fsType = "ext4";
+            options = [
+              "noatime"
+              "discard"
+            ];
+            neededForBoot = true;
+          };
 
-      "/persist" = {
-        fsType = "none";
-        device = "/.disk/persist";
-        options = [
-          "bind"
-          "rw"
-        ];
-        depends = [
-          "/.disk/persist"
-        ];
-      };
+          "/persist" = {
+            fsType = "none";
+            device = "/.disk/persist";
+            options = [
+              "bind"
+              "rw"
+            ];
+            depends = [
+              "/.disk/persist"
+            ];
+          };
 
-      "/state" = {
-        fsType = "none";
-        device = "/.disk/state";
-        options = [
-          "bind"
-          "rw"
-        ];
-        depends = [
-          "/.disk/state"
-        ];
-      };
+          "/state" = {
+            fsType = "none";
+            device = "/.disk/state";
+            options = [
+              "bind"
+              "rw"
+            ];
+            depends = [
+              "/.disk/state"
+            ];
+          };
 
-      "/nix/store" = lib.mkForce {
-        fsType = "overlay";
-        device = "overlay";
-        options = [
-          "lowerdir=/nix/.ro-store"
-          "upperdir=/.disk/persist/store"
-          "workdir=/.disk/state/work"
-        ];
-        depends = [
-          "/nix/.ro-store"
-          "/.disk/persist/store"
-          "/.disk/state/work"
-        ];
-      };
-    };
-  };
+          "/nix/store" = lib.mkForce {
+            fsType = "overlay";
+            device = "overlay";
+            options = [
+              "lowerdir=/nix/.ro-store"
+              "upperdir=/.disk/persist/store"
+              "workdir=/.disk/state/work"
+            ];
+            depends = [
+              "/nix/.ro-store"
+              "/.disk/persist/store"
+              "/.disk/state/work"
+            ];
+          };
+        };
+      }
+    ]
+  );
 }

nix/configuration/hosts/i_only_boot_zfs/DEPLOY_BOOT

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-TARGET=i_only_boot_zfs
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-
-nixos-rebuild boot --flake "$DIR/../../#i_only_boot_zfs" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/i_only_boot_zfs/DEPLOY_SWITCH

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-TARGET=i_only_boot_zfs
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-
-nixos-rebuild switch --flake "$DIR/../../#i_only_boot_zfs" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/i_only_boot_zfs/ISO

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#i_only_boot_zfs.iso" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/i_only_boot_zfs/SELF_BOOT

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#i_only_boot_zfs" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/i_only_boot_zfs/SELF_BUILD

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#i_only_boot_zfs" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/i_only_boot_zfs/SELF_SWITCH

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#i_only_boot_zfs" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/i_only_boot_zfs/default.nix

@@ -1,63 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  imports = [
-    ./hardware-configuration.nix
-    ./wrapped-disk-config.nix
-    ./distributed_build.nix
-    ./power_management.nix
-  ];
-
-  config = {
-    # Generate with `head -c4 /dev/urandom | od -A none -t x4`
-    networking.hostId = "6a05d86e";
-
-    networking.hostName = "i_only_boot_zfs"; # Define your hostname.
-
-    time.timeZone = "America/New_York";
-    i18n.defaultLocale = "en_US.UTF-8";
-
-    me.boot.enable = true;
-    me.boot.secure = false;
-    me.mountPersistence = true;
-
-    # Toggle to start writing the extlinux config which will be used by zfsbootmenu
-    # boot.loader.generic-extlinux-compatible.enable = true;
-    # boot.loader.systemd-boot.enable = lib.mkForce false;
-
-    me.optimizations = {
-      # enable = true;
-      # arch = "kabylake";
-      # build_arch = "x86-64-v3";
-      system_features = [
-        # "gccarch-kabylake"
-        "gccarch-x86-64-v3"
-        "benchmark"
-        "big-parallel"
-        "kvm"
-        "nixos-test"
-      ];
-    };
-
-    # Early KMS
-    # boot.initrd.kernelModules = [ "amdgpu" ];
-
-    # Mount tmpfs at /tmp
-    boot.tmp.useTmpfs = true;
-
-    # Enable TRIM
-    # services.fstrim.enable = lib.mkDefault true;
-
-    # Even when installed, we want to dhcp because this is for a VM.
-    networking.dhcpcd.enable = true;
-    networking.useDHCP = true;
-
-    me.build_in_ram.enable = true;
-    me.dont_use_substituters.enable = true;
-    me.minimal_base.enable = true;
-  };
-}

nix/configuration/hosts/i_only_boot_zfs/disk-config.nix

@@ -1,155 +0,0 @@
-# Manual Step:
-#   Check if drive supports 4kn: nvme id-ns -H /dev/nvme0n1
-#   Format the drive to 4kn: nvme format --lbaf=1 /dev/nvme0n1
-
-{
-  disko.devices = {
-    disk = {
-      main = {
-        type = "disk";
-        device = "/dev/nvme0n1";
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/efi";
-                mountOptions = [
-                  "umask=0077"
-                  "noatime"
-                  "discard"
-                ];
-              };
-            };
-            zfs = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        # mode = "mirror";
-        # Workaround: cannot import 'zroot': I/O error in disko tests
-        options.cachefile = "none";
-        options = {
-          ashift = "12";
-          compatibility = "openzfs-2.2-freebsd";
-          autotrim = "on";
-        };
-        rootFsOptions = {
-          acltype = "posixacl";
-          atime = "off";
-          relatime = "off";
-          xattr = "sa";
-          mountpoint = "none";
-          compression = "lz4";
-          canmount = "off";
-          utf8only = "on";
-          dnodesize = "auto";
-          normalization = "formD";
-        };
-
-        datasets = {
-          "linux/nix" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-            options = {
-              # encryption = "aes-256-gcm";
-              # keyformat = "passphrase";
-              # keylocation = "file:///tmp/secret.key";
-            };
-          };
-          "linux/nix/root" = {
-            type = "zfs_fs";
-            options.mountpoint = "legacy";
-            mountpoint = "/";
-            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/root@blank$' || zfs snapshot zroot/linux/nix/root@blank";
-          };
-          "linux/nix/boot" = {
-            type = "zfs_fs";
-            options = {
-              mountpoint = "legacy";
-              "org.zfsbootmenu:active" = "on";
-            };
-            mountpoint = "/boot";
-            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/boot@blank$' || zfs snapshot zroot/linux/nix/boot@blank";
-          };
-          "linux/nix/nix" = {
-            type = "zfs_fs";
-            options.mountpoint = "legacy";
-            mountpoint = "/nix";
-            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/nix@blank$' || zfs snapshot zroot/linux/nix/nix@blank";
-            options = {
-              recordsize = "16MiB";
-              compression = "zstd-19";
-            };
-          };
-          "linux/nix/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "legacy";
-            mountpoint = "/home";
-            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/home@blank$' || zfs snapshot zroot/linux/nix/home@blank";
-          };
-          "linux/nix/persist" = {
-            type = "zfs_fs";
-            options.mountpoint = "legacy";
-            mountpoint = "/persist";
-            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/persist@blank$' || zfs snapshot zroot/linux/nix/persist@blank";
-          };
-          "linux/nix/state" = {
-            type = "zfs_fs";
-            options.mountpoint = "legacy";
-            mountpoint = "/state";
-            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/state@blank$' || zfs snapshot zroot/linux/nix/state@blank";
-          };
-        };
-      };
-    };
-  };
-
-  # Make sure all persistent volumes are marked as neededForBoot
-  #
-  # Also mounts /home so it is mounted before the user home directories are created.
-  fileSystems."/persist".neededForBoot = true;
-  fileSystems."/state".neededForBoot = true;
-  fileSystems."/home".neededForBoot = true;
-
-  fileSystems."/".options = [
-    "noatime"
-    "norelatime"
-  ];
-  fileSystems."/boot".options = [
-    "noatime"
-    "norelatime"
-  ];
-  fileSystems."/nix".options = [
-    "noatime"
-    "norelatime"
-  ];
-  fileSystems."/persist".options = [
-    "noatime"
-    "norelatime"
-  ];
-  fileSystems."/state".options = [
-    "noatime"
-    "norelatime"
-  ];
-  fileSystems."/home".options = [
-    "noatime"
-    "norelatime"
-  ];
-
-  # Only attempt to decrypt the main pool. Otherwise it attempts to decrypt pools that aren't even used.
-  # boot.zfs.requestEncryptionCredentials = [ "zroot/linux/nix" ];
-}

nix/configuration/hosts/i_only_boot_zfs/distributed_build.nix

@@ -1,19 +0,0 @@
-{
-  imports = [ ];
-
-  config = {
-    me.distributed_build.enable = true;
-    me.distributed_build.machines.hydra = {
-      enable = true;
-      additional_config = {
-        speedFactor = 2;
-      };
-    };
-    me.distributed_build.machines.quark = {
-      enable = true;
-      additional_config = {
-        speedFactor = 2;
-      };
-    };
-  };
-}

nix/configuration/hosts/i_only_boot_zfs/hardware-configuration.nix

@@ -1,34 +0,0 @@
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  config = {
-    boot.initrd.availableKernelModules = [
-      "nvme"
-      "xhci_pci"
-      "thunderbolt"
-    ];
-    boot.initrd.kernelModules = [ ];
-    boot.kernelModules = [ ];
-    boot.extraModulePackages = [ ];
-
-    # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-    # (the default) this is the recommended approach. When using systemd-networkd it's
-    # still possible to use this option, but it's recommended to use it in conjunction
-    # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-    # networking.useDHCP = lib.mkDefault true;
-    # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-    # networking.interfaces.wlp58s0.useDHCP = lib.mkDefault true;
-
-    nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-    hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-  };
-}

nix/configuration/hosts/i_only_boot_zfs/power_management.nix

@@ -1,63 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-
-{
-  imports = [ ];
-
-  config = {
-    environment.systemPackages = with pkgs; [
-      powertop
-    ];
-
-    # pcie_aspm=force pcie_aspm.policy=powersupersave :: Enable PCIe active state power management for power reduction.
-    # nowatchdog :: Disable watchdog for power savings (related to disable_sp5100_watchdog above).
-    boot.kernelParams = [
-      "pcie_aspm=force"
-      # "pcie_aspm.policy=powersupersave"
-      "nowatchdog"
-    ];
-
-    systemd.tmpfiles.rules = [
-      "w- /sys/firmware/acpi/platform_profile - - - - low-power"
-      "w- /sys/devices/system/cpu/cpufreq/policy0/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy1/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy2/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy3/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy4/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy5/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy6/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy7/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy8/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy9/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy10/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy11/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy12/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy13/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy14/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy15/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpu0/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu1/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu2/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu3/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu4/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu5/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu6/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu7/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu8/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu9/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu10/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu11/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu12/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu13/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu14/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu15/cpufreq/boost - - - - 0"
-    ];
-
-    boot.extraModprobeConfig = ''
-      # Sound power-saving was causing chat notifications to be inaudible.
-      # options snd_hda_intel power_save=1
-    '';
-  };
-}

nix/configuration/hosts/i_only_boot_zfs/wrapped-disk-config.nix

@@ -1,7 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-
-lib.mkIf (!config.me.buildingPortable) (import ./disk-config.nix)

nix/configuration/hosts/ionlybootzfs/DEPLOY_BOOT

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+#
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+: "${JOBS:="1"}"
+
+#TARGET=10.216.1.14
+# TARGET=192.168.211.250
+TARGET="ionlybootzfs"
+
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
+for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
+
+nixos-rebuild boot --flake "$DIR/../../#ionlybootzfs" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+
+# rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild boot --flake /persist/manual/configuration#ionlybootzfs'

nix/configuration/hosts/ionlybootzfs/DEPLOY_SWITCH

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+#
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+: "${JOBS:="1"}"
+
+#TARGET=10.216.1.14
+# TARGET=192.168.211.250
+TARGET=ionlybootzfs
+
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
+for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
+
+nixos-rebuild switch --flake "$DIR/../../#ionlybootzfs" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+
+# rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild switch --flake /persist/manual/configuration#ionlybootzfs'

nix/configuration/hosts/ionlybootzfs/ISO

@@ -6,5 +6,7 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#odowork.iso" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#iso.ionlybootzfs" --max-jobs "$JOBS" "${@}" |& nom

nix/configuration/hosts/ionlybootzfs/default.nix

@@ -0,0 +1,63 @@
+#
+# Testing:
+# doas "$(nix-build '<nixpkgs>' --no-out-link -A 'qemu')/bin/qemu-system-x86_64" \
+#      -accel kvm \
+#      -cpu host \
+#      -smp cores=8 \
+#      -m 32768 \
+#      -drive "file=$(nix-build '<nixpkgs>' --no-out-link -A 'OVMF.fd')/FV/OVMF.fd,if=pflash,format=raw,readonly=on" \
+#      -drive file=/tmp/localdisk.img,if=none,id=nvm,format=raw \
+#      -device nvme,serial=deadbeef,drive=nvm \
+#      -nic user,hostfwd=tcp::60022-:22 \
+#      -boot order=d \
+#      -cdrom "$(readlink -f /persist/machine_setup/nix/configuration/result/iso/nixos*.iso)" \
+#      -display vnc=127.0.0.1:0
+#
+
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  imports = [
+    ./wrapped-disk-config.nix
+    ./hardware-configuration.nix
+  ];
+
+  # Generate with `head -c4 /dev/urandom | od -A none -t x4`
+  networking.hostId = "fbd233d8";
+
+  networking.hostName = "ionlybootzfs"; # Define your hostname.
+
+  time.timeZone = "America/New_York";
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  me.secureBoot.enable = true;
+
+  me.optimizations = {
+    enable = false;
+    arch = "znver4";
+    system_features = [
+      "gccarch-znver4"
+      "gccarch-skylake"
+      # "gccarch-alderlake" missing WAITPKG
+      "gccarch-x86-64-v3"
+      "gccarch-x86-64-v4"
+      "benchmark"
+      "big-parallel"
+      "kvm"
+      "nixos-test"
+    ];
+  };
+
+  # Mount tmpfs at /tmp
+  boot.tmp.useTmpfs = true;
+
+  me.emacs_flavor = "plainmacs";
+  me.graphical = false;
+  me.wireguard.activated = [ ];
+  me.wireguard.deactivated = [ ];
+  me.zsh.enable = true;
+}

nix/configuration/hosts/ionlybootzfs/disk-config.nix

@@ -65,8 +65,8 @@
             type = "zfs_fs";
             options.mountpoint = "none";
             options = {
-              # encryption = "aes-256-gcm";
-              # keyformat = "passphrase";
+              encryption = "aes-256-gcm";
+              keyformat = "passphrase";
               # keylocation = "file:///tmp/secret.key";
             };
           };
@@ -138,5 +138,5 @@
   ];
 
   # Only attempt to decrypt the main pool. Otherwise it attempts to decrypt pools that aren't even used.
-  # boot.zfs.requestEncryptionCredentials = [ "zroot/linux/nix" ];
+  boot.zfs.requestEncryptionCredentials = [ "zroot/linux/nix" ];
 }

nix/configuration/hosts/ionlybootzfs/hardware-configuration.nix

@@ -0,0 +1,38 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+    "sdhci_pci"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.dhcpcd.enable = lib.mkForce true;
+  networking.useDHCP = lib.mkForce true;
+  # systemd.network.enable = true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

nix/configuration/hosts/ionlybootzfs/optimized_build.nix

@@ -0,0 +1,131 @@
+{
+  config,
+  lib,
+  pkgs,
+  pkgs-unoptimized,
+  ...
+}:
+{
+  imports = [ ];
+
+  config = lib.mkMerge [
+    { }
+    (lib.mkIf (!config.me.optimizations.enable) {
+      boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_6_14;
+    })
+    (lib.mkIf (config.me.optimizations.enable) {
+      nixpkgs.hostPlatform = {
+        gcc.arch = "znver4";
+        gcc.tune = "znver4";
+        system = "x86_64-linux";
+      };
+
+      nixpkgs.overlays = [
+        (
+          final: prev:
+          let
+            addConfig =
+              additionalConfig: pkg:
+              pkg.override (oldconfig: {
+                structuredExtraConfig = pkg.structuredExtraConfig // additionalConfig;
+              });
+          in
+          {
+            linux_me = addConfig {
+              # Full preemption
+              PREEMPT = lib.mkOverride 60 lib.kernel.yes;
+              PREEMPT_VOLUNTARY = lib.mkOverride 60 lib.kernel.no;
+
+              # Google's BBRv3 TCP congestion Control
+              TCP_CONG_BBR = lib.kernel.yes;
+              DEFAULT_BBR = lib.kernel.yes;
+
+              # Preemptive Full Tickless Kernel at 300Hz
+              HZ = lib.kernel.freeform "300";
+              HZ_300 = lib.kernel.yes;
+              HZ_1000 = lib.kernel.no;
+            } prev.linux_6_14;
+            # gsl = prev.gsl.overrideAttrs (old: {
+            #   # gsl tests fails when optimizations are enabled.
+            #   # > FAIL: cholesky_invert unscaled hilbert (  4,  4)[0,2]: 2.55795384873636067e-13                        0
+            #   # >  (2.55795384873636067e-13 observed vs 0 expected) [28259614]
+            #   doCheck = false;
+            # });
+          }
+        )
+        (final: prev: {
+          haskellPackages = prev.haskellPackages.extend (
+            final': prev': {
+              inherit (pkgs-unoptimized.haskellPackages)
+                crypton
+                crypton-connection
+                crypton-x509
+                crypton-x509-store
+                crypton-x509-system
+                crypton-x509-validation
+                hspec-wai
+                http-client-tls
+                http2
+                pandoc
+                pandoc-cli
+                pandoc-lua-engine
+                pandoc-server
+                servant-server
+                tls
+                wai-app-static
+                wai-extra
+                warp
+                ;
+            }
+          );
+        })
+        (final: prev: {
+          inherit (pkgs-unoptimized)
+            gsl
+            redis
+            valkey
+            ;
+        })
+      ];
+
+      boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_me;
+    })
+    (lib.mkIf (!config.me.buildingIso) {
+      nix.settings.system-features = lib.mkForce [
+        "gccarch-znver4"
+        "gccarch-skylake"
+        # "gccarch-alderlake" missing WAITPKG
+        "gccarch-x86-64-v3"
+        "gccarch-x86-64-v4"
+        "benchmark"
+        "big-parallel"
+        "kvm"
+        "nixos-test"
+      ];
+
+      # Keep ALL dependencies so we can rebuild offline. This DRASTICALLY increase disk usage, but disk space is cheap.
+      # system.includeBuildDependencies = true;
+
+      # This also should enable building offline? TODO: test.
+      nix.extraOptions = ''
+        keep-outputs = true
+        keep-derivations = true
+      '';
+
+      # # building ON
+      # nixpkgs.localSystem = { system = "aarch64-linux"; };
+      # # building FOR
+      # nixpkgs.crossSystem = { system = "aarch64-linux"; };
+
+      # nixpkgs.config = {
+      #   replaceStdenv = ({ pkgs }: pkgs.clangStdenv);
+      # };
+      # or maybe an overlay
+      # stdenv = prev.clangStdenv;
+
+    })
+    (lib.mkIf (config.me.buildingIso) {
+      boot.supportedFilesystems.zfs = true;
+    })
+  ];
+}

nix/configuration/hosts/ionlybootzfs/wrapped-disk-config.nix

@@ -0,0 +1,8 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+lib.mkIf (!config.me.buildingIso) (import ./disk-config.nix)

nix/configuration/hosts/neelix/DEPLOY_BOOT

@@ -10,8 +10,10 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 # TARGET=192.168.211.250
 TARGET=neelix
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild boot --flake "$DIR/../../#neelix" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --flake "$DIR/../../#neelix" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
 
 # rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild boot --flake /persist/manual/configuration#neelix'

nix/configuration/hosts/neelix/DEPLOY_SWITCH

@@ -10,8 +10,10 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 # TARGET=192.168.211.250
 TARGET=neelix
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild switch --flake "$DIR/../../#neelix" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --flake "$DIR/../../#neelix" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
 
 # rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild switch --flake /persist/manual/configuration#neelix'

nix/configuration/hosts/neelix/default.nix

@@ -6,61 +6,46 @@
     ./power_management.nix
   ];
 
-  config = {
-    # Generate with `head -c4 /dev/urandom | od -A none -t x4`
-    networking.hostId = "bca9d0a5";
+  # Generate with `head -c4 /dev/urandom | od -A none -t x4`
+  networking.hostId = "bca9d0a5";
 
-    networking.hostName = "neelix"; # Define your hostname.
+  networking.hostName = "neelix"; # Define your hostname.
 
-    time.timeZone = "America/New_York";
-    i18n.defaultLocale = "en_US.UTF-8";
+  time.timeZone = "America/New_York";
+  i18n.defaultLocale = "en_US.UTF-8";
 
-    me.boot.secure = false;
-    me.mountPersistence = true;
+  me.secureBoot.enable = false;
 
-    me.optimizations = {
-      enable = false;
-      arch = "alderlake";
-      system_features = [
-        "gccarch-alderlake"
-        "gccarch-x86-64-v3"
-        "gccarch-x86-64-v4"
-        "benchmark"
-        "big-parallel"
-        "kvm"
-        "nixos-test"
-      ];
-    };
-
-    # Early KMS
-    boot.initrd.kernelModules = [ "i915" ];
-
-    # Mount tmpfs at /tmp
-    # boot.tmp.useTmpfs = true;
-
-    me.base.enable = true;
-    me.bluetooth.enable = true;
-    me.boot.enable = true;
-    me.doas.enable = true;
-    me.emacs_flavor = "plainmacs";
-    me.firewall.enable = true;
-    me.font.enable = true;
-    me.git.enable = true;
-    me.graphical = true;
-    me.graphics_card_type = "intel";
-    me.kodi.enable = true;
-    me.lvfs.enable = true;
-    me.memtest.enable = true;
-    me.network.enable = true;
-    me.nvme.enable = true;
-    me.sound.enable = true;
-    me.ssh.enable = true;
-    me.sshd.enable = true;
-    me.user.enable = true;
-    me.wireguard.activated = [ "wgh" ];
-    me.wireguard.deactivated = [ "wgf" ];
-    me.zfs.enable = true;
-    me.zrepl.enable = true;
-    me.zsh.enable = true;
+  me.optimizations = {
+    enable = false;
+    arch = "alderlake";
+    system_features = [
+      "gccarch-alderlake"
+      "gccarch-x86-64-v3"
+      "gccarch-x86-64-v4"
+      "benchmark"
+      "big-parallel"
+      "kvm"
+      "nixos-test"
+    ];
   };
+
+  # Early KMS
+  boot.initrd.kernelModules = [ "i915" ];
+
+  # Mount tmpfs at /tmp
+  # boot.tmp.useTmpfs = true;
+
+  me.bluetooth.enable = true;
+  me.emacs_flavor = "plainmacs";
+  me.graphical = true;
+  me.graphics_card_type = "intel";
+  me.kodi.enable = true;
+  me.lvfs.enable = true;
+  me.sound.enable = true;
+  me.wireguard.activated = [ "wgh" ];
+  me.wireguard.deactivated = [ "wgf" ];
+  me.zrepl.enable = true;
+  me.zsh.enable = true;
+
 }

nix/configuration/hosts/neelix/hardware-configuration.nix

@@ -1,6 +1,10 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
 {
   config,
   lib,
+  pkgs,
   modulesPath,
   ...
 }:
@@ -10,28 +14,26 @@
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  config = {
-    boot.initrd.availableKernelModules = [
-      "xhci_pci"
-      "nvme"
-      "usbhid"
-      "usb_storage"
-      "sd_mod"
-      "sdhci_pci"
-    ];
-    boot.initrd.kernelModules = [ ];
-    boot.kernelModules = [ ];
-    boot.extraModulePackages = [ ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+    "sdhci_pci"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
 
-    # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-    # (the default) this is the recommended approach. When using systemd-networkd it's
-    # still possible to use this option, but it's recommended to use it in conjunction
-    # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-    # networking.useDHCP = lib.mkDefault true;
-    # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-    # networking.interfaces.wlp58s0.useDHCP = lib.mkDefault true;
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  # networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp58s0.useDHCP = lib.mkDefault true;
 
-    nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-    hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-  };
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

nix/configuration/hosts/neelix/power_management.nix

@@ -1,4 +1,6 @@
 {
+  config,
+  lib,
   pkgs,
   ...
 }:
@@ -6,30 +8,28 @@
 {
   imports = [ ];
 
-  config = {
-    environment.systemPackages = with pkgs; [
-      powertop
-    ];
+  environment.systemPackages = with pkgs; [
+    powertop
+  ];
 
-    # pcie_aspm=force pcie_aspm.policy=powersupersave :: Enable PCIe active state power management for power reduction.
-    # nowatchdog :: Disable watchdog for power savings (related to disable_sp5100_watchdog above).
-    boot.kernelParams = [
-      "pcie_aspm=force"
-      # "pcie_aspm.policy=powersupersave"
-      "nowatchdog"
-    ];
+  # pcie_aspm=force pcie_aspm.policy=powersupersave :: Enable PCIe active state power management for power reduction.
+  # nowatchdog :: Disable watchdog for power savings (related to disable_sp5100_watchdog above).
+  boot.kernelParams = [
+    "pcie_aspm=force"
+    # "pcie_aspm.policy=powersupersave"
+    "nowatchdog"
+  ];
 
-    # default performance balance_performance balance_power power
-    # defaults to balance_performance
-    # systemd.tmpfiles.rules = [
-    #   "w- /sys/devices/system/cpu/cpufreq/policy0/energy_performance_preference - - - - power"
-    #   "w- /sys/devices/system/cpu/cpufreq/policy1/energy_performance_preference - - - - power"
-    #   "w- /sys/devices/system/cpu/cpufreq/policy2/energy_performance_preference - - - - power"
-    #   "w- /sys/devices/system/cpu/cpufreq/policy3/energy_performance_preference - - - - power"
-    # ];
+  # default performance balance_performance balance_power power
+  # defaults to balance_performance
+  # systemd.tmpfiles.rules = [
+  #   "w- /sys/devices/system/cpu/cpufreq/policy0/energy_performance_preference - - - - power"
+  #   "w- /sys/devices/system/cpu/cpufreq/policy1/energy_performance_preference - - - - power"
+  #   "w- /sys/devices/system/cpu/cpufreq/policy2/energy_performance_preference - - - - power"
+  #   "w- /sys/devices/system/cpu/cpufreq/policy3/energy_performance_preference - - - - power"
+  # ];
 
-    boot.extraModprobeConfig = ''
-      options snd_hda_intel power_save=1
-    '';
-  };
+  boot.extraModprobeConfig = ''
+    options snd_hda_intel power_save=1
+  '';
 }

nix/configuration/hosts/odo/DEPLOY_BOOT

@@ -6,8 +6,14 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
+# TARGET=10.216.1.15
+# TARGET=192.168.211.250
 TARGET=odo
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild boot --flake "$DIR/../../#odo" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --flake "$DIR/../../#odo" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+
+# rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild boot --flake /persist/manual/configuration#odo'

nix/configuration/hosts/odo/DEPLOY_SWITCH

@@ -6,8 +6,14 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
+#TARGET=10.216.1.14
+# TARGET=192.168.211.250
 TARGET=odo
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild switch --flake "$DIR/../../#odo" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --flake "$DIR/../../#odo" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+
+# rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild switch --flake /persist/manual/configuration#odo'

nix/configuration/hosts/odo/ISO

@@ -6,5 +6,7 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#odo.iso" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#iso.odo" --max-jobs "$JOBS" "${@}" |& nom

nix/configuration/hosts/odo/SELF_BOOT

@@ -6,5 +6,7 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --show-trace --use-remote-sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" "${@}" |& nom

nix/configuration/hosts/odo/SELF_BUILD

@@ -6,5 +6,7 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild build --show-trace --use-remote-sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" "${@}" |& nom

nix/configuration/hosts/odo/SELF_SWITCH

@@ -6,5 +6,7 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --show-trace --use-remote-sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" "${@}" |& nom

nix/configuration/hosts/odo/default.nix

@@ -15,140 +15,102 @@
     ./framework_module.nix
   ];
 
-  config = {
-    # Generate with `head -c4 /dev/urandom | od -A none -t x4`
-    networking.hostId = "908cbf04";
+  # Generate with `head -c4 /dev/urandom | od -A none -t x4`
+  networking.hostId = "908cbf04";
 
-    networking.hostName = "odo"; # Define your hostname.
+  networking.hostName = "odo"; # Define your hostname.
 
-    time.timeZone = "America/New_York";
-    i18n.defaultLocale = "en_US.UTF-8";
+  time.timeZone = "America/New_York";
+  i18n.defaultLocale = "en_US.UTF-8";
 
-    me.boot.enable = true;
-    me.boot.secure = false;
-    me.mountPersistence = true;
+  me.secureBoot.enable = true;
 
-    # Toggle to start writing the extlinux config which will be used by zfsbootmenu
-    boot.loader.generic-extlinux-compatible.enable = true;
-    boot.loader.systemd-boot.enable = lib.mkForce false;
-
-    me.optimizations = {
-      enable = true;
-      arch = "znver4";
-      # build_arch = "x86-64-v3";
-      system_features = [
-        "gccarch-znver4"
-        "gccarch-skylake"
-        "gccarch-kabylake"
-        # "gccarch-alderlake" missing WAITPKG
-        "gccarch-x86-64-v3"
-        "gccarch-x86-64-v4"
-        "benchmark"
-        "big-parallel"
-        "kvm"
-        "nixos-test"
-      ];
-    };
-
-    # Early KMS
-    boot.initrd.kernelModules = [ "amdgpu" ];
-
-    # Mount tmpfs at /tmp
-    boot.tmp.useTmpfs = true;
-
-    environment.systemPackages = with pkgs; [
-      fw-ectool
-      framework-tool
+  me.optimizations = {
+    enable = true;
+    arch = "znver4";
+    system_features = [
+      "gccarch-znver4"
+      "gccarch-skylake"
+      # "gccarch-alderlake" missing WAITPKG
+      "gccarch-x86-64-v3"
+      "gccarch-x86-64-v4"
+      "benchmark"
+      "big-parallel"
+      "kvm"
+      "nixos-test"
     ];
-
-    # Enable light sensor
-    # hardware.sensor.iio.enable = lib.mkDefault true;
-
-    # Enable TRIM
-    # services.fstrim.enable = lib.mkDefault true;
-
-    me.alacritty.enable = true;
-    me.amd_s2idle.enable = true;
-    me.ansible.enable = true;
-    me.ares.enable = true;
-    me.base.enable = true;
-    me.bluetooth.enable = true;
-    me.build_in_ram.enable = true;
-    me.chromecast.enable = true;
-    me.chromium.enable = true;
-    me.d2.enable = true;
-    me.direnv.enable = true;
-    me.doas.enable = true;
-    me.docker.enable = false;
-    me.dont_use_substituters.enable = true;
-    me.ecc.enable = false;
-    me.emacs_flavor = "full";
-    me.emulate_isa.enable = true;
-    me.firefox.enable = true;
-    me.firewall.enable = true;
-    me.flux.enable = true;
-    me.font.enable = true;
-    me.gcloud.enable = true;
-    me.git.config = ../../roles/git/files/gitconfig_home;
-    me.git.enable = true;
-    me.gnuplot.enable = true;
-    me.gpg.enable = true;
-    me.graphical = true;
-    me.graphics_card_type = "amd";
-    me.iso_mount.enable = true;
-    me.jujutsu.enable = true;
-    me.kanshi.enable = false;
-    me.kubernetes.enable = true;
-    me.latex.enable = true;
-    me.launch_keyboard.enable = true;
-    me.lvfs.enable = true;
-    me.media.enable = true;
-    me.memtest.enable = true;
-    me.network.enable = true;
-    me.nix_index.enable = true;
-    me.nvme.enable = true;
-    me.openpgp_card_tools.enable = true;
-    me.pcsx2.enable = true;
-    me.podman.enable = true;
-    me.python.enable = true;
-    me.qemu.enable = true;
-    me.recovery.enable = true;
-    me.rpcs3.enable = true;
-    me.rust.enable = true;
-    me.sequoia.enable = true;
-    me.shadps4.enable = false;
-    me.shikane.enable = true;
-    me.sops.enable = true;
-    me.sound.enable = true;
-    me.spaghettikart.enable = true;
-    me.ssh.enable = true;
-    me.sshd.enable = true;
-    me.steam.enable = true;
-    me.steam_run_free.enable = true;
-    me.sway.enable = true;
-    me.tekton.enable = true;
-    me.terraform.enable = true;
-    me.thunderbolt.enable = true;
-    me.user.enable = true;
-    me.uutils.enable = false;
-    me.vnc_client.enable = true;
-    me.vscode.enable = true;
-    me.wasm.enable = true;
-    me.waybar.enable = true;
-    me.wine.enable = false;
-    me.wireguard.activated = [
-      "drmario"
-      "wgh"
-      "colo"
-    ];
-    me.wireguard.deactivated = [ "wgf" ];
-    me.yubikey.enable = true;
-    me.zfs.enable = true;
-    me.zrepl.enable = true;
-    me.zsh.enable = true;
-
-    me.sm64ex.enable = true;
-    me.shipwright.enable = true;
-    me.ship2harkinian.enable = true;
   };
+
+  # Early KMS
+  boot.initrd.kernelModules = [ "amdgpu" ];
+
+  # Mount tmpfs at /tmp
+  boot.tmp.useTmpfs = true;
+
+  environment.systemPackages = with pkgs; [
+    fw-ectool
+    framework-tool
+  ];
+
+  # Enable light sensor
+  # hardware.sensor.iio.enable = lib.mkDefault true;
+
+  # Enable TRIM
+  # services.fstrim.enable = lib.mkDefault true;
+
+  me.alacritty.enable = true;
+  me.ansible.enable = true;
+  me.ares.enable = true;
+  me.bluetooth.enable = true;
+  me.chromecast.enable = true;
+  me.chromium.enable = true;
+  me.docker.enable = true;
+  me.ecc.enable = true;
+  me.emacs_flavor = "full";
+  me.firefox.enable = true;
+  me.flux.enable = true;
+  me.gcloud.enable = true;
+  me.git.config = ../../roles/git/files/gitconfig_home;
+  me.gnuplot.enable = true;
+  me.gpg.enable = true;
+  me.graphical = true;
+  me.graphics_card_type = "amd";
+  me.iso_mount.enable = true;
+  me.kanshi.enable = false;
+  me.kubernetes.enable = true;
+  me.latex.enable = true;
+  me.launch_keyboard.enable = true;
+  me.lvfs.enable = true;
+  me.media.enable = true;
+  me.nix_index.enable = true;
+  me.pcsx2.enable = true;
+  me.python.enable = true;
+  me.qemu.enable = true;
+  me.rpcs3.enable = true;
+  me.rust.enable = true;
+  me.shikane.enable = true;
+  me.sops.enable = true;
+  me.sound.enable = true;
+  me.steam.enable = true;
+  me.steam_run_free.enable = true;
+  me.sway.enable = true;
+  me.tekton.enable = true;
+  me.terraform.enable = true;
+  me.thunderbolt.enable = true;
+  me.vnc_client.enable = true;
+  me.vscode.enable = true;
+  me.wasm.enable = true;
+  me.waybar.enable = true;
+  me.wireguard.activated = [
+    "drmario"
+    "wgh"
+    "colo"
+  ];
+  me.wireguard.deactivated = [ "wgf" ];
+  me.zrepl.enable = true;
+  me.zsh.enable = true;
+
+  me.sm64ex.enable = true;
+  me.shipwright.enable = true;
+  me.ship2harkinian.enable = true;
 }

nix/configuration/hosts/odo/disk-config.nix

@@ -17,7 +17,7 @@
               content = {
                 type = "filesystem";
                 format = "vfat";
-                mountpoint = "/efi";
+                mountpoint = "/boot";
                 mountOptions = [
                   "umask=0077"
                   "noatime"
@@ -76,15 +76,6 @@
             mountpoint = "/";
             postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/root@blank$' || zfs snapshot zroot/linux/nix/root@blank";
           };
-          "linux/nix/boot" = {
-            type = "zfs_fs";
-            options = {
-              mountpoint = "legacy";
-              "org.zfsbootmenu:active" = "on";
-            };
-            mountpoint = "/boot";
-            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/boot@blank$' || zfs snapshot zroot/linux/nix/boot@blank";
-          };
           "linux/nix/nix" = {
             type = "zfs_fs";
             options.mountpoint = "legacy";
@@ -129,10 +120,6 @@
     "noatime"
     "norelatime"
   ];
-  fileSystems."/boot".options = [
-    "noatime"
-    "norelatime"
-  ];
   fileSystems."/nix".options = [
     "noatime"
     "norelatime"

nix/configuration/hosts/odo/distributed_build.nix

@@ -1,19 +1,27 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 {
   imports = [ ];
 
-  config = {
-    me.distributed_build.enable = true;
-    me.distributed_build.machines.hydra = {
-      enable = true;
-      additional_config = {
-        speedFactor = 2;
+  config = lib.mkMerge [
+    {
+      me.distributed_build.enable = true;
+      me.distributed_build.machines.hydra = {
+        enable = true;
+        additional_config = {
+          speedFactor = 2;
+        };
       };
-    };
-    me.distributed_build.machines.quark = {
-      enable = true;
-      additional_config = {
-        speedFactor = 2;
+      me.distributed_build.machines.quark = {
+        enable = true;
+        additional_config = {
+          speedFactor = 2;
+        };
       };
-    };
-  };
+    }
+  ];
 }

nix/configuration/hosts/odo/framework_module.nix

@@ -1,19 +1,23 @@
 {
   config,
+  lib,
+  pkgs,
   ...
 }:
 
 {
   imports = [ ];
 
-  config = {
-    boot.extraModulePackages = with config.boot.kernelPackages; [
-      framework-laptop-kmod
-    ];
-    # https://github.com/DHowett/framework-laptop-kmod?tab=readme-ov-file#usage
-    boot.kernelModules = [
-      "cros_ec"
-      "cros_ec_lpcs"
-    ];
-  };
+  config = lib.mkMerge [
+    {
+      boot.extraModulePackages = with config.boot.kernelPackages; [
+        framework-laptop-kmod
+      ];
+      # https://github.com/DHowett/framework-laptop-kmod?tab=readme-ov-file#usage
+      boot.kernelModules = [
+        "cros_ec"
+        "cros_ec_lpcs"
+      ];
+    }
+  ];
 }

nix/configuration/hosts/odo/hardware-configuration.nix

@@ -1,6 +1,10 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
 {
   config,
   lib,
+  pkgs,
   modulesPath,
   ...
 }:
@@ -10,25 +14,23 @@
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  config = {
-    boot.initrd.availableKernelModules = [
-      "nvme"
-      "xhci_pci"
-      "thunderbolt"
-    ];
-    boot.initrd.kernelModules = [ ];
-    boot.kernelModules = [ ];
-    boot.extraModulePackages = [ ];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "thunderbolt"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
 
-    # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-    # (the default) this is the recommended approach. When using systemd-networkd it's
-    # still possible to use this option, but it's recommended to use it in conjunction
-    # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-    # networking.useDHCP = lib.mkDefault true;
-    # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-    # networking.interfaces.wlp58s0.useDHCP = lib.mkDefault true;
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  # networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp58s0.useDHCP = lib.mkDefault true;
 
-    nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-    hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-  };
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

nix/configuration/hosts/odo/power_management.nix

@@ -1,4 +1,6 @@
 {
+  config,
+  lib,
   pkgs,
   ...
 }:
@@ -6,70 +8,52 @@
 {
   imports = [ ];
 
-  config = {
-    environment.systemPackages = with pkgs; [
-      powertop
-    ];
+  environment.systemPackages = with pkgs; [
+    powertop
+  ];
 
-    # amdgpu.abmlevel=3 :: Automatically reduce screen brightness but tweak colors to compensate for power reduction.
-    # pcie_aspm=force pcie_aspm.policy=powersupersave :: Enable PCIe active state power management for power reduction.
-    # nowatchdog :: Disable watchdog for power savings (related to disable_sp5100_watchdog above).
-    # amd_pstate=passive :: Fully automated hardware pstate control.
-    # amd_pstate=active :: Same as passive except we can set the energy performance preference (EPP) to suggest how much we prefer performance or energy efficiency.
-    # amd_pstate=guided :: Same as passive except we can set upper and lower frequency bounds.
-    # amdgpu.dcdebugmask=0x10 :: Allegedly disables Panel Replay from https://community.frame.work/t/tracking-freezing-arch-linux-amd/39495/32
-    boot.kernelParams = [
-      "amdgpu.abmlevel=2"
-      "pcie_aspm=force"
-      # "pcie_aspm.policy=powersupersave"
-      "nowatchdog"
-      # I don't see a measurable benefit from these two:
-      # "cpufreq.default_governor=powersave"
-      # "initcall_blacklist=cpufreq_gov_userspace_init"
-    ];
+  # amdgpu.abmlevel=3 :: Automatically reduce screen brightness but tweak colors to compensate for power reduction.
+  # pcie_aspm=force pcie_aspm.policy=powersupersave :: Enable PCIe active state power management for power reduction.
+  # nowatchdog :: Disable watchdog for power savings (related to disable_sp5100_watchdog above).
+  # amd_pstate=passive :: Fully automated hardware pstate control.
+  # amd_pstate=active :: Same as passive except we can set the energy performance preference (EPP) to suggest how much we prefer performance or energy efficiency.
+  # amd_pstate=guided :: Same as passive except we can set upper and lower frequency bounds.
+  # amdgpu.dcdebugmask=0x10 :: Allegedly disables Panel Replay from https://community.frame.work/t/tracking-freezing-arch-linux-amd/39495/32
+  boot.kernelParams = [
+    "amdgpu.abmlevel=3"
+    "pcie_aspm=force"
+    # "pcie_aspm.policy=powersupersave"
+    "nowatchdog"
+    # I don't see a measurable benefit from these two:
+    # "cpufreq.default_governor=powersave"
+    # "initcall_blacklist=cpufreq_gov_userspace_init"
+  ];
 
-    systemd.tmpfiles.rules = [
-      "w- /sys/firmware/acpi/platform_profile - - - - low-power"
-      "w- /sys/devices/system/cpu/cpufreq/policy0/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy1/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy2/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy3/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy4/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy5/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy6/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy7/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy8/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy9/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy10/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy11/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy12/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy13/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy14/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy15/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpu0/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu1/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu2/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu3/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu4/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu5/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu6/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu7/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu8/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu9/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu10/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu11/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu12/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu13/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu14/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu15/cpufreq/boost - - - - 0"
-    ];
+  systemd.tmpfiles.rules = [
+    "w- /sys/firmware/acpi/platform_profile - - - - low-power"
+    "w- /sys/devices/system/cpu/cpufreq/policy0/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy1/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy2/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy3/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy4/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy5/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy6/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy7/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy8/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy9/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy10/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy11/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy12/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy13/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy14/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy15/energy_performance_preference - - - - power"
+  ];
 
-    boot.extraModprobeConfig = ''
-      # Disable the hardware watchdog inside AMD 700 chipset series for power savings.
-      blacklist sp5100_tco
+  boot.extraModprobeConfig = ''
+    # Disable the hardware watchdog inside AMD 700 chipset series for power savings.
+    blacklist sp5100_tco
 
-      # Sound power-saving was causing chat notifications to be inaudible.
-      # options snd_hda_intel power_save=1
-    '';
-  };
+    # Sound power-saving was causing chat notifications to be inaudible.
+    # options snd_hda_intel power_save=1
+  '';
 }

nix/configuration/hosts/odo/screen_brightness.nix

@@ -1,9 +1,14 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
 {
   imports = [ ];
 
-  config = {
-    systemd.tmpfiles.rules = [
-      "w- /sys/class/backlight/amdgpu_bl1/brightness - - - - 32767"
-    ];
-  };
+  systemd.tmpfiles.rules = [
+    "w- /sys/class/backlight/amdgpu_bl1/brightness - - - - 85"
+  ];
 }

nix/configuration/hosts/odo/wifi.nix

@@ -1,7 +1,19 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
 {
   imports = [ ];
 
   config = {
+    # Doesn't seem necessary starting with 6.13
+    # environment.loginShellInit = lib.mkIf (!config.me.buildingIso) ''
+    #   doas iw dev wlan0 set power_save off
+    # '';
+
     # Enable debug logging for ath12k wifi card.
     boot.kernelParams = [
       "ath12k.debug_mask=0xffffffff"

nix/configuration/hosts/odo/wrapped-disk-config.nix

@@ -1,7 +1,8 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
 
-lib.mkIf (!config.me.buildingPortable) (import ./disk-config.nix)
+lib.mkIf (!config.me.buildingIso) (import ./disk-config.nix)

nix/configuration/hosts/odowork/DEPLOY_BOOT

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-TARGET=odowork
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-
-nixos-rebuild boot --flake "$DIR/../../#odowork" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/odowork/DEPLOY_SWITCH

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-TARGET=odowork
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-
-nixos-rebuild switch --flake "$DIR/../../#odowork" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/odowork/SELF_BOOT

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odowork" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/odowork/SELF_BUILD

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odowork" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/odowork/SELF_SWITCH

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odowork" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/odowork/default.nix

@@ -1,152 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  imports = [
-    ./hardware-configuration.nix
-    ./wrapped-disk-config.nix
-    ./distributed_build.nix
-    ./power_management.nix
-    ./screen_brightness.nix
-    ./wifi.nix
-    ./framework_module.nix
-  ];
-
-  config = {
-    # Generate with `head -c4 /dev/urandom | od -A none -t x4`
-    networking.hostId = "133cb66e";
-
-    networking.hostName = "odowork"; # Define your hostname.
-
-    time.timeZone = "America/New_York";
-    i18n.defaultLocale = "en_US.UTF-8";
-
-    me.boot.enable = true;
-    me.boot.secure = false;
-    me.mountPersistence = true;
-
-    # Toggle to start writing the extlinux config which will be used by zfsbootmenu
-    # boot.loader.generic-extlinux-compatible.enable = true;
-    # boot.loader.systemd-boot.enable = lib.mkForce false;
-
-    me.optimizations = {
-      enable = true;
-      arch = "znver4";
-      # build_arch = "x86-64-v3";
-      system_features = [
-        "gccarch-znver4"
-        "gccarch-skylake"
-        "gccarch-kabylake"
-        # "gccarch-alderlake" missing WAITPKG
-        "gccarch-x86-64-v3"
-        "gccarch-x86-64-v4"
-        "benchmark"
-        "big-parallel"
-        "kvm"
-        "nixos-test"
-      ];
-    };
-
-    # Early KMS
-    boot.initrd.kernelModules = [ "amdgpu" ];
-
-    # Mount tmpfs at /tmp
-    boot.tmp.useTmpfs = true;
-
-    environment.systemPackages = with pkgs; [
-      fw-ectool
-      framework-tool
-    ];
-
-    # Enable light sensor
-    # hardware.sensor.iio.enable = lib.mkDefault true;
-
-    # Enable TRIM
-    # services.fstrim.enable = lib.mkDefault true;
-
-    me.alacritty.enable = true;
-    me.amd_s2idle.enable = true;
-    me.ansible.enable = true;
-    me.ares.enable = true;
-    me.base.enable = true;
-    me.bluetooth.enable = true;
-    me.build_in_ram.enable = true;
-    me.chromecast.enable = true;
-    me.chromium.enable = true;
-    me.d2.enable = true;
-    me.direnv.enable = true;
-    me.doas.enable = true;
-    me.docker.enable = false;
-    me.dont_use_substituters.enable = true;
-    me.ecc.enable = false;
-    me.emacs_flavor = "full";
-    me.emulate_isa.enable = true;
-    me.firefox.enable = true;
-    me.firewall.enable = true;
-    me.flux.enable = true;
-    me.font.enable = true;
-    me.gcloud.enable = true;
-    me.git.config = ../../roles/git/files/gitconfig_home;
-    me.git.enable = true;
-    me.gnuplot.enable = true;
-    me.gpg.enable = true;
-    me.graphical = true;
-    me.graphics_card_type = "amd";
-    me.iso_mount.enable = true;
-    me.jujutsu.enable = true;
-    me.kanshi.enable = false;
-    me.kubernetes.enable = true;
-    me.latex.enable = true;
-    me.launch_keyboard.enable = true;
-    me.lvfs.enable = true;
-    me.media.enable = true;
-    me.memtest.enable = true;
-    me.network.enable = true;
-    me.nix_index.enable = true;
-    me.nvme.enable = true;
-    me.openpgp_card_tools.enable = true;
-    me.pcsx2.enable = true;
-    me.podman.enable = true;
-    me.python.enable = true;
-    me.qemu.enable = true;
-    me.recovery.enable = true;
-    me.rpcs3.enable = true;
-    me.rust.enable = true;
-    me.sequoia.enable = true;
-    me.shadps4.enable = false;
-    me.shikane.enable = true;
-    me.sops.enable = true;
-    me.sound.enable = true;
-    me.spaghettikart.enable = true;
-    me.ssh.enable = true;
-    me.sshd.enable = true;
-    me.steam.enable = true;
-    me.steam_run_free.enable = true;
-    me.sway.enable = true;
-    me.tekton.enable = true;
-    me.terraform.enable = true;
-    me.thunderbolt.enable = true;
-    me.user.enable = true;
-    me.uutils.enable = false;
-    me.vnc_client.enable = true;
-    me.vscode.enable = true;
-    me.wasm.enable = true;
-    me.waybar.enable = true;
-    me.wine.enable = false;
-    me.wireguard.activated = [
-      "wgh"
-    ];
-    me.wireguard.deactivated = [ "wgf" ];
-    me.yubikey.enable = true;
-    me.zfs.enable = true;
-    me.zrepl.enable = true;
-    me.zsh.enable = true;
-
-    me.sm64ex.enable = true;
-    me.shipwright.enable = true;
-    me.ship2harkinian.enable = true;
-  };
-}

nix/configuration/hosts/odowork/disk-config.nix

@@ -1,155 +0,0 @@
-# Manual Step:
-#   Check if drive supports 4kn: nvme id-ns -H /dev/nvme0n1
-#   Format the drive to 4kn: nvme format --lbaf=1 /dev/nvme0n1
-
-{
-  disko.devices = {
-    disk = {
-      main = {
-        type = "disk";
-        device = "/dev/nvme0n1";
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/efi";
-                mountOptions = [
-                  "umask=0077"
-                  "noatime"
-                  "discard"
-                ];
-              };
-            };
-            zfs = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-          };
-        };
-      };
-    };
-    zpool = {
-      zroot = {
-        type = "zpool";
-        # mode = "mirror";
-        # Workaround: cannot import 'zroot': I/O error in disko tests
-        options.cachefile = "none";
-        options = {
-          ashift = "12";
-          compatibility = "openzfs-2.2-freebsd";
-          autotrim = "on";
-        };
-        rootFsOptions = {
-          acltype = "posixacl";
-          atime = "off";
-          relatime = "off";
-          xattr = "sa";
-          mountpoint = "none";
-          compression = "lz4";
-          canmount = "off";
-          utf8only = "on";
-          dnodesize = "auto";
-          normalization = "formD";
-        };
-
-        datasets = {
-          "linux/nixwork" = {
-            type = "zfs_fs";
-            options.mountpoint = "none";
-            options = {
-              encryption = "aes-256-gcm";
-              keyformat = "passphrase";
-              # keylocation = "file:///tmp/secret.key";
-            };
-          };
-          "linux/nixwork/root" = {
-            type = "zfs_fs";
-            options.mountpoint = "legacy";
-            mountpoint = "/";
-            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nixwork/root@blank$' || zfs snapshot zroot/linux/nixwork/root@blank";
-          };
-          "linux/nixwork/boot" = {
-            type = "zfs_fs";
-            options = {
-              mountpoint = "legacy";
-              "org.zfsbootmenu:active" = "on";
-            };
-            mountpoint = "/boot";
-            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nixwork/boot@blank$' || zfs snapshot zroot/linux/nixwork/boot@blank";
-          };
-          "linux/nixwork/nix" = {
-            type = "zfs_fs";
-            options.mountpoint = "legacy";
-            mountpoint = "/nix";
-            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nixwork/nix@blank$' || zfs snapshot zroot/linux/nixwork/nix@blank";
-            options = {
-              recordsize = "16MiB";
-              compression = "zstd-19";
-            };
-          };
-          "linux/nixwork/home" = {
-            type = "zfs_fs";
-            options.mountpoint = "legacy";
-            mountpoint = "/home";
-            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nixwork/home@blank$' || zfs snapshot zroot/linux/nixwork/home@blank";
-          };
-          "linux/nixwork/persist" = {
-            type = "zfs_fs";
-            options.mountpoint = "legacy";
-            mountpoint = "/persist";
-            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nixwork/persist@blank$' || zfs snapshot zroot/linux/nixwork/persist@blank";
-          };
-          "linux/nixwork/state" = {
-            type = "zfs_fs";
-            options.mountpoint = "legacy";
-            mountpoint = "/state";
-            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nixwork/state@blank$' || zfs snapshot zroot/linux/nixwork/state@blank";
-          };
-        };
-      };
-    };
-  };
-
-  # Make sure all persistent volumes are marked as neededForBoot
-  #
-  # Also mounts /home so it is mounted before the user home directories are created.
-  fileSystems."/persist".neededForBoot = true;
-  fileSystems."/state".neededForBoot = true;
-  fileSystems."/home".neededForBoot = true;
-
-  fileSystems."/".options = [
-    "noatime"
-    "norelatime"
-  ];
-  fileSystems."/boot".options = [
-    "noatime"
-    "norelatime"
-  ];
-  fileSystems."/nix".options = [
-    "noatime"
-    "norelatime"
-  ];
-  fileSystems."/persist".options = [
-    "noatime"
-    "norelatime"
-  ];
-  fileSystems."/state".options = [
-    "noatime"
-    "norelatime"
-  ];
-  fileSystems."/home".options = [
-    "noatime"
-    "norelatime"
-  ];
-
-  # Only attempt to decrypt the main pool. Otherwise it attempts to decrypt pools that aren't even used.
-  boot.zfs.requestEncryptionCredentials = [ "zroot/linux/nixwork" ];
-}

nix/configuration/hosts/odowork/distributed_build.nix

@@ -1,19 +0,0 @@
-{
-  imports = [ ];
-
-  config = {
-    me.distributed_build.enable = true;
-    me.distributed_build.machines.hydra = {
-      enable = true;
-      additional_config = {
-        speedFactor = 2;
-      };
-    };
-    me.distributed_build.machines.quark = {
-      enable = true;
-      additional_config = {
-        speedFactor = 2;
-      };
-    };
-  };
-}

nix/configuration/hosts/odowork/framework_module.nix

@@ -1,19 +0,0 @@
-{
-  config,
-  ...
-}:
-
-{
-  imports = [ ];
-
-  config = {
-    boot.extraModulePackages = with config.boot.kernelPackages; [
-      framework-laptop-kmod
-    ];
-    # https://github.com/DHowett/framework-laptop-kmod?tab=readme-ov-file#usage
-    boot.kernelModules = [
-      "cros_ec"
-      "cros_ec_lpcs"
-    ];
-  };
-}

nix/configuration/hosts/odowork/hardware-configuration.nix

@@ -1,34 +0,0 @@
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  config = {
-    boot.initrd.availableKernelModules = [
-      "nvme"
-      "xhci_pci"
-      "thunderbolt"
-    ];
-    boot.initrd.kernelModules = [ ];
-    boot.kernelModules = [ ];
-    boot.extraModulePackages = [ ];
-
-    # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-    # (the default) this is the recommended approach. When using systemd-networkd it's
-    # still possible to use this option, but it's recommended to use it in conjunction
-    # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-    # networking.useDHCP = lib.mkDefault true;
-    # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-    # networking.interfaces.wlp58s0.useDHCP = lib.mkDefault true;
-
-    nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-    hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-  };
-}

nix/configuration/hosts/odowork/power_management.nix

@@ -1,75 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-
-{
-  imports = [ ];
-
-  config = {
-    environment.systemPackages = with pkgs; [
-      powertop
-    ];
-
-    # amdgpu.abmlevel=3 :: Automatically reduce screen brightness but tweak colors to compensate for power reduction.
-    # pcie_aspm=force pcie_aspm.policy=powersupersave :: Enable PCIe active state power management for power reduction.
-    # nowatchdog :: Disable watchdog for power savings (related to disable_sp5100_watchdog above).
-    # amd_pstate=passive :: Fully automated hardware pstate control.
-    # amd_pstate=active :: Same as passive except we can set the energy performance preference (EPP) to suggest how much we prefer performance or energy efficiency.
-    # amd_pstate=guided :: Same as passive except we can set upper and lower frequency bounds.
-    # amdgpu.dcdebugmask=0x10 :: Allegedly disables Panel Replay from https://community.frame.work/t/tracking-freezing-arch-linux-amd/39495/32
-    boot.kernelParams = [
-      "amdgpu.abmlevel=2"
-      "pcie_aspm=force"
-      # "pcie_aspm.policy=powersupersave"
-      "nowatchdog"
-      # I don't see a measurable benefit from these two:
-      # "cpufreq.default_governor=powersave"
-      # "initcall_blacklist=cpufreq_gov_userspace_init"
-    ];
-
-    systemd.tmpfiles.rules = [
-      "w- /sys/firmware/acpi/platform_profile - - - - low-power"
-      "w- /sys/devices/system/cpu/cpufreq/policy0/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy1/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy2/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy3/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy4/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy5/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy6/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy7/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy8/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy9/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy10/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy11/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy12/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy13/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy14/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpufreq/policy15/energy_performance_preference - - - - power"
-      "w- /sys/devices/system/cpu/cpu0/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu1/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu2/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu3/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu4/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu5/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu6/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu7/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu8/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu9/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu10/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu11/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu12/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu13/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu14/cpufreq/boost - - - - 0"
-      "w- /sys/devices/system/cpu/cpu15/cpufreq/boost - - - - 0"
-    ];
-
-    boot.extraModprobeConfig = ''
-      # Disable the hardware watchdog inside AMD 700 chipset series for power savings.
-      blacklist sp5100_tco
-
-      # Sound power-saving was causing chat notifications to be inaudible.
-      # options snd_hda_intel power_save=1
-    '';
-  };
-}

nix/configuration/hosts/odowork/screen_brightness.nix

@@ -1,9 +0,0 @@
-{
-  imports = [ ];
-
-  config = {
-    systemd.tmpfiles.rules = [
-      "w- /sys/class/backlight/amdgpu_bl1/brightness - - - - 32767"
-    ];
-  };
-}

nix/configuration/hosts/odowork/wifi.nix

@@ -1,10 +0,0 @@
-{
-  imports = [ ];
-
-  config = {
-    # Enable debug logging for ath12k wifi card.
-    boot.kernelParams = [
-      "ath12k.debug_mask=0xffffffff"
-    ];
-  };
-}

nix/configuration/hosts/odowork/wrapped-disk-config.nix

@@ -1,7 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-
-lib.mkIf (!config.me.buildingPortable) (import ./disk-config.nix)

nix/configuration/hosts/quark/DEPLOY_BOOT

@@ -6,8 +6,14 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
+#TARGET=10.216.1.15
+# TARGET=192.168.211.250
 TARGET=quark
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild boot --flake "$DIR/../../#quark" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --flake "$DIR/../../#quark" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+
+# rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild boot --flake /persist/manual/configuration#quark'

nix/configuration/hosts/quark/DEPLOY_SWITCH

@@ -6,8 +6,14 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
+#TARGET=10.216.1.14
+# TARGET=192.168.211.250
 TARGET=quark
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild switch --flake "$DIR/../../#quark" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --flake "$DIR/../../#quark" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+
+# rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild switch --flake /persist/manual/configuration#quark'

nix/configuration/hosts/quark/ISO

@@ -6,5 +6,7 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#quark.iso" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#iso.quark" --max-jobs "$JOBS" "${@}" |& nom

nix/configuration/hosts/quark/SELF_BOOT

@@ -6,5 +6,7 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild boot --show-trace --use-remote-sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" "${@}" |& nom

nix/configuration/hosts/quark/SELF_BUILD

@@ -6,5 +6,7 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild build --show-trace --use-remote-sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" "${@}" |& nom

nix/configuration/hosts/quark/SELF_SWITCH

@@ -6,5 +6,7 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" --log-format internal-json -v "${@}" |& nom --json
+nixos-rebuild switch --show-trace --use-remote-sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" "${@}" |& nom

nix/configuration/hosts/quark/default.nix

@@ -6,11 +6,11 @@
 }:
 {
   imports = [
-    ./wrapped-disk-config.nix
+    ./disk-config.nix
     ./distributed_build.nix
     ./hardware-configuration.nix
     ./power_management.nix
-    ./waybar.nix
+    ./wifi.nix
   ];
 
   config = {
@@ -22,23 +22,15 @@
     time.timeZone = "America/New_York";
     i18n.defaultLocale = "en_US.UTF-8";
 
-    me.boot.enable = true;
-    me.boot.secure = false;
-    me.mountPersistence = true;
-
-    # Toggle to start writing the extlinux config which will be used by zfsbootmenu
-    boot.loader.generic-extlinux-compatible.enable = true;
-    boot.loader.systemd-boot.enable = lib.mkForce false;
+    me.secureBoot.enable = true;
 
     me.optimizations = {
       enable = true;
-      arch = "znver4";
-      # build_arch = "x86-64-v3";
+      arch = "znver5";
       system_features = [
         "gccarch-znver4"
         "gccarch-znver5"
         "gccarch-skylake"
-        "gccarch-kabylake"
         # "gccarch-alderlake" missing WAITPKG
         "gccarch-x86-64-v3"
         "gccarch-x86-64-v4"
@@ -62,83 +54,55 @@
     me.rpcs3.config.Core."Use LLVM CPU" = "znver4";
 
     me.alacritty.enable = true;
-    me.amd_s2idle.enable = true;
     me.ansible.enable = true;
     me.ares.enable = true;
-    me.base.enable = true;
     me.bluetooth.enable = true;
-    me.build_in_ram.enable = true;
     me.chromecast.enable = true;
     me.chromium.enable = true;
-    me.d2.enable = true;
-    me.direnv.enable = true;
-    me.doas.enable = true;
-    me.docker.enable = false;
-    me.dont_use_substituters.enable = true;
+    me.docker.enable = true;
     me.ecc.enable = true;
     me.emacs_flavor = "full";
-    me.emulate_isa.enable = true;
     me.firefox.enable = true;
-    me.firewall.enable = true;
     me.flux.enable = true;
-    me.font.enable = true;
     me.gcloud.enable = true;
     me.git.config = ../../roles/git/files/gitconfig_home;
-    me.git.enable = true;
     me.gnuplot.enable = true;
     me.gpg.enable = true;
     me.graphical = true;
     me.graphics_card_type = "amd";
     me.iso_mount.enable = true;
-    me.jujutsu.enable = true;
     me.kanshi.enable = false;
     me.kubernetes.enable = true;
     me.latex.enable = true;
     me.launch_keyboard.enable = true;
     me.lvfs.enable = true;
     me.media.enable = true;
-    me.memtest.enable = true;
-    me.network.enable = true;
     me.nix_index.enable = true;
     me.nix_worker.enable = true;
-    me.nvme.enable = true;
-    me.openpgp_card_tools.enable = true;
     me.pcsx2.enable = true;
-    me.podman.enable = true;
     me.python.enable = true;
     me.qemu.enable = true;
-    me.recovery.enable = true;
-    me.rpcs3.enable = false;
+    me.rpcs3.enable = true;
     me.rust.enable = true;
-    me.sequoia.enable = true;
-    me.shadps4.enable = false;
     me.shikane.enable = true;
     me.sops.enable = true;
     me.sound.enable = true;
-    me.spaghettikart.enable = true;
-    me.ssh.enable = true;
-    me.sshd.enable = true;
     me.steam.enable = true;
     me.steam_run_free.enable = true;
     me.sway.enable = true;
     me.tekton.enable = true;
     me.terraform.enable = true;
     me.thunderbolt.enable = true;
-    me.user.enable = true;
-    me.uutils.enable = false;
     me.vnc_client.enable = true;
     me.vscode.enable = true;
     me.wasm.enable = true;
     me.waybar.enable = true;
-    me.wine.enable = false;
     me.wireguard.activated = [
       "drmario"
       "wgh"
       "colo"
     ];
     me.wireguard.deactivated = [ "wgf" ];
-    me.yubikey.enable = true;
-    me.zfs.enable = true;
     me.zrepl.enable = true;
     me.zsh.enable = true;
 

nix/configuration/hosts/quark/disk-config.nix

@@ -2,6 +2,13 @@
 #   Check if drive supports 4kn: nvme id-ns -H /dev/nvme0n1
 #   Format the drive to 4kn: nvme format --lbaf=1 /dev/nvme0n1
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+lib.mkIf (!config.me.buildingIso) {
   disko.devices = {
     disk = {
       main = {
@@ -16,7 +23,7 @@
               content = {
                 type = "filesystem";
                 format = "vfat";
-                mountpoint = "/efi";
+                mountpoint = "/boot";
                 mountOptions = [
                   "umask=0077"
                   "noatime"

nix/configuration/hosts/quark/distributed_build.nix

@@ -1,13 +1,21 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 {
   imports = [ ];
 
-  config = {
-    me.distributed_build.enable = true;
-    me.distributed_build.machines.hydra = {
-      enable = true;
-      additional_config = {
-        speedFactor = 2;
+  config = lib.mkMerge [
+    {
+      me.distributed_build.enable = true;
+      me.distributed_build.machines.hydra = {
+        enable = true;
+        additional_config = {
+          speedFactor = 2;
+        };
       };
-    };
-  };
+    }
+  ];
 }

nix/configuration/hosts/quark/hardware-configuration.nix

@@ -1,6 +1,10 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
 {
   config,
   lib,
+  pkgs,
   modulesPath,
   ...
 }:
@@ -10,24 +14,22 @@
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  config = {
-    boot.initrd.availableKernelModules = [
-      "nvme"
-      "xhci_pci"
-      "thunderbolt"
-    ];
-    boot.initrd.kernelModules = [ ];
-    boot.kernelModules = [ ];
-    boot.extraModulePackages = [ ];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "thunderbolt"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
 
-    # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-    # (the default) this is the recommended approach. When using systemd-networkd it's
-    # still possible to use this option, but it's recommended to use it in conjunction
-    # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-    # networking.useDHCP = lib.mkDefault true;
-    # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-    # networking.interfaces.wlp58s0.useDHCP = lib.mkDefault true;
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  # networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp58s0.useDHCP = lib.mkDefault true;
 
-    hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-  };
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

nix/configuration/hosts/quark/power_management.nix

@@ -8,43 +8,41 @@
 {
   imports = [ ];
 
-  config = {
-    environment.systemPackages = with pkgs; [
-      powertop
-    ];
+  environment.systemPackages = with pkgs; [
+    powertop
+  ];
 
-    boot.kernelParams = [
-      # Enable undervolting GPU.
-      # "amdgpu.ppfeaturemask=0xfff7ffff"
-    ];
+  boot.kernelParams = [
+    # Enable undervolting GPU.
+    # "amdgpu.ppfeaturemask=0xfff7ffff"
+  ];
 
-    systemd.tmpfiles.rules = [
-      # "w- /sys/devices/system/cpu/cpufreq/policy0/energy_performance_preference - - - - power"
-      # "w- /sys/devices/system/cpu/cpufreq/policy1/energy_performance_preference - - - - power"
-      # "w- /sys/devices/system/cpu/cpufreq/policy2/energy_performance_preference - - - - power"
-      # "w- /sys/devices/system/cpu/cpufreq/policy3/energy_performance_preference - - - - power"
-      # "w- /sys/devices/system/cpu/cpufreq/policy4/energy_performance_preference - - - - power"
-      # "w- /sys/devices/system/cpu/cpufreq/policy5/energy_performance_preference - - - - power"
-      # "w- /sys/devices/system/cpu/cpufreq/policy6/energy_performance_preference - - - - power"
-      # "w- /sys/devices/system/cpu/cpufreq/policy7/energy_performance_preference - - - - power"
-      # "w- /sys/devices/system/cpu/cpufreq/policy8/energy_performance_preference - - - - power"
-      # "w- /sys/devices/system/cpu/cpufreq/policy9/energy_performance_preference - - - - power"
-      # "w- /sys/devices/system/cpu/cpufreq/policy10/energy_performance_preference - - - - power"
-      # "w- /sys/devices/system/cpu/cpufreq/policy11/energy_performance_preference - - - - power"
-      # "w- /sys/devices/system/cpu/cpufreq/policy12/energy_performance_preference - - - - power"
-      # "w- /sys/devices/system/cpu/cpufreq/policy13/energy_performance_preference - - - - power"
-      # "w- /sys/devices/system/cpu/cpufreq/policy14/energy_performance_preference - - - - power"
-      # "w- /sys/devices/system/cpu/cpufreq/policy15/energy_performance_preference - - - - power"
-    ];
+  systemd.tmpfiles.rules = [
+    # "w- /sys/devices/system/cpu/cpufreq/policy0/energy_performance_preference - - - - power"
+    # "w- /sys/devices/system/cpu/cpufreq/policy1/energy_performance_preference - - - - power"
+    # "w- /sys/devices/system/cpu/cpufreq/policy2/energy_performance_preference - - - - power"
+    # "w- /sys/devices/system/cpu/cpufreq/policy3/energy_performance_preference - - - - power"
+    # "w- /sys/devices/system/cpu/cpufreq/policy4/energy_performance_preference - - - - power"
+    # "w- /sys/devices/system/cpu/cpufreq/policy5/energy_performance_preference - - - - power"
+    # "w- /sys/devices/system/cpu/cpufreq/policy6/energy_performance_preference - - - - power"
+    # "w- /sys/devices/system/cpu/cpufreq/policy7/energy_performance_preference - - - - power"
+    # "w- /sys/devices/system/cpu/cpufreq/policy8/energy_performance_preference - - - - power"
+    # "w- /sys/devices/system/cpu/cpufreq/policy9/energy_performance_preference - - - - power"
+    # "w- /sys/devices/system/cpu/cpufreq/policy10/energy_performance_preference - - - - power"
+    # "w- /sys/devices/system/cpu/cpufreq/policy11/energy_performance_preference - - - - power"
+    # "w- /sys/devices/system/cpu/cpufreq/policy12/energy_performance_preference - - - - power"
+    # "w- /sys/devices/system/cpu/cpufreq/policy13/energy_performance_preference - - - - power"
+    # "w- /sys/devices/system/cpu/cpufreq/policy14/energy_performance_preference - - - - power"
+    # "w- /sys/devices/system/cpu/cpufreq/policy15/energy_performance_preference - - - - power"
+  ];
 
-    # services.udev.packages = [
-    #   (pkgs.writeTextFile {
-    #     name = "amdgpu-low-power";
-    #     text = ''
-    #       ACTION=="add", SUBSYSTEM=="drm", DRIVERS=="amdgpu", ATTR{device/power_dpm_force_performance_level}="low"
-    #     '';
-    #     destination = "/etc/udev/rules.d/30-amdgpu-low-power.rules";
-    #   })
-    # ];
-  };
+  # services.udev.packages = [
+  #   (pkgs.writeTextFile {
+  #     name = "amdgpu-low-power";
+  #     text = ''
+  #       ACTION=="add", SUBSYSTEM=="drm", DRIVERS=="amdgpu", ATTR{device/power_dpm_force_performance_level}="low"
+  #     '';
+  #     destination = "/etc/udev/rules.d/30-amdgpu-low-power.rules";
+  #   })
+  # ];
 }

nix/configuration/hosts/quark/waybar.nix

@@ -1,75 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  imports = [ ];
-
-  config = {
-    me.waybar.config = lib.mkForce {
-      # "height": 10, # Waybar height (to be removed for auto height)
-      "modules-left" = [
-        "sway/workspaces"
-        "sway/mode"
-      ];
-      "modules-center" = [ "sway/window" ];
-      "modules-right" = [
-        "custom/night_mode"
-        # "custom/temperature" # /sys/class/thermal/thermal_zone* does not currently exist on quark
-        "custom/sound"
-        "custom/available_memory"
-        "idle_inhibitor"
-        "custom/clock"
-        "tray"
-      ];
-      "sway/workspaces" = {
-        "disable-scroll" = true;
-      };
-      "sway/mode" = {
-        "format" = "<span style=\"italic\">{}</span>";
-      };
-      "sway/window" = {
-        "format" = "{title}";
-      };
-      "idle_inhibitor" = {
-        "format" = "{icon}";
-        "format-icons" = {
-          "activated" = "☕"; # ☕
-          "deactivated" = "💤"; # ☾☁⛾⛔⏾⌛⏳💤
-        };
-      };
-      "tray" = {
-        # "icon-size" = 21;
-        "spacing" = 10;
-      };
-      "custom/clock" = {
-        "exec" = "waybar_custom_clock";
-        "return-type" = "json";
-        "restart-interval" = 30;
-      };
-      "custom/available_memory" = {
-        "exec" = "waybar_custom_available_memory";
-        "return-type" = "json";
-        "restart-interval" = 30;
-      };
-      "custom/sound" = {
-        "exec" = "waybar_custom_sound";
-        "return-type" = "json";
-        "restart-interval" = 30;
-      };
-      # "custom/temperature" = {
-      #   "exec" = "waybar_custom_temperature";
-      #   "return-type" = "json";
-      #   "restart-interval" = 30;
-      # };
-      "custom/night_mode" = {
-        "exec" = "waybar_night_mode";
-        "return-type" = "json";
-        "restart-interval" = 30;
-        "on-click" = "pkill -USR1 -f waybar_night_mode";
-      };
-    };
-  };
-}

nix/configuration/hosts/quark/wifi.nix

@@ -0,0 +1,16 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  config = {
+    environment.loginShellInit = lib.mkIf (!config.me.buildingIso) ''
+      doas iw dev wlan0 set power_save off
+    '';
+  };
+}

nix/configuration/hosts/quark/wrapped-disk-config.nix

@@ -1,7 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-
-lib.mkIf (!config.me.buildingPortable) (import ./disk-config.nix)

nix/configuration/hosts/recovery/DEPLOY_BOOT

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-TARGET=recovery
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-
-nixos-rebuild boot --flake "$DIR/../../#recovery" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/recovery/DEPLOY_SWITCH

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-TARGET=recovery
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-
-nixos-rebuild switch --flake "$DIR/../../#recovery" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/recovery/ISO

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#recovery.iso" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/recovery/SELF_BOOT

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#recovery" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/recovery/SELF_BUILD

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#recovery" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/recovery/SELF_SWITCH

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#recovery" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/recovery/default.nix

@@ -1,56 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  imports = [
-    ./hardware-configuration.nix
-    ./wrapped-disk-config.nix
-    ./distributed_build.nix
-    ./power_management.nix
-  ];
-
-  config = {
-    # Generate with `head -c4 /dev/urandom | od -A none -t x4`
-    networking.hostId = "46b62d92";
-
-    networking.hostName = "recovery"; # Define your hostname.
-
-    time.timeZone = "America/New_York";
-    i18n.defaultLocale = "en_US.UTF-8";
-
-    me.boot.enable = true;
-    me.boot.secure = true;
-    me.mountPersistence = true;
-
-    me.optimizations = {
-      # enable = true;
-      arch = "kabylake";
-      # build_arch = "x86-64-v3";
-      system_features = [
-        "gccarch-kabylake"
-        "gccarch-x86-64-v3"
-        "benchmark"
-        "big-parallel"
-        "kvm"
-        "nixos-test"
-      ];
-    };
-
-    # Early KMS
-    # boot.initrd.kernelModules = [ "amdgpu" ];
-
-    # Mount tmpfs at /tmp
-    boot.tmp.useTmpfs = true;
-
-    # Enable TRIM
-    # services.fstrim.enable = lib.mkDefault true;
-
-    me.build_in_ram.enable = true;
-    me.dont_use_substituters.enable = true;
-    me.minimal_base.enable = true;
-    me.recovery.enable = true;
-  };
-}

nix/configuration/hosts/recovery/distributed_build.nix

@@ -1,19 +0,0 @@
-{
-  imports = [ ];
-
-  config = {
-    me.distributed_build.enable = true;
-    me.distributed_build.machines.hydra = {
-      enable = true;
-      additional_config = {
-        speedFactor = 2;
-      };
-    };
-    me.distributed_build.machines.quark = {
-      enable = true;
-      additional_config = {
-        speedFactor = 2;
-      };
-    };
-  };
-}