Add a build for the yubikey management raspberry pi image.

It is technically a risk and since I build most of my software anyway, I'm not getting much benefit.

ansible/roles/sshd/files/keys/yubikey.pub

@@ -1 +1 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGu+k5lrirokdW5zVdRVBOqEOAvAPlIkG/MdJNc9g5ky cardno:000611194908
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID0+4zi26M3eYWnIrciR54kOlGxzfgCXG+o4ea1zpzrk openpgp:0x7FF123C8

nix/configuration/configuration.nix

@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  home-manager,
   ...
 }:
 
@@ -10,17 +9,20 @@
   imports = [
     ./roles/2ship2harkinian
     ./roles/alacritty
+    ./roles/amd_s2idle
     ./roles/ansible
     ./roles/ares
     ./roles/bluetooth
     ./roles/boot
     ./roles/chromecast
     ./roles/chromium
+    ./roles/d2
     ./roles/direnv
     ./roles/distributed_build
     ./roles/docker
     ./roles/ecc
     ./roles/emacs
+    ./roles/emulate_isa
     ./roles/firefox
     ./roles/firewall
     ./roles/flux
@@ -46,19 +48,23 @@
     ./roles/nix_index
     ./roles/nix_worker
     ./roles/nvme
+    ./roles/openpgp_card_tools
     ./roles/optimized_build
     ./roles/pcsx2
+    ./roles/podman
     ./roles/python
     ./roles/qemu
     ./roles/reset
     ./roles/rpcs3
     ./roles/rust
+    ./roles/sequoia
     ./roles/shadps4
     ./roles/shikane
     ./roles/shipwright
     ./roles/sm64ex
     ./roles/sops
     ./roles/sound
+    ./roles/spaghettikart
     ./roles/ssh
     ./roles/steam
     ./roles/steam_run_free
@@ -66,14 +72,17 @@
     ./roles/tekton
     ./roles/terraform
     ./roles/thunderbolt
+    ./roles/uutils
     ./roles/vnc_client
     ./roles/vscode
     ./roles/wasm
     ./roles/waybar
     ./roles/wireguard
+    ./roles/yubikey
     ./roles/zfs
     ./roles/zrepl
     ./roles/zsh
+    ./util/install_files
     ./util/unfree_polyfill
   ];
 
@@ -93,6 +102,7 @@
   nix.extraOptions = ''
     keep-outputs = true
     keep-derivations = true
+    substitute = false
   '';
 
   # Technically only needed when building the ISO because nix detects ZFS in the filesystem list normally. I basically always want this so I'm just setting it to always be on.
@@ -116,27 +126,12 @@
     # Generate with `mkpasswd -m scrypt`
     hashedPassword = "$7$CU..../....VXvNQ8za3wSGpdzGXNT50/$HcFtn/yvwPMCw4888BelpiAPLAxe/zU87fD.d/N6U48";
     openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGu+k5lrirokdW5zVdRVBOqEOAvAPlIkG/MdJNc9g5ky"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID0+4zi26M3eYWnIrciR54kOlGxzfgCXG+o4ea1zpzrk openpgp:0x7FF123C8"
       "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIEI6mu6I5Jp+Ib0vJxapGHbEShZjyvzV8jz5DnzDrI39AAAABHNzaDo="
       "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIAFNcSXwvy+brYTOGo56G93Ptuq2MmZsjvRWAfMqbmMLAAAABHNzaDo="
     ];
   };
   users.groups.talexander.gid = 11235;
-  home-manager.users.talexander =
-    { pkgs, ... }:
-    {
-      # The state version is required and should stay at the version you
-      # originally installed.
-      home.stateVersion = "24.11";
-    };
-
-  home-manager.users.root =
-    { pkgs, ... }:
-    {
-      # The state version is required and should stay at the version you
-      # originally installed.
-      home.stateVersion = "24.11";
-    };
 
   # Automatic garbage collection
   nix.gc = lib.mkIf (!config.me.buildingIso) {
@@ -148,6 +143,7 @@
     options = "--delete-older-than 30d";
   };
   nix.settings.auto-optimise-store = !config.me.buildingIso;
+  nix.settings.substituters = lib.mkForce [ ];
 
   # Use doas instead of sudo
   security.doas.enable = true;
@@ -182,7 +178,7 @@
     nix-tree
     libarchive # bsdtar
     lsof
-    doas-sudo-shim # To support --use-remote-sudo for remote builds
+    doas-sudo-shim # To support --sudo for remote builds
     dmidecode # Read SMBIOS information.
     ipcalc
     gptfdisk # for cgdisk

nix/configuration/flake.lock

@@ -1,22 +1,5 @@
 {
   "nodes": {
-    "ansible-sshjail": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "path": "flakes/ansible-sshjail",
-        "type": "path"
-      },
-      "original": {
-        "path": "flakes/ansible-sshjail",
-        "type": "path"
-      },
-      "parent": []
-    },
     "crane": {
       "locked": {
         "lastModified": 1731098351,
@@ -39,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750903843,
+        "lastModified": 1758287904,
-        "narHash": "sha256-Ng9+f0H5/dW+mq/XOKvB9uwvGbsuiiO6HrPdAcVglCs=",
+        "narHash": "sha256-IGmaEf3Do8o5Cwp1kXBN1wQmZwQN3NLfq5t4nHtVtcU=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "83c4da299c1d7d300f8c6fd3a72ac46cb0d59aae",
+        "rev": "67ff9807dd148e704baadbd4fd783b54282ca627",
         "type": "github"
       },
       "original": {
@@ -89,42 +72,6 @@
         "type": "github"
       }
     },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_2"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "gitignore": {
       "inputs": {
         "nixpkgs": [
@@ -147,26 +94,6 @@
         "type": "github"
       }
     },
-    "home-manager": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1751549056,
-        "narHash": "sha256-miKaJ4SFNxhZ/WVDADae2jNd9zka5bV9hKmXspAzvxo=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "1fa73bb2cc39e250eb01e511ae6ac83bfbf9f38c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
     "impermanence": {
       "locked": {
         "lastModified": 1737831083,
@@ -210,11 +137,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751271578,
+        "lastModified": 1759381078,
-        "narHash": "sha256-P/SQmKDu06x8yv7i0s8bvnnuJYkxVGBWLWHaU+tt4YY=",
+        "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3016b4b15d13f3089db8a41ef937b13a9e33a8df",
+        "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
         "type": "github"
       },
       "original": {
@@ -258,11 +185,11 @@
     },
     "nixpkgs-unoptimized": {
       "locked": {
-        "lastModified": 1751271578,
+        "lastModified": 1759381078,
-        "narHash": "sha256-P/SQmKDu06x8yv7i0s8bvnnuJYkxVGBWLWHaU+tt4YY=",
+        "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3016b4b15d13f3089db8a41ef937b13a9e33a8df",
+        "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
         "type": "github"
       },
       "original": {
@@ -301,15 +228,12 @@
     },
     "root": {
       "inputs": {
-        "ansible-sshjail": "ansible-sshjail",
         "disko": "disko",
-        "home-manager": "home-manager",
         "impermanence": "impermanence",
         "lanzaboote": "lanzaboote",
         "nixpkgs": "nixpkgs",
         "nixpkgs-dda3dcd3f": "nixpkgs-dda3dcd3f",
-        "nixpkgs-unoptimized": "nixpkgs-unoptimized",
+        "nixpkgs-unoptimized": "nixpkgs-unoptimized"
-        "zsh-histdb": "zsh-histdb"
       }
     },
     "rust-overlay": {
@@ -332,53 +256,6 @@
         "repo": "rust-overlay",
         "type": "github"
       }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "zsh-histdb": {
-      "inputs": {
-        "flake-utils": "flake-utils_2",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "path": "flakes/zsh-histdb",
-        "type": "path"
-      },
-      "original": {
-        "path": "flakes/zsh-histdb",
-        "type": "path"
-      },
-      "parent": []
     }
   },
   "root": "root",

nix/configuration/flake.nix

@@ -31,8 +31,6 @@
 #
 # doas nix --substituters "http://10.0.2.2:8080?trusted=1 https://cache.nixos.org/" --experimental-features "nix-command flakes" run github:nix-community/disko/latest -- --mode destroy,format,mount hosts/odo/disk-config.nix
 
-# nix flake update zsh-histdb --flake .
-# nix flake update ansible-sshjail --flake .
 # for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 # nixos-install --substituters "http://10.0.2.2:8080?trusted=1 https://cache.nixos.org/" --flake ".#vm_ionlybootzfs"
 #
@@ -45,26 +43,12 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     nixpkgs-dda3dcd3f.url = "github:NixOS/nixpkgs/dda3dcd3fe03e991015e9a74b22d35950f264a54";
     nixpkgs-unoptimized.url = "github:NixOS/nixpkgs/nixos-unstable";
-    home-manager.url = "github:nix-community/home-manager";
-    home-manager.inputs.nixpkgs.follows = "nixpkgs";
     lanzaboote = {
       url = "github:nix-community/lanzaboote/v0.4.2";
 
       # Optional but recommended to limit the size of your system closure.
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    zsh-histdb = {
-      url = "path:flakes/zsh-histdb";
-
-      # Optional but recommended to limit the size of your system closure.
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    ansible-sshjail = {
-      url = "path:flakes/ansible-sshjail";
-
-      # Optional but recommended to limit the size of your system closure.
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     disko = {
       url = "github:nix-community/disko";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -78,10 +62,7 @@
       nixpkgs-unoptimized,
       nixpkgs-dda3dcd3f,
       impermanence,
-      home-manager,
       lanzaboote,
-      zsh-histdb,
-      ansible-sshjail,
       ...
     }@inputs:
     let
@@ -99,19 +80,8 @@
         };
         modules = [
           impermanence.nixosModules.impermanence
-          home-manager.nixosModules.home-manager
           lanzaboote.nixosModules.lanzaboote
           inputs.disko.nixosModules.disko
-          {
-            home-manager.useGlobalPkgs = true;
-            home-manager.useUserPackages = true;
-          }
-          {
-            nixpkgs.overlays = [
-              zsh-histdb.overlays.default
-              ansible-sshjail.overlays.default
-            ];
-          }
           ./configuration.nix
         ];
       };
@@ -201,7 +171,7 @@
           };
           hydra =
             let
-              additional_iso_modules = additional_iso_modules ++ [
+              hydra_additional_iso_modules = additional_iso_modules ++ [
                 {
                   me.optimizations.enable = true;
                 }
@@ -214,13 +184,13 @@
                 ];
               };
               iso = main // {
-                modules = main.modules ++ additional_iso_modules;
+                modules = main.modules ++ hydra_additional_iso_modules;
               };
               vm = main // {
                 modules = main.modules ++ additional_vm_modules;
               };
               vm_iso = main // {
-                modules = main.modules ++ additional_vm_modules ++ additional_iso_modules;
+                modules = main.modules ++ additional_vm_modules ++ hydra_additional_iso_modules;
               };
             };
           ionlybootzfs = rec {

nix/configuration/flakes/ansible-sshjail/flake.lock

@@ -1,61 +0,0 @@
-{
-  "nodes": {
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1735141468,
-        "narHash": "sha256-VIAjBr1qGcEbmhLwQJD6TABppPMggzOvqFsqkDoMsAY=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "4005c3ff7505313cbc21081776ad0ce5dfd7a3ce",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-24.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

nix/configuration/flakes/ansible-sshjail/flake.nix

@@ -1,34 +0,0 @@
-{
-  description = "A slightly better history for zsh";
-  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
-  inputs.flake-utils.url = "github:numtide/flake-utils";
-
-  outputs =
-    {
-      self,
-      nixpkgs,
-      flake-utils,
-      ...
-    }:
-    let
-      out =
-        system:
-        let
-          pkgs = nixpkgs.legacyPackages.${system};
-          # Maybe pkgs = import nixpkgs { inherit system; }; ?
-          appliedOverlay = self.overlays.default pkgs pkgs;
-        in
-        {
-          packages = rec {
-            default = ansible-sshjail;
-            ansible-sshjail = appliedOverlay.ansible-sshjail;
-          };
-        };
-    in
-    flake-utils.lib.eachDefaultSystem out
-    // {
-      overlays.default = final: prev: {
-        ansible-sshjail = final.callPackage ./package.nix { };
-      };
-    };
-}

nix/configuration/flakes/zsh-histdb/flake.lock

@@ -1,61 +0,0 @@
-{
-  "nodes": {
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1735141468,
-        "narHash": "sha256-VIAjBr1qGcEbmhLwQJD6TABppPMggzOvqFsqkDoMsAY=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "4005c3ff7505313cbc21081776ad0ce5dfd7a3ce",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-24.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

nix/configuration/flakes/zsh-histdb/flake.nix

@@ -1,34 +0,0 @@
-{
-  description = "A slightly better history for zsh";
-  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
-  inputs.flake-utils.url = "github:numtide/flake-utils";
-
-  outputs =
-    {
-      self,
-      nixpkgs,
-      flake-utils,
-      ...
-    }:
-    let
-      out =
-        system:
-        let
-          pkgs = nixpkgs.legacyPackages.${system};
-          # Maybe pkgs = import nixpkgs { inherit system; }; ?
-          appliedOverlay = self.overlays.default pkgs pkgs;
-        in
-        {
-          packages = rec {
-            default = zsh-histdb;
-            zsh-histdb = appliedOverlay.zsh-histdb;
-          };
-        };
-    in
-    flake-utils.lib.eachDefaultSystem out
-    // {
-      overlays.default = final: prev: {
-        zsh-histdb = final.callPackage ./package.nix { };
-      };
-    };
-}

nix/configuration/hosts/hydra/DEPLOY_BOOT

@@ -10,10 +10,8 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 # TARGET=192.168.211.250
 TARGET=hydra
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild boot --flake "$DIR/../../#hydra" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+nixos-rebuild boot --flake "$DIR/../../#hydra" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
 
 # rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild boot --flake /persist/manual/configuration#hydra'

nix/configuration/hosts/hydra/DEPLOY_SWITCH

@@ -10,10 +10,8 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 # TARGET=192.168.211.250
 TARGET=hydra
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild switch --flake "$DIR/../../#hydra" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+nixos-rebuild switch --flake "$DIR/../../#hydra" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
 
 # rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild switch --flake /persist/manual/configuration#hydra'

nix/configuration/hosts/hydra/ISO

@@ -6,7 +6,5 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#iso.hydra" --max-jobs "$JOBS" "${@}" |& nom
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#iso.hydra" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/hydra/VM_ISO

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+#
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+: "${JOBS:="1"}"
+
+for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#vm_iso.hydra" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
+
+install -m 0644 result/iso/nixos-*-x86_64-linux.iso ~/hydra.iso
+unlink ./result

nix/configuration/hosts/hydra/default.nix

@@ -24,7 +24,6 @@
   imports = [
     ./disk-config.nix
     ./hardware-configuration.nix
-    ./optimized_build.nix
     ./vm_disk.nix
   ];
 

nix/configuration/hosts/ionlybootzfs/DEPLOY_BOOT

@@ -10,10 +10,8 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 # TARGET=192.168.211.250
 TARGET="ionlybootzfs"
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild boot --flake "$DIR/../../#ionlybootzfs" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+nixos-rebuild boot --flake "$DIR/../../#ionlybootzfs" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
 
 # rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild boot --flake /persist/manual/configuration#ionlybootzfs'

nix/configuration/hosts/ionlybootzfs/DEPLOY_SWITCH

@@ -10,10 +10,8 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 # TARGET=192.168.211.250
 TARGET=ionlybootzfs
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild switch --flake "$DIR/../../#ionlybootzfs" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+nixos-rebuild switch --flake "$DIR/../../#ionlybootzfs" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
 
 # rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild switch --flake /persist/manual/configuration#ionlybootzfs'

nix/configuration/hosts/ionlybootzfs/ISO

@@ -6,7 +6,5 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#iso.ionlybootzfs" --max-jobs "$JOBS" "${@}" |& nom
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#iso.ionlybootzfs" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/neelix/DEPLOY_BOOT

@@ -10,10 +10,8 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 # TARGET=192.168.211.250
 TARGET=neelix
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild boot --flake "$DIR/../../#neelix" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+nixos-rebuild boot --flake "$DIR/../../#neelix" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
 
 # rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild boot --flake /persist/manual/configuration#neelix'

nix/configuration/hosts/neelix/DEPLOY_SWITCH

@@ -10,10 +10,8 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 # TARGET=192.168.211.250
 TARGET=neelix
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild switch --flake "$DIR/../../#neelix" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+nixos-rebuild switch --flake "$DIR/../../#neelix" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
 
 # rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild switch --flake /persist/manual/configuration#neelix'

nix/configuration/hosts/odo/DEPLOY_BOOT

@@ -10,10 +10,8 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 # TARGET=192.168.211.250
 TARGET=odo
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild boot --flake "$DIR/../../#odo" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+nixos-rebuild boot --flake "$DIR/../../#odo" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
 
 # rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild boot --flake /persist/manual/configuration#odo'

nix/configuration/hosts/odo/DEPLOY_SWITCH

@@ -10,10 +10,8 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 # TARGET=192.168.211.250
 TARGET=odo
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild switch --flake "$DIR/../../#odo" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+nixos-rebuild switch --flake "$DIR/../../#odo" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
 
 # rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild switch --flake /persist/manual/configuration#odo'

nix/configuration/hosts/odo/ISO

@@ -6,7 +6,5 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#iso.odo" --max-jobs "$JOBS" "${@}" |& nom
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#iso.odo" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/odo/SELF_BOOT

@@ -6,7 +6,5 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild boot --show-trace --use-remote-sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" "${@}" |& nom
+nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/odo/SELF_BUILD

@@ -6,7 +6,5 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild build --show-trace --use-remote-sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" "${@}" |& nom
+nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/odo/SELF_SWITCH

@@ -6,7 +6,5 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild switch --show-trace --use-remote-sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" "${@}" |& nom
+nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/odo/default.nix

@@ -15,104 +15,115 @@
     ./framework_module.nix
   ];
 
-  # Generate with `head -c4 /dev/urandom | od -A none -t x4`
+  config = {
-  networking.hostId = "908cbf04";
+    # Generate with `head -c4 /dev/urandom | od -A none -t x4`
+    networking.hostId = "908cbf04";
 
-  networking.hostName = "odo"; # Define your hostname.
+    networking.hostName = "odo"; # Define your hostname.
 
-  time.timeZone = "America/New_York";
+    time.timeZone = "America/New_York";
-  i18n.defaultLocale = "en_US.UTF-8";
+    i18n.defaultLocale = "en_US.UTF-8";
 
-  me.secureBoot.enable = true;
+    me.secureBoot.enable = true;
 
-  me.optimizations = {
+    me.optimizations = {
-    enable = true;
+      enable = true;
-    arch = "znver4";
+      arch = "znver4";
-    system_features = [
+      system_features = [
-      "gccarch-znver4"
+        "gccarch-znver4"
-      "gccarch-skylake"
+        "gccarch-skylake"
-      # "gccarch-alderlake" missing WAITPKG
+        # "gccarch-alderlake" missing WAITPKG
-      "gccarch-x86-64-v3"
+        "gccarch-x86-64-v3"
-      "gccarch-x86-64-v4"
+        "gccarch-x86-64-v4"
-      "benchmark"
+        "benchmark"
-      "big-parallel"
+        "big-parallel"
-      "kvm"
+        "kvm"
-      "nixos-test"
+        "nixos-test"
+      ];
+    };
+
+    # Early KMS
+    boot.initrd.kernelModules = [ "amdgpu" ];
+
+    # Mount tmpfs at /tmp
+    boot.tmp.useTmpfs = true;
+
+    environment.systemPackages = with pkgs; [
+      fw-ectool
+      framework-tool
     ];
+
+    # Enable light sensor
+    # hardware.sensor.iio.enable = lib.mkDefault true;
+
+    # Enable TRIM
+    # services.fstrim.enable = lib.mkDefault true;
+
+    me.alacritty.enable = true;
+    me.amd_s2idle.enable = true;
+    me.ansible.enable = true;
+    me.ares.enable = true;
+    me.bluetooth.enable = true;
+    me.chromecast.enable = true;
+    me.chromium.enable = true;
+    me.d2.enable = true;
+    me.direnv.enable = true;
+    me.docker.enable = false;
+    me.ecc.enable = false;
+    me.emacs_flavor = "full";
+    me.emulate_isa.enable = true;
+    me.firefox.enable = true;
+    me.flux.enable = true;
+    me.gcloud.enable = true;
+    me.git.config = ../../roles/git/files/gitconfig_home;
+    me.gnuplot.enable = true;
+    me.gpg.enable = true;
+    me.graphical = true;
+    me.graphics_card_type = "amd";
+    me.iso_mount.enable = true;
+    me.kanshi.enable = false;
+    me.kubernetes.enable = true;
+    me.latex.enable = true;
+    me.launch_keyboard.enable = true;
+    me.lvfs.enable = true;
+    me.media.enable = true;
+    me.nix_index.enable = true;
+    me.openpgp_card_tools.enable = true;
+    me.pcsx2.enable = true;
+    me.podman.enable = true;
+    me.python.enable = true;
+    me.qemu.enable = true;
+    me.rpcs3.enable = true;
+    me.rust.enable = true;
+    me.sequoia.enable = true;
+    me.shadps4.enable = true;
+    me.shikane.enable = true;
+    me.sops.enable = true;
+    me.sound.enable = true;
+    me.spaghettikart.enable = true;
+    me.steam.enable = true;
+    me.steam_run_free.enable = true;
+    me.sway.enable = true;
+    me.tekton.enable = true;
+    me.terraform.enable = true;
+    me.thunderbolt.enable = true;
+    me.uutils.enable = false;
+    me.vnc_client.enable = true;
+    me.vscode.enable = true;
+    me.wasm.enable = true;
+    me.waybar.enable = true;
+    me.wireguard.activated = [
+      "drmario"
+      "wgh"
+      "colo"
+    ];
+    me.wireguard.deactivated = [ "wgf" ];
+    me.yubikey.enable = true;
+    me.zrepl.enable = true;
+    me.zsh.enable = true;
+
+    me.sm64ex.enable = true;
+    me.shipwright.enable = true;
+    me.ship2harkinian.enable = true;
   };
-
-  # Early KMS
-  boot.initrd.kernelModules = [ "amdgpu" ];
-
-  # Mount tmpfs at /tmp
-  boot.tmp.useTmpfs = true;
-
-  environment.systemPackages = with pkgs; [
-    fw-ectool
-    framework-tool
-  ];
-
-  # Enable light sensor
-  # hardware.sensor.iio.enable = lib.mkDefault true;
-
-  # Enable TRIM
-  # services.fstrim.enable = lib.mkDefault true;
-
-  me.alacritty.enable = true;
-  me.ansible.enable = true;
-  me.ares.enable = true;
-  me.bluetooth.enable = true;
-  me.chromecast.enable = true;
-  me.chromium.enable = true;
-  me.direnv.enable = true;
-  me.docker.enable = true;
-  me.ecc.enable = true;
-  me.emacs_flavor = "full";
-  me.firefox.enable = true;
-  me.flux.enable = true;
-  me.gcloud.enable = true;
-  me.git.config = ../../roles/git/files/gitconfig_home;
-  me.gnuplot.enable = true;
-  me.gpg.enable = true;
-  me.graphical = true;
-  me.graphics_card_type = "amd";
-  me.iso_mount.enable = true;
-  me.kanshi.enable = false;
-  me.kubernetes.enable = true;
-  me.latex.enable = true;
-  me.launch_keyboard.enable = true;
-  me.lvfs.enable = true;
-  me.media.enable = true;
-  me.nix_index.enable = true;
-  me.pcsx2.enable = true;
-  me.python.enable = true;
-  me.qemu.enable = true;
-  me.rpcs3.enable = true;
-  me.rust.enable = true;
-  me.shadps4.enable = true;
-  me.shikane.enable = true;
-  me.sops.enable = true;
-  me.sound.enable = true;
-  me.steam.enable = true;
-  me.steam_run_free.enable = true;
-  me.sway.enable = true;
-  me.tekton.enable = true;
-  me.terraform.enable = true;
-  me.thunderbolt.enable = true;
-  me.vnc_client.enable = true;
-  me.vscode.enable = true;
-  me.wasm.enable = true;
-  me.waybar.enable = true;
-  me.wireguard.activated = [
-    "drmario"
-    "wgh"
-    "colo"
-  ];
-  me.wireguard.deactivated = [ "wgf" ];
-  me.zrepl.enable = true;
-  me.zsh.enable = true;
-
-  me.sm64ex.enable = true;
-  me.shipwright.enable = true;
-  me.ship2harkinian.enable = true;
 }

nix/configuration/hosts/odo/power_management.nix

@@ -20,7 +20,7 @@
   # amd_pstate=guided :: Same as passive except we can set upper and lower frequency bounds.
   # amdgpu.dcdebugmask=0x10 :: Allegedly disables Panel Replay from https://community.frame.work/t/tracking-freezing-arch-linux-amd/39495/32
   boot.kernelParams = [
-    "amdgpu.abmlevel=3"
+    "amdgpu.abmlevel=2"
     "pcie_aspm=force"
     # "pcie_aspm.policy=powersupersave"
     "nowatchdog"

nix/configuration/hosts/odo/screen_brightness.nix

@@ -9,6 +9,6 @@
   imports = [ ];
 
   systemd.tmpfiles.rules = [
-    "w- /sys/class/backlight/amdgpu_bl1/brightness - - - - 85"
+    "w- /sys/class/backlight/amdgpu_bl1/brightness - - - - 21845"
   ];
 }

nix/configuration/hosts/quark/DEPLOY_BOOT

@@ -10,10 +10,8 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 # TARGET=192.168.211.250
 TARGET=quark
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild boot --flake "$DIR/../../#quark" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+nixos-rebuild boot --flake "$DIR/../../#quark" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
 
 # rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild boot --flake /persist/manual/configuration#quark'

nix/configuration/hosts/quark/DEPLOY_SWITCH

@@ -10,10 +10,8 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 # TARGET=192.168.211.250
 TARGET=quark
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 
-nixos-rebuild switch --flake "$DIR/../../#quark" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+nixos-rebuild switch --flake "$DIR/../../#quark" --target-host "$TARGET" --build-host "$TARGET" --fast --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json
 
 # rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild switch --flake /persist/manual/configuration#quark'

nix/configuration/hosts/quark/ISO

@@ -6,7 +6,5 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#iso.quark" --max-jobs "$JOBS" "${@}" |& nom
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#iso.quark" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/quark/SELF_BOOT

@@ -6,7 +6,5 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild boot --show-trace --use-remote-sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" "${@}" |& nom
+nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/quark/SELF_BUILD

@@ -6,7 +6,5 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild build --show-trace --use-remote-sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" "${@}" |& nom
+nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/quark/SELF_SWITCH

@@ -6,7 +6,5 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
 
-nix flake update zsh-histdb --flake "$DIR/../../"
-nix flake update ansible-sshjail --flake "$DIR/../../"
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild switch --show-trace --use-remote-sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" "${@}" |& nom
+nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" --log-format internal-json -v "${@}" |& nom --json

nix/configuration/hosts/quark/default.nix

@@ -10,7 +10,6 @@
     ./distributed_build.nix
     ./hardware-configuration.nix
     ./power_management.nix
-    ./wifi.nix
   ];
 
   config = {
@@ -26,7 +25,7 @@
 
     me.optimizations = {
       enable = true;
-      arch = "znver5";
+      arch = "znver4";
       system_features = [
         "gccarch-znver4"
         "gccarch-znver5"
@@ -54,15 +53,18 @@
     me.rpcs3.config.Core."Use LLVM CPU" = "znver4";
 
     me.alacritty.enable = true;
+    me.amd_s2idle.enable = true;
     me.ansible.enable = true;
     me.ares.enable = true;
     me.bluetooth.enable = true;
     me.chromecast.enable = true;
     me.chromium.enable = true;
+    me.d2.enable = true;
     me.direnv.enable = true;
-    me.docker.enable = true;
+    me.docker.enable = false;
     me.ecc.enable = true;
     me.emacs_flavor = "full";
+    me.emulate_isa.enable = true;
     me.firefox.enable = true;
     me.flux.enable = true;
     me.gcloud.enable = true;
@@ -80,21 +82,26 @@
     me.media.enable = true;
     me.nix_index.enable = true;
     me.nix_worker.enable = true;
+    me.openpgp_card_tools.enable = true;
     me.pcsx2.enable = true;
+    me.podman.enable = true;
     me.python.enable = true;
     me.qemu.enable = true;
     me.rpcs3.enable = true;
     me.rust.enable = true;
+    me.sequoia.enable = true;
     me.shadps4.enable = true;
     me.shikane.enable = true;
     me.sops.enable = true;
     me.sound.enable = true;
+    me.spaghettikart.enable = true;
     me.steam.enable = true;
     me.steam_run_free.enable = true;
     me.sway.enable = true;
     me.tekton.enable = true;
     me.terraform.enable = true;
     me.thunderbolt.enable = true;
+    me.uutils.enable = false;
     me.vnc_client.enable = true;
     me.vscode.enable = true;
     me.wasm.enable = true;
@@ -105,6 +112,7 @@
       "colo"
     ];
     me.wireguard.deactivated = [ "wgf" ];
+    me.yubikey.enable = true;
     me.zrepl.enable = true;
     me.zsh.enable = true;
 

nix/configuration/hosts/quark/wifi.nix

@@ -1,16 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-{
-  imports = [ ];
-
-  config = {
-    environment.loginShellInit = lib.mkIf (!config.me.buildingIso) ''
-      doas iw dev wlan0 set power_save off
-    '';
-  };
-}

nix/configuration/roles/alacritty/default.nix

@@ -24,13 +24,11 @@
           xdg-utils # for xdg-open
         ];
 
-        home-manager.users.talexander =
+        me.install.user.talexander.file = {
-          { pkgs, ... }:
+          ".config/alacritty/alacritty.toml" = {
-          {
+            source = ./files/alacritty.toml;
-            home.file.".config/alacritty/alacritty.toml" = {
-              source = ./files/alacritty.toml;
-            };
           };
+        };
       })
     ]
   );

nix/configuration/roles/amd_s2idle/cysystemd.nix

@@ -0,0 +1,48 @@
+{
+  lib,
+  pkgs,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+  cython,
+  pkg-config,
+  setuptools,
+}:
+
+let
+  version = "1.6.3";
+in
+buildPythonPackage {
+  pname = "cysystemd";
+  inherit version;
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "mosquito";
+    repo = "cysystemd";
+    tag = version;
+    hash = "sha256-xumrQgoKfFeKdRQUIYXXiXEcNd76i4wo/EIDm8BN7oU=";
+  };
+
+  disabled = pythonOlder "3.6";
+
+  build-system = [
+    setuptools
+    cython
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [ pkgs.systemd ];
+
+  pythonImportsCheck = [ "cysystemd" ];
+
+  meta = {
+    description = "systemd wrapper on Cython";
+    homepage = "https://github.com/mosquito/cysystemd";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+  };
+}

nix/configuration/roles/amd_s2idle/default.nix

@@ -0,0 +1,47 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    amd_s2idle.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install amd_s2idle.";
+    };
+  };
+
+  config = lib.mkIf config.me.amd_s2idle.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+          amd-debug-tools
+        ];
+        nixpkgs.overlays = [
+          (
+            final: prev:
+            let
+              innerPackage = (final.callPackage ./package.nix { });
+            in
+            {
+              amd-debug-tools = innerPackage;
+            }
+          )
+          (final: prev: {
+            pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+              (python-final: python-prev: {
+                cysystemd = (python-final.callPackage ./cysystemd.nix { });
+              })
+            ];
+          })
+        ];
+      }
+    ]
+  );
+}

nix/configuration/roles/amd_s2idle/package.nix

@@ -0,0 +1,60 @@
+{
+  lib,
+  fetchgit,
+  python3Packages,
+  acpica-tools,
+  ethtool,
+  libdisplay-info,
+}:
+
+let
+  version = "0.2.8";
+in
+python3Packages.buildPythonApplication {
+  pname = "amd-debug-tools";
+  inherit version;
+  pyproject = true;
+
+  build-system = with python3Packages; [
+    pyudev
+    setuptools
+    setuptools-git
+    setuptools-git-versioning
+  ];
+  dependencies = with python3Packages; [
+    acpica-tools
+    cysystemd
+    dbus-fast
+    ethtool
+    jinja2
+    libdisplay-info
+    matplotlib
+    pandas
+    pyudev
+    seaborn
+    tabulate
+  ];
+  src = fetchgit {
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/superm1/amd-debug-tools.git";
+    tag = version;
+    hash = "sha256-EmXsW7Q5WMFL32LWr29W3GnGpw5aj53wlp9KbFV1r0Q=";
+    leaveDotGit = true;
+  };
+
+  disabled = python3Packages.pythonOlder "3.7";
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail ', "setuptools-git-versioning>=2.0,<3"' ""
+  '';
+
+  pythonImportsCheck = [ "amd_debug" ];
+
+  meta = {
+    description = "Debug tools for AMD zen systems";
+    homepage = "https://git.kernel.org/pub/scm/linux/kernel/git/superm1/amd-debug-tools.git/";
+    changelog = "https://git.kernel.org/pub/scm/linux/kernel/git/superm1/amd-debug-tools.git/tag/?h=${version}";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+  };
+}

nix/configuration/roles/ansible/default.nix

@@ -25,6 +25,9 @@
         ];
 
         nixpkgs.overlays = [
+          (final: prev: {
+            ansible-sshjail = (final.callPackage ./package/ansible-sshjail/package.nix { });
+          })
           (final: prev: {
             ansible = pkgs.symlinkJoin {
               name = "ansible";

nix/configuration/roles/d2/default.nix

@@ -0,0 +1,29 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    d2.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install d2.";
+    };
+  };
+
+  config = lib.mkIf config.me.d2.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+          d2
+        ];
+      }
+    ]
+  );
+}

nix/configuration/roles/distributed_build/default.nix

@@ -58,12 +58,13 @@ in
               ];
               maxJobs = 1;
               supportedFeatures = [
-                # "nixos-test"
+                "nixos-test"
                 "benchmark"
                 "big-parallel"
                 # "kvm"
                 "gccarch-x86-64-v3"
                 "gccarch-x86-64-v4"
+                "gccarch-skylake"
                 "gccarch-znver4"
               ];
             }
@@ -86,12 +87,16 @@ in
               ];
               maxJobs = 1;
               supportedFeatures = [
-                # "nixos-test"
+                "gccarch-armv6"
+                "gccarch-aarch64"
+                "gccarch-riscv64"
+                "nixos-test"
                 "benchmark"
                 "big-parallel"
-                # "kvm"
+                "kvm"
                 "gccarch-x86-64-v3"
                 "gccarch-x86-64-v4"
+                "gccarch-skylake"
                 "gccarch-znver4"
                 "gccarch-znver5"
               ];

nix/configuration/roles/docker/default.nix

@@ -19,6 +19,14 @@
 
   config = lib.mkIf config.me.docker.enable (
     lib.mkMerge [
+      {
+        assertions = [
+          {
+            assertion = !config.me.podman.enable;
+            message = "docker conflicts with podman";
+          }
+        ];
+      }
       {
         virtualisation.docker.enable = true;
         # Use docker activation

nix/configuration/roles/emacs/default.nix

@@ -134,6 +134,7 @@ in
                     final.prettier # Format yaml, json, and JS
                     final.terraform-ls
                     final.typescript-language-server
+                    final.tex
                   ]
                 }
               '';
@@ -141,14 +142,12 @@ in
           })
         ];
 
-        home-manager.users.talexander =
+        me.install.user.talexander.file = {
-          { pkgs, ... }:
+          ".config/emacs" = {
-          {
+            source = ./files/emacs;
-            home.file.".config/emacs" = {
+            recursive = true;
-              source = ./files/emacs;
-              recursive = true;
-            };
           };
+        };
       })
       (lib.mkIf (config.me.emacs_flavor == "plainmacs") {
         nixpkgs.overlays = [

nix/configuration/roles/emacs/files/emacs/elisp/base.el

@@ -6,11 +6,13 @@
              )
 
 (use-package auto-package-update
-   :ensure t
+  :ensure t
-   :config
+  :custom
-   (setq auto-package-update-delete-old-versions t
+  (auto-package-update-interval 14)
-         auto-package-update-interval 14)
+  (auto-package-update-delete-old-versions t)
-   (auto-package-update-maybe))
+  :config
+  (auto-package-update-maybe)
+  )
 
 (defun assert-directory (p)
   (unless (file-exists-p p) (make-directory p t))
@@ -110,9 +112,6 @@
 
 ;; (setq-default fringes-outside-margins t)
 
-;; Per-pixel scrolling instead of per-line
-(pixel-scroll-precision-mode)
-
 ;; Typed text replaces selection
 (delete-selection-mode)
 

nix/configuration/roles/emacs/files/emacs/elisp/lang-d2.el

@@ -0,0 +1,16 @@
+(defun d2-format-buffer ()
+  "Run prettier."
+  (interactive)
+  (run-command-on-buffer "d2" "fmt" "-")
+  )
+
+(use-package d2-mode
+  :commands (d2-mode)
+  :hook (
+         (d2-mode . (lambda ()
+                      ;; (add-hook 'before-save-hook 'd2-format-buffer nil 'local)
+                      ))
+         )
+  )
+
+(provide 'lang-d2)

nix/configuration/roles/emacs/files/emacs/elisp/lang-org.el

@@ -87,4 +87,8 @@
 (use-package gnuplot)
 (use-package graphviz-dot-mode)
 
+(use-package htmlize
+  ;; For syntax highlighting when exporting to HTML.
+  )
+
 (provide 'lang-org)

nix/configuration/roles/emacs/files/emacs/init.el

@@ -40,4 +40,6 @@
 
 (require 'lang-cmake)
 
+(require 'lang-d2)
+
 (load-directory autoload-directory)

nix/configuration/roles/emulate_isa/default.nix

@@ -0,0 +1,41 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    emulate_isa.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to enable emulating other CPU architectures.";
+    };
+  };
+
+  config = lib.mkIf config.me.emulate_isa.enable (
+    lib.mkMerge [
+      {
+        boot.binfmt.emulatedSystems = [
+          "aarch64-linux" # Raspberry Pi gen 3
+          "riscv64-linux"
+          # TODO: Should "x86_64-linux" be in this list or should this list be dependent on the host CPU?
+          "armv6l-linux" # Raspberry Pi gen 1
+        ];
+
+        me.optimizations = {
+          system_features = [
+            "gccarch-armv6"
+            "gccarch-aarch64"
+            "gccarch-riscv64"
+          ];
+        };
+      }
+    ]
+  );
+}
+# NOTE: build nixosConfigurations.<name>.config.system.build.sdImage

nix/configuration/roles/firefox/default.nix

@@ -70,9 +70,12 @@
             # Allow sending dark mode preference to websites.
             # Allow sending timezone to websites.
             "privacy.fingerprintingProtection.overrides" =
-              "+AllTargets,-CSSPrefersColorScheme,-JSDateTimeUTC,-CanvasExtractionBeforeUserInputIsBlocked";
+              "+AllTargets,-CSSPrefersColorScheme,-JSDateTimeUTC,-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt";
             # Disable weather on new tab page
             "browser.newtabpage.activity-stream.showWeather" = false;
+            # Disable AI stuff that wastes battery life
+            "browser.ml.chat.enabled" = false;
+            "browser.ml.enabled" = false;
           };
           # Check about:policies#documentation and https://mozilla.github.io/policy-templates/ for options.
           policies = {

nix/configuration/roles/fonts/default.nix

@@ -15,6 +15,7 @@
         cascadia-code
         source-sans-pro
         source-serif-pro
+        noto-fonts
         noto-fonts-cjk-sans
         noto-fonts-cjk-serif
         noto-fonts-color-emoji

nix/configuration/roles/git/default.nix

@@ -36,13 +36,11 @@ in
       ];
     }
     (lib.mkIf (config.me.git.config != null) {
-      home-manager.users.talexander =
+      me.install.user.talexander.file = {
-        { pkgs, ... }:
+        ".gitconfig" = {
-        {
+          source = config.me.git.config;
-          home.file.".gitconfig" = {
-            source = config.me.git.config;
-          };
         };
+      };
     })
     (lib.mkIf (config.me.graphical) {
       nixpkgs.overlays = [

nix/configuration/roles/git/files/gitconfig_home

@@ -1,13 +1,14 @@
 [user]
 	email = tom@fizz.buzz
 	name = Tom Alexander
-	signingkey = D3A179C9A53C0EDE
+	signingkey = 36C99E8B3C39D85F
 [push]
 	default = simple # (default since 2.0)
 [alias]
 	lg = log --color --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit
 	bh = log --oneline --branches=* --remotes=* --graph --decorate
 	amend = commit --amend --no-edit
+        authorcount = shortlog --summary --numbered --all --no-merges
 [core]
 	excludesfile = ~/.gitignore_global
 [commit]
@@ -52,3 +53,6 @@
 	autoStash = true
         # updateRefs was annoying when you want to split a branch in two by rebasing away from commits from one branch and rebasing away some commits from another branch.
 	updateRefs = false
+# Disabled because ephemeral pin storage is not yet ready in openpgp-card-state
+# [gpg]
+# 	program = oct-git

nix/configuration/roles/gpg/default.nix

@@ -29,9 +29,7 @@ in
     lib.mkMerge [
       {
         # Fetch public keys:
-        # gpg --locate-keys tom@fizz.buzz
+        # gpg --locate-external-keys tom@fizz.buzz
-        #
-        # gpg -vvv --auto-key-locate local,wkd --locate-keys tom@fizz.buzz
 
         hardware.gpgSmartcards.enable = true;
         services.udev.packages = [
@@ -47,35 +45,64 @@ in
           })
         ];
         services.pcscd.enable = true;
-        # services.gnome.gnome-keyring.enable = true;
 
-        # services.dbus.packages = [ pkgs.gcr ];
+        me.install.user.talexander.file = {
-
+          ".gnupg/scdaemon.conf" = {
-        # services.pcscd.plugins = lib.mkForce [ ];
+            source = ./files/scdaemon.conf;
-
-        #   programs.gpg.scdaemonSettings = {
-        #   disable-ccid = true;
-        # };
-
-        # .gnupg/scdaemon.conf
-        home-manager.users.talexander =
-          { pkgs, ... }:
-          {
-            home.file.".gnupg/scdaemon.conf" = {
-              source = ./files/scdaemon.conf;
-            };
           };
+        };
 
-        # programs.gnupg.dirmngr.enable = true;
         programs.gnupg.agent = {
           enable = true;
           enableSSHSupport = true;
           pinentryPackage = pkgs.pinentry-qt;
+          # Settings block populates /etc/gnupg/gpg-agent.conf
           # settings = {
-          #   disable-ccid = true;
           # };
         };
 
+        # Disabled because it breaks signing git commits because gpg wants to copy pubring.kbx. Unfortunately, this makes the install of scdaemon.conf do nothing since this mount of the full .gnupg directory goes over it.
+        #
+        # environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+        #   hideMounts = true;
+        #   users.talexander = {
+        #     files = [
+        #       {
+        #         file = ".gnupg/trustdb.gpg";
+        #         parentDirectory = {
+        #           mode = "u=rwx,g=,o=";
+        #         };
+        #       }
+        #       {
+        #         file = ".gnupg/pubring.kbx";
+        #         parentDirectory = {
+        #           mode = "u=rwx,g=,o=";
+        #         };
+        #       }
+        #       {
+        #         file = ".gnupg/tofu.db";
+        #         parentDirectory = {
+        #           mode = "u=rwx,g=,o=";
+        #         };
+        #       }
+        #     ];
+        #     directories = [
+        #       {
+        #         directory = ".gnupg/crls.d";
+        #         user = "talexander";
+        #         group = "talexander";
+        #         mode = "0700";
+        #       }
+        #       {
+        #         directory = ".gnupg/private-keys-v1.d";
+        #         user = "talexander";
+        #         group = "talexander";
+        #         mode = "0700";
+        #       }
+        #     ];
+        #   };
+        # };
+
         environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
           hideMounts = true;
           users.talexander = {
@@ -85,7 +112,7 @@ in
                 user = "talexander";
                 group = "talexander";
                 mode = "0700";
-              } # Local keyring
+              }
             ];
           };
         };
@@ -93,8 +120,6 @@ in
         environment.systemPackages = with pkgs; [
           pcsclite
           pcsctools
-          yubikey-personalization
-          yubikey-manager
           glibcLocales
           ccid
           libusb-compat-0_1

nix/configuration/roles/gpg/files/gpg_test_wkd.bash

@@ -6,3 +6,6 @@ IFS=$'\n\t'
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 gpg --no-default-keyring --keyring /tmp/gpg-$$ --auto-key-locate clear,wkd --locate-keys "${@}"
+
+# To generate files for the WKD:
+# gpg-wks-client --directory ./pgp/.well-known/openpgpkey --install-key <keyid> <email>

nix/configuration/roles/gpg/files/scdaemon.conf

@@ -1,6 +1,9 @@
 #reader-port Yubico Yubi
 disable-ccid
 
+# This setting enables other backends like oct to access the pgp card simultaneously but it also means that gpg will ask for the pin for EVERY ssh session which is annoying in scripts.
+#pcsc-shared
+
 #log-file /home/talexander/scd.log
 #verbose
 #debug cardio

nix/configuration/roles/kanshi/default.nix

@@ -41,15 +41,11 @@ in
           exec_kanshi
         ];
 
-        home-manager.users.talexander =
+        me.install.user.talexander.file = {
-          { pkgs, ... }:
+          ".config/kanshi/config" = {
-          {
+            source = ./files/config_kanshi;
-            home.file = {
-              ".config/kanshi/config" = {
-                source = ./files/config_kanshi;
-              };
-            };
           };
+        };
       })
     ]
   );

nix/configuration/roles/kodi/default.nix

@@ -51,7 +51,7 @@
           # Generate with `mkpasswd -m scrypt`
           hashedPassword = "$7$CU..../....VXvNQ8za3wSGpdzGXNT50/$HcFtn/yvwPMCw4888BelpiAPLAxe/zU87fD.d/N6U48";
           openssh.authorizedKeys.keys = [
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGu+k5lrirokdW5zVdRVBOqEOAvAPlIkG/MdJNc9g5ky"
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID0+4zi26M3eYWnIrciR54kOlGxzfgCXG+o4ea1zpzrk openpgp:0x7FF123C8"
             "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIEI6mu6I5Jp+Ib0vJxapGHbEShZjyvzV8jz5DnzDrI39AAAABHNzaDo="
             "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIAFNcSXwvy+brYTOGo56G93Ptuq2MmZsjvRWAfMqbmMLAAAABHNzaDo="
           ];
@@ -78,21 +78,13 @@
           };
         };
 
-        home-manager.users.kodi =
+        # home.file.".kodi/userdata/mediasources.xml".source = ./files/mediasources.xml;
-          { pkgs, ... }:
-          {
-            # home.file.".kodi/userdata/mediasources.xml".source = ./files/mediasources.xml;
 
-            # home.file.".kodi/userdata/addon_data/peripheral.joystick/resources/buttonmaps/xml/linux/DualSense_Wireless_Controller_13b_8a.xml".source =
+        # home.file.".kodi/userdata/addon_data/peripheral.joystick/resources/buttonmaps/xml/linux/DualSense_Wireless_Controller_13b_8a.xml".source =
-            #   ./files/DualSense_Wireless_Controller_13b_8a.xml;
+        #   ./files/DualSense_Wireless_Controller_13b_8a.xml;
 
-            # TODO: Maybe .kodi/userdata/sources.xml
+        # TODO: Maybe .kodi/userdata/sources.xml
-            # TODO: ./userdata/guisettings.xml:303:    <setting id="filecache.memorysize">128</setting>
+        # TODO: ./userdata/guisettings.xml:303:    <setting id="filecache.memorysize">128</setting>
-
-            # The state version is required and should stay at the version you
-            # originally installed.
-            home.stateVersion = "24.11";
-          };
       })
     ]
   );

nix/configuration/roles/latex/default.nix

@@ -5,22 +5,6 @@
   ...
 }:
 
-let
-  tex = (
-    pkgs.texlive.combine {
-      inherit (pkgs.texlive)
-        scheme-basic
-        dvisvgm
-        dvipng # for preview and export as html in org-mode
-        wrapfig
-        amsmath
-        ulem
-        hyperref
-        capt-of
-        ;
-    }
-  );
-in
 {
   imports = [ ];
 
@@ -40,6 +24,35 @@ in
           tex
         ];
       }
+      {
+        nixpkgs.overlays = [
+          (final: prev: {
+            tex = (
+              pkgs.texlive.combine {
+                inherit (pkgs.texlive)
+                  scheme-basic
+                  dvisvgm
+                  dvipng # for preview and export as html in org-mode
+                  wrapfig
+                  amsmath
+                  ulem
+                  hyperref
+                  capt-of
+                  svg # emacs org-mode pdf export
+                  catchfile # emacs org-mode pdf export
+                  xcolor # emacs org-mode pdf export
+                  transparent # emacs org-mode pdf export
+                  pgf # emacs org-mode pdf export
+                  minted # emacs org-mode pdf export code block highlighting
+                  upquote # emacs org-mode pdf export
+                  lineno # emacs org-mode pdf export
+                  ;
+              }
+            );
+          })
+        ];
+
+      }
     ]
   );
 }

nix/configuration/roles/media/default.nix

@@ -52,13 +52,11 @@ in
           imv
         ];
 
-        home-manager.users.talexander =
+        me.install.user.talexander.file = {
-          { pkgs, ... }:
+          ".config/mpv/mpv.conf" = {
-          {
+            source = ./files/mpv.conf;
-            home.file.".config/mpv/mpv.conf" = {
-              source = ./files/mpv.conf;
-            };
           };
+        };
       })
       (lib.mkIf (config.me.graphics_card_type == "amd" || config.me.graphics_card_type == "intel") {
         environment.systemPackages = with pkgs; [

nix/configuration/roles/media/files/cast_file_vaapi

@@ -123,11 +123,13 @@ function convert {
         if [ "$acceleration_type" == "software" ]; then
             args+=(-c:v h264)
             args+=(-profile:v high)
+            args+=(-vf format=yuv420p)
             args+=(-b:v "$VIDEO_BITRATE")
         elif [ "$acceleration_type" == "hardware" ]; then
             args+=(-vf 'format=nv12|vaapi,hwupload')
             args+=(-c:v h264_vulkan)
             args+=(-profile:v high)
+            args+=(-vf format=yuv420p)
             args+=(-b:v "$VIDEO_BITRATE")
         fi
     elif [ "$codec" == "av1" ]; then

nix/configuration/roles/network/default.nix

@@ -55,8 +55,20 @@
       General = {
         EnableNetworkConfiguration = true;
         AddressRandomization = "network";
-        ControlPortOverNL80211 = false;
       };
+      # Rank = {
+      #   BandModifier2_4GHz = 1.0;
+      #   BandModifier5GHz = 1.0;
+      #   BandModifier6GHz = 1.0;
+      # };
+      DriverQuirks = {
+        PowerSaveDisable = "*";
+        # ath12k_pci
+      };
+      # Scan = {
+      #   DisablePeriodicScan = true;
+      #   DisableRoamingScan = true;
+      # };
     };
   };
   environment.systemPackages = with pkgs; [
@@ -94,12 +106,27 @@
     # "net.ipv6.conf.default.use_tempaddr" = 2;
   };
 
-  nixpkgs.overlays = [
+  # nixpkgs.overlays = [
-    (final: prev: {
+  #   (final: prev: {
-      inherit (pkgs-dda3dcd3f)
+  #     inherit (pkgs-dda3dcd3f)
-        linux-firmware
+  #       linux-firmware
-        ;
+  #       ;
-    })
+  #   })
-  ];
+  # ];
+
+  # nixpkgs.overlays = [
+  #   (final: prev: {
+  #     linux-firmware = prev.linux-firwmare.overrideAttrs (old: rec {
+  #       version = "20250917";
+
+  #       src = final.fetchFromGitLab {
+  #         owner = "kernel-firmware";
+  #         repo = "linux-firmware";
+  #         tag = version;
+  #         hash = "sha256-tecFB6WYEfBK9FB7Rv8nHLdefIoaFnHrpzXBl+iSd08=";
+  #       };
+  #     });
+  #   })
+  # ];
 
 }

nix/configuration/roles/nix_worker/default.nix

@@ -43,7 +43,7 @@
           hashedPassword = "$7$CU..../....VXvNQ8za3wSGpdzGXNT50/$HcFtn/yvwPMCw4888BelpiAPLAxe/zU87fD.d/N6U48";
           openssh.authorizedKeys.keys = [
             # Normal keys:
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGu+k5lrirokdW5zVdRVBOqEOAvAPlIkG/MdJNc9g5ky"
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID0+4zi26M3eYWnIrciR54kOlGxzfgCXG+o4ea1zpzrk openpgp:0x7FF123C8"
             "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIEI6mu6I5Jp+Ib0vJxapGHbEShZjyvzV8jz5DnzDrI39AAAABHNzaDo="
             "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIAFNcSXwvy+brYTOGo56G93Ptuq2MmZsjvRWAfMqbmMLAAAABHNzaDo="
             # Key for nix to connect:

nix/configuration/roles/openpgp_card_tools/default.nix

@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [
+    ./openpgp-card-ssh-agent.nix
+  ];
+
+  options.me = {
+    openpgp_card_tools.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install openpgp-card-tools.";
+    };
+  };
+
+  config = lib.mkIf config.me.openpgp_card_tools.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+          openpgp-card-tools
+          openpgp-card-tool-git
+          openpgp-card-ssh-agent
+        ];
+
+        nixpkgs.overlays = [
+          (final: prev: {
+            openpgp-card-tool-git = (final.callPackage ./package/openpgp-card-tool-git/package.nix { });
+            openpgp-card-ssh-agent = (final.callPackage ./package/openpgp-card-ssh-agent/package.nix { });
+          })
+        ];
+
+        me.install.user.talexander.file = {
+          ".config/openpgp-card-state/config.toml" = {
+            source = ./files/openpgp-card-state.toml;
+          };
+        };
+
+        # The current openpgp-card-ssh-agent has an outdated dependency on openpgp-card-state which makes it not handle my current openpgp-card-state.toml
+        # services.openpgp-card-ssh-agent.enable = true;
+      }
+    ]
+  );
+}

nix/configuration/roles/openpgp_card_tools/files/openpgp-card-state.toml

@@ -0,0 +1 @@
+default_pin_storage = "Pinentry"

nix/configuration/roles/openpgp_card_tools/openpgp-card-ssh-agent.nix

@@ -0,0 +1,94 @@
+# Upstream to nixpkgs/nixos/modules/services/networking/ssh/openpgp-card-ssh-agent.nix
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkIf
+    mkOption
+    mkEnableOption
+    mkPackageOption
+    mkDefault
+    types
+    concatMapStringsSep
+    generators
+    ;
+  cfg = config.services.openpgp-card-ssh-agent;
+in
+{
+  options.services.openpgp-card-ssh-agent = {
+
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to start openpgp-card-ssh-agent when you log in.
+        Also sets SSH_AUTH_SOCK to point at openpgp-card-ssh-agent.
+      '';
+    };
+
+    package = mkPackageOption pkgs "openpgp-card-ssh-agent" { };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.user.sockets.openpgp-card-ssh-agent = {
+      wantedBy = [ "sockets.target" ];
+      description = "A simple ssh-agent backed by OpenPGP card authentication keys";
+      documentation = [
+        "https://codeberg.org/openpgp-card/ssh-agent"
+        "man:ssh-add(1)"
+        "man:ssh-agent(1)"
+        "man:ssh(1)"
+      ];
+      socketConfig = {
+        ListenStream = "%t/openpgp-card/ssh-agent.sock";
+        SocketMode = "0600";
+        DirectoryMode = "0700";
+      };
+    };
+
+    systemd.user.services.openpgp-card-ssh-agent = {
+      description = "A simple ssh-agent backed by OpenPGP card authentication keys";
+      documentation = [
+        "https://codeberg.org/openpgp-card/ssh-agent"
+        "man:ssh-add(1)"
+        "man:ssh-agent(1)"
+        "man:ssh(1)"
+      ];
+      after = [ "local-fs.target" ];
+      requires = [
+        "openpgp-card-ssh-agent.socket"
+        # "gnome-keyring-daemon.service"
+      ];
+
+      serviceConfig = {
+        ExecStart = ''
+          ${cfg.package}/bin/openpgp-card-ssh-agent -H fd://
+        '';
+      };
+    };
+
+    environment.extraInit = ''
+      if [ -z "$SSH_AUTH_SOCK" ] && [ -n "$XDG_RUNTIME_DIR" ]; then
+        export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/openpgp-card/ssh-agent.sock"
+      fi
+    '';
+
+    assertions = [
+      {
+        assertion = cfg.enable -> !config.programs.ssh.startAgent;
+        message = "You can't use ssh-agent and GnuPG agent with SSH support enabled at the same time!";
+      }
+      {
+        assertion = cfg.enable -> !config.programs.gnupg.agent.enableSSHSupport;
+        message = "You can't use GnuPG agent with SSH support enabled and openpgp-card-ssh-agent at the same time!";
+      }
+    ];
+  };
+}

nix/configuration/roles/openpgp_card_tools/package/openpgp-card-ssh-agent/package.nix

@@ -0,0 +1,52 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitea,
+  pkg-config,
+  pcsclite,
+  dbus,
+  openssl,
+  testers,
+  openpgp-card-ssh-agent,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "openpgp-card-ssh-agent";
+  version = "0.3.4";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "openpgp-card";
+    repo = "ssh-agent";
+    rev = "v${version}";
+    hash = "sha256-nWbvEsVa7YJsBtVZfLQDB4CiaHP3GEYeYS32+WZv8PE=";
+  };
+
+  cargoHash = "sha256-nG7xebypXv7UAfu7sWbcp4DIhLv4lfzMrQUY6m2iDmw=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    pcsclite
+    dbus
+  ];
+
+  passthru = {
+    tests.version = testers.testVersion {
+      package = openpgp-card-ssh-agent;
+    };
+  };
+
+  meta = with lib; {
+    description = "An ssh agent that uses OpenPGP cards for your key";
+    homepage = "https://codeberg.org/openpgp-card/ssh-agent";
+    license = with licenses; [
+      asl20 # OR
+      mit
+    ];
+    mainProgram = "openpgp-card-ssh-agent";
+  };
+}

nix/configuration/roles/openpgp_card_tools/package/openpgp-card-tool-git/package.nix

@@ -0,0 +1,54 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitea,
+  pkg-config,
+  pcsclite,
+  dbus,
+  openssl,
+  sqlite,
+  testers,
+  openpgp-card-tool-git,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "openpgp-card-tool-git";
+  version = "0.1.6";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "openpgp-card";
+    repo = "oct-git";
+    rev = "v${version}";
+    hash = "sha256-38/JHzCkL3+0IbOacH54A5Hj03oDe9jDzcwp672a8LE=";
+  };
+
+  cargoHash = "sha256-j1Osj2rjLxrSKh82ym6PiIHVO1wLE7Ax2/5+pdRcv+E=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    pcsclite
+    dbus
+    sqlite
+  ];
+
+  passthru = {
+    tests.version = testers.testVersion {
+      package = openpgp-card-tool-git;
+    };
+  };
+
+  meta = with lib; {
+    description = "Tool for using OpenPGP cards with git";
+    homepage = "https://codeberg.org/openpgp-card/oct-git";
+    license = with licenses; [
+      asl20 # OR
+      mit
+    ];
+    mainProgram = "oct-git";
+  };
+}

nix/configuration/roles/optimized_build/default.nix

@@ -47,7 +47,7 @@
     (lib.mkIf (!config.me.optimizations.enable) (
       lib.mkMerge [
         {
-          boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_6_15;
+          boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_6_16;
         }
       ]
     ))
@@ -94,45 +94,14 @@
                   HZ = lib.kernel.freeform "300";
                   HZ_300 = lib.kernel.yes;
                   HZ_1000 = lib.kernel.no;
-                } prev.linux_6_15;
+                } prev.linux_6_16;
               }
             )
-            (final: prev: {
-              haskellPackages = prev.haskellPackages.extend (
-                final': prev': {
-                  inherit (pkgs-unoptimized.haskellPackages)
-                    crypto-token
-                    crypton
-                    crypton-connection
-                    crypton-x509
-                    crypton-x509-store
-                    crypton-x509-system
-                    crypton-x509-validation
-                    hspec-wai
-                    http-client-tls
-                    http2
-                    pandoc
-                    pandoc-cli
-                    pandoc-lua-engine
-                    pandoc-server
-                    servant-server
-                    tls
-                    tls-session-manager
-                    wai-app-static
-                    wai-extra
-                    warp
-                    warp-tls
-                    ;
-                }
-              );
-            })
             (final: prev: {
               inherit (pkgs-unoptimized)
                 gsl
-                redis
-                valkey
-                nix-serve-ng
                 rapidjson
+                assimp
                 ;
             })
           ];

nix/configuration/roles/pcsx2/default.nix

@@ -82,13 +82,11 @@
           };
         };
 
-        home-manager.users.talexander =
+        me.install.user.talexander.file = {
-          { pkgs, ... }:
+          ".config/PCSX2/inis/PCSX2.ini" = {
-          {
+            source = ./files/PCSX2.ini;
-            home.file.".config/PCSX2/inis/PCSX2.ini" = {
-              source = ./files/PCSX2.ini;
-            };
           };
+        };
       })
     ]
   );

nix/configuration/roles/podman/default.nix

@@ -0,0 +1,80 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    podman.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install podman.";
+    };
+  };
+
+  config = lib.mkIf config.me.podman.enable (
+    lib.mkMerge [
+      {
+        assertions = [
+          {
+            assertion = !config.me.docker.enable;
+            message = "podman conflicts with docker";
+          }
+        ];
+      }
+      {
+        environment.systemPackages = with pkgs; [
+          dive
+          podman-tui
+          podman-compose
+        ];
+
+        # Write config files in /etc/containers
+        virtualisation.containers.enable = true;
+        # By default this includes "quay.io" which leads to prompting for which registry to download from.
+        virtualisation.containers.registries.search = [ "docker.io" ];
+        virtualisation = {
+          podman = {
+            enable = true;
+            # Install docker shim
+            dockerCompat = true;
+            # Support name resolution in podman-compose.
+            defaultNetwork.settings.dns_enabled = true;
+          };
+        };
+
+        environment.variables = {
+          # For compatibility with tools expecting a docker socket (like dive).
+          DOCKER_HOST = "unix://$XDG_RUNTIME_DIR/podman/podman.sock";
+        };
+
+        environment.persistence."/state" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          directories = [
+            {
+              directory = "/var/lib/containers";
+              user = "root";
+              group = "root";
+              mode = "0755";
+            }
+          ];
+          users.talexander = {
+            directories = [
+              {
+                directory = ".local/share/containers";
+                user = "talexander";
+                group = "talexander";
+                mode = "0700";
+              }
+            ];
+          };
+        };
+      }
+    ]
+  );
+}

nix/configuration/roles/python/default.nix

@@ -31,7 +31,23 @@
           pyright
           isort
           black
+          uv
         ];
+
+        environment.persistence."/state" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          users.talexander = {
+            directories = [
+              {
+                # Poetry virtual environments.
+                directory = ".cache/pypoetry";
+                user = "talexander";
+                group = "talexander";
+                mode = "0755";
+              }
+            ];
+          };
+        };
       }
     ]
   );

nix/configuration/roles/qemu/default.nix

@@ -5,6 +5,41 @@
   ...
 }:
 
+let
+  qemurc =
+    (pkgs.writeScriptBin "qemurc" (
+      builtins.readFile (
+        pkgs.replaceVars ./files/qemurc.bash {
+          "OVMFfd" = "${pkgs.OVMF.fd}";
+          mount_root = "/vm";
+          zfs_root = "zroot/linux/nix/vm";
+        }
+      )
+    )).overrideAttrs
+      (old: {
+        buildCommand = ''
+          ${old.buildCommand}
+          patchShebangs $out
+        '';
+      });
+  qemurc_wrapped =
+    (pkgs.writeScriptBin "qemurc" ''
+      #!/usr/bin/env bash
+      export "PATH=${
+        lib.makeBinPath [
+          pkgs.swtpm
+          pkgs.tmux
+        ]
+      }:''${PATH}"
+      exec ${qemurc}/bin/qemurc "''${@}"
+    '').overrideAttrs
+      (old: {
+        buildCommand = ''
+          ${old.buildCommand}
+          patchShebangs $out
+        '';
+      });
+in
 {
   imports = [ ];
 
@@ -22,6 +57,7 @@
       {
         environment.systemPackages = with pkgs; [
           qemu
+          qemurc_wrapped
         ];
       }
     ]

nix/configuration/roles/qemu/files/qemurc.bash

@@ -0,0 +1,375 @@
+#!/usr/bin/env bash
+#
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+# Share a host directory to the guest via 9pfs.
+#
+# Inside the VM run:
+#   mount -t virtfs -o trans=virtio sharename /some/vm/path
+#   mount -t 9p -o cache=mmap -o msize=512000 sharename /mnt/9p
+#   mount -t 9p -o trans=virtio,cache=mmap,msize=512000 bind9p /path/to/mountpoint
+
+# Example usage:
+#
+#   doas qemurc create-disk mint 10
+#   doas env CD=/vm/iso/linuxmint-22.2-cinnamon-64bit.iso qemurc start mint
+#   doas qemurc start mint
+#   doas env WAYLAND_DISPLAY="$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY" XDG_RUNTIME_DIR=/run/user/0 qemurc start mint
+
+
+: ${VERBOSE:="NO"} # or YES
+if [ "$VERBOSE" = "YES" ]; then
+    set -x
+fi
+
+: ${CPU_CORES:="1"}
+: ${MEMORY:="1G"}
+: ${GTK_ENABLE:="NO"} # Only enable one, either GTK or VNC
+: ${VNC_ENABLE:="NO"} # Only enable one, either GTK or VNC
+: ${VNC_LISTEN:="127.0.0.1:0"}
+: ${VNC_WIDTH:="1920"}
+: ${VNC_HEIGHT:="1080"}
+: ${AUDIO_ENABLE:="NO"}
+: ${TPM_ENABLE:="NO"}
+: ${BIND9P:=""}
+: "${CD:=}"
+
+: ${SHUTDOWN_TIMEOUT:="600"}
+: ${MOUNT_ROOT:="@mount_root@"}
+: ${ZFS_ROOT:="@zfs_root@"}
+
+
+
+############## Setup #########################
+
+
+function cleanup {
+    sync
+
+    for p in "${pids[@]}"; do
+        log "Killing $p"
+        kill "$p"
+        log "Killed $p"
+    done
+
+    for vm in "${vms[@]}"; do
+        log "Stopping $vm"
+        stop_one "$vm"
+        log "Stopped $vm"
+    done
+}
+pids=()
+vms=()
+trap "set +e; cleanup" EXIT
+
+function die {
+    local status_code="$1"
+    shift
+    (>&2 echo "${@}")
+    exit "$status_code"
+}
+
+function log {
+    (>&2 echo "${@}")
+}
+
+############## Program #########################
+
+function main {
+    local cmd
+    cmd=$1
+    shift
+    if [ "$cmd" = "start" ]; then
+        init
+        start "${@}"
+    elif [ "$cmd" = "stop" ]; then
+        init
+        stop "${@}"
+    elif [ "$cmd" = "status" ]; then
+        init
+        status "${@}"
+    elif [ "$cmd" = "console" ]; then
+        init
+        console "${@}"
+    elif [ "$cmd" = "_start_body" ]; then
+        init
+        start_body "${@}"
+    elif [ "$cmd" = "create-disk" ]; then
+        create_disk "${@}"
+    else
+        (>&2 echo "Unknown command: $cmd")
+        exit 1
+    fi
+}
+
+function start {
+    local num_vms="$#"
+    if [ "$num_vms" -eq 0 ]; then
+        log "No VMs specified."
+        return 0
+    fi
+
+    while [ "$#" -gt 0 ]; do
+        local name="$1"
+        shift 1
+        log "Starting VM $name."
+        start_one "$name"
+        [ "$#" -eq 0 ] || sleep 5
+    done
+}
+
+function start_one {
+    local name="$1"
+    local tmux_name="$name"
+    tmux new-session -d -s "$tmux_name" "$0" "_start_body" "$name"
+}
+
+function launch_pidfile {
+    local pidfile="$1"
+    shift 1
+    mkdir -p "$(dirname "$pidfile")"
+    cat > "${pidfile}" <<< "$$"
+    set -x
+    exec "${@}"
+}
+export -f launch_pidfile
+
+function stop {
+    local num_vms="$#"
+    if [ "$num_vms" -eq 0 ]; then
+        log "No VMs specified."
+        return 0
+    fi
+
+    while [ "$#" -gt 0 ]; do
+        local name="$1"
+        shift 1
+        log "Stopping VM $name."
+        stop_one "$name"
+        [ "$#" -eq 0 ] || sleep 5
+    done
+}
+
+function stop_one {
+    local name="$1"
+    local pidfile="/run/qemurc/${name}/pid"
+
+    if [ ! -e "$pidfile" ]; then
+        log "Pid file $pidfile does not exist."
+        return 0
+    fi
+
+    local qemu_pid
+    qemu_pid=$(cat "$pidfile")
+
+    if ps -p "$qemu_pid" >/dev/null; then
+        # We cannot send a graceful shutdown command externally to qemu: https://gitlab.com/qemu-project/qemu/-/issues/148
+        log "Killing ${name}:${qemu_pid}."
+        kill -SIGTERM "$qemu_pid"
+    fi
+
+    local timeout_start timeout_end
+    timeout_start=$(date +%s)
+    while ps -p "$qemu_pid" >/dev/null; do
+        timeout_end=$(date +%s)
+        if [ $((timeout_end-timeout_start)) -ge "$SHUTDOWN_TIMEOUT" ]; then
+            log "${name}:${qemu_pid} took more than $SHUTDOWN_TIMEOUT seconds to shut down. Hard powering down."
+            break
+        fi
+
+        log "Waiting for ${name}:${qemu_pid} to exit."
+        sleep 2
+    done
+
+    kill -9 "$qemu_pid"
+
+    local timeout_start timeout_end
+    timeout_start=$(date +%s)
+    while ps -p "$qemu_pid" >/dev/null; do
+        timeout_end=$(date +%s)
+        if [ $((timeout_end-timeout_start)) -ge "$SHUTDOWN_TIMEOUT" ]; then
+            log "${name}:${qemu_pid} took more than $SHUTDOWN_TIMEOUT seconds to hard power down. Giving up."
+            break
+        fi
+
+        log "Waiting for ${name}:${qemu_pid} to hard power down."
+        sleep 2
+    done
+
+    rm -f "$pidfile"
+
+    log "Finished stopping $name."
+}
+
+function status {
+    local num_vms="$#"
+
+    if [ "$num_vms" -gt 0 ]; then
+        for name in "$@"; do
+            status_one "$name"
+        done
+    else
+        log "No VMs specified."
+    fi
+}
+
+function status_one {
+    local name="$1"
+    local pidfile="/run/qemurc/${name}/pid"
+
+    if [ ! -e "$pidfile" ]; then
+        log "$name is not running."
+        return 0
+    fi
+
+    local qemu_pid
+    qemu_pid=$(cat "$pidfile")
+
+    if ! ps -p "$qemu_pid" >/dev/null; then
+        log "$name is not running."
+        return 0
+    fi
+
+    log "$name is running as pid $qemu_pid."
+}
+
+function console {
+    local num_vms="$#"
+
+    if [ "$num_vms" -gt 0 ]; then
+        for name in "$@"; do
+            log "Attaching to console of VM $name."
+            console_one "$name"
+        done
+    else
+        log "No VMs specified."
+    fi
+}
+
+function console_one {
+    local name="$1"
+    local tmux_name="$name"
+    exec tmux a -t "$tmux_name"
+}
+
+function init {
+    mkdir -p /run/qemurc
+}
+
+############## qemu ############################
+
+function create_disk {
+    local name="$1"
+    local gigabytes="$2"
+
+    local zfs_path="${ZFS_ROOT}/${name}"
+    local mount_path="${MOUNT_ROOT}/${name}"
+
+    zfs create -o mountpoint=none -o canmount=off "$zfs_path"
+    zfs create -o "mountpoint=$mount_path" -o canmount=on "$zfs_path/settings"
+    zfs create -s "-V${gigabytes}G" -o volmode=dev -o primarycache=metadata -o secondarycache=none "$zfs_path/disk0"
+    zfs snapshot -r "$zfs_path@empty"
+
+    install -m0600 "@OVMFfd@/FV/OVMF_VARS.fd" "${mount_path}/"
+    tee "${mount_path}/settings" <<EOF
+CPU_CORES="$CPU_CORES"
+MEMORY="$MEMORY"
+GTK_ENABLE="$GTK_ENABLE"
+VNC_ENABLE="$VNC_ENABLE"
+VNC_LISTEN="$VNC_LISTEN"
+VNC_WIDTH="$VNC_WIDTH"
+VNC_HEIGHT="$VNC_HEIGHT"
+AUDIO_ENABLE="$AUDIO_ENABLE"
+TPM_ENABLE="$TPM_ENABLE"
+BIND9P="$BIND9P"
+EOF
+
+}
+
+function start_body {
+    local name="$1"
+    local zfs_path="${ZFS_ROOT}/${name}"
+    local mount_path="${MOUNT_ROOT}/${name}"
+    local run_path="/run/qemurc/${name}"
+    local mount_cd="$CD"
+    local swtpm_sock="${run_path}/swtpm.sock"
+    local swtpm_path="${MOUNT_ROOT}/${name}/swtpm"
+
+    install -d -m 0700 "$run_path"
+
+    if [ -e "${mount_path}/settings" ]; then
+        source "${mount_path}/settings"
+    fi
+
+    local additional_args=()
+
+    if [ -n "$BIND9P" ]; then
+        additional_args+=(-device "virtio-9p-type,fsdev=${BIND9P},mount_tag=bind9p")
+    fi
+
+    if [ -n "$mount_cd" ]; then
+        additional_args+=(-cdrom "$mount_cd")
+    fi
+    if [ "$VNC_ENABLE" = "YES" ]; then
+        additional_args+=(-vnc "${VNC_LISTEN},power-control=on")
+    fi
+
+    if [ "$AUDIO_ENABLE" = "YES" ]; then
+        additional_args+=(-audio "driver=pa,model=virtio,server=/run/user/11235/pulse/native")
+    fi
+
+    if [ "$TPM_ENABLE" = "YES" ]; then
+        install -d -m 0700 "$swtpm_path"
+        swtpm socket --tpm2 --tpmstate dir="$swtpm_path" --ctrl type=unixio,path="$swtpm_sock" &
+        local tpm_pid=$!
+        pids+=("$tpm_pid")
+        additional_args+=(-chardev "socket,id=chrtpm,path=$swtpm_sock"
+                          -tpmdev "emulator,id=tpm0,chardev=chrtpm"
+                          -device "tpm-tis,tpmdev=tpm0")
+    fi
+
+    if [ "$GTK_ENABLE" = "YES" ]; then
+        additional_args+=(
+            -device 'virtio-gpu-gl,hostmem=8G,blob=true,venus=true'
+            -display 'gtk,gl=on'
+            -vga virtio
+        )
+    fi
+
+
+    vms+=("$name")
+
+    local pidfile="/run/qemurc/${name}/pid"
+
+    local launch_cmd=()
+    launch_cmd+=(
+        launch_pidfile "$pidfile"
+        qemu-system-x86_64
+        -accel kvm
+        -cpu host
+        -smp cores="$CPU_CORES"
+        -m "$MEMORY"
+        -rtc base=localtime
+        -drive "file=\"@OVMFfd@/FV/OVMF_CODE.fd\",if=pflash,format=raw,readonly=on"
+        -drive "if=pflash,format=raw,file=\"$(readlink -f "${mount_path}/OVMF_VARS.fd")\""
+        -drive "if=none,file=/dev/zvol/${zfs_path}/disk0,format=raw,id=hd0"
+        -device 'nvme,serial=deadbeef,drive=hd0'
+        -nic 'user,hostfwd=tcp::60022-:22'
+        -boot order=d
+        "${additional_args[@]}"
+    )
+    set +e
+    rm -f "$pidfile"
+    (
+        IFS=$' \n\t'
+        set -ex
+        bash -c "${launch_cmd[*]}"
+    )
+    local exit_code=$?
+    log "Exit code ${exit_code}"
+    set -e
+}
+
+main "${@}"

nix/configuration/roles/rpcs3/default.nix

@@ -70,28 +70,26 @@ in
           }
         ];
 
-        home-manager.users.talexander =
+        me.install.user.talexander.file = {
-          { pkgs, ... }:
+          ".config/rpcs3/config.yml" = lib.mkIf (config.me.rpcs3.config != null) {
-          {
+            source = rpcs3_config_yaml;
-            home.file.".config/rpcs3/config.yml" = lib.mkIf (config.me.rpcs3.config != null) {
-              source = rpcs3_config_yaml;
-            };
-            home.file.".config/rpcs3/GuiConfigs/CurrentSettings.ini" = {
-              source = ./files/CurrentSettings.ini;
-            };
-            home.file.".config/rpcs3/custom_configs/config_BLUS30443.yml" = {
-              # Demon's Souls per-game config.
-              source = ./files/config_BLUS30443.yml;
-            };
-            home.file.".config/rpcs3/patches/patch.yml" = {
-              # All of the available patches.
-              source = ./files/patch.yml;
-            };
-            home.file.".config/rpcs3/patch_config.yml" = {
-              # Patches that I have enabled.
-              source = ./files/patch_config.yml;
-            };
           };
+          ".config/rpcs3/GuiConfigs/CurrentSettings.ini" = {
+            source = ./files/CurrentSettings.ini;
+          };
+          ".config/rpcs3/custom_configs/config_BLUS30443.yml" = {
+            # Demon's Souls per-game config.
+            source = ./files/config_BLUS30443.yml;
+          };
+          ".config/rpcs3/patches/patch.yml" = {
+            # All of the available patches.
+            source = ./files/patch.yml;
+          };
+          ".config/rpcs3/patch_config.yml" = {
+            # Patches that I have enabled.
+            source = ./files/patch_config.yml;
+          };
+        };
 
         environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
           hideMounts = true;

nix/configuration/roles/rust/default.nix

@@ -48,18 +48,14 @@ in
           # ? cargo-public-api
         ];
 
-        home-manager.users.talexander =
+        me.install.user.talexander.file = {
-          { pkgs, ... }:
+          ".cargo/config.toml" = {
-          {
+            source = ./files/cargo_config.toml;
-            home.file = {
-              ".cargo/config.toml" = {
-                source = ./files/cargo_config.toml;
-              };
-              ".rustup/settings.toml" = {
-                source = ./files/rustup_settings.toml;
-              };
-            };
           };
+          ".rustup/settings.toml" = {
+            source = ./files/rustup_settings.toml;
+          };
+        };
 
         environment.persistence."/state" = lib.mkIf (!config.me.buildingIso) {
           hideMounts = true;

nix/configuration/roles/sequoia/default.nix

@@ -0,0 +1,29 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    sequoia.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install sequoia.";
+    };
+  };
+
+  config = lib.mkIf config.me.sequoia.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+          sequoia-sq
+        ];
+      }
+    ]
+  );
+}

nix/configuration/roles/shadps4/default.nix

@@ -24,13 +24,11 @@
           shadps4
         ];
 
-        home-manager.users.talexander =
+        me.install.user.talexander.file = {
-          { pkgs, ... }:
+          ".local/share/shadPS4/config.toml" = {
-          {
+            source = ./files/config.toml;
-            home.file.".local/share/shadPS4/config.toml" = {
-              source = ./files/config.toml;
-            };
           };
+        };
 
         environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
           hideMounts = true;

nix/configuration/roles/shikane/default.nix

@@ -36,15 +36,11 @@ in
           exec_shikane
         ];
 
-        home-manager.users.talexander =
+        me.install.user.talexander.file = {
-          { pkgs, ... }:
+          ".config/shikane/config.toml" = {
-          {
+            source = ./files/config.toml;
-            home.file = {
-              ".config/shikane/config.toml" = {
-                source = ./files/config.toml;
-              };
-            };
           };
+        };
       })
     ]
   );

nix/configuration/roles/shikane/files/config.toml

@@ -1,3 +1,15 @@
+[[profile]]
+name = "laptop"
+
+[[profile.output]]
+enable = true
+search = ["m=0x0BCA", "s=", "v=BOE"]
+mode = "2256x1504@59.999Hz"
+position = "0,0"
+scale = 1.5
+transform = "normal"
+adaptive_sync = false
+
 [[profile]]
   name = "homedesk"
   exec = ["notify-send shikane \"Profile $SHIKANE_PROFILE_NAME has been applied\""]

nix/configuration/roles/spaghettikart/default.nix

@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    spaghettikart.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install spaghettikart.";
+    };
+  };
+
+  config = lib.mkIf config.me.spaghettikart.enable (
+    lib.mkMerge [
+      {
+        allowedUnfree = [ "spaghettikart" ];
+      }
+      (lib.mkIf config.me.graphical {
+        environment.systemPackages = with pkgs; [
+          spaghettikart
+        ];
+
+        me.install.user.talexander.file = {
+          ".local/share/spaghettikart/spaghettify.cfg.json" = {
+            source = ./files/spaghettify.cfg.json;
+            method = "overwrite";
+          };
+        };
+
+        environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          users.talexander = {
+            files = [
+              ".local/share/spaghettikart/default.sav"
+              ".local/share/spaghettikart/mk64.o2r"
+            ];
+          };
+        };
+      })
+    ]
+  );
+}

nix/configuration/roles/spaghettikart/files/spaghettify.cfg.json

@@ -0,0 +1,14 @@
+{
+  "CVars": {
+    "gDisableLod": 1,
+    "gMSAAValue": 2,
+    "gShowSpaghettiVersion": 0,
+    "gSkipIntro": 1,
+    "gVsyncEnabled": 1
+  },
+  "Window": {
+    "Fullscreen": {
+      "Enabled": true
+    }
+  }
+}

nix/configuration/roles/ssh/default.nix

@@ -27,19 +27,14 @@
     };
   };
 
-  home-manager.users.talexander =
+  me.install.user.root.file = {
-    { pkgs, ... }:
+    ".ssh/config" = {
-    {
+      source = ./files/ssh_config_root;
-      home.file.".ssh/config" = {
-        source = ./files/ssh_config;
-      };
     };
-
+  };
-  home-manager.users.root =
+  me.install.user.talexander.file = {
-    { pkgs, ... }:
+    ".ssh/config" = {
-    {
+      source = ./files/ssh_config;
-      home.file.".ssh/config" = {
-        source = ./files/ssh_config_root;
-      };
     };
+  };
 }

nix/configuration/roles/sway/default.nix

@@ -376,26 +376,18 @@ in
       };
     };
 
-    home-manager.users.talexander =
+    me.install.user.talexander.file = {
-      { pkgs, ... }:
+      ".config/mimeapps.list" = {
-      {
+        # Configure default programs (for example, default browser)
-        home.file = {
+        source = ./files/mimeapps.list;
-          # Configure default programs (for example, default browser)
-          ".config/mimeapps.list" = {
-            source = ./files/mimeapps.list;
-          };
-        };
-        home.file = {
-          ".config/gtk-3.0/settings.ini" = {
-            source = ./files/settings.ini;
-          };
-        };
-        home.file = {
-          ".icons/default" = {
-            source = "${pkgs.adwaita-icon-theme}/share/icons/Adwaita";
-          };
-        };
       };
+      ".config/gtk-3.0/settings.ini" = {
+        source = ./files/settings.ini;
+      };
+      ".icons/default" = {
+        source = "${pkgs.adwaita-icon-theme}/share/icons/Adwaita";
+      };
+    };
 
     # For mounting drives in pcmanfm
     services.gvfs.enable = true;

nix/configuration/roles/uutils/default.nix

@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    uutils.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to replace GNU coreutils with uutils (a rust drop-in replacement).";
+    };
+  };
+
+  config = lib.mkIf config.me.uutils.enable (
+    lib.mkMerge [
+      {
+        # environment.corePackages automatically installes coreutils-full, so merely installing uutils-coreutils-noprefix is insufficient for replacing GNU coreutils.
+        nixpkgs.overlays = [
+          (final: prev: {
+            coreutils = final.uutils-coreutils-noprefix;
+            coreutils-full = final.uutils-coreutils-noprefix;
+          })
+        ];
+      }
+    ]
+  );
+}

nix/configuration/roles/vscode/default.nix

@@ -48,16 +48,14 @@
           })
         ];
 
-        home-manager.users.talexander =
+        me.install.user.talexander.file = {
-          { pkgs, ... }:
+          ".config/Code/User/settings.json" = {
-          {
+            source = ./files/settings.json;
-            home.file.".config/Code/User/settings.json" = {
-              source = ./files/settings.json;
-            };
-            home.file.".config/Code/User/keybindings.json" = {
-              source = ./files/keybindings.json;
-            };
           };
+          ".config/Code/User/keybindings.json" = {
+            source = ./files/keybindings.json;
+          };
+        };
       })
     ]
   );

nix/configuration/roles/vscode/files/keybindings.json

@@ -20,6 +20,12 @@
         "command": "-workbench.action.navigateBack",
         "when": "canNavigateBack"
     },
+  {
+    // This isn't quite right. In emacs it would go back to the last location you performed an action which could include navigation. This goes back to the place where you last changed the text. Either way, close enough.
+        "key": "ctrl+x ctrl+x",
+        "command": "workbench.action.navigateToLastEditLocation",
+        "when": "canNavigateToLastEditLocation"
+    },
     {
         "key": "shift+alt+/",
         "command": "editor.action.goToReferences",

nix/configuration/roles/vscode/files/settings.json

@@ -18,6 +18,7 @@
   "workbench.editor.showTabs": "none",
   "workbench.activityBar.location": "hidden",
   "window.menuBarVisibility": "toggle",
+  "window.commandCenter": false,
   "explorer.autoReveal": false,
   "[python]": {
     "editor.defaultFormatter": "ms-python.black-formatter",
@@ -35,11 +36,21 @@
     "editor.defaultFormatter": "esbenp.prettier-vscode",
     "editor.formatOnSave": true
   },
+  "[typescriptreact]": {
+    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.formatOnSave": true
+  },
+  "javascript.autoClosingTags": false,
+  "typescript.autoClosingTags": false,
   "black-formatter.importStrategy": "fromEnvironment",
   "workbench.statusBar.visible": false,
   "git.openRepositoryInParentFolders": "never",
   "files.autoSave": "afterDelay",
   "editor.rulers": [
     100
-  ]
+  ],
+  "workbench.secondarySideBar.defaultVisibility": "hidden",
+  "editor.autoClosingBrackets": "never",
+  "editor.autoSurround": "never",
+  "workbench.editor.navigationScope": "editorGroup"
 }

nix/configuration/roles/waybar/default.nix

@@ -113,18 +113,14 @@ in
 
         services.upower.enable = true; # for battery
 
-        home-manager.users.talexander =
+        me.install.user.talexander.file = {
-          { pkgs, ... }:
+          ".config/waybar/config" = {
-          {
+            source = ./files/waybar_config.json;
-            home.file = {
-              ".config/waybar/config" = {
-                source = ./files/waybar_config.json;
-              };
-              ".config/waybar/style.css" = {
-                source = ./files/style.css;
-              };
-            };
           };
+          ".config/waybar/style.css" = {
+            source = ./files/style.css;
+          };
+        };
       })
     ]
   );

nix/configuration/roles/yubikey/default.nix

@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    yubikey.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install yubikey.";
+    };
+  };
+
+  config = lib.mkIf config.me.yubikey.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+          yubikey-personalization
+          yubikey-manager
+        ];
+      }
+    ]
+  );
+}

nix/configuration/roles/zsh/default.nix

@@ -90,13 +90,11 @@ in
           enable = true;
         };
 
-        home-manager.users.talexander =
+        me.install.user.talexander.file = {
-          { pkgs, ... }:
+          ".zshrc" = {
-          {
+            source = "${zshrc}";
-            home.file.".zshrc" = {
-              source = "${zshrc}";
-            };
           };
+        };
 
         environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
           hideMounts = true;
@@ -111,6 +109,12 @@ in
             ];
           };
         };
+
+        nixpkgs.overlays = [
+          (final: prev: {
+            zsh-histdb = (final.callPackage ./package/zsh-histdb/package.nix { });
+          })
+        ];
       }
     ]
   );

nix/configuration/util/install_files/default.nix

@@ -0,0 +1,333 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.me.install;
+  inherit (lib)
+    filter
+    attrNames
+    ;
+
+  get_shell_values =
+    target:
+    let
+      homedir = config.users.users."${target.username}".home;
+      group = config.users.users."${target.username}".group;
+    in
+    {
+      source = lib.strings.escapeShellArg "${target.source}";
+      destination = lib.strings.escapeShellArg "${homedir}/${target.target}";
+      mode = lib.strings.escapeShellArg "${target.mode}";
+      dir_mode = lib.strings.escapeShellArg "${target.dir_mode}";
+      username = lib.strings.escapeShellArg "${target.username}";
+      group = lib.strings.escapeShellArg "${group}";
+    };
+  install_user_file =
+    let
+      constructors = {
+        "overwrite" = install_user_file_overwrite;
+        "symlink" = install_user_file_symlink;
+      };
+    in
+    stage: target: (constructors."${target.method}"."${stage}" target);
+  install_user_file_overwrite = {
+    "check" = (target: "");
+    "install" = (
+      target:
+      let
+        inherit (get_shell_values target)
+          source
+          destination
+          mode
+          dir_mode
+          username
+          group
+          ;
+        flags = lib.strings.concatStringsSep " " [
+          (if mode != "" then "-m ${mode}" else "")
+          (if username != "" then "-o ${username}" else "")
+          (if group != "" then "-g ${group}" else "")
+        ];
+        dir_flags = lib.strings.concatStringsSep " " [
+          (if dir_mode != "" then "-m ${dir_mode}" else "")
+          (if username != "" then "-o ${username}" else "")
+          (if group != "" then "-g ${group}" else "")
+        ];
+      in
+      if target.recursive then
+        [
+          ''
+            find ${source} -type f -print0 | while read -r -d "" file; do
+                relative_path=$(realpath -s --relative-to ${source} "$file")
+                full_dest=${destination}/"$relative_path"
+                create_containing_directories "$full_dest" ${dir_flags}
+                $DRY_RUN_CMD install $VERBOSE_ARG --compare ${flags} "$file" "$full_dest"
+            done
+          ''
+        ]
+      else
+        [
+          ''
+            create_containing_directories ${destination} ${dir_flags}
+            $DRY_RUN_CMD install $VERBOSE_ARG --compare ${flags} ${source} ${destination}
+          ''
+        ]
+    );
+    "uninstall" = (
+      target:
+      let
+        inherit (get_shell_values target)
+          source
+          destination
+          ;
+      in
+      if target.recursive then
+        [
+          ''
+            find ${source} -type f -print0 | while read -r -d "" file; do
+                relative_path=$(realpath -s --relative-to ${source} "$file")
+                full_dest=${destination}/"$relative_path"
+                $DRY_RUN_CMD echo rm -f "$full_dest"
+            done
+          ''
+        ]
+      else
+        [
+          ''
+            $DRY_RUN_CMD echo rm -f ${destination}
+          ''
+        ]
+    );
+  };
+  install_user_file_symlink = {
+    "check" = (target: "");
+    "install" = (
+      target:
+      let
+        inherit (get_shell_values target)
+          source
+          destination
+          mode
+          dir_mode
+          username
+          group
+          ;
+        owner = lib.strings.concatStringsSep ":" (
+          filter (val: val != "") [
+            username
+            group
+          ]
+        );
+        dir_flags = lib.strings.concatStringsSep " " [
+          (if dir_mode != "" then "-m ${dir_mode}" else "")
+          (if username != "" then "-o ${username}" else "")
+          (if group != "" then "-g ${group}" else "")
+        ];
+      in
+      if target.recursive then
+        [
+          ''
+            find ${source} -type f -print0 | while read -r -d "" file; do
+                relative_path=$(realpath -s --relative-to ${source} "$file")
+                full_dest=${destination}/"$relative_path"
+                create_containing_directories "$full_dest" ${dir_flags}
+                $DRY_RUN_CMD ln $VERBOSE_ARG -s "$file" "$full_dest"
+                $DRY_RUN_CMD chown $VERBOSE_ARG -h ${owner} "$full_dest"
+            done
+          ''
+        ]
+      else
+        [
+          ''
+            create_containing_directories ${destination} ${dir_flags}
+            $DRY_RUN_CMD ln $VERBOSE_ARG -s ${source} ${destination}
+            $DRY_RUN_CMD chown $VERBOSE_ARG -h ${owner} ${destination}
+          ''
+        ]
+    );
+    "uninstall" = (
+      target:
+      let
+        inherit (get_shell_values target)
+          source
+          destination
+          ;
+      in
+      if target.recursive then
+        [
+          ''
+            find ${source} -type f -print0 | while read -r -d "" file; do
+                relative_path=$(realpath -s --relative-to ${source} "$file")
+                full_dest=${destination}/"$relative_path"
+                $DRY_RUN_CMD echo rm -f "$full_dest"
+            done
+          ''
+        ]
+      else
+        [
+          ''
+            $DRY_RUN_CMD echo rm -f ${destination}
+          ''
+        ]
+    );
+  };
+in
+{
+  imports = [ ];
+
+  options.me.install = {
+    user = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule (
+          { name, config, ... }:
+          let
+            username = name;
+          in
+          {
+            options = {
+              enable = lib.mkOption {
+                type = lib.types.bool;
+                default = true;
+                defaultText = "enable";
+                example = lib.literalExpression false;
+                description = "Whether we want to install files in this user's home directory.";
+              };
+
+              file = lib.mkOption {
+                type = lib.types.attrsOf (
+                  lib.types.submodule (
+                    { name, config, ... }:
+                    let
+                      path = name;
+                    in
+                    {
+                      options = {
+                        enable = lib.mkOption {
+                          type = lib.types.bool;
+                          default = true;
+                          defaultText = "enable";
+                          example = lib.literalExpression false;
+                          description = "Whether we want to install this file in this user's home directory.";
+                        };
+                        username = lib.mkOption {
+                          type = lib.types.str;
+                          defaultText = "username";
+                          example = "root";
+                          description = "The username for the user whose home directory will contain the file.";
+                        };
+                        target = lib.mkOption {
+                          type = lib.types.str;
+                          defaultText = "target";
+                          example = ".local/share/foo/bar.txt";
+                          description = "The path where the file should be written.";
+                        };
+                        method = lib.mkOption {
+                          type = lib.types.enum [
+                            "symlink"
+                            "overwrite"
+                            # "bind_mount" TODO: for directories?
+                          ];
+                          default = "symlink";
+                          defaultText = "me.install.file.‹path›.method";
+                          example = "overwrite";
+                          description = "The way in which the file should be installed.";
+                        };
+                        mode = lib.mkOption {
+                          type = lib.types.str;
+                          default = "0444";
+                          defaultText = "me.install.file.‹path›.mode";
+                          example = "0750";
+                          description = "The read, write, execute permission flags.";
+                        };
+                        dir_mode = lib.mkOption {
+                          type = lib.types.str;
+                          default = "0755";
+                          defaultText = "dir_mode";
+                          example = "0755";
+                          description = "The read, write, execute permission flags for any parent directories that need to be created.";
+                        };
+                        source = lib.mkOption {
+                          type = lib.types.path;
+                          defaultText = "me.install.file.‹path›.source";
+                          example = ./files/foo.txt;
+                          description = "The source file to install into the destination.";
+                        };
+                        recursive = lib.mkOption {
+                          type = lib.types.bool;
+                          default = false;
+                          defaultText = "recursive";
+                          example = lib.literalExpression false;
+                          description = "Whether we want to recurse through the directory doing individual installs for each file.";
+                        };
+                      };
+
+                      config = {
+                        username = lib.mkDefault username;
+                        target = lib.mkDefault path;
+                      };
+                    }
+                  )
+                );
+              };
+            };
+          }
+        )
+      );
+    };
+  };
+
+  config =
+    let
+      all_users = builtins.map (username: cfg.user."${username}") (attrNames cfg.user);
+      enabled_users = filter (user: user.enable) all_users;
+      all_file_targets = lib.flatten (
+        builtins.map (user: (builtins.map (path: user.file."${path}") (attrNames user.file))) enabled_users
+      );
+      enabled_file_targets = filter (target: target.enable) all_file_targets;
+      check_commands = lib.flatten (builtins.map (install_user_file "check") enabled_file_targets);
+      install_commands = lib.flatten (builtins.map (install_user_file "install") enabled_file_targets);
+      uninstall_commands = lib.flatten (
+        builtins.map (install_user_file "uninstall") enabled_file_targets
+      );
+    in
+    {
+      systemd.services.me-install-file = {
+        enable = true;
+        description = "me-install-file";
+        wantedBy = [ "multi-user.target" ];
+        wants = [ "multi-user.target" ];
+        before = [ "multi-user.target" ];
+        # path = with pkgs; [
+        #   zfs
+        # ];
+        unitConfig.DefaultDependencies = "no";
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = "yes";
+        };
+        script =
+          ''
+            set -o pipefail
+            IFS=$'\n\t'
+            source ${./files/lib.bash}
+          ''
+          + (lib.strings.concatStringsSep "\n" (
+            [
+            ]
+            ++ check_commands
+            ++ install_commands
+          ));
+        preStop =
+          ''
+            set -o pipefail
+            IFS=$'\n\t'
+            source ${./files/lib.bash}
+          ''
+          + (lib.strings.concatStringsSep "\n" uninstall_commands);
+      };
+    };
+}

nix/configuration/util/install_files/files/lib.bash

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+#
+
+############## Setup #########################
+
+function die {
+    local status_code="$1"
+    shift
+    (>&2 echo "${@}")
+    exit "$status_code"
+}
+
+function log {
+    (>&2 echo "${@}")
+}
+
+############## Program #########################
+
+function create_containing_directories {
+    local full_dest="$1"
+    shift 1
+    local dirs_to_create=()
+    local containing_directory="$full_dest"
+    while true; do
+        containing_directory=$(dirname "$containing_directory")
+        if [ -e "$containing_directory" ] || [ "$containing_directory" = "/" ]; then
+            break
+        fi
+        dirs_to_create+=($containing_directory)
+    done
+
+    for (( idx=${#dirs_to_create[@]}-1 ; idx>=0 ; idx-- )) ; do
+        local containing_directory="${dirs_to_create[idx]}"
+        log "Creating $containing_directory"
+        $DRY_RUN_CMD install $VERBOSE_ARG -d "${@}" "$containing_directory"
+    done
+
+}

nix/steam_deck/configuration/flake.lock

@@ -1,12 +1,15 @@
 {
   "nodes": {
     "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
       "locked": {
-        "lastModified": 1659877975,
+        "lastModified": 1731533236,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
@@ -22,11 +25,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1739314552,
+        "lastModified": 1757698511,
-        "narHash": "sha256-ggVf2BclyIW3jexc/uvgsgJH4e2cuG6Nyg54NeXgbFI=",
+        "narHash": "sha256-UqHHGydF/q3jfYXCpvYLA0TWtvByOp1NwOKCUjhYmPs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "83bd3a26ac0526ae04fa74df46738bb44b89dcdd",
+        "rev": "a3fcc92180c7462082cd849498369591dfb20855",
         "type": "github"
       },
       "original": {
@@ -58,11 +61,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1713543440,
+        "lastModified": 1752054764,
-        "narHash": "sha256-lnzZQYG0+EXl/6NkGpyIz+FEOc/DSEG57AP1VsdeNrM=",
+        "narHash": "sha256-Ob/HuUhANoDs+nvYqyTKrkcPXf4ZgXoqMTQoCK0RFgQ=",
         "owner": "nix-community",
         "repo": "nixGL",
-        "rev": "310f8e49a149e4c9ea52f1adf70cdc768ec53f8a",
+        "rev": "a8e1ce7d49a149ed70df676785b07f63288f53c5",
         "type": "github"
       },
       "original": {
@@ -73,11 +76,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1739138025,
+        "lastModified": 1757746433,
-        "narHash": "sha256-M4ilIfGxzbBZuURokv24aqJTbdjPA9K+DtKUzrJaES4=",
+        "narHash": "sha256-fEvTiU4s9lWgW7mYEU/1QUPirgkn+odUBTaindgiziY=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b2243f41e860ac85c0b446eadc6930359b294e79",
+        "rev": "6d7ec06d6868ac6d94c371458fc2391ded9ff13d",
         "type": "github"
       },
       "original": {
@@ -94,6 +97,21 @@
         "nixgl": "nixgl",
         "nixpkgs": "nixpkgs"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

nix/steam_deck/configuration/flake.nix

@@ -4,8 +4,10 @@
 
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
-    nixgl.url = "github:nix-community/nixGL";
+    nixgl = {
-    nixgl.inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:nix-community/nixGL";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -23,6 +25,7 @@
       ...
     }:
     let
+      forAllSystems = nixpkgs.lib.genAttrs nixpkgs.lib.systems.flakeExposed;
       system = "x86_64-linux";
       pkgs = import nixpkgs {
         inherit system;
@@ -31,7 +34,7 @@
     in
     # pkgs = nixpkgs.legacyPackages.${system};
     {
-      defaultPackage.${system} = home-manager.defaultPackage.${system};
+      defaultPackage.${system} = home-manager.packages.${system}.default;
       homeConfigurations."deck" = home-manager.lib.homeManagerConfiguration {
         inherit pkgs;
 

nix/steam_deck/configuration/home.nix

@@ -18,6 +18,7 @@
     ./roles/ryujinx
     ./roles/shipwright
     ./roles/sm64ex
+    ./roles/spaghettikart
     ./roles/steam_rom_manager
     ./roles/yuzu
     ./util/copy_files

nix/steam_deck/configuration/hosts/deck/default.nix

@@ -20,6 +20,7 @@
     me.ship2harkinian.enable = true;
     me.shipwright.enable = true;
     me.sm64ex.enable = true;
+    me.spaghettikart.enable = true;
     me.steam_rom_manager.enable = true; # Steam rom manager UI does not render. I think it wants to be in an AppImage.
     me.yuzu.enable = true;
   };

nix/steam_deck/configuration/roles/duckstation/default.nix

@@ -51,6 +51,7 @@ in
           (
             final: prev:
             let
+              modified_package = (pkgs.callPackage ./package/package.nix { });
               optimizeWithFlags =
                 pkg: flags:
                 pkg.overrideAttrs (old: {
@@ -58,16 +59,16 @@ in
                 });
               original_package =
                 if config.me.optimizations.enable then
-                  (optimizeWithFlags prev.duckstation [
+                  (optimizeWithFlags modified_package [
                     "-march=znver2"
                     "-mtune=znver2"
                   ])
                 else
-                  prev.duckstation;
+                  modified_package;
             in
             {
               duckstation = pkgs.buildEnv {
-                name = prev.duckstation.name;
+                name = original_package.name;
                 paths = [
                   (config.lib.nixGL.wrap original_package)
                 ];