Add support for setting the group owning the file.

This is remove duplication between the individual hosts folders.

nix/configuration/configuration.nix

@@ -16,6 +16,7 @@
     ./roles/boot
     ./roles/chromecast
     ./roles/chromium
+    ./roles/distributed_build
     ./roles/docker
     ./roles/ecc
     ./roles/emacs
@@ -31,6 +32,7 @@
     ./roles/graphics
     ./roles/hydra
     ./roles/iso
+    ./roles/iso_mount
     ./roles/kanshi
     ./roles/kodi
     ./roles/kubernetes
@@ -41,11 +43,14 @@
     ./roles/memtest86
     ./roles/network
     ./roles/nix_index
+    ./roles/nix_worker
     ./roles/nvme
+    ./roles/optimized_build
     ./roles/pcsx2
     ./roles/python
     ./roles/qemu
     ./roles/reset
+    ./roles/rpcs3
     ./roles/rust
     ./roles/shikane
     ./roles/shipwright
@@ -67,9 +72,14 @@
     ./roles/zfs
     ./roles/zrepl
     ./roles/zsh
+    ./util/install_files
     ./util/unfree_polyfill
   ];
 
+  me.install.user.talexander.file."/home/talexander/flake.nix" = {
+    source = ./flake.nix;
+  };
+
   nix.settings.experimental-features = [
     "nix-command"
     "flakes"
@@ -82,6 +92,16 @@
   # Use nixos-rebuild-ng
   # system.rebuild.enableNg = true;
 
+  # Keep outputs so we can build offline.
+  nix.extraOptions = ''
+    keep-outputs = true
+    keep-derivations = true
+  '';
+
+  # Technically only needed when building the ISO because nix detects ZFS in the filesystem list normally. I basically always want this so I'm just setting it to always be on.
+  boot.supportedFilesystems.zfs = true;
+  # TODO: Is this different from boot.supportedFilesystems = [ "zfs" ]; ?
+
   services.getty = {
     autologinUser = "talexander"; # I use full disk encryption so the user password is irrelevant.
     autologinOnce = true;
@@ -168,6 +188,7 @@
     ipcalc
     gptfdisk # for cgdisk
     nix-output-monitor # For better view into nixos-rebuild
+    nix-serve-ng # Serve nix store over http
   ];
 
   services.openssh = {

nix/configuration/flake.lock

@@ -39,11 +39,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745812220,
+        "lastModified": 1746729224,
-        "narHash": "sha256-hotBG0EJ9VmAHJYF0yhWuTVZpENHvwcJ2SxvIPrXm+g=",
+        "narHash": "sha256-9R4sOLAK1w3Bq54H3XOJogdc7a6C2bLLmatOQ+5pf5w=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "d0c543d740fad42fe2c035b43c9d41127e073c78",
+        "rev": "85555d27ded84604ad6657ecca255a03fd878607",
         "type": "github"
       },
       "original": {
@@ -154,11 +154,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746369725,
+        "lastModified": 1746981801,
-        "narHash": "sha256-m3ai7LLFYsymMK0uVywCceWfUhP0k3CALyFOfcJACqE=",
+        "narHash": "sha256-+Bfr0KqZV6gZdA7e2kupeoawozaLIHLuiPtC54uxbFc=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "1a1793f6d940d22c6e49753548c5b6cb7dc5545d",
+        "rev": "ff915842e4a2e63c4c8c5c08c6870b9d5b3c3ee9",
         "type": "github"
       },
       "original": {
@@ -210,11 +210,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746232882,
+        "lastModified": 1746663147,
-        "narHash": "sha256-MHmBH2rS8KkRRdoU/feC/dKbdlMkcNkB5mwkuipVHeQ=",
+        "narHash": "sha256-Ua0drDHawlzNqJnclTJGf87dBmaO/tn7iZ+TCkTRpRc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7a2622e2c0dbad5c4493cb268aba12896e28b008",
+        "rev": "dda3dcd3fe03e991015e9a74b22d35950f264a54",
         "type": "github"
       },
       "original": {
@@ -258,11 +258,11 @@
     },
     "nixpkgs-unoptimized": {
       "locked": {
-        "lastModified": 1746232882,
+        "lastModified": 1746663147,
-        "narHash": "sha256-MHmBH2rS8KkRRdoU/feC/dKbdlMkcNkB5mwkuipVHeQ=",
+        "narHash": "sha256-Ua0drDHawlzNqJnclTJGf87dBmaO/tn7iZ+TCkTRpRc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7a2622e2c0dbad5c4493cb268aba12896e28b008",
+        "rev": "dda3dcd3fe03e991015e9a74b22d35950f264a54",
         "type": "github"
       },
       "original": {

nix/configuration/flake.nix

@@ -29,12 +29,12 @@
 # Install on a new machine:
 #
 #
-# doas nix --experimental-features "nix-command flakes" run github:nix-community/disko/latest -- --mode destroy,format,mount hosts/quark/disk-config.nix
+# doas nix --substituters "http://10.0.2.2:8080?trusted=1 https://cache.nixos.org/" --experimental-features "nix-command flakes" run github:nix-community/disko/latest -- --mode destroy,format,mount hosts/odo/disk-config.nix
 
 # nix flake update zsh-histdb --flake .
 # nix flake update ansible-sshjail --flake .
 # for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-# nixos-install --flake ".#quark"
+# nixos-install --substituters "http://10.0.2.2:8080?trusted=1 https://cache.nixos.org/" --flake ".#vm_ionlybootzfs"
 #
 
 {
@@ -115,120 +115,158 @@
           ./configuration.nix
         ];
       };
-      systems = {
+      systems =
-        odo = {
+        let
-          main = nixpkgs.lib.nixosSystem (
+          additional_iso_modules = [
-            base_x86_64_linux
+            (nixpkgs + "/nixos/modules/installer/cd-dvd/iso-image.nix")
-            // {
+            # TODO: Figure out how to do image based appliances
+            # (nixpkgs + "/nixos/modules/profiles/image-based-appliance.nix")
+            {
+              isoImage.makeEfiBootable = true;
+              isoImage.makeUsbBootable = true;
+              me.buildingIso = true;
+              me.optimizations.enable = nixpkgs.lib.mkForce false;
+            }
+            {
+              # These are big space hogs. The chance that I need them on an ISO is slim.
+              me.steam.enable = nixpkgs.lib.mkForce false;
+              me.pcsx2.enable = nixpkgs.lib.mkForce false;
+            }
+          ];
+          additional_vm_modules = [
+            (nixpkgs + "/nixos/modules/profiles/qemu-guest.nix")
+            {
+              networking.dhcpcd.enable = true;
+              networking.useDHCP = true;
+              me.optimizations.enable = nixpkgs.lib.mkForce false;
+            }
+            {
+              # I don't need games on a virtual machine.
+              me.steam.enable = nixpkgs.lib.mkForce false;
+              me.pcsx2.enable = nixpkgs.lib.mkForce false;
+              me.sm64ex.enable = nixpkgs.lib.mkForce false;
+              me.shipwright.enable = nixpkgs.lib.mkForce false;
+              me.ship2harkinian.enable = nixpkgs.lib.mkForce false;
+            }
+          ];
+        in
+        {
+          odo = rec {
+            main = base_x86_64_linux // {
               modules = base_x86_64_linux.modules ++ [
                 ./hosts/odo
               ];
-            }
+            };
-          );
+            iso = main // {
-          iso = nixpkgs.lib.nixosSystem (
+              modules = main.modules ++ additional_iso_modules;
-            base_x86_64_linux
+            };
-            // {
+            vm = main // {
-              modules = base_x86_64_linux.modules ++ [
+              modules = main.modules ++ additional_vm_modules;
-                ./hosts/odo
+            };
-                (nixpkgs + "/nixos/modules/installer/cd-dvd/iso-image.nix")
+            vm_iso = main // {
-                # TODO: Figure out how to do image based appliances
+              modules = main.modules ++ additional_vm_modules ++ additional_iso_modules;
-                # (nixpkgs + "/nixos/modules/profiles/image-based-appliance.nix")
+            };
-                {
+          };
-                  isoImage.makeEfiBootable = true;
+          quark = rec {
-                  isoImage.makeUsbBootable = true;
+            main = base_x86_64_linux // {
-                  me.buildingIso = true;
-                  me.optimizations.enable = false;
-                }
-              ];
-            }
-          );
-        };
-        quark = {
-          main = nixpkgs.lib.nixosSystem (
-            base_x86_64_linux
-            // {
               modules = base_x86_64_linux.modules ++ [
                 ./hosts/quark
               ];
-            }
+            };
-          );
+            iso = main // {
-          iso = nixpkgs.lib.nixosSystem (
+              modules = main.modules ++ additional_iso_modules;
-            base_x86_64_linux
+            };
-            // {
+            vm = main // {
-              modules = base_x86_64_linux.modules ++ [
+              modules = main.modules ++ additional_vm_modules;
-                ./hosts/quark
+            };
-                (nixpkgs + "/nixos/modules/installer/cd-dvd/iso-image.nix")
+            vm_iso = main // {
-                # TODO: Figure out how to do image based appliances
+              modules = main.modules ++ additional_vm_modules ++ additional_iso_modules;
-                # (nixpkgs + "/nixos/modules/profiles/image-based-appliance.nix")
+            };
-                {
+          };
-                  isoImage.makeEfiBootable = true;
+          neelix = rec {
-                  isoImage.makeUsbBootable = true;
+            main = base_x86_64_linux // {
-                  me.buildingIso = true;
-                  me.optimizations.enable = false;
-                }
-              ];
-            }
-          );
-        };
-        neelix = {
-          main = nixpkgs.lib.nixosSystem (
-            base_x86_64_linux
-            // {
               modules = base_x86_64_linux.modules ++ [
                 ./hosts/neelix
               ];
-            }
+            };
-          );
+            iso = main // {
-          iso = nixpkgs.lib.nixosSystem (
+              modules = main.modules ++ additional_iso_modules;
-            base_x86_64_linux
+            };
-            // {
+            vm = main // {
-              modules = base_x86_64_linux.modules ++ [
+              modules = main.modules ++ additional_vm_modules;
-                ./hosts/neelix
+            };
-                (nixpkgs + "/nixos/modules/installer/cd-dvd/iso-image.nix")
+            vm_iso = main // {
+              modules = main.modules ++ additional_vm_modules ++ additional_iso_modules;
+            };
+          };
+          hydra =
+            let
+              additional_iso_modules = additional_iso_modules ++ [
                 {
-                  isoImage.makeEfiBootable = true;
+                  me.optimizations.enable = true;
-                  isoImage.makeUsbBootable = true;
-                  me.buildingIso = true;
-                  me.optimizations.enable = false;
                 }
               ];
-            }
+            in
-          );
+            rec {
-        };
+              main = base_x86_64_linux // {
-        hydra = {
+                modules = base_x86_64_linux.modules ++ [
-          main = nixpkgs.lib.nixosSystem (
+                  ./hosts/hydra
-            base_x86_64_linux
+                ];
-            // {
+              };
+              iso = main // {
+                modules = main.modules ++ additional_iso_modules;
+              };
+              vm = main // {
+                modules = main.modules ++ additional_vm_modules;
+              };
+              vm_iso = main // {
+                modules = main.modules ++ additional_vm_modules ++ additional_iso_modules;
+              };
+            };
+          ionlybootzfs = rec {
+            main = base_x86_64_linux // {
               modules = base_x86_64_linux.modules ++ [
-                ./hosts/hydra
+                ./hosts/ionlybootzfs
               ];
-            }
+            };
-          );
+            iso = main // {
-          iso = nixpkgs.lib.nixosSystem (
+              modules = main.modules ++ additional_iso_modules;
-            base_x86_64_linux
+            };
-            // {
+            vm = main // {
-              modules = base_x86_64_linux.modules ++ [
+              modules = main.modules ++ additional_vm_modules;
-                ./hosts/hydra
+            };
-                (nixpkgs + "/nixos/modules/installer/cd-dvd/iso-image.nix")
+            vm_iso = main // {
-                {
+              modules = main.modules ++ additional_vm_modules ++ additional_iso_modules;
-                  isoImage.makeEfiBootable = true;
+            };
-                  isoImage.makeUsbBootable = true;
+          };
-                  me.buildingIso = true;
+
-                }
-              ];
-            }
-          );
         };
-      };
     in
     {
-      nixosConfigurations.odo = systems.odo.main;
+      nixosConfigurations.odo = nixpkgs.lib.nixosSystem systems.odo.main;
-      iso.odo = systems.odo.iso.config.system.build.isoImage;
+      iso.odo = (nixpkgs.lib.nixosSystem systems.odo.iso).config.system.build.isoImage;
-      nixosConfigurations.quark = systems.quark.main;
+      nixosConfigurations.vm_odo = nixpkgs.lib.nixosSystem systems.odo.vm;
-      iso.quark = systems.quark.iso.config.system.build.isoImage;
+      vm_iso.odo = (nixpkgs.lib.nixosSystem systems.odo.vm_iso).config.system.build.isoImage;
-      nixosConfigurations.neelix = systems.neelix.main;
+
-      iso.neelix = systems.neelix.iso.config.system.build.isoImage;
+      nixosConfigurations.quark = nixpkgs.lib.nixosSystem systems.quark.main;
-      nixosConfigurations.hydra = systems.hydra.main;
+      iso.quark = (nixpkgs.lib.nixosSystem systems.quark.iso).config.system.build.isoImage;
-      iso.hydra = systems.hydra.iso.config.system.build.isoImage;
+      nixosConfigurations.vm_quark = nixpkgs.lib.nixosSystem systems.quark.vm;
+      vm_iso.quark = (nixpkgs.lib.nixosSystem systems.quark.vm_iso).config.system.build.isoImage;
+
+      nixosConfigurations.neelix = nixpkgs.lib.nixosSystem systems.neelix.main;
+      iso.neelix = (nixpkgs.lib.nixosSystem systems.neelix.iso).config.system.build.isoImage;
+      nixosConfigurations.vm_neelix = nixpkgs.lib.nixosSystem systems.neelix.vm;
+      vm_iso.neelix = (nixpkgs.lib.nixosSystem systems.neelix.vm_iso).config.system.build.isoImage;
+
+      nixosConfigurations.hydra = nixpkgs.lib.nixosSystem systems.hydra.main;
+      iso.hydra = (nixpkgs.lib.nixosSystem systems.hydra.iso).config.system.build.isoImage;
+      nixosConfigurations.vm_hydra = nixpkgs.lib.nixosSystem systems.hydra.vm;
+      vm_iso.hydra = (nixpkgs.lib.nixosSystem systems.hydra.vm_iso).config.system.build.isoImage;
+
+      nixosConfigurations.ionlybootzfs = nixpkgs.lib.nixosSystem systems.ionlybootzfs.main;
+      iso.ionlybootzfs = (nixpkgs.lib.nixosSystem systems.ionlybootzfs.iso).config.system.build.isoImage;
+      nixosConfigurations.vm_ionlybootzfs = nixpkgs.lib.nixosSystem systems.ionlybootzfs.vm;
+      vm_iso.ionlybootzfs =
+        (nixpkgs.lib.nixosSystem systems.ionlybootzfs.vm_iso).config.system.build.isoImage;
     };
 }

nix/configuration/hosts/hydra/default.nix

@@ -36,22 +36,33 @@
   time.timeZone = "America/New_York";
   i18n.defaultLocale = "en_US.UTF-8";
 
-  me.optimizations.enable = true;
   me.secureBoot.enable = false;
 
+  me.optimizations = {
+    enable = true;
+    arch = "znver4";
+    system_features = [
+      "gccarch-znver4"
+      "gccarch-skylake"
+      # "gccarch-alderlake" missing WAITPKG
+      "gccarch-x86-64-v3"
+      "gccarch-x86-64-v4"
+      "benchmark"
+      "big-parallel"
+      "kvm"
+      "nixos-test"
+    ];
+  };
+
   # Mount tmpfs at /tmp
   boot.tmp.useTmpfs = true;
 
   me.emacs_flavor = "plainmacs";
   me.graphical = false;
   me.hydra.enable = false;
+  me.nix_worker.enable = true;
   me.vm_disk.enable = true;
   me.wireguard.activated = [ ];
   me.wireguard.deactivated = [ ];
   me.zsh.enable = true;
-
-  # Trust this key so nix running as root can ssh into hydra.
-  users.users.talexander.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB/IlYTQ0M5pFN5tdoswh37CDl/gbULI3h+SsKXCansh talexander@odo"
-  ];
 }

nix/configuration/hosts/hydra/optimized_build.nix

@@ -1,73 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  imports = [ ];
-
-  config = lib.mkMerge [
-    {
-      nix.settings.system-features = lib.mkForce [
-        "gccarch-znver4"
-        "gccarch-x86-64-v3"
-        "gccarch-x86-64-v4"
-        "benchmark"
-        "big-parallel"
-        # "kvm"
-        # "nixos-test"
-      ];
-
-      nixpkgs.hostPlatform = {
-        gcc.arch = "znver4";
-        gcc.tune = "znver4";
-        system = "x86_64-linux";
-      };
-
-      nixpkgs.overlays = [
-        (
-          final: prev:
-          let
-            optimizeWithFlags =
-              pkg: flags:
-              pkg.overrideAttrs (old: {
-                NIX_CFLAGS_COMPILE = [ (old.NIX_CFLAGS_COMPILE or "") ] ++ flags;
-              });
-            addConfig =
-              additionalConfig: pkg:
-              pkg.override (oldconfig: {
-                structuredExtraConfig = pkg.structuredExtraConfig // additionalConfig;
-              });
-          in
-          {
-            linux_znver4 =
-              addConfig
-                {
-                  # Full preemption
-                  PREEMPT = lib.mkOverride 60 lib.kernel.yes;
-                  PREEMPT_VOLUNTARY = lib.mkOverride 60 lib.kernel.no;
-
-                  # Google's BBRv3 TCP congestion Control
-                  TCP_CONG_BBR = lib.kernel.yes;
-                  DEFAULT_BBR = lib.kernel.yes;
-
-                  # Preemptive Full Tickless Kernel at 300Hz
-                  HZ = lib.kernel.freeform "300";
-                  HZ_300 = lib.kernel.yes;
-                  HZ_1000 = lib.kernel.no;
-                }
-                (
-                  optimizeWithFlags prev.linux_6_14 [
-                    "-march=znver4"
-                    "-mtune=znver4"
-                  ]
-                );
-          }
-        )
-      ];
-
-      boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_znver4;
-    }
-  ];
-}

nix/configuration/hosts/ionlybootzfs/DEPLOY_BOOT

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+#
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+: "${JOBS:="1"}"
+
+#TARGET=10.216.1.14
+# TARGET=192.168.211.250
+TARGET="ionlybootzfs"
+
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
+for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
+
+nixos-rebuild boot --flake "$DIR/../../#ionlybootzfs" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+
+# rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild boot --flake /persist/manual/configuration#ionlybootzfs'

nix/configuration/hosts/ionlybootzfs/DEPLOY_SWITCH

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+#
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+: "${JOBS:="1"}"
+
+#TARGET=10.216.1.14
+# TARGET=192.168.211.250
+TARGET=ionlybootzfs
+
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
+for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
+
+nixos-rebuild switch --flake "$DIR/../../#ionlybootzfs" --target-host "$TARGET" --build-host "$TARGET" --fast --use-remote-sudo --max-jobs "$JOBS" "${@}" |& nom
+
+# rsync -av --progress --delete --exclude=.git "$DIR/../../../configuration" "talexander@${TARGET}:/persist/manual/" && ssh talexander@${TARGET} 'cd /persist/manual/configuration && nix flake update zsh-histdb && nix flake update ansible-sshjail && doas nice -n 19 nixos-rebuild switch --flake /persist/manual/configuration#ionlybootzfs'

nix/configuration/hosts/ionlybootzfs/ISO

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+#
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+: "${JOBS:="1"}"
+
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
+for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
+nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#iso.ionlybootzfs" --max-jobs "$JOBS" "${@}" |& nom

nix/configuration/hosts/ionlybootzfs/default.nix

@@ -0,0 +1,63 @@
+#
+# Testing:
+# doas "$(nix-build '<nixpkgs>' --no-out-link -A 'qemu')/bin/qemu-system-x86_64" \
+#      -accel kvm \
+#      -cpu host \
+#      -smp cores=8 \
+#      -m 32768 \
+#      -drive "file=$(nix-build '<nixpkgs>' --no-out-link -A 'OVMF.fd')/FV/OVMF.fd,if=pflash,format=raw,readonly=on" \
+#      -drive file=/tmp/localdisk.img,if=none,id=nvm,format=raw \
+#      -device nvme,serial=deadbeef,drive=nvm \
+#      -nic user,hostfwd=tcp::60022-:22 \
+#      -boot order=d \
+#      -cdrom "$(readlink -f /persist/machine_setup/nix/configuration/result/iso/nixos*.iso)" \
+#      -display vnc=127.0.0.1:0
+#
+
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  imports = [
+    ./wrapped-disk-config.nix
+    ./hardware-configuration.nix
+  ];
+
+  # Generate with `head -c4 /dev/urandom | od -A none -t x4`
+  networking.hostId = "fbd233d8";
+
+  networking.hostName = "ionlybootzfs"; # Define your hostname.
+
+  time.timeZone = "America/New_York";
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  me.secureBoot.enable = true;
+
+  me.optimizations = {
+    enable = false;
+    arch = "znver4";
+    system_features = [
+      "gccarch-znver4"
+      "gccarch-skylake"
+      # "gccarch-alderlake" missing WAITPKG
+      "gccarch-x86-64-v3"
+      "gccarch-x86-64-v4"
+      "benchmark"
+      "big-parallel"
+      "kvm"
+      "nixos-test"
+    ];
+  };
+
+  # Mount tmpfs at /tmp
+  boot.tmp.useTmpfs = true;
+
+  me.emacs_flavor = "plainmacs";
+  me.graphical = false;
+  me.wireguard.activated = [ ];
+  me.wireguard.deactivated = [ ];
+  me.zsh.enable = true;
+}

nix/configuration/hosts/ionlybootzfs/disk-config.nix

@@ -0,0 +1,142 @@
+# Manual Step:
+#   Check if drive supports 4kn: nvme id-ns -H /dev/nvme0n1
+#   Format the drive to 4kn: nvme format --lbaf=1 /dev/nvme0n1
+
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/nvme0n1";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [
+                  "umask=0077"
+                  "noatime"
+                  "discard"
+                ];
+              };
+            };
+            zfs = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        # mode = "mirror";
+        # Workaround: cannot import 'zroot': I/O error in disko tests
+        options.cachefile = "none";
+        options = {
+          ashift = "12";
+          compatibility = "openzfs-2.2-freebsd";
+          autotrim = "on";
+        };
+        rootFsOptions = {
+          acltype = "posixacl";
+          atime = "off";
+          relatime = "off";
+          xattr = "sa";
+          mountpoint = "none";
+          compression = "lz4";
+          canmount = "off";
+          utf8only = "on";
+          dnodesize = "auto";
+          normalization = "formD";
+        };
+
+        datasets = {
+          "linux/nix" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+            options = {
+              encryption = "aes-256-gcm";
+              keyformat = "passphrase";
+              # keylocation = "file:///tmp/secret.key";
+            };
+          };
+          "linux/nix/root" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/";
+            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/root@blank$' || zfs snapshot zroot/linux/nix/root@blank";
+          };
+          "linux/nix/nix" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/nix";
+            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/nix@blank$' || zfs snapshot zroot/linux/nix/nix@blank";
+            options = {
+              recordsize = "16MiB";
+              compression = "zstd-19";
+            };
+          };
+          "linux/nix/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/home";
+            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/home@blank$' || zfs snapshot zroot/linux/nix/home@blank";
+          };
+          "linux/nix/persist" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/persist";
+            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/persist@blank$' || zfs snapshot zroot/linux/nix/persist@blank";
+          };
+          "linux/nix/state" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/state";
+            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/state@blank$' || zfs snapshot zroot/linux/nix/state@blank";
+          };
+        };
+      };
+    };
+  };
+
+  # Make sure all persistent volumes are marked as neededForBoot
+  #
+  # Also mounts /home so it is mounted before the user home directories are created.
+  fileSystems."/persist".neededForBoot = true;
+  fileSystems."/state".neededForBoot = true;
+  fileSystems."/home".neededForBoot = true;
+
+  fileSystems."/".options = [
+    "noatime"
+    "norelatime"
+  ];
+  fileSystems."/nix".options = [
+    "noatime"
+    "norelatime"
+  ];
+  fileSystems."/persist".options = [
+    "noatime"
+    "norelatime"
+  ];
+  fileSystems."/state".options = [
+    "noatime"
+    "norelatime"
+  ];
+  fileSystems."/home".options = [
+    "noatime"
+    "norelatime"
+  ];
+
+  # Only attempt to decrypt the main pool. Otherwise it attempts to decrypt pools that aren't even used.
+  boot.zfs.requestEncryptionCredentials = [ "zroot/linux/nix" ];
+}

nix/configuration/hosts/ionlybootzfs/hardware-configuration.nix

@@ -0,0 +1,38 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+    "sdhci_pci"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.dhcpcd.enable = lib.mkForce true;
+  networking.useDHCP = lib.mkForce true;
+  # systemd.network.enable = true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

nix/configuration/hosts/ionlybootzfs/optimized_build.nix

@@ -56,31 +56,35 @@
         (final: prev: {
           haskellPackages = prev.haskellPackages.extend (
             final': prev': {
-              crypton = pkgs-unoptimized.haskellPackages.crypton;
+              inherit (pkgs-unoptimized.haskellPackages)
-              crypton-connection = pkgs-unoptimized.haskellPackages.crypton-connection;
+                crypton
-              crypton-x509 = pkgs-unoptimized.haskellPackages.crypton-x509;
+                crypton-connection
-              crypton-x509-store = pkgs-unoptimized.haskellPackages.crypton-x509-store;
+                crypton-x509
-              crypton-x509-system = pkgs-unoptimized.haskellPackages.crypton-x509-system;
+                crypton-x509-store
-              crypton-x509-validation = pkgs-unoptimized.haskellPackages.crypton-x509-validation;
+                crypton-x509-system
-              hspec-wai = pkgs-unoptimized.haskellPackages.hspec-wai;
+                crypton-x509-validation
-              http-client-tls = pkgs-unoptimized.haskellPackages.http-client-tls;
+                hspec-wai
-              http2 = pkgs-unoptimized.haskellPackages.http2;
+                http-client-tls
-              pandoc = pkgs-unoptimized.haskellPackages.pandoc;
+                http2
-              pandoc-cli = pkgs-unoptimized.haskellPackages.pandoc-cli;
+                pandoc
-              pandoc-lua-engine = pkgs-unoptimized.haskellPackages.pandoc-lua-engine;
+                pandoc-cli
-              pandoc-server = pkgs-unoptimized.haskellPackages.pandoc-server;
+                pandoc-lua-engine
-              servant-server = pkgs-unoptimized.haskellPackages.servant-server;
+                pandoc-server
-              tls = pkgs-unoptimized.haskellPackages.tls;
+                servant-server
-              wai-app-static = pkgs-unoptimized.haskellPackages.wai-app-static;
+                tls
-              wai-extra = pkgs-unoptimized.haskellPackages.wai-extra;
+                wai-app-static
-              warp = pkgs-unoptimized.haskellPackages.warp;
+                wai-extra
+                warp
+                ;
             }
           );
         })
         (final: prev: {
-          gsl = pkgs-unoptimized.gsl;
+          inherit (pkgs-unoptimized)
-          redis = pkgs-unoptimized.redis;
+            gsl
-          valkey = pkgs-unoptimized.valkey;
+            redis
+            valkey
+            ;
         })
       ];
 

nix/configuration/hosts/ionlybootzfs/wrapped-disk-config.nix

@@ -0,0 +1,8 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+lib.mkIf (!config.me.buildingIso) (import ./disk-config.nix)

nix/configuration/hosts/neelix/default.nix

@@ -3,7 +3,6 @@
   imports = [
     ./hardware-configuration.nix
     ./disk-config.nix
-    ./optimized_build.nix
     ./power_management.nix
   ];
 
@@ -15,9 +14,22 @@
   time.timeZone = "America/New_York";
   i18n.defaultLocale = "en_US.UTF-8";
 
-  me.optimizations.enable = false;
   me.secureBoot.enable = false;
 
+  me.optimizations = {
+    enable = false;
+    arch = "alderlake";
+    system_features = [
+      "gccarch-alderlake"
+      "gccarch-x86-64-v3"
+      "gccarch-x86-64-v4"
+      "benchmark"
+      "big-parallel"
+      "kvm"
+      "nixos-test"
+    ];
+  };
+
   # Early KMS
   boot.initrd.kernelModules = [ "i915" ];
 

nix/configuration/hosts/neelix/hardware-configuration.nix

@@ -14,7 +14,14 @@
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usbhid" "usb_storage" "sd_mod" "sdhci_pci" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+    "sdhci_pci"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
@@ -23,7 +30,7 @@
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction
   # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
+  # networking.useDHCP = lib.mkDefault true;
   # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
   # networking.interfaces.wlp58s0.useDHCP = lib.mkDefault true;
 

nix/configuration/hosts/neelix/optimized_build.nix

@@ -1,80 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  imports = [ ];
-
-  config = lib.mkMerge [
-    { }
-    (lib.mkIf (!config.me.optimizations.enable) {
-      boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_6_13;
-    })
-    (lib.mkIf (config.me.optimizations.enable) {
-      nixpkgs.hostPlatform = {
-        gcc.arch = "alderlake";
-        gcc.tune = "alderlake";
-        system = "x86_64-linux";
-      };
-
-      nixpkgs.overlays = [
-        (
-          self: super:
-          let
-            optimizeWithFlags =
-              pkg: flags:
-              pkg.overrideAttrs (old: {
-                NIX_CFLAGS_COMPILE = [ (old.NIX_CFLAGS_COMPILE or "") ] ++ flags;
-              });
-            addConfig =
-              additionalConfig: pkg:
-              pkg.override (oldconfig: {
-                structuredExtraConfig = pkg.structuredExtraConfig // additionalConfig;
-              });
-          in
-          {
-            linux_me =
-              addConfig
-                {
-                  # Full preemption
-                  PREEMPT = lib.mkOverride 60 lib.kernel.yes;
-                  PREEMPT_VOLUNTARY = lib.mkOverride 60 lib.kernel.no;
-
-                  # Google's BBRv3 TCP congestion Control
-                  TCP_CONG_BBR = lib.kernel.yes;
-                  DEFAULT_BBR = lib.kernel.yes;
-
-                  # Preemptive Full Tickless Kernel at 300Hz
-                  HZ = lib.kernel.freeform "300";
-                  HZ_300 = lib.kernel.yes;
-                  HZ_1000 = lib.kernel.no;
-                }
-                (
-                  optimizeWithFlags super.linux_6_12 [
-                    "-march=alderlake"
-                    "-mtune=alderlake"
-                  ]
-                );
-          }
-        )
-      ];
-
-      boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_me;
-    })
-    (lib.mkIf (!config.me.buildingIso) {
-      nix.settings.system-features = lib.mkForce [
-        "gccarch-alderlake"
-        "gccarch-x86-64-v3"
-        "benchmark"
-        "big-parallel"
-        "kvm"
-        "nixos-test"
-      ];
-    })
-    (lib.mkIf (config.me.buildingIso) {
-      boot.supportedFilesystems = [ "zfs" ];
-    })
-  ];
-}

nix/configuration/hosts/odo/SELF_BUILD

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+#
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+: "${JOBS:="1"}"
+
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
+for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
+nixos-rebuild build --show-trace --use-remote-sudo --max-jobs "$JOBS" --flake "$DIR/../../#odo" "${@}" |& nom

nix/configuration/hosts/odo/default.nix

@@ -7,8 +7,7 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ./disk-config.nix
+    ./wrapped-disk-config.nix
-    ./optimized_build.nix
     ./distributed_build.nix
     ./power_management.nix
     ./screen_brightness.nix
@@ -24,9 +23,24 @@
   time.timeZone = "America/New_York";
   i18n.defaultLocale = "en_US.UTF-8";
 
-  me.optimizations.enable = true;
   me.secureBoot.enable = true;
 
+  me.optimizations = {
+    enable = true;
+    arch = "znver4";
+    system_features = [
+      "gccarch-znver4"
+      "gccarch-skylake"
+      # "gccarch-alderlake" missing WAITPKG
+      "gccarch-x86-64-v3"
+      "gccarch-x86-64-v4"
+      "benchmark"
+      "big-parallel"
+      "kvm"
+      "nixos-test"
+    ];
+  };
+
   # Early KMS
   boot.initrd.kernelModules = [ "amdgpu" ];
 
@@ -61,6 +75,7 @@
   me.gpg.enable = true;
   me.graphical = true;
   me.graphics_card_type = "amd";
+  me.iso_mount.enable = true;
   me.kanshi.enable = false;
   me.kubernetes.enable = true;
   me.latex.enable = true;
@@ -71,6 +86,7 @@
   me.pcsx2.enable = true;
   me.python.enable = true;
   me.qemu.enable = true;
+  me.rpcs3.enable = true;
   me.rust.enable = true;
   me.shikane.enable = true;
   me.sops.enable = true;

nix/configuration/hosts/odo/disk-config.nix

@@ -1,14 +1,8 @@
 # Manual Step:
 #   Check if drive supports 4kn: nvme id-ns -H /dev/nvme0n1
 #   Format the drive to 4kn: nvme format --lbaf=1 /dev/nvme0n1
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 
-lib.mkIf (!config.me.buildingIso) {
+{
   disko.devices = {
     disk = {
       main = {

nix/configuration/hosts/odo/distributed_build.nix

@@ -9,48 +9,19 @@
 
   config = lib.mkMerge [
     {
-      nix.distributedBuilds = true;
+      me.distributed_build.enable = true;
-      nix.buildMachines = [
+      me.distributed_build.machines.hydra = {
-        {
+        enable = true;
-          hostName = "hydra";
+        additional_config = {
-          sshUser = "talexander";
-          systems = [
-            "x86_64-linux"
-            # "aarch64-linux"
-          ];
-          maxJobs = 1;
           speedFactor = 2;
-          supportedFeatures = [
+        };
-            # "nixos-test"
+      };
-            "benchmark"
+      me.distributed_build.machines.quark = {
-            "big-parallel"
+        enable = true;
-            # "kvm"
+        additional_config = {
-            "gccarch-znver4"
-            "gccarch-x86-64-v3"
-            "gccarch-x86-64-v4"
-          ];
-        }
-        {
-          hostName = "quark";
-          sshUser = "talexander";
-          systems = [
-            "x86_64-linux"
-            # "aarch64-linux"
-          ];
-          maxJobs = 1;
           speedFactor = 2;
-          supportedFeatures = [
+        };
-            # "nixos-test"
+      };
-            "benchmark"
-            "big-parallel"
-            # "kvm"
-            "gccarch-znver4"
-            "gccarch-x86-64-v3"
-            "gccarch-x86-64-v4"
-            "gccarch-znver5"
-          ];
-        }
-      ];
     }
   ];
 }

nix/configuration/hosts/odo/hardware-configuration.nix

@@ -27,7 +27,7 @@
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction
   # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
+  # networking.useDHCP = lib.mkDefault true;
   # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
   # networking.interfaces.wlp58s0.useDHCP = lib.mkDefault true;
 

nix/configuration/hosts/odo/wrapped-disk-config.nix

@@ -0,0 +1,8 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+lib.mkIf (!config.me.buildingIso) (import ./disk-config.nix)

nix/configuration/hosts/quark/SELF_BUILD

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+#
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+: "${JOBS:="1"}"
+
+nix flake update zsh-histdb --flake "$DIR/../../"
+nix flake update ansible-sshjail --flake "$DIR/../../"
+for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
+nixos-rebuild build --show-trace --use-remote-sudo --max-jobs "$JOBS" --flake "$DIR/../../#quark" "${@}" |& nom

nix/configuration/hosts/quark/default.nix

@@ -9,82 +9,105 @@
     ./disk-config.nix
     ./distributed_build.nix
     ./hardware-configuration.nix
-    ./optimized_build.nix
     ./power_management.nix
     ./wifi.nix
   ];
 
-  # Generate with `head -c4 /dev/urandom | od -A none -t x4`
+  config = {
-  networking.hostId = "47ee7d7c";
+    # Generate with `head -c4 /dev/urandom | od -A none -t x4`
+    networking.hostId = "47ee7d7c";
 
-  networking.hostName = "quark"; # Define your hostname.
+    networking.hostName = "quark"; # Define your hostname.
 
-  time.timeZone = "America/New_York";
+    time.timeZone = "America/New_York";
-  i18n.defaultLocale = "en_US.UTF-8";
+    i18n.defaultLocale = "en_US.UTF-8";
 
-  me.optimizations.enable = true;
+    me.secureBoot.enable = true;
-  me.secureBoot.enable = true;
 
-  # Early KMS
+    me.optimizations = {
-  boot.initrd.kernelModules = [ "amdgpu" ];
+      enable = true;
+      arch = "znver5";
+      system_features = [
+        "gccarch-znver4"
+        "gccarch-znver5"
+        "gccarch-skylake"
+        # "gccarch-alderlake" missing WAITPKG
+        "gccarch-x86-64-v3"
+        "gccarch-x86-64-v4"
+        "benchmark"
+        "big-parallel"
+        "kvm"
+        "nixos-test"
+      ];
+    };
 
-  # Mount tmpfs at /tmp
+    # Early KMS
-  boot.tmp.useTmpfs = true;
+    boot.initrd.kernelModules = [ "amdgpu" ];
 
-  # Enable TRIM
+    # Mount tmpfs at /tmp
-  # services.fstrim.enable = lib.mkDefault true;
+    boot.tmp.useTmpfs = true;
 
-  me.alacritty.enable = true;
+    # Enable TRIM
-  me.ansible.enable = true;
+    # services.fstrim.enable = lib.mkDefault true;
-  me.ares.enable = true;
-  me.bluetooth.enable = true;
-  me.chromecast.enable = true;
-  me.chromium.enable = true;
-  me.docker.enable = true;
-  me.ecc.enable = true;
-  me.emacs_flavor = "full";
-  me.firefox.enable = true;
-  me.flux.enable = true;
-  me.gcloud.enable = true;
-  me.git.config = ../../roles/git/files/gitconfig_home;
-  me.gnuplot.enable = true;
-  me.gpg.enable = true;
-  me.graphical = true;
-  me.graphics_card_type = "amd";
-  me.kanshi.enable = false;
-  me.kubernetes.enable = true;
-  me.latex.enable = true;
-  me.launch_keyboard.enable = true;
-  me.lvfs.enable = true;
-  me.media.enable = true;
-  me.nix_index.enable = true;
-  me.pcsx2.enable = true;
-  me.python.enable = true;
-  me.qemu.enable = true;
-  me.rust.enable = true;
-  me.shikane.enable = true;
-  me.sops.enable = true;
-  me.sound.enable = true;
-  me.steam.enable = true;
-  me.steam_run_free.enable = true;
-  me.sway.enable = true;
-  me.tekton.enable = true;
-  me.terraform.enable = true;
-  me.thunderbolt.enable = true;
-  me.vnc_client.enable = true;
-  me.vscode.enable = true;
-  me.wasm.enable = true;
-  me.waybar.enable = true;
-  me.wireguard.activated = [
-    "drmario"
-    "wgh"
-    "colo"
-  ];
-  me.wireguard.deactivated = [ "wgf" ];
-  me.zrepl.enable = true;
-  me.zsh.enable = true;
 
-  me.sm64ex.enable = true;
+    # RPCS3 has difficulty with znver5
-  me.shipwright.enable = true;
+    me.rpcs3.config.Core."Use LLVM CPU" = "znver4";
-  me.ship2harkinian.enable = true;
+
+    me.alacritty.enable = true;
+    me.ansible.enable = true;
+    me.ares.enable = true;
+    me.bluetooth.enable = true;
+    me.chromecast.enable = true;
+    me.chromium.enable = true;
+    me.docker.enable = true;
+    me.ecc.enable = true;
+    me.emacs_flavor = "full";
+    me.firefox.enable = true;
+    me.flux.enable = true;
+    me.gcloud.enable = true;
+    me.git.config = ../../roles/git/files/gitconfig_home;
+    me.gnuplot.enable = true;
+    me.gpg.enable = true;
+    me.graphical = true;
+    me.graphics_card_type = "amd";
+    me.iso_mount.enable = true;
+    me.kanshi.enable = false;
+    me.kubernetes.enable = true;
+    me.latex.enable = true;
+    me.launch_keyboard.enable = true;
+    me.lvfs.enable = true;
+    me.media.enable = true;
+    me.nix_index.enable = true;
+    me.nix_worker.enable = true;
+    me.pcsx2.enable = true;
+    me.python.enable = true;
+    me.qemu.enable = true;
+    me.rpcs3.enable = true;
+    me.rust.enable = true;
+    me.shikane.enable = true;
+    me.sops.enable = true;
+    me.sound.enable = true;
+    me.steam.enable = true;
+    me.steam_run_free.enable = true;
+    me.sway.enable = true;
+    me.tekton.enable = true;
+    me.terraform.enable = true;
+    me.thunderbolt.enable = true;
+    me.vnc_client.enable = true;
+    me.vscode.enable = true;
+    me.wasm.enable = true;
+    me.waybar.enable = true;
+    me.wireguard.activated = [
+      "drmario"
+      "wgh"
+      "colo"
+    ];
+    me.wireguard.deactivated = [ "wgf" ];
+    me.zrepl.enable = true;
+    me.zsh.enable = true;
+
+    me.sm64ex.enable = true;
+    me.shipwright.enable = true;
+    me.ship2harkinian.enable = true;
+  };
 }

nix/configuration/hosts/quark/distributed_build.nix

@@ -9,28 +9,13 @@
 
   config = lib.mkMerge [
     {
-      nix.distributedBuilds = true;
+      me.distributed_build.enable = true;
-      nix.buildMachines = [
+      me.distributed_build.machines.hydra = {
-        {
+        enable = true;
-          hostName = "hydra";
+        additional_config = {
-          sshUser = "talexander";
-          systems = [
-            "x86_64-linux"
-            # "aarch64-linux"
-          ];
-          maxJobs = 1;
           speedFactor = 2;
-          supportedFeatures = [
+        };
-            # "nixos-test"
+      };
-            "benchmark"
-            "big-parallel"
-            # "kvm"
-            "gccarch-znver4"
-            "gccarch-x86-64-v3"
-            "gccarch-x86-64-v4"
-          ];
-        }
-      ];
     }
   ];
 }

nix/configuration/hosts/quark/hardware-configuration.nix

@@ -27,10 +27,9 @@
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction
   # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
+  # networking.useDHCP = lib.mkDefault true;
   # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
   # networking.interfaces.wlp58s0.useDHCP = lib.mkDefault true;
 
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

nix/configuration/hosts/quark/optimized_build.nix

@@ -1,122 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  pkgs-unoptimized,
-  ...
-}:
-{
-  imports = [ ];
-
-  config = lib.mkMerge [
-    { }
-    (lib.mkIf (!config.me.optimizations.enable) {
-      boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_6_14;
-    })
-    (lib.mkIf (config.me.optimizations.enable) {
-      nixpkgs.hostPlatform = {
-        gcc.arch = "znver5";
-        gcc.tune = "znver5";
-        system = "x86_64-linux";
-      };
-
-      nixpkgs.overlays = [
-        (
-          final: prev:
-          let
-            addConfig =
-              additionalConfig: pkg:
-              pkg.override (oldconfig: {
-                structuredExtraConfig = pkg.structuredExtraConfig // additionalConfig;
-              });
-          in
-          {
-            linux_me = addConfig {
-              # Full preemption
-              PREEMPT = lib.mkOverride 60 lib.kernel.yes;
-              PREEMPT_VOLUNTARY = lib.mkOverride 60 lib.kernel.no;
-
-              # Google's BBRv3 TCP congestion Control
-              TCP_CONG_BBR = lib.kernel.yes;
-              DEFAULT_BBR = lib.kernel.yes;
-
-              # Preemptive Full Tickless Kernel at 300Hz
-              HZ = lib.kernel.freeform "300";
-              HZ_300 = lib.kernel.yes;
-              HZ_1000 = lib.kernel.no;
-            } prev.linux_6_14;
-          }
-        )
-        (final: prev: {
-          haskellPackages = prev.haskellPackages.extend (
-            final': prev': {
-              crypton = pkgs-unoptimized.haskellPackages.crypton;
-              crypton-connection = pkgs-unoptimized.haskellPackages.crypton-connection;
-              crypton-x509 = pkgs-unoptimized.haskellPackages.crypton-x509;
-              crypton-x509-store = pkgs-unoptimized.haskellPackages.crypton-x509-store;
-              crypton-x509-system = pkgs-unoptimized.haskellPackages.crypton-x509-system;
-              crypton-x509-validation = pkgs-unoptimized.haskellPackages.crypton-x509-validation;
-              hspec-wai = pkgs-unoptimized.haskellPackages.hspec-wai;
-              http-client-tls = pkgs-unoptimized.haskellPackages.http-client-tls;
-              http2 = pkgs-unoptimized.haskellPackages.http2;
-              pandoc = pkgs-unoptimized.haskellPackages.pandoc;
-              pandoc-cli = pkgs-unoptimized.haskellPackages.pandoc-cli;
-              pandoc-lua-engine = pkgs-unoptimized.haskellPackages.pandoc-lua-engine;
-              pandoc-server = pkgs-unoptimized.haskellPackages.pandoc-server;
-              servant-server = pkgs-unoptimized.haskellPackages.servant-server;
-              tls = pkgs-unoptimized.haskellPackages.tls;
-              wai-app-static = pkgs-unoptimized.haskellPackages.wai-app-static;
-              wai-extra = pkgs-unoptimized.haskellPackages.wai-extra;
-              warp = pkgs-unoptimized.haskellPackages.warp;
-            }
-          );
-        })
-        (final: prev: {
-          gsl = pkgs-unoptimized.gsl;
-          redis = pkgs-unoptimized.redis;
-          valkey = pkgs-unoptimized.valkey;
-        })
-      ];
-
-      boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_me;
-    })
-    (lib.mkIf (!config.me.buildingIso) {
-      nix.settings.system-features = lib.mkForce [
-        "gccarch-znver4"
-        "gccarch-znver5"
-        "gccarch-skylake"
-        # "gccarch-alderlake" missing WAITPKG
-        "gccarch-x86-64-v3"
-        "gccarch-x86-64-v4"
-        "benchmark"
-        "big-parallel"
-        "kvm"
-        "nixos-test"
-      ];
-
-      # Keep ALL dependencies so we can rebuild offline. This DRASTICALLY increase disk usage, but disk space is cheap.
-      # system.includeBuildDependencies = true;
-
-      # This also should enable building offline? TODO: test.
-      nix.extraOptions = ''
-        keep-outputs = true
-        keep-derivations = true
-      '';
-
-      # # building ON
-      # nixpkgs.localSystem = { system = "aarch64-linux"; };
-      # # building FOR
-      # nixpkgs.crossSystem = { system = "aarch64-linux"; };
-
-      # nixpkgs.config = {
-      #   replaceStdenv = ({ pkgs }: pkgs.clangStdenv);
-      # };
-      # or maybe an overlay
-      # stdenv = prev.clangStdenv;
-
-    })
-    (lib.mkIf (config.me.buildingIso) {
-      boot.supportedFilesystems.zfs = true;
-    })
-  ];
-}

nix/configuration/roles/distributed_build/default.nix

@@ -0,0 +1,105 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  make_machine_config = name: {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to use the ${name} machine during distributed builds.";
+    };
+
+    additional_config = lib.mkOption {
+      type = lib.types.attrs;
+      default = { };
+      example = lib.literalExpression {
+        speedFactor = 2;
+      };
+      description = "Additional config values for the buildMachines entry. For example, speedFactor.";
+    };
+  };
+in
+{
+  imports = [ ];
+
+  options.me = {
+    distributed_build.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to use multiple machines to perform a nixos-rebuild.";
+    };
+
+    distributed_build.machines.hydra = make_machine_config "hydra";
+    distributed_build.machines.quark = make_machine_config "quark";
+  };
+
+  config = lib.mkIf config.me.distributed_build.enable (
+    lib.mkMerge [
+      {
+        nix.distributedBuilds = true;
+      }
+      (lib.mkIf config.me.distributed_build.machines.hydra.enable {
+        nix.buildMachines = [
+          (
+            {
+              hostName = "hydra";
+              sshUser = "nixworker";
+              # sshKey = "";
+              # publicHostKey = "";
+              systems = [
+                "x86_64-linux"
+                # "aarch64-linux"
+              ];
+              maxJobs = 1;
+              supportedFeatures = [
+                # "nixos-test"
+                "benchmark"
+                "big-parallel"
+                # "kvm"
+                "gccarch-x86-64-v3"
+                "gccarch-x86-64-v4"
+                "gccarch-znver4"
+              ];
+            }
+            // config.me.distributed_build.machines.hydra.additional_config
+          )
+        ];
+      })
+      (lib.mkIf config.me.distributed_build.machines.quark.enable {
+        nix.buildMachines = [
+          (
+            {
+              hostName = "quark";
+              sshUser = "nixworker";
+              sshKey = "/persist/manual/ssh/root/keys/id_ed25519";
+              # From: base64 -w0 /persist/ssh/ssh_host_ed25519_key.pub
+              publicHostKey = "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUx0alplYlVYTkRkU3Y1enVGbjM3eFNMZUN3S2hPKzFMdWovM2FYNFJRTEEgcm9vdEBxdWFyawo=";
+              systems = [
+                "x86_64-linux"
+                # "aarch64-linux"
+              ];
+              maxJobs = 1;
+              supportedFeatures = [
+                # "nixos-test"
+                "benchmark"
+                "big-parallel"
+                # "kvm"
+                "gccarch-x86-64-v3"
+                "gccarch-x86-64-v4"
+                "gccarch-znver4"
+                "gccarch-znver5"
+              ];
+            }
+            // config.me.distributed_build.machines.quark.additional_config
+          )
+        ];
+      })
+    ]
+  );
+}

nix/configuration/roles/ecc/default.nix

@@ -1,3 +1,4 @@
+# Check memory errors with: ras-mc-ctl --error-count
 {
   config,
   lib,

nix/configuration/roles/emacs/default.nix

@@ -113,7 +113,7 @@ in
                 "doc"
                 "info"
               ];
-              buildInputs = [ final.makeWrapper ];
+              nativeBuildInputs = [ final.makeWrapper ];
               postBuild = ''
                 wrapProgram $out/bin/emacs --prefix PATH : ${
                   lib.makeBinPath [

nix/configuration/roles/emacs/files/emacs/elisp/base-extensions.el

@@ -14,17 +14,6 @@
 
 ;; Other packages
 
-(use-package emacs
-  :config
-  (setq enable-recursive-minibuffers t)
-
-  ;; Filter the M-x list base on the current mode
-  (setq read-extended-command-predicate #'command-completion-default-include-p)
-
-  ;; Enable triggering completion with the tab key.
-  (setq tab-always-indent 'complete)
-  )
-
 (use-package dashboard
   :config
   (dashboard-setup-startup-hook))

nix/configuration/roles/emacs/files/emacs/elisp/base.el

@@ -24,11 +24,51 @@
 (setq autoload-directory (concat user-emacs-directory (file-name-as-directory "elisp") (file-name-as-directory "autoload")))
 (add-to-list 'load-path (assert-directory autoload-directory))
 
+(use-package emacs
+  :ensure nil
+  :bind
+  (("C-z" . nil)
+   ("C-x C-z" . nil)
+   ("RET" . newline-and-indent)
+   )
+  :custom
+  ;; Replace highlighted text if you start typing.
+  (delete-selection-mode 1)
+
+  (history-length 300)
+
+  ;; Enable auto-revert for buffers like dired
+  (global-auto-revert-non-file-buffers t)
+
+  ;; If the underlying file changes, reload it automatically. This is useful for moving around in git without confusing language servers.
+  (auto-revert-avoid-polling t)
+  (auto-revert-interval 5)
+  (auto-revert-check-vc-info t)
+  (global-auto-revert-mode t)
+
+  ;; Disable backup files and lockfiles
+  (create-lockfiles nil)
+  (make-backup-files nil)
+  (backup-inhibited t)
+
+  ;; Do not auto-save files
+  (auto-save-default nil)
+
+  (pixel-scroll-precision-mode t)
+  (pixel-scroll-precision-use-momentum nil)
+
+  :config
+  (setq enable-recursive-minibuffers t)
+
+  ;; Filter the M-x list base on the current mode
+  (setq read-extended-command-predicate #'command-completion-default-include-p)
+
+  ;; Enable triggering completion with the tab key.
+  (setq tab-always-indent 'complete)
+
+  )
+
 (setq-default
- ;; Disable backup files and lockfiles
- make-backup-files nil
- auto-save-default nil
- create-lockfiles nil
  ;; Unless otherwise specified, always install packages if they are absent.
  use-package-always-ensure t
  ;; Point custom-file at /dev/null so emacs does not write any settings to my dotfiles.
@@ -80,12 +120,6 @@
 ;; Delete trailing whitespace before save
 (add-hook 'before-save-hook 'delete-trailing-whitespace)
 
-;; If the underlying file changes, reload it automatically. This is useful for moving around in git without confusing language servers.
-(setopt auto-revert-avoid-polling t)
-(setopt auto-revert-interval 5)
-(setopt auto-revert-check-vc-info t)
-(global-auto-revert-mode)
-
 ;;;;; Performance
 ;; Run garbage collect when emacs is idle
 (run-with-idle-timer 5 t (lambda () (garbage-collect)))

nix/configuration/roles/emacs/files/emacs/elisp/lang-rust.el

@@ -60,8 +60,8 @@
   (unless (treesit-ready-p 'rust) (treesit-install-language-grammar 'rust))
   :config
   ;; Add keybindings for interacting with Cargo
-  (use-package cargo
+  ;; (use-package cargo
-    :hook (rust-ts-mode . cargo-minor-mode))
+  ;;   :hook (rust-ts-mode . cargo-minor-mode))
   )
 
 (use-package toml-ts-mode

nix/configuration/roles/firefox/default.nix

@@ -88,10 +88,10 @@
                 install_url = "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi";
                 installation_mode = "force_installed";
               };
-              "firefox@teleparty.com" = {
+              # "firefox@teleparty.com" = {
-                install_url = "https://addons.mozilla.org/firefox/downloads/latest/netflix-party-is-now-teleparty/latest.xpi";
+              #   install_url = "https://addons.mozilla.org/firefox/downloads/latest/netflix-party-is-now-teleparty/latest.xpi";
-                installation_mode = "normal_installed";
+              #   installation_mode = "normal_installed";
-              };
+              # };
               "@ublacklist" = {
                 install_url = "https://addons.mozilla.org/firefox/downloads/latest/ublacklist/latest.xpi";
                 installation_mode = "normal_installed";

nix/configuration/roles/global_options/default.nix

@@ -8,15 +8,6 @@
 {
   imports = [ ];
 
-  options.me = {
-    optimizations.enable = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      example = true;
-      description = "Whether we want to enable CPU optimizations (will trigger a rebuild from source).";
-    };
-  };
-
   # options.me.graphics_card_type = lib.mkOption {
   #   type = lib.types.nullOr (
   #     lib.types.enum [

nix/configuration/roles/iso_mount/default.nix

@@ -0,0 +1,45 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  iso_mount =
+    (pkgs.writeScriptBin "iso_mount" (builtins.readFile ./files/iso_mount.bash)).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+  iso_unmount =
+    (pkgs.writeScriptBin "iso_unmount" (builtins.readFile ./files/iso_unmount.bash)).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+
+in
+{
+  imports = [ ];
+
+  options.me = {
+    iso_mount.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install iso_mount.";
+    };
+  };
+
+  config = lib.mkIf config.me.iso_mount.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = [
+          iso_mount
+          iso_unmount
+        ];
+      }
+    ]
+  );
+}

nix/configuration/roles/iso_mount/files/iso_mount.bash

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#
+# Mount a full-disk image as a loopback device so you can mount individual partitions from inside of it.
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+exec udisksctl loop-setup -r -f "${@}"

nix/configuration/roles/iso_mount/files/iso_unmount.bash

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#
+# Mount a full-disk image as a loopback device so you can mount individual partitions from inside of it.
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+exec udisksctl loop-delete "${@}"

nix/configuration/roles/kubernetes/default.nix

@@ -33,7 +33,7 @@ let
     .overrideAttrs
       (old: {
         buildCommand = "${old.buildCommand}\n patchShebangs $out";
-        buildInputs = [ pkgs.makeWrapper ];
+        nativeBuildInputs = [ pkgs.makeWrapper ];
         postBuild = ''
           wrapProgram $out/bin/decrypt_k8s_secret --prefix PATH : ${
             lib.makeBinPath [

nix/configuration/roles/lvfs/default.nix

@@ -20,8 +20,8 @@
   config = lib.mkIf config.me.lvfs.enable (
     lib.mkMerge [
       {
-        # TODO: Is this installing firmware or just downloading it? Is this needed?
+        # TODO: Is this installing firmware or just downloading it?
-        # services.fwupd.enable = true;
+        services.fwupd.enable = true;
         environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
           hideMounts = true;
           directories = [

nix/configuration/roles/media/default.nix

@@ -28,7 +28,7 @@ in
       type = lib.types.bool;
       default = false;
       example = true;
-      description = "Whether we want to install media.";
+      description = "Whether we want to install media utilities.";
     };
   };
 
@@ -39,6 +39,8 @@ in
           ffmpeg
           libva-utils # for vainfo
           vdpauinfo
+          mkvtoolnix-cli # for mkvmerge
+          yt-dlp
         ];
       }
       (lib.mkIf config.me.graphical {

nix/configuration/roles/media/files/cast_file_vaapi

@@ -6,6 +6,7 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : ${VIDEO_BITRATE:="1M"} # Only for encoding modes targeting bitrate
 : ${AUDIO_BITRATE:="192k"}
+: ${SPEED:="1"}
 
 ############## Setup #########################
 
@@ -62,6 +63,8 @@ function copy {
         "rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch"
 }
 
+# benchmark vulkan decode:
+# ffmpeg -init_hw_device "vulkan=vk:0" -hwaccel vulkan -hwaccel_output_format vulkan -i INPUT -f null - -benchmark
 function convert {
     local args=()
     local acceleration_type="$1" # "software" or "hardware"
@@ -99,11 +102,23 @@ function convert {
     if [ "$acceleration_type" == "software" ]; then
         true
     elif [ "$acceleration_type" == "hardware" ]; then
-        args+=(-vaapi_device /dev/dri/renderD128)
+        if [ "$codec" == "h264" ]; then
+            args+=(-init_hw_device vulkan)
+        elif [ "$codec" == "av1" ]; then
+            args+=(-vaapi_device /dev/dri/renderD128)
+        fi
     fi
 
     args+=(-i "$file_to_cast")
 
+    if [ "$SPEED" != "1" ]; then
+        local audio_speed video_speed
+        video_speed=$(bc -l <<< "1/${SPEED}")
+        audio_speed=$(bc -l <<< "${SPEED}/1")
+        args+=(-filter:v "setpts=${video_speed}*PTS")
+        args+=(-filter:a "atempo=${audio_speed}")
+    fi
+
     if [ "$codec" == "h264" ]; then
         if [ "$acceleration_type" == "software" ]; then
             args+=(-c:v h264)
@@ -111,7 +126,7 @@ function convert {
             args+=(-b:v "$VIDEO_BITRATE")
         elif [ "$acceleration_type" == "hardware" ]; then
             args+=(-vf 'format=nv12|vaapi,hwupload')
-            args+=(-c:v h264_vaapi)
+            args+=(-c:v h264_vulkan)
             args+=(-profile:v high)
             args+=(-b:v "$VIDEO_BITRATE")
         fi
@@ -119,12 +134,14 @@ function convert {
         if [ "$acceleration_type" == "software" ]; then
             args+=(-c:v libsvtav1)
             args+=(-preset 4) # [0-13] default 10, lower = higher quality / slower encode
-            args+=(-crf 20) # [0-63] default 35, lower = higher quality / larger file
+            # args+=(-crf 20) # [0-63] default 35, lower = higher quality / larger file
             # Parameters: https://gitlab.com/AOMediaCodec/SVT-AV1/-/blob/master/Docs/Parameters.md
             # fast-decode [0-2] default 0 (off), higher = faster decode
             # tune [0-2] default 1, Specifies whether to use PSNR or VQ as the tuning metric [0 = VQ, 1 = PSNR, 2 = SSIM]
             # film-grain-denoise, setting to 0 uses the original frames instead of denoising the film grain
-            args+=(-svtav1-params "fast-decode=1:film-grain-denoise=0")
+            # rc 1 = vbr 2 = cbr
+            # tbr = average bitrate
+            args+=(-svtav1-params "fast-decode=1:film-grain-denoise=0:tbr=${VIDEO_BITRATE}:rc=1:passes=2")
         elif [ "$acceleration_type" == "hardware" ]; then
             # -c:v av1_amf -quality quality
             args+=(-vf 'format=nv12|vaapi,hwupload')
@@ -206,32 +223,4 @@ function encode_webcam {
         "rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch"
 }
 
-function speed_up_preprocess_vp8 {
-    local file_to_cast file_to_save
-    file_to_cast="$1"
-    file_to_save="$2"
-
-    set -x
-
-    # -bf 0 :: Disable b-frames because webrtc doesn't support h264 streams with b-frames.
-    # -strict -2 :: Enable support for experimental codecs like opus.
-    # -b:v 2M :: Target 2 megabit/s
-    # -crf 10 :: Target a quality level and adjust bitrate accordingly. This should be preferred, but ideally both should be used.
-    # Could also use -filter_complex "[0:v]setpts=0.5*PTS[v];[0:a]atempo=2.0[a]" -map "[v]" -map "[a]"
-    </dev/null exec ffmpeg \
-               -i "$file_to_cast" \
-               -filter:v "setpts=0.66666666*PTS" \
-               -filter:a "atempo=1.5" \
-               -c:v vp8 \
-               -b:v 2M \
-               -crf 10 \
-               -bf 0 \
-               -c:a opus \
-               -b:a 320k \
-               -ar 48000 \
-               -strict -2 \
-               "$file_to_save"
-}
-
-
 main "${@}"

nix/configuration/roles/network/default.nix

@@ -18,8 +18,8 @@
 {
   imports = [ ];
 
-  networking.dhcpcd.enable = false;
+  networking.dhcpcd.enable = lib.mkDefault false;
-  networking.useDHCP = false;
+  networking.useDHCP = lib.mkDefault false;
   networking.nameservers = [
     "194.242.2.2#doh.mullvad.net"
     "2a07:e340::2#doh.mullvad.net"

nix/configuration/roles/nix_worker/default.nix

@@ -0,0 +1,57 @@
+# MANUAL: Remember to set up root's ssh config with any necessary values. For example:
+
+# Host foo
+#   HostName ns1.fizz.buzz
+#   Port 65122
+#   User nixworker
+#   IdentitiesOnly yes
+#   IdentityFile /persist/manual/ssh/root/keys/id_ed25519
+
+# Host *
+#   Compression yes
+
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    nix_worker.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether this machine should be set up to function as a nix.buildMachines. This does not configure nix.buildMachines, but only does the necessary setup to get the machine ready/capable of being a nix.buildMachines.";
+    };
+  };
+
+  config = lib.mkIf config.me.nix_worker.enable (
+    lib.mkMerge [
+      {
+        nix.settings.trusted-users = [ "nixworker" ];
+
+        users.users.nixworker = {
+          isNormalUser = true;
+          createHome = true; # https://github.com/NixOS/nixpkgs/issues/6481
+          group = "nixworker";
+          # extraGroups = [ "wheel" ];
+          # Generate with `mkpasswd -m scrypt`
+          hashedPassword = "$7$CU..../....VXvNQ8za3wSGpdzGXNT50/$HcFtn/yvwPMCw4888BelpiAPLAxe/zU87fD.d/N6U48";
+          openssh.authorizedKeys.keys = [
+            # Normal keys:
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGu+k5lrirokdW5zVdRVBOqEOAvAPlIkG/MdJNc9g5ky"
+            "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIEI6mu6I5Jp+Ib0vJxapGHbEShZjyvzV8jz5DnzDrI39AAAABHNzaDo="
+            "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIAFNcSXwvy+brYTOGo56G93Ptuq2MmZsjvRWAfMqbmMLAAAABHNzaDo="
+            # Key for nix to connect:
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB/IlYTQ0M5pFN5tdoswh37CDl/gbULI3h+SsKXCansh talexander@odo"
+          ];
+        };
+        users.groups.nixworker = { };
+      }
+    ]
+  );
+}

nix/configuration/roles/optimized_build/default.nix

@@ -0,0 +1,150 @@
+{
+  config,
+  lib,
+  pkgs,
+  pkgs-unoptimized,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    optimizations.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to enable CPU optimizations (will trigger a rebuild from source).";
+    };
+
+    optimizations.arch = lib.mkOption {
+      type = lib.types.str;
+      default = null;
+      example = "znver4";
+      description = "The CPU arch for which programs should be optimized.";
+    };
+
+    optimizations.system_features = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [
+        "gccarch-znver4"
+        "gccarch-znver5"
+        "gccarch-skylake"
+        # "gccarch-alderlake" missing WAITPKG
+        "gccarch-x86-64-v3"
+        "gccarch-x86-64-v4"
+        "benchmark"
+        "big-parallel"
+        "kvm"
+        "nixos-test"
+      ];
+      description = "The list of CPU features that should be enabled on this machine.";
+    };
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf (!config.me.optimizations.enable) (
+      lib.mkMerge [
+        {
+          boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_6_14;
+        }
+      ]
+    ))
+    (lib.mkIf config.me.optimizations.enable (
+      lib.mkMerge [
+        {
+          boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_me;
+
+          nixpkgs.hostPlatform = {
+            gcc.arch = config.me.optimizations.arch;
+            gcc.tune = config.me.optimizations.arch;
+            system = "x86_64-linux";
+          };
+
+          # Uncomment on of these to enable cross compiling:
+          # nixpkgs.buildPlatform = builtins.currentSystem;
+          # nixpkgs.buildPlatform = {
+          #   gcc.arch = "znver4";
+          #   gcc.tune = "znver4";
+          #   system = "x86_64-linux";
+          # };
+
+          nixpkgs.overlays = [
+            (
+              final: prev:
+              let
+                addConfig =
+                  additionalConfig: pkg:
+                  pkg.override (oldconfig: {
+                    structuredExtraConfig = pkg.structuredExtraConfig // additionalConfig;
+                  });
+              in
+              {
+                linux_me = addConfig {
+                  # Full preemption
+                  PREEMPT = lib.mkOverride 60 lib.kernel.yes;
+                  PREEMPT_VOLUNTARY = lib.mkOverride 60 lib.kernel.no;
+
+                  # Google's BBRv3 TCP congestion Control
+                  TCP_CONG_BBR = lib.kernel.yes;
+                  DEFAULT_BBR = lib.kernel.yes;
+
+                  # Preemptive Full Tickless Kernel at 300Hz
+                  HZ = lib.kernel.freeform "300";
+                  HZ_300 = lib.kernel.yes;
+                  HZ_1000 = lib.kernel.no;
+                } prev.linux_6_14;
+              }
+            )
+            (final: prev: {
+              haskellPackages = prev.haskellPackages.extend (
+                final': prev': {
+                  inherit (pkgs-unoptimized.haskellPackages)
+                    crypto-token
+                    crypton
+                    crypton-connection
+                    crypton-x509
+                    crypton-x509-store
+                    crypton-x509-system
+                    crypton-x509-validation
+                    hspec-wai
+                    http-client-tls
+                    http2
+                    pandoc
+                    pandoc-cli
+                    pandoc-lua-engine
+                    pandoc-server
+                    servant-server
+                    tls
+                    tls-session-manager
+                    wai-app-static
+                    wai-extra
+                    warp
+                    warp-tls
+                    ;
+                }
+              );
+            })
+            (final: prev: {
+              inherit (pkgs-unoptimized)
+                gsl
+                redis
+                valkey
+                nix-serve-ng
+                ;
+            })
+          ];
+        }
+      ]
+    ))
+    (lib.mkIf (config.me.optimizations.system_features != [ ]) (
+      lib.mkMerge [
+        {
+          nix.settings.system-features = lib.mkForce config.me.optimizations.system_features;
+        }
+      ]
+    ))
+
+  ];
+}

nix/configuration/roles/rpcs3/default.nix

@@ -0,0 +1,170 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  rpcs3_config_yaml = settingsFormat.generate "config.yml" config.me.rpcs3.config;
+  settingsFormat = pkgs.formats.yaml { };
+in
+{
+  imports = [ ];
+
+  options.me = {
+    rpcs3.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install rpcs3.";
+    };
+
+    rpcs3.config = lib.mkOption rec {
+      apply = lib.recursiveUpdate default;
+      inherit (settingsFormat) type;
+      default = {
+        Core = {
+          "Use LLVM CPU" = lib.mkIf (config.me.optimizations.enable) config.me.optimizations.arch;
+        };
+        VFS = {
+          "Enable /host_root/" = false;
+        };
+        Video = {
+          "Write Color Buffers" = true;
+          VSync = true;
+          "Performance Overlay" = {
+            Enabled = false;
+          };
+        };
+        Miscellaneous = {
+          "Pause emulation on RPCS3 focus loss" = true;
+          "Start games in fullscreen mode" = true;
+          "Pause Emulation During Home Menu" = false; # true makes the home menu slow
+        };
+      };
+      example = null;
+      description = "RPCS3's config.yml in nix form.";
+    };
+  };
+
+  config = lib.mkIf config.me.rpcs3.enable (
+    lib.mkMerge [
+      (lib.mkIf config.me.graphical {
+        environment.systemPackages = with pkgs; [
+          rpcs3
+        ];
+
+        security.pam.loginLimits = [
+          {
+            domain = "@wheel";
+            item = "memlock";
+            type = "hard";
+            value = "unlimited";
+          }
+          {
+            domain = "@wheel";
+            item = "memlock";
+            type = "soft";
+            value = "unlimited";
+          }
+        ];
+
+        home-manager.users.talexander =
+          { pkgs, ... }:
+          {
+            home.file.".config/rpcs3/config.yml" = lib.mkIf (config.me.rpcs3.config != null) {
+              source = rpcs3_config_yaml;
+            };
+            home.file.".config/rpcs3/GuiConfigs/CurrentSettings.ini" = {
+              source = ./files/CurrentSettings.ini;
+            };
+          };
+
+        environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          users.talexander = {
+            directories = [
+              {
+                # Location of ROMs.
+                directory = ".config/rpcs3/games";
+                user = "talexander";
+                group = "talexander";
+                mode = "0755";
+              }
+              {
+                directory = ".config/rpcs3/dev_hdd0";
+                user = "talexander";
+                group = "talexander";
+                mode = "0755";
+              }
+              {
+                directory = ".config/rpcs3/dev_hdd1";
+                user = "talexander";
+                group = "talexander";
+                mode = "0755";
+              }
+              {
+                directory = ".config/rpcs3/savestates";
+                user = "talexander";
+                group = "talexander";
+                mode = "0755";
+              }
+              {
+                directory = ".config/rpcs3/dev_usb000";
+                user = "talexander";
+                group = "talexander";
+                mode = "0755";
+              }
+              {
+                # Seems to be where the firmware is installed.
+                directory = ".config/rpcs3/dev_flash";
+                user = "talexander";
+                group = "talexander";
+                mode = "0755";
+              }
+              {
+                # Controller config.
+                directory = ".config/rpcs3/input_configs";
+                user = "talexander";
+                group = "talexander";
+                mode = "0755";
+              }
+              {
+                # Game icons.
+                directory = ".config/rpcs3/Icons";
+                user = "talexander";
+                group = "talexander";
+                mode = "0755";
+              }
+            ];
+            files = [
+              {
+                # play times and recently played
+                file = ".config/rpcs3/GuiConfigs/persistent_settings.dat";
+                parentDirectory = {
+                  mode = "0755";
+                };
+              }
+            ];
+          };
+        };
+
+        environment.persistence."/state" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          users.talexander = {
+            directories = [
+              {
+                # Game saves
+                directory = ".cache/rpcs3";
+                user = "talexander";
+                group = "talexander";
+                mode = "0755";
+              }
+            ];
+          };
+        };
+      })
+    ]
+  );
+}

nix/configuration/roles/rpcs3/files/CurrentSettings.ini

@@ -0,0 +1,5 @@
+[Meta]
+currentStylesheet=Darker Style by TheMitoSan
+
+[main_window]
+infoBoxEnabledWelcome=false

nix/configuration/roles/rust/default.nix

@@ -131,7 +131,7 @@ in
                 ++ [
                   prev.rustup
                 ];
-              buildInputs = [ pkgs.makeWrapper ];
+              nativeBuildInputs = [ pkgs.makeWrapper ];
             };
           })
         ];

nix/configuration/roles/ssh/files/ssh_config

@@ -34,5 +34,9 @@ Host hydra
   ProxyJump talexander@mrmanager
   HostName 10.215.1.219
 
+Host ionlybootzfs
+  HostName 127.0.0.1
+  Port 60022
+
 Host *
   Compression yes

nix/configuration/roles/ssh/files/ssh_config_root

@@ -1,7 +1,7 @@
 Host hydra
   HostName ns1.fizz.buzz
   Port 65122
-  User talexander
+  User nixworker
   IdentitiesOnly yes
   IdentityFile /persist/manual/ssh/root/keys/id_ed25519
 

nix/configuration/roles/vscode/default.nix

@@ -22,6 +22,7 @@
       (lib.mkIf config.me.graphical {
         allowedUnfree = [
           "vscode"
+          "vscode-x86_64-unknown-linux-gnu-with-extensions"
           "vscode-with-extensions"
           "vscode-extension-ms-vscode-remote-remote-ssh"
         ];
@@ -33,6 +34,7 @@
               ms-python.python
               ms-azuretools.vscode-docker
               ms-vscode-remote.remote-ssh
+              esbenp.prettier-vscode
             ]
             # ++ pkgs.vscode-utils.extensionsFromVscodeMarketplace [
             #   {

nix/configuration/roles/vscode/files/settings.json

@@ -31,6 +31,10 @@
     "editor.defaultFormatter": "hashicorp.terraform",
     "editor.formatOnSave": true
   },
+  "[typescript]": {
+    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.formatOnSave": true
+  },
   "black-formatter.importStrategy": "fromEnvironment",
   "workbench.statusBar.visible": false,
   "git.openRepositoryInParentFolders": "never",

nix/configuration/roles/wasm/default.nix

@@ -24,7 +24,15 @@
         environment.systemPackages = with pkgs; [
           wabt
           wasm-bindgen-cli
-          pkgs-unoptimized.binaryen # for wasm-opt
+          binaryen # for wasm-opt
+        ];
+
+        nixpkgs.overlays = [
+          (final: prev: {
+            inherit (pkgs-unoptimized)
+              binaryen
+              ;
+          })
         ];
       }
     ]

nix/configuration/util/install_files/default.nix

@@ -0,0 +1,179 @@
+{
+  config,
+  lib,
+  pkgs,
+  home-manager,
+  ...
+}:
+
+let
+  inherit (lib)
+    attrNames
+    filter
+    flatten
+    ;
+  makeFileOption =
+    prefix:
+    lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule (
+          { name, config, ... }:
+          {
+            options = {
+              enable = lib.mkOption {
+                type = lib.types.bool;
+                default = true;
+                defaultText = "${prefix}.‹path›.enable";
+                example = false;
+                description = "Whether we want to install this file.";
+              };
+              method = lib.mkOption {
+                type = lib.types.enum [
+                  "symlink"
+                  "overwrite"
+                  "initialize"
+                  # "bind_mount" TODO: for directories?
+                ];
+                default = "symlink";
+                defaultText = "${prefix}.‹path›.method";
+                example = "overwrite";
+                description = "The way in which the file should be installed.";
+              };
+              mode = lib.mkOption {
+                type = lib.types.str;
+                default = "0444";
+                defaultText = "${prefix}.‹path›.mode";
+                example = "0750";
+                description = "The read, write, execute permission flags.";
+              };
+              source = lib.mkOption {
+                type = lib.types.path;
+                defaultText = "${prefix}.‹path›.source";
+                example = ./files/foo.txt;
+                description = "The source file to install into the destination.";
+              };
+              target = lib.mkOption {
+                type = lib.types.str;
+                defaultText = "${prefix}.‹path›.target";
+                example = ".local/share/foo/bar.txt";
+                description = "The path where the file should be written.";
+              };
+              group = lib.mkOption {
+                type = lib.types.nullOr lib.types.str;
+                default = null;
+                defaultText = "${prefix}.‹path›.group";
+                example = ".local/share/foo/bar.txt";
+                description = "The group that should own the file.";
+              };
+            };
+
+            config = {
+              target = lib.mkDefault name;
+            };
+          }
+        )
+      );
+      defaultText = "${prefix}.‹path›";
+      default = { };
+      example = lib.literalExpression ''
+        {
+          ".config/foo/bar.txt" = {
+            source = ./files/bar.txt
+          };
+        }
+      '';
+    };
+in
+{
+  imports = [ ];
+
+  options.me.install = {
+    user = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule (
+          { name, config, ... }:
+          {
+            options = {
+              enable = lib.mkOption {
+                type = lib.types.bool;
+                default = true;
+                defaultText = "me.install.user.‹username›.enable";
+                example = false;
+                description = "Whether we want to install files in this user's home directory.";
+              };
+              target_username = lib.mkOption {
+                type = lib.types.str;
+                defaultText = "me.install.file.‹username›.target_username";
+                example = "root";
+                description = "The username for the user whose home directory will contain the file.";
+              };
+              file = makeFileOption "me.install.user.‹username›.file";
+            };
+
+            config = {
+              target_username = lib.mkDefault name;
+            };
+          }
+        )
+      );
+
+      defaultText = "me.install.user.‹username›";
+      default = { };
+      # TODO: example
+    };
+    # TODO: Global option owned by root?
+    # file = makeFileOption "me.install.file";
+  };
+
+  config =
+    let
+      cfg = config.me.install;
+      active_install_users = filter (username: cfg.user."${username}".enable) (attrNames cfg.user);
+      install_commands = flatten (
+        builtins.map (
+          username:
+          let
+            active_install_file_targets = filter (target: cfg.user."${username}".file."${target}".enable) (
+              attrNames cfg.user."${username}".file
+            );
+          in
+          builtins.map (
+            target:
+            let
+              target_config = cfg.user."${username}".file."${target}";
+              source = lib.strings.escapeShellArg "${target_config.source}";
+              destination = lib.strings.escapeShellArg "${target_config.target}";
+              mode = lib.strings.escapeShellArg "${target_config.mode}";
+              escaped_username = lib.strings.escapeShellArg "${username}";
+              escaped_group =
+                if target_config.group == null then
+                  "$(id -g ${escaped_username})"
+                else
+                  (lib.strings.escapeShellArg "${target_config.group}");
+            in
+            ''
+              $DRY_RUN_CMD install $VERBOSE_ARG -D --compare -o ${escaped_username} -g ${escaped_group} -m ${mode} ${source} ${destination}
+            ''
+          ) active_install_file_targets
+        ) active_install_users
+      );
+
+    in
+    lib.mkMerge [
+      (lib.mkIf (install_commands != [ ]) ({
+        systemd.services.me-install-file = {
+          enable = true;
+          description = "me-install-file";
+          wantedBy = [ "multi-user.target" ];
+          wants = [ "multi-user.target" ];
+          after = [ "multi-user.target" ];
+          unitConfig.DefaultDependencies = "no";
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = "yes";
+          };
+          script = (lib.strings.concatStringsSep "\n" install_commands);
+        };
+      }))
+    ];
+}

nix/steam_deck/configuration/roles/rpcs3/default.nix

@@ -10,6 +10,9 @@ let
     export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${pkgs.libglvnd}/lib"
     exec ${pkgs.rpcs3}/bin/rpcs3 "''${@}"
   '';
+  rpcs3_config_yaml = settingsFormat.generate "config.yml" config.me.rpcs3.config;
+  settingsFormat = pkgs.formats.yaml { };
+
 in
 {
   imports = [ ];
@@ -21,6 +24,33 @@ in
       example = true;
       description = "Whether we want to install rpcs3.";
     };
+
+    rpcs3.config = lib.mkOption rec {
+      apply = lib.recursiveUpdate default;
+      inherit (settingsFormat) type;
+      default = {
+        Core = {
+          "Use LLVM CPU" = "znver2";
+        };
+        VFS = {
+          "Enable /host_root/" = false;
+        };
+        Video = {
+          "Write Color Buffers" = true;
+          VSync = true;
+          "Performance Overlay" = {
+            Enabled = false;
+          };
+        };
+        Miscellaneous = {
+          "Pause emulation on RPCS3 focus loss" = true;
+          "Start games in fullscreen mode" = true;
+          "Pause Emulation During Home Menu" = false; # true makes the home menu slow
+        };
+      };
+      example = null;
+      description = "RPCS3's config.yml in nix form.";
+    };
   };
 
   config = lib.mkIf config.me.rpcs3.enable (
@@ -31,15 +61,25 @@ in
           steam_rpcs3
         ];
 
-        # .config/rpcs3/config.yml
+        home.file.".config/rpcs3/config.yml" = lib.mkIf (config.me.rpcs3.config != null) {
-        # .config/rpcs3/GuiConfigs/CurrentSettings.ini
+          source = rpcs3_config_yaml;
+        };
+        home.file.".config/rpcs3/GuiConfigs/CurrentSettings.ini" = {
+          source = ./files/CurrentSettings.ini;
+        };
 
         me.persist.directories = [
+          ".config/rpcs3/games" # Location of ROMs.
           ".config/rpcs3/dev_hdd0"
           ".config/rpcs3/dev_hdd1"
           ".config/rpcs3/savestates"
           ".config/rpcs3/dev_usb000"
           ".config/rpcs3/dev_flash" # Seems to be where the firmware is installed.
+          ".config/rpcs3/input_configs" # Controller config.
+          ".config/rpcs3/Icons" # Game icons.
+        ];
+        me.persist.files = [
+          ".config/rpcs3/GuiConfigs/persistent_settings.dat" # play times and recently played
         ];
         me.state.directories = [ ".cache/rpcs3" ];
 

nix/steam_deck/configuration/roles/rpcs3/files/CurrentSettings.ini

@@ -0,0 +1,5 @@
+[Meta]
+currentStylesheet=Darker Style by TheMitoSan
+
+[main_window]
+infoBoxEnabledWelcome=false

nix/steam_deck/configuration/roles/steam_rom_manager/default.nix

@@ -24,21 +24,12 @@ in
   config = lib.mkIf config.me.steam_rom_manager.enable (
     lib.mkMerge [
       (lib.mkIf config.me.graphical {
-        home.packages = with pkgs; [
+        home.packages = [
           package
         ];
 
         me.persist.directories = [ ".config/steam-rom-manager/userData" ];
 
-        home.persistence."/home/deck/.persist" = {
-          directories = [
-            {
-              directory = ".config/steam-rom-manager/userData";
-              method = "symlink";
-            }
-          ];
-        };
-
         # TODO: Install a fully configured /home/deck/.persist/.config/steam-rom-manager/userData/userConfigurations.json (which contains the parser definitions) and /home/deck/.persist/.config/steam-rom-manager/userData/userSettings.json (which contains the applications settings like steam directory).
         # TODO: Maybe only persist /home/deck/.persist/.config/steam-rom-manager/userData/artworkBackups and /home/deck/.persist/.config/steam-rom-manager/userData/artworkCache.json after the parser config is being installed.
 

nix/steam_deck/configuration/util/persist_symlink/default.nix

@@ -16,6 +16,12 @@
       example = [ ".local/share/dolphin-emu/Wii" ];
       description = "List of folders relative to the home directory to persist.";
     };
+    persist.files = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [ ".local/share/foo.sqlite3" ];
+      description = "List of files relative to the home directory to persist.";
+    };
     state.directories = lib.mkOption {
       type = lib.types.listOf lib.types.str;
       default = [ ];
@@ -50,6 +56,11 @@
         );
       };
     })
+    (lib.mkIf (config.me.persist.files != [ ]) {
+      home.persistence."/home/deck/.persist" = {
+        files = config.me.persist.files;
+      };
+    })
     (lib.mkIf (config.me.state.directories != [ ]) {
       home.persistence."/home/deck/.state" = {
         directories = (