Still not working.

The latest nixpkgs does not support overriding the name so I am removing it now for compatibility.

ansible/roles/sftp/tasks/common.yaml

@@ -64,6 +64,23 @@
 #     force: true
 #   diff: false
 
+- name: Create directories
+  file:
+    name: "{{ item }}"
+    state: directory
+    mode: 0700
+    owner: nochainstounlock
+    group: nochainstounlock
+  loop:
+    - /home/nochainstounlock/.ssh
+
+- name: Set authorized keys
+  authorized_key:
+    user: nochainstounlock
+    key: |
+      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMrjXsXjtxEm47XnRZfo67kJULoc0NBLrB0lPYFiS2Ar kodi@neelix
+    exclusive: true
+
 - import_tasks: tasks/freebsd.yaml
   when: 'os_flavor == "freebsd"'
 

nix/configuration/boot.nix

@@ -1,56 +0,0 @@
-# ISO does not work with systemd initrd yet https://github.com/NixOS/nixpkgs/pull/291750
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-{
-  imports = [ ];
-
-  config = lib.mkIf (!config.me.buildingIso) {
-
-    boot.loader.grub.enable = false;
-    # Use the systemd-boot EFI boot loader.
-    boot.loader.systemd-boot.enable = true;
-    # TODO: make not write bootx64.efi
-    boot.loader.efi.canTouchEfiVariables = false;
-
-    # Automatically delete old generations
-    boot.loader.systemd-boot.configurationLimit = 3;
-
-    # Check what will be lost with `zfs diff zroot/linux/root@blank`
-    boot.initrd.systemd.enable = lib.mkDefault true;
-    boot.initrd.systemd.services.zfs-rollback = {
-      description = "Rollback ZFS root dataset to blank snapshot";
-      wantedBy = [
-        "initrd.target"
-      ];
-      after = [
-        "zfs-import-zroot.service"
-      ];
-      before = [
-        "sysroot.mount"
-      ];
-      path = with pkgs; [
-        zfs
-      ];
-      unitConfig.DefaultDependencies = "no";
-      serviceConfig.Type = "oneshot";
-      script = ''
-        zfs rollback -r zroot/linux/nix/root@blank
-        zfs rollback -r zroot/linux/nix/home@blank
-        echo "rollback complete"
-      '';
-    };
-  };
-}
-# efibootmgr -c -d /dev/sda -p 1 -L NixOS-boot -l '\EFI\NixOS-boot\grubx64.efi'
-
-# Text-only:
-# sudo cp "$(nix-build '<nixpkgs>' --no-out-link -A 'refind')/share/refind/refind_x64.efi" /boot/EFI/boot/bootx64.efi
-
-# Full graphics:
-# $ sudo nix-shell -p refind efibootmgr
-# $ refind-install

nix/configuration/configuration.nix

@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  pkgs-unstable,
   home-manager,
   ...
 }:
@@ -10,29 +9,60 @@
 {
   imports = [
     ./roles/reset
+    ./roles/global_options
+    ./util/unfree_polyfill
     ./roles/iso
-    ./hosts/odo
     "${
       builtins.fetchTarball {
         url = "https://github.com/nix-community/disko/archive/refs/tags/v1.9.0.tar.gz";
         sha256 = "0j76ar4qz320fakdii4659w5lww8wiz6yb7g47npywqvf2lbp388";
       }
     }/module.nix"
-    ./boot.nix
-    ./zfs.nix
-    ./network.nix
+    ./roles/boot
+    ./roles/zfs
+    ./roles/network
     ./roles/firewall
+    ./roles/zsh
+    ./roles/zrepl
     ./roles/graphics
     ./roles/sound
     ./roles/sway
+    ./roles/kanshi
     ./roles/alacritty
     ./roles/firefox
+    ./roles/chromium
     ./roles/emacs
     ./roles/git
     ./roles/fonts
     ./roles/gpg
     ./roles/waybar
     ./roles/qemu
+    ./roles/wireguard
+    ./roles/ares
+    ./roles/ssh
+    ./roles/python
+    ./roles/docker
+    ./roles/kubernetes
+    ./roles/rust
+    ./roles/media
+    ./roles/steam
+    ./roles/latex
+    ./roles/launch_keyboard
+    ./roles/lvfs
+    ./roles/nvme
+    ./roles/terraform
+    ./roles/vscode
+    ./roles/wasm
+    ./roles/vnc_client
+    ./roles/chromecast
+    ./roles/memtest86
+    ./roles/kodi
+    ./roles/ansible
+    ./roles/bluetooth
+    ./roles/sm64ex
+    ./roles/shipwright
+    ./roles/2ship2harkinian
+    ./roles/nix_index
   ];
 
   nix.settings.experimental-features = [
@@ -41,9 +71,13 @@
   ];
   nix.settings.trusted-users = [ "@wheel" ];
 
-  boot.kernelPackages = pkgs.linuxPackages_6_11;
+  # boot.kernelPackages = pkgs.linuxPackages_6_11;
   hardware.enableRedistributableFirmware = true;
 
+  services.getty = {
+    autologinUser = "talexander"; # I use full disk encryption so the user password is irrelevant.
+    autologinOnce = true;
+  };
   users.mutableUsers = false;
   users.users.talexander = {
     isNormalUser = true;
@@ -78,12 +112,13 @@
     };
 
   # Automatic garbage collection
-  nix.gc = {
+  nix.gc = lib.mkIf (!config.me.buildingIso) {
     # Runs nix-collect-garbage --delete-older-than 5d
     automatic = true;
     randomizedDelaySec = "14m";
-    options = "--delete-older-than 5d";
+    options = "--delete-older-than 30d";
   };
+  nix.settings.auto-optimise-store = !config.me.buildingIso;
 
   # Use doas instead of sudo
   security.doas.enable = true;
@@ -97,9 +132,6 @@
     }
   ];
 
-  # Do not use default packages (nixos includes some defaults like nano)
-  environment.defaultPackages = lib.mkForce [ ];
-
   environment.systemPackages = with pkgs; [
     wget
     mg
@@ -110,12 +142,16 @@
     file
     usbutils # for lsusb
     pciutils # for lspci
-    mesa-demos # for glxgears TODO move to better role
-    vulkan-tools # for vkcube TODO move to better role
-    xorg.xeyes # to test which windows are using x11 TODO move to better role
     ripgrep
     strace
+    ltrace
+    trace-cmd # ftrace
     tcpdump
+    git-crypt
+    gnumake
+    ncdu
+    nix-tree
+    libarchive # bsdtar
   ];
 
   services.openssh = {
@@ -144,7 +180,6 @@
       "/var/lib/nixos" # Contains user information (uids/gids)
       "/var/lib/systemd" # Systemd state directory for random seed, persistent timers, core dumps, persist hardware state like backlight and rfkill
       "/var/log/journal" # Logs, alternatively set `services.journald.storage = "volatile";` to write to /run/log/journal
-      "/etc/zfs/zpool.cache" # Which zpools to import, the root zpool is already imported and does not need this cache file but this captures additional pools. TODO consider setting cachefile=none on main pool.
     ];
     files = [
       "/etc/machine-id" # Systemd unique machine id "otherwise, the system journal may fail to list earlier boots, etc"
@@ -153,10 +188,16 @@
       "/etc/ssh/ssh_host_ed25519_key"
       "/etc/ssh/ssh_host_ed25519_key.pub"
     ];
-    # users.talexander = {
-    #   directories = [];
-    #   files = [];
-    # };
+    users.talexander = {
+      directories = [
+        {
+          directory = "persist";
+          user = "talexander";
+          group = "talexander";
+          mode = "0700";
+        }
+      ];
+    };
   };
 
   # Write a list of the currently installed packages to /etc/current-system-packages
@@ -168,12 +209,24 @@
     in
     formatted;
 
+  # environment.etc."system-packages-with-source".text = builtins.concatStringsSep "\n\n" (
+  #   builtins.map (
+  #     x: x.file + "\n" + builtins.concatStringsSep "\n" (builtins.map (s: "  " + s) x.value)
+  #   ) config.environment.systemPackages.definitionsWithLocations
+  # );
+
   # nixpkgs.overlays = [
   #   (final: prev: {
   #     nix = pkgs-unstable.nix;
   #   })
   # ];
 
+  # nixpkgs.overlays = [
+  #   (final: prev: {
+  #     foot = throw "foo";
+  #   })
+  # ];
+
   # Copy the NixOS configuration file and link it from the resulting system
   # (/run/current-system/configuration.nix). This is useful in case you
   # accidentally delete configuration.nix.

nix/configuration/flake.lock

@@ -1,5 +1,133 @@
 {
   "nodes": {
+    "ansible-sshjail": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-c4Ds4E/10Zj5AQLuJ3JvJTuDK8o2WjVXLcIL7eyhTfw=",
+        "path": "flakes/ansible-sshjail",
+        "type": "path"
+      },
+      "original": {
+        "path": "flakes/ansible-sshjail",
+        "type": "path"
+      }
+    },
+    "crane": {
+      "locked": {
+        "lastModified": 1731098351,
+        "narHash": "sha256-HQkYvKvaLQqNa10KEFGgWHfMAbWBfFp+4cAgkut+NNE=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "ef80ead953c1b28316cc3f8613904edc2eb90c28",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730504689,
+        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "pre-commit-hooks-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -7,27 +135,26 @@
         ]
       },
       "locked": {
-        "lastModified": 1734366194,
-        "narHash": "sha256-vykpJ1xsdkv0j8WOVXrRFHUAdp9NXHpxdnn1F4pYgSw=",
+        "lastModified": 1737762889,
+        "narHash": "sha256-5HGG09bh/Yx0JA8wtBMAzt0HMCL1bYZ93x4IqzVExio=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "80b0fdf483c5d1cb75aaad909bd390d48673857f",
+        "rev": "daf04c5950b676f47a794300657f1d3d14c1a120",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-24.11",
         "repo": "home-manager",
         "type": "github"
       }
     },
     "impermanence": {
       "locked": {
-        "lastModified": 1734200366,
-        "narHash": "sha256-0NursoP4BUdnc+wy+Mq3icHkXu/RgP1Sjo0MJxV2+Dw=",
+        "lastModified": 1737831083,
+        "narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "c6323585fa0035d780e3d8906eb1b24b65d19a48",
+        "rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
         "type": "github"
       },
       "original": {
@@ -36,18 +163,44 @@
         "type": "github"
       }
     },
+    "lanzaboote": {
+      "inputs": {
+        "crane": "crane",
+        "flake-compat": "flake-compat",
+        "flake-parts": "flake-parts",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1737639419,
+        "narHash": "sha256-AEEDktApTEZ5PZXNDkry2YV2k6t0dTgLPEmAZbnigXU=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "a65905a09e2c43ff63be8c0e86a93712361f871e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "v0.4.2",
+        "repo": "lanzaboote",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1734323986,
-        "narHash": "sha256-m/lh6hYMIWDYHCAsn81CDAiXoT3gmxXI9J987W5tZrE=",
+        "lastModified": 1737885589,
+        "narHash": "sha256-Zf0hSrtzaM1DEz8//+Xs51k/wdSajticVrATqDrfQjg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "394571358ce82dff7411395829aa6a3aad45b907",
+        "rev": "852ff1d9e153d8875a83602e03fdef8a63f0ecf8",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.11",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -68,29 +221,127 @@
         "type": "github"
       }
     },
-    "nixpkgs-unstable": {
+    "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1734424634,
-        "narHash": "sha256-cHar1vqHOOyC7f1+tVycPoWTfKIaqkoe1Q6TnKzuti4=",
+        "lastModified": 1730741070,
+        "narHash": "sha256-edm8WG19kWozJ/GqyYx2VjW99EdhjKwbY3ZwdlPAAlo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d3c42f187194c26d9f0309a8ecc469d6c878ce33",
+        "rev": "d063c1dd113c91ab27959ba540c0d9753409edf3",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-24.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
+    "pre-commit-hooks-nix": {
+      "inputs": {
+        "flake-compat": [
+          "lanzaboote",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": "nixpkgs-stable"
+      },
+      "locked": {
+        "lastModified": 1731363552,
+        "narHash": "sha256-vFta1uHnD29VUY4HJOO/D6p6rxyObnf+InnSMT4jlMU=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "cd1af27aa85026ac759d5d3fccf650abe7e1bbf0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
+        "ansible-sshjail": "ansible-sshjail",
         "home-manager": "home-manager",
         "impermanence": "impermanence",
+        "lanzaboote": "lanzaboote",
         "nixpkgs": "nixpkgs",
         "nixpkgs-b93b4e9b5": "nixpkgs-b93b4e9b5",
-        "nixpkgs-unstable": "nixpkgs-unstable"
+        "zsh-histdb": "zsh-histdb"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1731897198,
+        "narHash": "sha256-Ou7vLETSKwmE/HRQz4cImXXJBr/k9gp4J4z/PF8LzTE=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "0be641045af6d8666c11c2c40e45ffc9667839b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "zsh-histdb": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-5DWw7GnwVZ98HUp/UUJcyUmmy9Bh/mcQB8MQQ0t3ZRo=",
+        "path": "flakes/zsh-histdb",
+        "type": "path"
+      },
+      "original": {
+        "path": "flakes/zsh-histdb",
+        "type": "path"
       }
     }
   },

nix/configuration/flake.nix

@@ -16,7 +16,7 @@
 #        -display vnc=127.0.0.1:0
 #
 # doas cp "$(nix-build '<nixpkgs>' --no-out-link -A 'OVMF.fd')/FV/OVMF_VARS.fd" /tmp/OVMF_VARS.fd
-# doas "$(nix-build '<nixpkgs>' --no-out-link -A 'qemu')/bin/qemu-system-x86_64" -accel kvm -cpu host -smp cores=8 -m 32768 -drive "file=$(nix-build '<nixpkgs>' --no-out-link -A 'OVMF.fd')/FV/OVMF.fd,if=pflash,format=raw,readonly=on" -drive if=pflash,format=raw,file="/tmp/OVMF_VARS.fd" -nic user,hostfwd=tcp::60022-:22 -boot order=d -cdrom /persist/machine_setup/nix/configuration/result/iso/nixos.iso -display vnc=127.0.0.1:0
+# doas "$(nix-build '<nixpkgs>' --no-out-link -A 'qemu')/bin/qemu-system-x86_64" -accel kvm -cpu host -smp cores=8 -m 32768 -drive "file=$(nix-build '<nixpkgs>' --no-out-link -A 'OVMF.fd')/FV/OVMF.fd,if=pflash,format=raw,readonly=on" -drive if=pflash,format=raw,file="/tmp/OVMF_VARS.fd" -nic user,hostfwd=tcp::60022-:22 -boot order=d -cdrom /persist/machine_setup/nix/configuration/result/iso/nixos*.iso -display vnc=127.0.0.1:0
 
 # Get a repl for this flake
 #   nix repl --expr "builtins.getFlake \"$PWD\""
@@ -30,21 +30,40 @@
 
   inputs = {
     impermanence.url = "github:nix-community/impermanence";
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
-    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     nixpkgs-b93b4e9b5.url = "github:NixOS/nixpkgs/b93b4e9b527904aadf52dba6ca35efde2067cbd4";
-    home-manager.url = "github:nix-community/home-manager/release-24.11";
+    home-manager.url = "github:nix-community/home-manager";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/v0.4.2";
+
+      # Optional but recommended to limit the size of your system closure.
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    zsh-histdb = {
+      url = "path:flakes/zsh-histdb";
+
+      # Optional but recommended to limit the size of your system closure.
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    ansible-sshjail = {
+      url = "path:flakes/ansible-sshjail";
+
+      # Optional but recommended to limit the size of your system closure.
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
     {
       self,
       nixpkgs,
-      nixpkgs-unstable,
       nixpkgs-b93b4e9b5,
       impermanence,
       home-manager,
+      lanzaboote,
+      zsh-histdb,
+      ansible-sshjail,
       ...
     }@inputs:
     let
@@ -54,29 +73,66 @@
           pkgs-b93b4e9b5 = import nixpkgs-b93b4e9b5 {
             inherit system;
           };
-          pkgs-unstable = import nixpkgs-unstable {
-            inherit system;
-          };
         };
         modules = [
           impermanence.nixosModules.impermanence
           home-manager.nixosModules.home-manager
+          lanzaboote.nixosModules.lanzaboote
           {
             home-manager.useGlobalPkgs = true;
             home-manager.useUserPackages = true;
           }
+          {
+            nixpkgs.overlays = [
+              zsh-histdb.overlays.default
+              ansible-sshjail.overlays.default
+            ];
+          }
           ./configuration.nix
         ];
       };
       systems = {
         odo = {
-          main = nixpkgs.lib.nixosSystem (base_x86_64_linux // { });
+          main = nixpkgs.lib.nixosSystem (
+            base_x86_64_linux
+            // {
+              modules = base_x86_64_linux.modules ++ [
+                ./hosts/odo
+              ];
+            }
+          );
           iso = nixpkgs.lib.nixosSystem (
             base_x86_64_linux
             // {
               modules = base_x86_64_linux.modules ++ [
+                ./hosts/odo
+                (nixpkgs + "/nixos/modules/installer/cd-dvd/iso-image.nix")
+                # TODO: Figure out how to do image based appliances
+                # (nixpkgs + "/nixos/modules/profiles/image-based-appliance.nix")
+                {
+                  isoImage.makeEfiBootable = true;
+                  isoImage.makeUsbBootable = true;
+                  me.buildingIso = true;
+                }
+              ];
+            }
+          );
+        };
+        neelix = {
+          main = nixpkgs.lib.nixosSystem (
+            base_x86_64_linux
+            // {
+              modules = base_x86_64_linux.modules ++ [
+                ./hosts/neelix
+              ];
+            }
+          );
+          iso = nixpkgs.lib.nixosSystem (
+            base_x86_64_linux
+            // {
+              modules = base_x86_64_linux.modules ++ [
+                ./hosts/neelix
                 (nixpkgs + "/nixos/modules/installer/cd-dvd/iso-image.nix")
-                # TODO: maybe?  imports = [ "${modulesPath}/profiles/image-based-appliance.nix" ];
                 {
                   isoImage.makeEfiBootable = true;
                   isoImage.makeUsbBootable = true;
@@ -91,5 +147,7 @@
     {
       nixosConfigurations.odo = systems.odo.main;
       iso.odo = systems.odo.iso.config.system.build.isoImage;
+      nixosConfigurations.neelix = systems.neelix.main;
+      iso.neelix = systems.neelix.iso.config.system.build.isoImage;
     };
 }

nix/configuration/flakes/ansible-sshjail/flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1735141468,
+        "narHash": "sha256-VIAjBr1qGcEbmhLwQJD6TABppPMggzOvqFsqkDoMsAY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "4005c3ff7505313cbc21081776ad0ce5dfd7a3ce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

nix/configuration/flakes/ansible-sshjail/flake.nix

@@ -0,0 +1,34 @@
+{
+  description = "A slightly better history for zsh";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+  inputs.flake-utils.url = "github:numtide/flake-utils";
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      flake-utils,
+      ...
+    }:
+    let
+      out =
+        system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+          # Maybe pkgs = import nixpkgs { inherit system; }; ?
+          appliedOverlay = self.overlays.default pkgs pkgs;
+        in
+        {
+          packages = rec {
+            default = ansible-sshjail;
+            ansible-sshjail = appliedOverlay.ansible-sshjail;
+          };
+        };
+    in
+    flake-utils.lib.eachDefaultSystem out
+    // {
+      overlays.default = final: prev: {
+        ansible-sshjail = final.callPackage ./package.nix { };
+      };
+    };
+}

nix/configuration/flakes/ansible-sshjail/package.nix

@@ -0,0 +1,33 @@
+# unpackPhase
+# patchPhase
+# configurePhase
+# buildPhase
+# checkPhase
+# installPhase
+# fixupPhase
+# installCheckPhase
+# distPhase
+{
+  stdenv,
+  fetchgit,
+  ...
+}:
+stdenv.mkDerivation {
+  name = "ansible-sshjail";
+  src = fetchgit {
+    url = "https://github.com/austinhyde/ansible-sshjail.git";
+    rev = "a7b0076fdb680b915d35efafd1382919100532b6";
+    sha256 = "sha256-4QX/017fDRzb363NexgvHZ/VFKXOjRgGPDKKygyUylM=";
+  };
+  phases = [
+    "installPhase"
+  ];
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/ansible/plugins/connection_plugins
+    cp $src/sshjail.py $out/share/ansible/plugins/connection_plugins/
+
+    runHook postInstall
+  '';
+}

nix/configuration/flakes/starship-game/flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1735141468,
+        "narHash": "sha256-VIAjBr1qGcEbmhLwQJD6TABppPMggzOvqFsqkDoMsAY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "4005c3ff7505313cbc21081776ad0ce5dfd7a3ce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

nix/configuration/flakes/starship-game/flake.nix

@@ -0,0 +1,34 @@
+{
+  description = "A slightly better history for zsh";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+  inputs.flake-utils.url = "github:numtide/flake-utils";
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      flake-utils,
+      ...
+    }:
+    let
+      out =
+        system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+          # Maybe pkgs = import nixpkgs { inherit system; }; ?
+          appliedOverlay = self.overlays.default pkgs pkgs;
+        in
+        {
+          packages = rec {
+            default = starship-game;
+            starship-game = appliedOverlay.starship-game;
+          };
+        };
+    in
+    flake-utils.lib.eachDefaultSystem out
+    // {
+      overlays.default = final: prev: {
+        starship-game = final.callPackage ./package.nix { };
+      };
+    };
+}

nix/configuration/flakes/starship-game/package.nix

@@ -0,0 +1,261 @@
+{
+  lib,
+  stdenv,
+  SDL2,
+  cmake,
+  copyDesktopItems,
+  fetchFromGitHub,
+  fetchpatch,
+  fetchurl,
+  imagemagick,
+  imgui,
+  libpng,
+  libpulseaudio,
+  libzip,
+  lsb-release,
+  makeDesktopItem,
+  makeWrapper,
+  ninja,
+  nlohmann_json,
+  pkg-config,
+  python3,
+  spdlog,
+  stormlib,
+  tinyxml-2,
+  writeTextFile,
+  zenity,
+}:
+
+let
+
+  # This would get fetched at build time otherwise, see:
+  # https://github.com/HarbourMasters/2ship2harkinian/blob/1.0.2/mm/CMakeLists.txt#L708
+  gamecontrollerdb = fetchurl {
+    name = "gamecontrollerdb.txt";
+    url = "https://raw.githubusercontent.com/gabomdq/SDL_GameControllerDB/b1759cf84028aab89caa1c395e198c340b8dfd89/gamecontrollerdb.txt";
+    hash = "sha256-7C5EkqBIhLGNJuhi3832y0ffW5Ep7iuTYXb1bL5h2Js=";
+  };
+
+  # 2ship needs a specific imgui version
+  imgui' = imgui.overrideAttrs rec {
+    version = "1.90.6";
+    src = fetchFromGitHub {
+      owner = "ocornut";
+      repo = "imgui";
+      rev = "v${version}-docking";
+      hash = "sha256-Y8lZb1cLJF48sbuxQ3vXq6GLru/WThR78pq7LlORIzc=";
+    };
+  };
+
+  libgfxd = fetchFromGitHub {
+    owner = "glankk";
+    repo = "libgfxd";
+    rev = "96fd3b849f38b3a7c7b7f3ff03c5921d328e6cdf";
+    hash = "sha256-dedZuV0BxU6goT+rPvrofYqTz9pTA/f6eQcsvpDWdvQ=";
+  };
+
+  yaml_cpp = fetchFromGitHub {
+    owner = "jbeder";
+    repo = "yaml-cpp";
+    rev = "f7320141120f720aecc4c32be25586e7da9eb978";
+    hash = "sha256-J87oS6Az1/vNdyXu3L7KmUGWzU0IAkGrGMUUha+xDXI=";
+  };
+
+  # spdlog = fetchFromGitHub {
+  #   owner = "gabime";
+  #   repo = "spdlog";
+  #   rev = "7e635fca68d014934b4af8a1cf874f63989352b7";
+  #   hash = "sha256-cxTaOuLXHRU8xMz9gluYz0a93O0ez2xOxbloyc1m1ns=";
+  # };
+
+  # stb_impl = writeTextFile {
+  #   name = "stb_impl.c";
+  #   text = ''
+  #     #define STB_IMAGE_IMPLEMENTATION
+  #     #include "stb_image.h"
+  #   '';
+  # };
+
+  # stb' = fetchurl {
+  #   name = "stb_image.h";
+  #   url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h";
+  #   hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
+  # };
+
+  # Apply 2ship's patch for stormlib
+  stormlib' = stormlib.overrideAttrs (prev: rec {
+    version = "9.25";
+    src = fetchFromGitHub {
+      owner = "ladislav-zezula";
+      repo = "StormLib";
+      rev = "v${version}";
+      hash = "sha256-HTi2FKzKCbRaP13XERUmHkJgw8IfKaRJvsK3+YxFFdc=";
+    };
+    nativeBuildInputs = prev.nativeBuildInputs ++ [ pkg-config ];
+    patches = (prev.patches or [ ]) ++ [
+      (fetchpatch {
+        name = "stormlib-optimizations.patch";
+        url = "https://github.com/briaguya-ai/StormLib/commit/ff338b230544f8b2bb68d2fbe075175ed2fd758c.patch";
+        hash = "sha256-Jbnsu5E6PkBifcx/yULMVC//ab7tszYgktS09Azs5+4=";
+      })
+    ];
+  });
+
+  thread_pool = fetchFromGitHub {
+    owner = "bshoshany";
+    repo = "thread-pool";
+    rev = "v4.1.0";
+    hash = "sha256-zhRFEmPYNFLqQCfvdAaG5VBNle9Qm8FepIIIrT9sh88=";
+  };
+
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "starship-game";
+  version = "v1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "HarbourMasters";
+    repo = "starship";
+    # rev = "5e5e49da93e066f51c3010ba38f09331d866f2db";
+    tag = finalAttrs.version;
+    hash = "sha256-kaLLlLuonqE2DJcRlWR4tCEBNjwIYFlzeDLcYsvMO7I=";
+    fetchSubmodules = true;
+  };
+
+  # patches = [
+  #   # remove fetching stb as we will patch our own
+  #   ./0001-deps.patch
+  # ];
+
+  nativeBuildInputs = [
+    cmake
+    copyDesktopItems
+    imagemagick
+    lsb-release
+    makeWrapper
+    ninja
+    pkg-config
+    python3
+  ];
+
+  buildInputs = [
+    SDL2
+    imgui'
+    libpng
+    libpulseaudio
+    libzip
+    nlohmann_json
+    spdlog
+    stormlib'
+    tinyxml-2
+    zenity
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "NON_PORTABLE" true)
+    (lib.cmakeFeature "CMAKE_INSTALL_PREFIX" "${placeholder "out"}/starship-game")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_IMGUI" "${imgui'.src}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_LIBGFXD" "${libgfxd}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_STORMLIB" "${stormlib'}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_THREADPOOL" "${thread_pool}")
+  ];
+
+  dontAddPrefix = true;
+
+  # Linking fails without this
+  hardeningDisable = [ "format" ];
+
+  # Pie needs to be enabled or else it segfaults
+  hardeningEnable = [ "pie" ];
+
+  # preConfigure = ''
+  #   # mirror 2ship's stb
+  #   mkdir stb
+  #   cp ${stb'} ./stb/${stb'.name}
+  #   cp ${stb_impl} ./stb/${stb_impl.name}
+
+  #   substituteInPlace libultraship/cmake/dependencies/common.cmake \
+  #     --replace-fail "\''${STB_DIR}" "/build/source/stb"
+  # '';
+
+  # (cd tools/Torch && cmake -H. -Bbuild-cmake -GNinja \
+  # -DFETCHCONTENT_SOURCE_DIR_LIBGFXD=${libgfxd} \
+  # -DFETCHCONTENT_SOURCE_DIR_YAML-CPP=${finalAttrs.yaml_cpp_src} \
+  # -DFETCHCONTENT_SOURCE_DIR_SPDLOG=${finalAttrs.spdlog_src}
+  # )
+
+  configurePhase = ''
+    cmake -H. -Bbuild-cmake -GNinja \
+    -DFETCHCONTENT_SOURCE_DIR_IMGUI=${imgui'.src} \
+    -DFETCHCONTENT_SOURCE_DIR_STORMLIB=${stormlib'} \
+    -DFETCHCONTENT_SOURCE_DIR_THREADPOOL=${thread_pool}
+
+    (cd tools/Torch && cmake -H. -Bbuild-cmake -GNinja \
+    -DFETCHCONTENT_SOURCE_DIR_LIBGFXD=${libgfxd} \
+    -DFETCHCONTENT_SOURCE_DIR_YAML-CPP=${yaml_cpp} \
+    -DFETCHCONTENT_SOURCE_DIR_SPDLOG=${spdlog}
+    )
+
+    (cd libultraship && cmake -H. -Bbuild-cmake -GNinja \
+    -DFETCHCONTENT_SOURCE_DIR_LIBGFXD=${libgfxd} \
+    -DFETCHCONTENT_SOURCE_DIR_IMGUI=${imgui'.src} \
+    -DFETCHCONTENT_SOURCE_DIR_STORMLIB=${stormlib'} \
+    -DFETCHCONTENT_SOURCE_DIR_THREADPOOL=${thread_pool}
+    )
+
+  '';
+
+  buildPhase = ''
+    cmake --build build-cmake
+  '';
+
+  postBuild = ''
+    cp ${gamecontrollerdb} ${gamecontrollerdb.name}
+    pushd ../OTRExporter
+    python3 ./extract_assets.py -z ../build/ZAPD/ZAPD.out --norom --xml-root ../mm/assets/xml --custom-assets-path ../mm/assets/custom --custom-otr-file 2ship.o2r --port-ver ${finalAttrs.version}
+    popd
+  '';
+
+  preInstall = ''
+    # Cmake likes it here for its install paths
+    cp ../OTRExporter/2ship.o2r mm/
+  '';
+
+  postInstall = ''
+    mkdir -p $out/bin
+    ln -s $out/2s2h/2s2h.elf $out/bin/2s2h
+    install -Dm644 ../mm/linux/2s2hIcon.png $out/share/pixmaps/2s2h.png
+  '';
+
+  postFixup = ''
+    wrapProgram $out/2s2h/2s2h.elf --prefix PATH ":" ${lib.makeBinPath [ zenity ]}
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "starship";
+      icon = "starship";
+      exec = "starship";
+      comment = finalAttrs.meta.description;
+      genericName = "Starship";
+      desktopName = "starship";
+      categories = [ "Game" ];
+    })
+  ];
+
+  meta = {
+    homepage = "https://github.com/HarbourMasters/2ship2harkinian";
+    description = "A PC port of Majora's Mask with modern controls, widescreen, high-resolution, and more";
+    mainProgram = "starship";
+    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers; [ ];
+    license = with lib.licenses; [
+      # # OTRExporter, OTRGui, ZAPDTR, libultraship
+      # mit
+      # # 2 Ship 2 Harkinian
+      # cc0
+      # # Reverse engineering
+      # unfree
+    ];
+  };
+})

nix/configuration/flakes/zsh-histdb/flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1735141468,
+        "narHash": "sha256-VIAjBr1qGcEbmhLwQJD6TABppPMggzOvqFsqkDoMsAY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "4005c3ff7505313cbc21081776ad0ce5dfd7a3ce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

nix/configuration/flakes/zsh-histdb/flake.nix

@@ -0,0 +1,34 @@
+{
+  description = "A slightly better history for zsh";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+  inputs.flake-utils.url = "github:numtide/flake-utils";
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      flake-utils,
+      ...
+    }:
+    let
+      out =
+        system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+          # Maybe pkgs = import nixpkgs { inherit system; }; ?
+          appliedOverlay = self.overlays.default pkgs pkgs;
+        in
+        {
+          packages = rec {
+            default = zsh-histdb;
+            zsh-histdb = appliedOverlay.zsh-histdb;
+          };
+        };
+    in
+    flake-utils.lib.eachDefaultSystem out
+    // {
+      overlays.default = final: prev: {
+        zsh-histdb = final.callPackage ./package.nix { };
+      };
+    };
+}

nix/configuration/flakes/zsh-histdb/package.nix

@@ -0,0 +1,36 @@
+# unpackPhase
+# patchPhase
+# configurePhase
+# buildPhase
+# checkPhase
+# installPhase
+# fixupPhase
+# installCheckPhase
+# distPhase
+{
+  stdenv,
+  pkgs,
+  sqlite,
+  ...
+}:
+stdenv.mkDerivation {
+  name = "zsh-histdb";
+  src = pkgs.fetchgit {
+    url = "https://github.com/larkery/zsh-histdb.git";
+    rev = "90a6c104d0fcc0410d665e148fa7da28c49684eb";
+    sha256 = "sha256-vtG1poaRVbfb/wKPChk1WpPgDq+7udLqLfYfLqap4Vg=";
+  };
+  buildInputs = [ sqlite ];
+  phases = [
+    "installPhase"
+  ];
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/zsh/plugins/zsh-histdb
+    cp -r $src/histdb-* $src/*.zsh $src/db_migrations $out/share/zsh/plugins/zsh-histdb/
+    runHook postInstall
+  '';
+  postInstall = ''
+    substituteInPlace $out/share/zsh/plugins/zsh-histdb/sqlite-history.zsh $out/share/zsh/plugins/zsh-histdb/histdb-merge $out/share/zsh/plugins/zsh-histdb/histdb-migrate --replace-fail "sqlite3" "${sqlite}/bin/sqlite3"
+  '';
+}

nix/configuration/hosts/neelix/default.nix

@@ -0,0 +1,38 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./disk-config.nix
+    ./optimized_build.nix
+    ./power_management.nix
+  ];
+
+  # Generate with `head -c4 /dev/urandom | od -A none -t x4`
+  networking.hostId = "fbd233d8";
+
+  networking.hostName = "neelix"; # Define your hostname.
+
+  time.timeZone = "America/New_York";
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  me.secureBoot.enable = false;
+
+  # Early KMS
+  boot.initrd.kernelModules = [ "i915" ];
+
+  # Mount tmpfs at /tmp
+  boot.tmp.useTmpfs = true;
+
+  me.bluetooth.enable = true;
+  me.emacs_flavor = "plainmacs";
+  me.graphical = true;
+  me.graphics_card_type = "intel";
+  me.kodi.enable = true;
+  me.lvfs.enable = true;
+  me.sound.enable = true;
+  me.wireguard.activated = [ "wgh" ];
+  me.wireguard.deactivated = [ "wgf" ];
+  me.zrepl.enable = true;
+  me.zsh.enable = true;
+
+}

nix/configuration/hosts/neelix/disk-config.nix

@@ -0,0 +1,140 @@
+# Manual Step:
+#   Check if drive supports 4kn: nvme id-ns -H /dev/nvme0n1
+#   Format the drive to 4kn: nvme format --lbaf=1 /dev/nvme0n1
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+lib.mkIf (!config.me.buildingIso) {
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/nvme0n1";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [
+                  "umask=0077"
+                  "noatime"
+                  "discard"
+                ];
+              };
+            };
+            zfs = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        # mode = "mirror";
+        # Workaround: cannot import 'zroot': I/O error in disko tests
+        options.cachefile = "none";
+        options = {
+          ashift = "12";
+          compatibility = "openzfs-2.2-freebsd";
+          autotrim = "on";
+        };
+        rootFsOptions = {
+          acltype = "posixacl";
+          atime = "off";
+          relatime = "off";
+          xattr = "sa";
+          mountpoint = "none";
+          compression = "lz4";
+          canmount = "off";
+          utf8only = "on";
+          dnodesize = "auto";
+          normalization = "formD";
+        };
+
+        datasets = {
+          "linux/nix" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "linux/nix/root" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/";
+            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/root@blank$' || zfs snapshot zroot/linux/nix/root@blank";
+          };
+          "linux/nix/nix" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/nix";
+            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/nix@blank$' || zfs snapshot zroot/linux/nix/nix@blank";
+            options = {
+              recordsize = "1MiB";
+              compression = "lz4";
+            };
+          };
+          "linux/nix/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/home";
+            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/home@blank$' || zfs snapshot zroot/linux/nix/home@blank";
+          };
+          "linux/nix/persist" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/persist";
+            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/persist@blank$' || zfs snapshot zroot/linux/nix/persist@blank";
+          };
+          "linux/nix/state" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/state";
+            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/state@blank$' || zfs snapshot zroot/linux/nix/state@blank";
+          };
+        };
+      };
+    };
+  };
+
+  # Make sure all persistent volumes are marked as neededForBoot
+  #
+  # Also mounts /home so it is mounted before the user home directories are created.
+  fileSystems."/persist".neededForBoot = true;
+  fileSystems."/state".neededForBoot = true;
+  fileSystems."/home".neededForBoot = true;
+
+  fileSystems."/".options = [
+    "noatime"
+    "norelatime"
+  ];
+  fileSystems."/nix".options = [
+    "noatime"
+    "norelatime"
+  ];
+  fileSystems."/persist".options = [
+    "noatime"
+    "norelatime"
+  ];
+  fileSystems."/state".options = [
+    "noatime"
+    "norelatime"
+  ];
+  fileSystems."/home".options = [
+    "noatime"
+    "norelatime"
+  ];
+}

nix/configuration/hosts/neelix/hardware-configuration.nix

@@ -0,0 +1,32 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usbhid" "usb_storage" "sd_mod" "sdhci_pci" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp58s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

nix/configuration/hosts/neelix/optimized_build.nix

@@ -0,0 +1,78 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  imports = [ ];
+
+  config = lib.mkMerge [
+    { }
+    (lib.mkIf (!config.me.buildingIso) {
+      nix.settings.system-features = lib.mkForce [
+        "gccarch-alderlake"
+        "gccarch-x86-64-v3"
+        "benchmark"
+        "big-parallel"
+        "kvm"
+        "nixos-test"
+      ];
+
+      # nixpkgs.hostPlatform = {
+      #   gcc.arch = "alderlake";
+      #   gcc.tune = "alderlake";
+      #   system = "x86_64-linux";
+
+      # };
+
+      nixpkgs.overlays = [
+        (
+          self: super:
+          let
+            optimizeWithFlags =
+              pkg: flags:
+              pkg.overrideAttrs (old: {
+                NIX_CFLAGS_COMPILE = [ (old.NIX_CFLAGS_COMPILE or "") ] ++ flags;
+              });
+            addConfig =
+              additionalConfig: pkg:
+              pkg.override (oldconfig: {
+                structuredExtraConfig = pkg.structuredExtraConfig // additionalConfig;
+              });
+          in
+          {
+            linux_alderlake =
+              addConfig
+                {
+                  # Full preemption
+                  PREEMPT = lib.mkOverride 60 lib.kernel.yes;
+                  PREEMPT_VOLUNTARY = lib.mkOverride 60 lib.kernel.no;
+
+                  # Google's BBRv3 TCP congestion Control
+                  TCP_CONG_BBR = lib.kernel.yes;
+                  DEFAULT_BBR = lib.kernel.yes;
+
+                  # Preemptive Full Tickless Kernel at 300Hz
+                  HZ = lib.kernel.freeform "300";
+                  HZ_300 = lib.kernel.yes;
+                  HZ_1000 = lib.kernel.no;
+                }
+                (
+                  optimizeWithFlags super.linux_6_12 [
+                    "-march=alderlake"
+                    "-mtune=alderlake"
+                  ]
+                );
+          }
+        )
+      ];
+
+      boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_alderlake;
+    })
+    (lib.mkIf (config.me.buildingIso) {
+      boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_6_12;
+      boot.supportedFilesystems = [ "zfs" ];
+    })
+  ];
+}

nix/configuration/hosts/neelix/power_management.nix

@@ -0,0 +1,35 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    powertop
+  ];
+
+  # pcie_aspm=force pcie_aspm.policy=powersupersave :: Enable PCIe active state power management for power reduction.
+  # nowatchdog :: Disable watchdog for power savings (related to disable_sp5100_watchdog above).
+  boot.kernelParams = [
+    "pcie_aspm=force"
+    # "pcie_aspm.policy=powersupersave"
+    "nowatchdog"
+  ];
+
+  # default performance balance_performance balance_power power
+  # defaults to balance_performance
+  # systemd.tmpfiles.rules = [
+  #   "w- /sys/devices/system/cpu/cpufreq/policy0/energy_performance_preference - - - - power"
+  #   "w- /sys/devices/system/cpu/cpufreq/policy1/energy_performance_preference - - - - power"
+  #   "w- /sys/devices/system/cpu/cpufreq/policy2/energy_performance_preference - - - - power"
+  #   "w- /sys/devices/system/cpu/cpufreq/policy3/energy_performance_preference - - - - power"
+  # ];
+
+  boot.extraModprobeConfig = ''
+    options snd_hda_intel power_save=1
+  '';
+}

nix/configuration/hosts/odo/default.nix

@@ -3,6 +3,10 @@
   imports = [
     ./hardware-configuration.nix
     ./disk-config.nix
+    ./optimized_build.nix
+    ./power_management.nix
+    ./screen_brightness.nix
+    ./wifi.nix
   ];
 
   # Generate with `head -c4 /dev/urandom | od -A none -t x4`
@@ -11,4 +15,61 @@
   networking.hostName = "odo"; # Define your hostname.
 
   time.timeZone = "America/New_York";
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  me.secureBoot.enable = true;
+
+  # Early KMS
+  boot.initrd.kernelModules = [ "amdgpu" ];
+
+  # Mount tmpfs at /tmp
+  boot.tmp.useTmpfs = true;
+
+  environment.systemPackages = with pkgs; [
+    fw-ectool
+  ];
+
+  me.alacritty.enable = true;
+  me.ansible.enable = true;
+  me.ares.enable = true;
+  me.bluetooth.enable = true;
+  me.chromecast.enable = true;
+  me.chromium.enable = true;
+  me.docker.enable = true;
+  me.emacs_flavor = "full";
+  me.firefox.enable = true;
+  me.git.config = ../../roles/git/files/gitconfig_home;
+  me.gpg.enable = true;
+  me.graphical = true;
+  me.graphics_card_type = "amd";
+  me.kanshi.enable = true;
+  me.kubernetes.enable = true;
+  me.latex.enable = true;
+  me.launch_keyboard.enable = true;
+  me.lvfs.enable = true;
+  me.media.enable = true;
+  me.nix_index.enable = true;
+  me.python.enable = true;
+  me.qemu.enable = true;
+  me.rust.enable = true;
+  me.sound.enable = true;
+  me.steam.enable = true;
+  me.sway.enable = true;
+  me.terraform.enable = true;
+  me.vnc_client.enable = true;
+  me.vscode.enable = true;
+  me.wasm.enable = true;
+  me.waybar.enable = true;
+  me.wireguard.activated = [
+    "drmario"
+    "wgh"
+    "colo"
+  ];
+  me.wireguard.deactivated = [ "wgf" ];
+  me.zrepl.enable = true;
+  me.zsh.enable = true;
+
+  me.sm64ex.enable = true;
+  me.shipwright.enable = true;
+  me.ship2harkinian.enable = true;
 }

nix/configuration/hosts/odo/disk-config.nix

@@ -1,3 +1,6 @@
+# Manual Step:
+#   Check if drive supports 4kn: nvme id-ns -H /dev/nvme0n1
+#   Format the drive to 4kn: nvme format --lbaf=1 /dev/nvme0n1
 {
   config,
   lib,
@@ -118,4 +121,28 @@ lib.mkIf (!config.me.buildingIso) {
   fileSystems."/persist".neededForBoot = true;
   fileSystems."/state".neededForBoot = true;
   fileSystems."/home".neededForBoot = true;
+
+  fileSystems."/".options = [
+    "noatime"
+    "norelatime"
+  ];
+  fileSystems."/nix".options = [
+    "noatime"
+    "norelatime"
+  ];
+  fileSystems."/persist".options = [
+    "noatime"
+    "norelatime"
+  ];
+  fileSystems."/state".options = [
+    "noatime"
+    "norelatime"
+  ];
+  fileSystems."/home".options = [
+    "noatime"
+    "norelatime"
+  ];
+
+  # Only attempt to decrypt the main pool. Otherwise it attempts to decrypt pools that aren't even used.
+  boot.zfs.requestEncryptionCredentials = [ "zroot/linux/nix" ];
 }

nix/configuration/hosts/odo/hardware-configuration.nix

@@ -20,7 +20,7 @@
     "thunderbolt"
   ];
   boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
+  boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking

nix/configuration/hosts/odo/optimized_build.nix

@@ -0,0 +1,81 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  imports = [ ];
+
+  config = lib.mkMerge [
+    { }
+    (lib.mkIf (!config.me.buildingIso) {
+      nix.settings.system-features = lib.mkForce [
+        "gccarch-znver4"
+        "gccarch-skylake"
+        # "gccarch-alderlake" missing WAITPKG
+        "gccarch-x86-64-v3"
+        "gccarch-x86-64-v4"
+        "benchmark"
+        "big-parallel"
+        "kvm"
+        "nixos-test"
+      ];
+
+      # nixpkgs.hostPlatform = {
+      #   gcc.arch = "znver4";
+      #   gcc.tune = "znver4";
+      #   system = "x86_64-linux";
+
+      # };
+
+      nixpkgs.overlays = [
+        (
+          self: super:
+          let
+            optimizeWithFlags =
+              pkg: flags:
+              pkg.overrideAttrs (old: {
+                NIX_CFLAGS_COMPILE = [ (old.NIX_CFLAGS_COMPILE or "") ] ++ flags;
+              });
+            addConfig =
+              additionalConfig: pkg:
+              pkg.override (oldconfig: {
+                structuredExtraConfig = pkg.structuredExtraConfig // additionalConfig;
+              });
+          in
+          {
+            linux_znver4 =
+              addConfig
+                {
+                  # Full preemption
+                  PREEMPT = lib.mkOverride 60 lib.kernel.yes;
+                  PREEMPT_VOLUNTARY = lib.mkOverride 60 lib.kernel.no;
+
+                  # Google's BBRv3 TCP congestion Control
+                  TCP_CONG_BBR = lib.kernel.yes;
+                  DEFAULT_BBR = lib.kernel.yes;
+
+                  # Preemptive Full Tickless Kernel at 300Hz
+                  HZ = lib.kernel.freeform "300";
+                  HZ_300 = lib.kernel.yes;
+                  HZ_1000 = lib.kernel.no;
+                }
+                (
+                  optimizeWithFlags super.linux_6_12 [
+                    "-march=znver4"
+                    "-mtune=znver4"
+                  ]
+                );
+          }
+        )
+      ];
+
+      boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_znver4;
+    })
+    (lib.mkIf (config.me.buildingIso) {
+      boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_6_12;
+      boot.supportedFilesystems.zfs = true;
+    })
+  ];
+}

nix/configuration/hosts/odo/power_management.nix

@@ -0,0 +1,59 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    powertop
+  ];
+
+  # amdgpu.abmlevel=3 :: Automatically reduce screen brightness but tweak colors to compensate for power reduction.
+  # pcie_aspm=force pcie_aspm.policy=powersupersave :: Enable PCIe active state power management for power reduction.
+  # nowatchdog :: Disable watchdog for power savings (related to disable_sp5100_watchdog above).
+  # amd_pstate=passive :: Fully automated hardware pstate control.
+  # amd_pstate=active :: Same as passive except we can set the energy performance preference (EPP) to suggest how much we prefer performance or energy efficiency.
+  # amd_pstate=guided :: Same as passive except we can set upper and lower frequency bounds.
+  # amdgpu.dcdebugmask=0x10 :: Allegedly disables Panel Replay from https://community.frame.work/t/tracking-freezing-arch-linux-amd/39495/32
+  boot.kernelParams = [
+    "amdgpu.abmlevel=3"
+    "pcie_aspm=force"
+    # "pcie_aspm.policy=powersupersave"
+    "nowatchdog"
+    # I don't see a measurable benefit from these two:
+    # "cpufreq.default_governor=powersave"
+    # "initcall_blacklist=cpufreq_gov_userspace_init"
+  ];
+
+  systemd.tmpfiles.rules = [
+    "w- /sys/firmware/acpi/platform_profile - - - - low-power"
+    "w- /sys/devices/system/cpu/cpufreq/policy0/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy1/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy2/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy3/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy4/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy5/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy6/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy7/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy8/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy9/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy10/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy11/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy12/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy13/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy14/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy15/energy_performance_preference - - - - power"
+  ];
+
+  boot.extraModprobeConfig = ''
+    # Disable the hardware watchdog inside AMD 700 chipset series for power savings.
+    blacklist sp5100_tco
+
+    # Sound power-saving was causing chat notifications to be inaudible.
+    # options snd_hda_intel power_save=1
+  '';
+}

nix/configuration/hosts/odo/screen_brightness.nix

@@ -0,0 +1,14 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  systemd.tmpfiles.rules = [
+    "w- /sys/class/backlight/amdgpu_bl1/brightness - - - - 85"
+  ];
+}

nix/configuration/hosts/odo/wifi.nix

@@ -0,0 +1,21 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  config = {
+    environment.loginShellInit = lib.mkIf (!config.me.buildingIso) ''
+      doas iw dev wlan0 set power_save off
+    '';
+
+    # Enable debug logging for ath12k wifi card.
+    boot.kernelParams = [
+      "ath12k.debug_mask=0xffffffff"
+    ];
+  };
+}

nix/configuration/roles/2ship2harkinian/default.nix

@@ -0,0 +1,48 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    ship2harkinian.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install 2ship2harkinian.";
+    };
+  };
+
+  config = lib.mkIf config.me.ship2harkinian.enable (
+    lib.mkMerge [
+      {
+        allowedUnfree = [ "2ship2harkinian" ];
+      }
+      (lib.mkIf config.me.graphical {
+        environment.systemPackages = with pkgs; [
+          _2ship2harkinian
+        ];
+
+        # TODO perhaps install ~/.local/share/2ship/2ship2harkinian.json
+
+        environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          users.talexander = {
+            directories = [
+              {
+                directory = ".local/share/2ship";
+                user = "talexander";
+                group = "talexander";
+                mode = "0755";
+              }
+            ];
+          };
+        };
+      })
+    ]
+  );
+}

nix/configuration/roles/alacritty/default.nix

@@ -7,7 +7,18 @@
 
 {
   imports = [ ];
+  options.me = {
+    alacritty.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install alacritty.";
+    };
+  };
 
+  config = lib.mkIf config.me.alacritty.enable (
+    lib.mkMerge [
+      (lib.mkIf config.me.graphical {
         environment.systemPackages = with pkgs; [
           alacritty
           xdg-utils # for xdg-open
@@ -20,5 +31,8 @@
               source = ./files/alacritty.toml;
             };
           };
+      })
+    ]
+  );
 
 }

nix/configuration/roles/ansible/default.nix

@@ -0,0 +1,86 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    ansible.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install ansible.";
+    };
+  };
+
+  config = lib.mkIf config.me.ansible.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+          ansible
+        ];
+
+        nixpkgs.overlays = [
+          (final: prev: {
+            ansible = pkgs.symlinkJoin {
+              name = "ansible";
+              paths = [
+                (prev.ansible.overridePythonAttrs {
+                  propagatedBuildInputs = prev.ansible.propagatedBuildInputs ++ [ prev.python3Packages.jmespath ];
+                })
+                pkgs.ansible-sshjail
+              ];
+              buildInputs = [ pkgs.makeWrapper ];
+
+              postBuild = ''
+                ${lib.concatMapStringsSep "\n"
+                  (
+                    prog:
+                    (
+                      "wrapProgram $out/bin/${prog} ${
+                        lib.concatMapStringsSep " "
+                          (
+                            plugin_type:
+                            "--set ANSIBLE_${lib.toUpper plugin_type}_PLUGINS $out/share/ansible/plugins/${lib.toLower plugin_type}_plugins"
+                          )
+                          [
+                            "action"
+                            "cache"
+                            "callback"
+                            "connection"
+                            "filter"
+                            "inventory"
+                            "lookup"
+                            "shell"
+                            "strategy"
+                            "test"
+                            "vars"
+                          ]
+                      } --prefix PATH : ${lib.makeBinPath [ ]}"
+                    )
+                  )
+                  [
+                    "ansible"
+                    "ansible-config"
+                    "ansible-console"
+                    "ansible-doc"
+                    "ansible-galaxy"
+                    "ansible-inventory"
+                    "ansible-playbook"
+                    "ansible-pull"
+                    "ansible-test"
+                    "ansible-vault"
+                  ]
+                }
+              '';
+            };
+          })
+        ];
+      }
+    ]
+  );
+}

nix/configuration/roles/ares/default.nix

@@ -0,0 +1,44 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    ares.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install ares.";
+    };
+  };
+
+  config = lib.mkIf config.me.ares.enable (
+    lib.mkMerge [
+      { }
+      (lib.mkIf config.me.graphical {
+        environment.systemPackages = with pkgs; [
+          ares
+        ];
+
+        environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          users.talexander = {
+            directories = [
+              {
+                directory = ".local/share/ares";
+                user = "talexander";
+                group = "talexander";
+                mode = "0755";
+              }
+            ];
+          };
+        };
+      })
+    ]
+  );
+}

nix/configuration/roles/blank/default.nix

@@ -8,4 +8,23 @@
 {
   imports = [ ];
 
+  options.me = {
+    blank.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install blank.";
+    };
+  };
+
+  config = lib.mkIf config.me.blank.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+        ];
+      }
+      (lib.mkIf config.me.graphical {
+      })
+    ]
+  );
 }

nix/configuration/roles/bluetooth/default.nix

@@ -0,0 +1,46 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    bluetooth.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install bluetooth.";
+    };
+  };
+
+  config = lib.mkIf config.me.bluetooth.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+        ];
+
+        hardware.bluetooth = {
+          enable = true;
+          powerOnBoot = true;
+          settings = {
+            General = {
+              # Enable support for showing battery charge level.
+              Experimental = true;
+            };
+          };
+        };
+
+        environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          directories = [
+            "/var/lib/bluetooth" # Bluetooth pairing information.
+          ];
+        };
+      }
+    ]
+  );
+}

nix/configuration/roles/boot/default.nix

@@ -0,0 +1,105 @@
+# ISO does not work with systemd initrd yet https://github.com/NixOS/nixpkgs/pull/291750
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options = {
+    me.secureBoot = {
+      enable = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Enable to use secure boot.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkMerge [
+    {
+      environment.systemPackages = with pkgs; [
+        tpm2-tools # For tpm2_eventlog to check for OptionRoms
+        # cp /sys/kernel/security/tpm0/binary_bios_measurements eventlog
+        # tpm2_eventlog eventlog | grep "BOOT_SERVICES_DRIVER"
+        sbctl # For debugging and troubleshooting Secure Boot.
+      ];
+    }
+    (lib.mkIf (!config.me.buildingIso) {
+
+      boot.loader.grub.enable = false;
+      # Use the systemd-boot EFI boot loader.
+      boot.loader.systemd-boot.enable = true;
+      # TODO: make not write bootx64.efi
+      boot.loader.efi.canTouchEfiVariables = false;
+
+      # Automatically delete old generations
+      boot.loader.systemd-boot.configurationLimit = 3;
+
+      boot.loader.systemd-boot.memtest86.enable = true;
+
+      # Check what will be lost with `zfs diff zroot/linux/root@blank`
+      boot.initrd.systemd.enable = lib.mkDefault true;
+      boot.initrd.systemd.services.zfs-rollback = {
+        description = "Rollback ZFS root dataset to blank snapshot";
+        wantedBy = [
+          "initrd.target"
+        ];
+        after = [
+          "zfs-import-zroot.service"
+        ];
+        before = [
+          "sysroot.mount"
+        ];
+        path = with pkgs; [
+          zfs
+        ];
+        unitConfig.DefaultDependencies = "no";
+        serviceConfig.Type = "oneshot";
+        script = ''
+          zfs rollback -r zroot/linux/nix/root@blank
+          zfs rollback -r zroot/linux/nix/home@blank
+          echo "rollback complete"
+        '';
+      };
+
+      # boot.loader.systemd-boot.extraEntries = {
+      #   "windows.conf" = ''
+      #     title Windows
+      #     efi /EFI/Microsoft/Boot/bootmgfw.efi
+      #     options root=PARTUUID=17e325bf-a378-4d1d-be6a-f6df5476f0fa
+      #   '';
+      # };
+    })
+    (lib.mkIf (config.me.secureBoot.enable) {
+
+      environment.systemPackages = with pkgs; [
+        sbctl
+      ];
+      boot.loader.systemd-boot.enable = lib.mkForce false;
+      boot.lanzaboote = {
+        enable = true;
+        pkiBundle = "/var/lib/sbctl";
+      };
+      environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+        hideMounts = true;
+        directories = [
+          "/var/lib/sbctl" # Secure Boot Keys
+        ];
+      };
+    })
+  ];
+}
+# efibootmgr -c -d /dev/sda -p 1 -L NixOS-boot -l '\EFI\NixOS-boot\grubx64.efi'
+
+# Text-only:
+# sudo cp "$(nix-build '<nixpkgs>' --no-out-link -A 'refind')/share/refind/refind_x64.efi" /boot/EFI/boot/bootx64.efi
+
+# Full graphics:
+# $ sudo nix-shell -p refind efibootmgr
+# $ refind-install

nix/configuration/roles/chromecast/default.nix

@@ -0,0 +1,31 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    chromecast.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install chromecast.";
+    };
+  };
+
+  config = lib.mkIf config.me.chromecast.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+          catt
+        ];
+      }
+      (lib.mkIf config.me.graphical {
+      })
+    ]
+  );
+}

nix/configuration/roles/chromium/default.nix

@@ -0,0 +1,65 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    chromium.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install chromium.";
+    };
+  };
+
+  config = lib.mkIf config.me.chromium.enable (
+    lib.mkMerge [
+      { }
+      (lib.mkIf config.me.graphical {
+        environment.systemPackages = with pkgs; [
+          (chromium.override { enableWideVine = true; })
+        ];
+        allowedUnfree = [
+          "chromium"
+          "chromium-unwrapped"
+          "widevine-cdm"
+        ];
+
+        environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          users.talexander = {
+            directories = [
+              {
+                directory = ".config/chromium";
+                user = "talexander";
+                group = "talexander";
+                mode = "0700";
+              }
+            ];
+          };
+        };
+        environment.persistence."/state" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          users.talexander = {
+            directories = [
+              {
+                directory = ".cache/chromium";
+                user = "talexander";
+                group = "talexander";
+                mode = "0700";
+              }
+            ];
+          };
+        };
+
+        # Enabling vulkan causes video to render as white
+        # nixpkgs.config.chromium.commandLineArgs = "--enable-features=Vulkan";
+      })
+    ]
+  );
+}

nix/configuration/roles/docker/default.nix

@@ -0,0 +1,64 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    docker.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install docker.";
+    };
+  };
+
+  config = lib.mkIf config.me.docker.enable (
+    lib.mkMerge [
+      {
+        virtualisation.docker.enable = true;
+        # Use docker activation
+        virtualisation.docker.enableOnBoot = false;
+        # Rootless docker breaks access to ssh for buildkit.
+        # virtualisation.docker.rootless = {
+        #   enable = true;
+        #   setSocketVariable = true;
+        # };
+        # Give docker access to ssh for fetching repos with buildkit.
+        virtualisation.docker.extraPackages = [ pkgs.openssh ];
+        environment.systemPackages = with pkgs; [
+          docker-buildx
+        ];
+
+        environment.persistence."/state" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          directories = [
+            {
+              directory = "/var/lib/docker";
+              user = "root";
+              group = "root";
+              mode = "0740";
+            }
+          ];
+          # users.talexander = {
+          #   directories = [
+          #     {
+          #       directory = ".local/share/docker";
+          #       user = "talexander";
+          #       group = "talexander";
+          #       mode = "0740";
+          #     }
+          #   ];
+          # };
+        };
+
+        # Needed for non-rootless docker
+        users.users.talexander.extraGroups = [ "docker" ];
+      }
+    ]
+  );
+}

nix/configuration/roles/emacs/default.nix

@@ -6,7 +6,9 @@
 }:
 
 let
-  plainmacs = pkgs.writeShellScriptBin "plainmacs" ''
+  plainmacs =
+    emacs_package:
+    pkgs.writeShellScriptBin "plainmacs" ''
       INIT_SCRIPT=$(cat <<EOF
       (progn
         (setq make-backup-files nil auto-save-default nil create-lockfiles nil)
@@ -34,32 +36,37 @@ let
       EOF
       )
 
-    exec ${pkgs.emacs29-pgtk}/bin/emacs -q --eval "$INIT_SCRIPT" "''${@}"
+      exec ${emacs_package}/bin/emacs -q --eval "$INIT_SCRIPT" "''${@}"
     '';
-  e_shorthand = pkgs.writeShellScriptBin "e" ''
-    exec ${pkgs.emacs29-pgtk}/bin/emacs "''${@}"
+  e_shorthand =
+    emacs_package:
+    pkgs.writeShellScriptBin "e" ''
+      exec ${emacs_package}/bin/emacs "''${@}"
     '';
 in
 {
   imports = [ ];
 
-  environment.systemPackages = with pkgs; [
-    plainmacs
-    e_shorthand
-    emacs29-pgtk
-    clang # To compile tree-sitter grammars
-    nixd # nix language server
-    nixfmt-rfc-style # auto-formatting nix files through nixd
-  ];
+  options.me.emacs_flavor = lib.mkOption {
+    type = lib.types.nullOr (
+      lib.types.enum [
+        "full"
+        "plainmacs"
+      ]
+    );
+    default = null;
+    example = "full";
+    description = "What flavor of emacs to set up.";
+  };
 
-  home-manager.users.talexander =
-    { pkgs, ... }:
+  config = lib.mkIf (config.me.emacs_flavor != null) (
+    lib.mkMerge [
       {
-      home.file.".config/emacs" = {
-        source = ./files/emacs;
-        recursive = true;
-      };
-    };
+        environment.systemPackages = with pkgs; [
+          my_emacs
+          (plainmacs my_emacs)
+          (e_shorthand my_emacs)
+        ];
 
         environment.persistence."/state" = lib.mkIf (!config.me.buildingIso) {
           hideMounts = true;
@@ -77,5 +84,84 @@ in
           };
         };
 
-  environment.variables.EDITOR = "${plainmacs}/bin/plainmacs";
+        environment.variables.EDITOR = "plainmacs";
+      }
+      (lib.mkIf (config.me.graphical) {
+        nixpkgs.overlays = [
+          (final: prev: {
+            my_emacs = final.emacs29-pgtk;
+          })
+        ];
+      })
+      (lib.mkIf (!config.me.graphical) {
+        nixpkgs.overlays = [
+          (final: prev: {
+            my_emacs = final.emacs-nox;
+          })
+        ];
+      })
+      (lib.mkIf (config.me.emacs_flavor == "full") {
+        nixpkgs.overlays = [
+          (final: prev: {
+            my_emacs = pkgs.buildEnv {
+              name = prev.my_emacs.name;
+              paths = with prev; [
+                my_emacs
+              ];
+              extraOutputsToInstall = [
+                "man"
+                "doc"
+                "info"
+              ];
+              buildInputs = [ final.makeWrapper ];
+              postBuild = ''
+                wrapProgram $out/bin/emacs --prefix PATH : ${
+                  lib.makeBinPath [
+                    (final.aspellWithDicts (
+                      dicts: with dicts; [
+                        en
+                        en-computers
+                      ]
+                    ))
+                    final.nixd # nix language server
+                    final.nixfmt-rfc-style # auto-formatting nix files through nixd
+                    final.clang # To compile tree-sitter grammars
+                    final.shellcheck
+                    final.cmake-language-server
+                    final.cmake # Used by cmake-language-server
+                  ]
+                }
+              '';
+            };
+          })
+        ];
+
+        home-manager.users.talexander =
+          { pkgs, ... }:
+          {
+            home.file.".config/emacs" = {
+              source = ./files/emacs;
+              recursive = true;
+            };
+          };
+      })
+      (lib.mkIf (config.me.emacs_flavor == "plainmacs") {
+        nixpkgs.overlays = [
+          (final: prev: {
+            my_emacs = pkgs.buildEnv {
+              name = prev.my_emacs.name;
+              paths = with prev; [
+                my_emacs
+              ];
+              extraOutputsToInstall = [
+                "man"
+                "doc"
+                "info"
+              ];
+            };
+          })
+        ];
+      })
+    ]
+  );
 }

nix/configuration/roles/emacs/files/emacs/elisp/lang-cmake.el

@@ -0,0 +1,18 @@
+(require 'common-lsp)
+
+(use-package cmake-mode
+  :commands cmake-mode
+  :hook (
+         (cmake-mode . (lambda ()
+                         (eglot-ensure)
+                         (defclass my/eglot-cmake (eglot-lsp-server) ()
+                           :documentation
+                           "Own eglot server class.")
+
+                         (add-to-list 'eglot-server-programs
+                                      '(cmake-mode . (my/eglot-cmake "cmake-language-server")))
+                         ))
+         )
+  )
+
+(provide 'lang-cmake)

nix/configuration/roles/emacs/files/emacs/elisp/lang-org.el

@@ -38,6 +38,8 @@
 
   ;; TODO: There is an option to set the compiler, could be better than manually doing this here https://orgmode.org/manual/LaTeX_002fPDF-export-commands.html
   ;; (setq org-latex-compiler "lualatex")
+  ;; TODO: nixos latex page recommends this line, figure out what it does / why its needed:
+  ;; (setq org-preview-latex-default-process 'dvisvgm)
   (setq org-latex-pdf-process
         '("lualatex -shell-escape -interaction nonstopmode -output-directory %o %f"
           "lualatex -shell-escape -interaction nonstopmode -output-directory %o %f"

nix/configuration/roles/emacs/files/emacs/init.el

@@ -38,4 +38,6 @@
 
 (require 'lang-nix)
 
+(require 'lang-cmake)
+
 (load-directory autoload-directory)

nix/configuration/roles/firefox/default.nix

@@ -8,6 +8,18 @@
 {
   imports = [ ];
 
+  options.me = {
+    firefox.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install firefox.";
+    };
+  };
+
+  config = lib.mkIf config.me.firefox.enable (
+    lib.mkMerge [
+      (lib.mkIf config.me.graphical {
         programs.firefox = {
           enable = true;
           package = (pkgs.wrapFirefox (pkgs.firefox-unwrapped.override { pipewireSupport = true; }) { });
@@ -80,6 +92,14 @@
                 install_url = "https://addons.mozilla.org/firefox/downloads/latest/netflix-party-is-now-teleparty/latest.xpi";
                 installation_mode = "normal_installed";
               };
+              "@ublacklist" = {
+                install_url = "https://addons.mozilla.org/firefox/downloads/latest/ublacklist/latest.xpi";
+                installation_mode = "normal_installed";
+              };
+              "@react-devtools" = {
+                install_url = "https://addons.mozilla.org/firefox/downloads/latest/react-devtools/latest.xpi";
+                installation_mode = "normal_installed";
+              };
             };
           };
         };
@@ -110,4 +130,7 @@
             ];
           };
         };
+      })
+    ]
+  );
 }

nix/configuration/roles/fonts/default.nix

@@ -8,116 +8,22 @@
 {
   imports = [ ];
 
+  config = lib.mkIf config.me.graphical {
     fonts = {
-    enableDefaultPackages = true;
+      enableDefaultPackages = false;
       packages = with pkgs; [
         cascadia-code
         source-sans-pro
         source-serif-pro
+        noto-fonts-cjk-sans
+        noto-fonts-cjk-serif
+        noto-fonts-color-emoji
       ];
 
       fontconfig = {
-      localConf = ''
-        <?xml version="1.0"?>
-        <!DOCTYPE fontconfig SYSTEM "fonts.dtd">
-        <fontconfig>
-          <!-- reject all bitmap fonts, with the exception of 'terminus' -->
-          <selectfont>
-            <!-- <acceptfont> -->
-            <!--   <pattern> -->
-            <!--     <patelt name="family"> <string>Terminus</string> </patelt> -->
-            <!--   </pattern> -->
-            <!-- </acceptfont> -->
-            <rejectfont>
-              <pattern>
-                <patelt name="scalable"> <bool>false</bool> </patelt>
-              </pattern>
-            </rejectfont>
-            <rejectfont>
-              <!-- You don't want ghostscript fonts in your web browsing because of annoying ligatures like ffi -->
-              <glob>/usr/share/fonts/gsfonts/*</glob>
-            </rejectfont>
-          </selectfont>
-
-          <!-- preferred aliases -->
-          <alias>
-            <family>serif</family>
-            <prefer>
-              <family>Source Serif Pro</family>
-              <family>Source Sans Pro</family>
-            </prefer>
-          </alias>
-
-          <!-- preferred aliases -->
-          <alias>
-            <family>sans-serif</family>
-            <prefer>
-              <family>Source Sans Pro</family>
-              <family>Source Serif Pro</family>
-            </prefer>
-          </alias>
-
-          <!-- preferred aliases -->
-          <alias>
-            <family>monospace</family>
-            <prefer>
-              <family>Cascadia Mono</family>
-              <family>Cascadia Code</family>
-            </prefer>
-          </alias>
-
-
-          <!-- Screw it. Force Liberation Mono to be source code pro. -->
-          <match target="pattern">
-            <test qual="any" name="family"><string>Liberation Mono</string></test>
-            <edit name="family" mode="assign" binding="same"><string>Cascadia Mono</string></edit>
-          </match>
-
-          <!-- Dejavu Sans Mono keeps coming back when I query "monospace". Doesn't happen when I'm using Souce Code Pro but does happen with cascadia... force it to cascadia -->
-          <match target="pattern">
-            <test qual="any" name="family"><string>monospace</string></test>
-            <edit name="family" mode="assign" binding="same"><string>Cascadia Mono</string></edit>
-          </match>
-
-          <!-- Disable ligatures in monospace fonts. -->
-          <match target="font">
-            <test name="family" compare="eq" ignore-blanks="true">
-              <string>Cascadia Code</string>
-            </test>
-            <edit name="fontfeatures" mode="append">
-              <string>liga off</string>
-              <string>dlig off</string>
-            </edit>
-          </match>
-
-          <!-- Font Display Settings -->
-          <match target="font" >
-            <edit mode="assign" name="rgba" >
-              <const>rgb</const>
-            </edit>
-          </match>
-          <match target="font" >
-            <edit mode="assign" name="hinting" >
-              <bool>true</bool>
-            </edit>
-          </match>
-          <match target="font" >
-            <edit mode="assign" name="hintstyle" >
-              <const>hintslight</const>
-            </edit>
-          </match>
-          <match target="font" >
-            <edit mode="assign" name="antialias" >
-              <bool>true</bool>
-            </edit>
-          </match>
-          <match target="font" >
-            <edit mode="assign" name="lcdfilter" >
-              <const>lcddefault</const>
-            </edit>
-          </match>
-        </fontconfig>
-      '';
+        localConf = (builtins.readFile ./files/fonts.conf);
+        useEmbeddedBitmaps = true;
+      };
     };
   };
 }

nix/configuration/roles/fonts/files/fonts.conf

@@ -0,0 +1,99 @@
+<?xml version="1.0"?>
+<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+<fontconfig>
+  <!-- reject all bitmap fonts, with the exception of 'terminus' -->
+  <selectfont>
+    <!-- <acceptfont> -->
+    <!--   <pattern> -->
+    <!--     <patelt name="family"> <string>Terminus</string> </patelt> -->
+    <!--   </pattern> -->
+    <!-- </acceptfont> -->
+    <rejectfont>
+      <pattern>
+        <patelt name="scalable"> <bool>false</bool> </patelt>
+      </pattern>
+    </rejectfont>
+    <rejectfont>
+      <!-- You don't want ghostscript fonts in your web browsing because of annoying ligatures like ffi -->
+      <glob>/usr/share/fonts/gsfonts/*</glob>
+    </rejectfont>
+  </selectfont>
+
+  <!-- preferred aliases -->
+  <alias>
+    <family>serif</family>
+    <prefer>
+      <family>Source Serif Pro</family>
+      <family>Source Sans Pro</family>
+    </prefer>
+  </alias>
+
+  <!-- preferred aliases -->
+  <alias>
+    <family>sans-serif</family>
+    <prefer>
+      <family>Source Sans Pro</family>
+      <family>Source Serif Pro</family>
+    </prefer>
+  </alias>
+
+  <!-- preferred aliases -->
+  <alias>
+    <family>monospace</family>
+    <prefer>
+      <family>Cascadia Mono</family>
+      <family>Cascadia Code</family>
+    </prefer>
+  </alias>
+
+
+  <!-- Screw it. Force Liberation Mono to be source code pro. -->
+  <match target="pattern">
+    <test qual="any" name="family"><string>Liberation Mono</string></test>
+    <edit name="family" mode="assign" binding="same"><string>Cascadia Mono</string></edit>
+  </match>
+
+  <!-- Dejavu Sans Mono keeps coming back when I query "monospace". Doesn't happen when I'm using Souce Code Pro but does happen with cascadia... force it to cascadia -->
+  <match target="pattern">
+    <test qual="any" name="family"><string>monospace</string></test>
+    <edit name="family" mode="assign" binding="same"><string>Cascadia Mono</string></edit>
+  </match>
+
+  <!-- Disable ligatures in monospace fonts. -->
+  <match target="font">
+    <test name="family" compare="eq" ignore-blanks="true">
+      <string>Cascadia Code</string>
+    </test>
+    <edit name="fontfeatures" mode="append">
+      <string>liga off</string>
+      <string>dlig off</string>
+    </edit>
+  </match>
+
+  <!-- Font Display Settings -->
+  <match target="font" >
+    <edit mode="assign" name="rgba" >
+      <const>rgb</const>
+    </edit>
+  </match>
+  <match target="font" >
+    <edit mode="assign" name="hinting" >
+      <bool>true</bool>
+    </edit>
+  </match>
+  <match target="font" >
+    <edit mode="assign" name="hintstyle" >
+      <const>hintslight</const>
+    </edit>
+  </match>
+  <match target="font" >
+    <edit mode="assign" name="antialias" >
+      <bool>true</bool>
+    </edit>
+  </match>
+  <match target="font" >
+    <edit mode="assign" name="lcdfilter" >
+      <const>lcddefault</const>
+    </edit>
+  </match>
+</fontconfig>

nix/configuration/roles/git/default.nix

@@ -8,15 +8,78 @@
 {
   imports = [ ];
 
+  options.me = {
+    git.config = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      example = ./files/gitconfig_home;
+      description = "A git config file.";
+    };
+  };
+
+  config = lib.mkMerge [
+    {
       environment.systemPackages = with pkgs; [
         git
       ];
-
+    }
+    (lib.mkIf (config.me.git.config != null) {
       home-manager.users.talexander =
         { pkgs, ... }:
         {
           home.file.".gitconfig" = {
-        source = ./files/gitconfig_home;
+            source = config.me.git.config;
           };
         };
+    })
+    # (lib.mkIf (config.me.graphical) {
+    #   nixpkgs.overlays = [
+    #     (final: prev: {
+    #       git = pkgs.buildEnv {
+    #         name = prev.git.name;
+    #         paths = [
+    #           prev.git
+    #         ];
+    #         extraOutputsToInstall = [
+    #           "man"
+    #           "doc"
+    #           "info"
+    #         ];
+    #         buildInputs = [ final.makeWrapper ];
+    #         postBuild = ''
+    #           wrapProgram $out/bin/git --prefix PATH : ${
+    #             lib.makeBinPath [
+    #               final.meld
+    #             ]
+    #           }
+    #         '';
+    #       };
+    #     })
+    #   ];
+    # })
+    # (lib.mkIf (!config.me.graphical) {
+    #   nixpkgs.overlays = [
+    #     (final: prev: {
+    #       git = pkgs.buildEnv {
+    #         name = prev.git.name;
+    #         paths = [
+    #           prev.git
+    #         ];
+    #         extraOutputsToInstall = [
+    #           "man"
+    #           "doc"
+    #           "info"
+    #         ];
+    #         buildInputs = [ final.makeWrapper ];
+    #         postBuild = ''
+    #           wrapProgram $out/bin/git --prefix PATH : ${
+    #             lib.makeBinPath [
+    #             ]
+    #           }
+    #         '';
+    #       };
+    #     })
+    #   ];
+    # })
+  ];
 }

nix/configuration/roles/global_options/default.nix

@@ -0,0 +1,34 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+
+  };
+
+  # options.me.graphics_card_type = lib.mkOption {
+  #   type = lib.types.nullOr (
+  #     lib.types.enum [
+  #       "amd"
+  #       "intel"
+  #       "nvidia"
+  #     ]
+  #   );
+  #   default = null;
+  #   example = "amd";
+  #   description = "What graphics card type is in the computer.";
+  # };
+
+  # options.me.graphical = lib.mkOption {
+  #   type = lib.types.bool;
+  #   default = false;
+  #   example = true;
+  #   description = "Whether we want to install graphical programs.";
+  # };
+}

nix/configuration/roles/gpg/default.nix

@@ -5,17 +5,75 @@
   ...
 }:
 
+let
+  gpg_test_wkd =
+    (pkgs.writeScriptBin "gpg_test_wkd" (builtins.readFile ./files/gpg_test_wkd.bash)).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+in
 {
   imports = [ ];
 
+  options.me = {
+    gpg.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install gpg.";
+    };
+  };
+
+  config = lib.mkIf config.me.gpg.enable (
+    lib.mkMerge [
+      {
         # Fetch public keys:
         # gpg --locate-keys tom@fizz.buzz
         #
         # gpg -vvv --auto-key-locate local,wkd --locate-keys tom@fizz.buzz
 
+        hardware.gpgSmartcards.enable = true;
+        services.udev.packages = [
+          pkgs.yubikey-personalization
+          pkgs.libfido2
+          (pkgs.writeTextFile {
+            name = "my-rules";
+            text = ''
+              ACTION=="add", SUBSYSTEM=="usb", ENV{ID_VENDOR_ID}=="1050", ENV{ID_MODEL_ID}=="0406", MODE="660", GROUP="wheel"
+              KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0406", TAG+="uaccess", GROUP="wheel", MODE="0660"
+            '';
+            destination = "/etc/udev/rules.d/50-yubikey.rules";
+          })
+        ];
+        services.pcscd.enable = true;
+        # services.gnome.gnome-keyring.enable = true;
+
+        # services.dbus.packages = [ pkgs.gcr ];
+
+        # services.pcscd.plugins = lib.mkForce [ ];
+
+        #   programs.gpg.scdaemonSettings = {
+        #   disable-ccid = true;
+        # };
+
+        # .gnupg/scdaemon.conf
+        home-manager.users.talexander =
+          { pkgs, ... }:
+          {
+            home.file.".gnupg/scdaemon.conf" = {
+              source = ./files/scdaemon.conf;
+            };
+          };
+
+        # programs.gnupg.dirmngr.enable = true;
         programs.gnupg.agent = {
           enable = true;
           enableSSHSupport = true;
+          pinentryPackage = pkgs.pinentry-qt;
+          # settings = {
+          #   disable-ccid = true;
+          # };
         };
 
         environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
@@ -32,4 +90,19 @@
           };
         };
 
+        environment.systemPackages = with pkgs; [
+          pcsclite
+          pcsctools
+          yubikey-personalization
+          yubikey-manager
+          glibcLocales
+          ccid
+          libusb-compat-0_1
+          gpg_test_wkd
+        ];
+
+        programs.gnupg.agent.enableExtraSocket = true;
+      }
+    ]
+  );
 }

nix/configuration/roles/gpg/files/gpg_test_wkd.bash

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#
+# Test that we can retrieve a PGP key using Web Key Directory (WKD)
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+gpg --no-default-keyring --keyring /tmp/gpg-$$ --auto-key-locate clear,wkd --locate-keys "${@}"

nix/configuration/roles/gpg/files/scdaemon.conf

@@ -0,0 +1,7 @@
+#reader-port Yubico Yubi
+disable-ccid
+
+#log-file /home/talexander/scd.log
+#verbose
+#debug cardio
+#debug-level 5

nix/configuration/roles/graphics/default.nix

@@ -8,5 +8,36 @@
 {
   imports = [ ];
 
+  options.me.graphics_card_type = lib.mkOption {
+    type = lib.types.nullOr (
+      lib.types.enum [
+        "amd"
+        "intel"
+        "nvidia"
+      ]
+    );
+    default = null;
+    example = "amd";
+    description = "What graphics card type is in the computer.";
+  };
+
+  options.me.graphical = lib.mkOption {
+    type = lib.types.bool;
+    default = false;
+    example = true;
+    description = "Whether we want to install graphical programs.";
+  };
+
+  config = (
+    lib.mkMerge [
+      (lib.mkIf config.me.graphical {
+        environment.systemPackages = with pkgs; [
+          mesa-demos # for glxgears
+          vulkan-tools # for vkcube
+          xorg.xeyes # to test which windows are using x11
+        ];
         hardware.graphics.enable = true;
+      })
+    ]
+  );
 }

nix/configuration/roles/kanshi/default.nix

@@ -0,0 +1,56 @@
+# TODO: Maybe replace with https://gitlab.com/w0lff/shikane because its written in rust
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  exec_kanshi = pkgs.writeTextFile {
+    name = "exec_kanshi.conf";
+    text = ''
+      exec kanshi
+    '';
+  };
+in
+{
+  imports = [ ];
+
+  options.me = {
+    kanshi.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install kanshi.";
+    };
+  };
+
+  config = lib.mkIf config.me.kanshi.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+        ];
+      }
+      (lib.mkIf config.me.graphical {
+        environment.systemPackages = with pkgs; [
+          kanshi
+        ];
+
+        me.swayIncludes = [
+          exec_kanshi
+        ];
+
+        home-manager.users.talexander =
+          { pkgs, ... }:
+          {
+            home.file = {
+              ".config/kanshi/config" = {
+                source = ./files/config_kanshi;
+              };
+            };
+          };
+      })
+    ]
+  );
+}

nix/configuration/roles/kanshi/files/config_kanshi

@@ -0,0 +1,7 @@
+profile docked {
+	output eDP-1 disable
+	output "Dell Inc. DELL U3014 P1V6N35M329L" enable
+}
+profile laptop {
+	output eDP-1 enable
+}

nix/configuration/roles/kodi/default.nix

@@ -0,0 +1,99 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    kodi.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install kodi.";
+    };
+  };
+
+  config = lib.mkIf config.me.kodi.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+        ];
+      }
+      (lib.mkIf config.me.graphical {
+        services.cage.user = "kodi";
+        services.cage.program = "${pkgs.kodi-wayland}/bin/kodi-standalone";
+        services.cage.enable = true;
+
+        nixpkgs.overlays = [
+          (final: prev: {
+            kodi-wayland = prev.kodi-wayland.withPackages (
+              kodiPkgs: with kodiPkgs; [
+                joystick
+                vfs-sftp
+              ]
+            );
+          })
+        ];
+
+        users.users.kodi = {
+          isNormalUser = true;
+          createHome = true; # https://github.com/NixOS/nixpkgs/issues/6481
+          group = "kodi";
+          extraGroups = [ ];
+          uid = 12000;
+          packages = with pkgs; [
+            tree
+          ];
+          # Generate with `mkpasswd -m scrypt`
+          hashedPassword = "$7$CU..../....VXvNQ8za3wSGpdzGXNT50/$HcFtn/yvwPMCw4888BelpiAPLAxe/zU87fD.d/N6U48";
+          openssh.authorizedKeys.keys = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGu+k5lrirokdW5zVdRVBOqEOAvAPlIkG/MdJNc9g5ky"
+            "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIEI6mu6I5Jp+Ib0vJxapGHbEShZjyvzV8jz5DnzDrI39AAAABHNzaDo="
+            "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIAFNcSXwvy+brYTOGo56G93Ptuq2MmZsjvRWAfMqbmMLAAAABHNzaDo="
+          ];
+        };
+        users.groups.kodi.gid = 12000;
+
+        environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          users.kodi = {
+            directories = [
+              {
+                directory = ".ssh";
+                user = "kodi";
+                group = "kodi";
+                mode = "0755";
+              }
+              {
+                directory = ".kodi";
+                user = "kodi";
+                group = "kodi";
+                mode = "0755";
+              }
+            ];
+          };
+        };
+
+        home-manager.users.kodi =
+          { pkgs, ... }:
+          {
+            # home.file.".kodi/userdata/mediasources.xml".source = ./files/mediasources.xml;
+
+            # home.file.".kodi/userdata/addon_data/peripheral.joystick/resources/buttonmaps/xml/linux/DualSense_Wireless_Controller_13b_8a.xml".source =
+            #   ./files/DualSense_Wireless_Controller_13b_8a.xml;
+
+            # TODO: Maybe .kodi/userdata/sources.xml
+            # TODO: ./userdata/guisettings.xml:303:    <setting id="filecache.memorysize">128</setting>
+
+            # The state version is required and should stay at the version you
+            # originally installed.
+            home.stateVersion = "24.11";
+          };
+      })
+    ]
+  );
+}

nix/configuration/roles/kodi/files/DualSense_Wireless_Controller_13b_8a.xml

@@ -0,0 +1,38 @@
+<?xml version="1.0" ?>
+<buttonmap>
+    <device name="DualSense Wireless Controller" provider="linux" buttoncount="13" axiscount="8">
+        <configuration>
+            <axis index="2" center="-1" range="2" />
+            <axis index="5" center="-1" range="2" />
+        </configuration>
+        <controller id="game.controller.default">
+            <feature name="a" button="0" />
+            <feature name="b" button="1" />
+            <feature name="back" button="9" />
+            <feature name="down" axis="+7" />
+            <feature name="guide" button="10" />
+            <feature name="left" axis="-6" />
+            <feature name="leftbumper" button="4" />
+            <feature name="leftstick">
+                <up axis="-1" />
+                <down axis="+1" />
+                <right axis="+0" />
+                <left axis="-0" />
+            </feature>
+            <feature name="lefttrigger" button="6" />
+            <feature name="right" axis="+6" />
+            <feature name="rightbumper" button="5" />
+            <feature name="rightstick">
+                <up axis="-4" />
+                <down axis="+4" />
+                <right axis="+3" />
+                <left axis="-3" />
+            </feature>
+            <feature name="righttrigger" button="7" />
+            <feature name="start" button="8" />
+            <feature name="up" axis="-7" />
+            <feature name="x" button="3" />
+            <feature name="y" button="2" />
+        </controller>
+    </device>
+</buttonmap>

nix/configuration/roles/kodi/files/mediasources.xml

@@ -0,0 +1,5 @@
+<mediasources>
+    <network>
+        <location id="0">sftp://nochainstounlock@stuff.fizz.buzz:42069/readonly/library/</location>
+    </network>
+</mediasources>

nix/configuration/roles/kubernetes/default.nix

@@ -0,0 +1,76 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  alias_kx = pkgs.writeShellScriptBin "kx" ''
+    exec ${pkgs.kubeswitch}/bin/switcher "''${@}"
+  '';
+  alias_ks = pkgs.writeShellScriptBin "ks" ''
+    exec ${pkgs.kubeswitch}/bin/switcher namespace "''${@}"
+  '';
+  alias_k = pkgs.writeShellScriptBin "k" ''
+    exec ${pkgs.kubectl}/bin/kubectl "''${@}"
+  '';
+  alias_ka = pkgs.writeShellScriptBin "ka" ''
+    exec ${pkgs.kubectl}/bin/kubectl "''${@}" --all-namespaces
+  '';
+  alias_kdel = pkgs.writeShellScriptBin "kdel" ''
+    exec ${pkgs.kubectl}/bin/kubectl delete --all "''${@}"
+  '';
+  alias_kd = pkgs.writeShellScriptBin "kd" ''
+    export KUBECTL_EXTERNAL_DIFF="${pkgs.colordiff}/bin/colordiff -N -u"
+    exec ${pkgs.kubectl}/bin/kubectl diff "''${@}"
+  '';
+  alias_klog = pkgs.writeShellScriptBin "klog" ''
+    exec ${pkgs.kubectl}/bin/kubectl logs --all-containers "$@"
+  '';
+in
+{
+  imports = [ ];
+
+  options.me = {
+    kubernetes.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install kubernetes.";
+    };
+  };
+
+  config = lib.mkIf config.me.kubernetes.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+          kubectl
+          kubeswitch
+          stern
+          alias_kx
+          alias_ks
+          alias_k
+          alias_ka
+          alias_kdel
+          alias_kd
+          alias_klog
+        ];
+
+        environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          users.talexander = {
+            directories = [
+              {
+                directory = ".kube";
+                user = "talexander";
+                group = "talexander";
+                mode = "0750";
+              }
+            ];
+          };
+        };
+      }
+    ]
+  );
+}

nix/configuration/roles/latex/default.nix

@@ -0,0 +1,45 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  tex = (
+    pkgs.texlive.combine {
+      inherit (pkgs.texlive)
+        scheme-basic
+        dvisvgm
+        dvipng # for preview and export as html in org-mode
+        wrapfig
+        amsmath
+        ulem
+        hyperref
+        capt-of
+        ;
+    }
+  );
+in
+{
+  imports = [ ];
+
+  options.me = {
+    latex.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install latex.";
+    };
+  };
+
+  config = lib.mkIf config.me.latex.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+          tex
+        ];
+      }
+    ]
+  );
+}

nix/configuration/roles/launch_keyboard/default.nix

@@ -0,0 +1,48 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    launch_keyboard.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install launch_keyboard.";
+    };
+  };
+
+  config = lib.mkIf config.me.launch_keyboard.enable (
+    lib.mkMerge [
+      (lib.mkIf config.me.graphical {
+        environment.systemPackages = with pkgs; [
+          system76-keyboard-configurator
+          dfu-programmer # For flashing keyboard https://support.system76.com/articles/launch_2-firmware-update/
+          avrdude # For flashing keyboard https://support.system76.com/articles/launch_2-firmware-update/
+          lxqt.lxqt-policykit # Need a polkit agent to launch the keyboard configurator
+        ];
+
+        systemd = {
+          user.services.lxqt-policykit-agent = {
+            description = "lxqt-policykit-agent";
+            wantedBy = [ "graphical-session.target" ];
+            wants = [ "graphical-session.target" ];
+            after = [ "graphical-session.target" ];
+            serviceConfig = {
+              Type = "simple";
+              ExecStart = "${pkgs.lxqt.lxqt-policykit}/bin/lxqt-policykit-agent";
+              Restart = "on-failure";
+              RestartSec = 1;
+              TimeoutStopSec = 10;
+            };
+          };
+        };
+      })
+    ]
+  );
+}

nix/configuration/roles/launch_keyboard/files/launch_keyboard_layout.json

@@ -0,0 +1,894 @@
+{
+  "model": "system76/launch_2",
+  "version": 1,
+  "map": {
+    "K00": [
+      "ESC",
+      "RESET",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K01": [
+      "F1",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K02": [
+      "F2",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K03": [
+      "F3",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K04": [
+      "F4",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K05": [
+      "F5",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K06": [
+      "F6",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K07": [
+      "F7",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K08": [
+      "F8",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K09": [
+      "F9",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K0A": [
+      "F10",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K0B": [
+      "F11",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K0C": [
+      "F12",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K0D": [
+      "DEL",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K0E": [
+      "HOME",
+      "PLAY_PAUSE",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K10": [
+      "TICK",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K11": [
+      "1",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K12": [
+      "2",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K13": [
+      "3",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K14": [
+      "4",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K15": [
+      "5",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K16": [
+      "6",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K17": [
+      "7",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K18": [
+      "8",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K19": [
+      "9",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K1A": [
+      "0",
+      "KBD_TOGGLE",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K1B": [
+      "MINUS",
+      "KBD_DOWN",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K1C": [
+      "EQUALS",
+      "KBD_UP",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K1D": [
+      "BKSP",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K1E": [
+      "PGUP",
+      "VOLUME_UP",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K20": [
+      "TAB",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K21": [
+      "Q",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K22": [
+      "W",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K23": [
+      "E",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K24": [
+      "R",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K25": [
+      "T",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K26": [
+      "Y",
+      "HOME",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K27": [
+      "U",
+      "PGDN",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K28": [
+      "I",
+      "PGUP",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K29": [
+      "O",
+      "END",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K2A": [
+      "P",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K2B": [
+      "BRACE_OPEN",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K2C": [
+      "BRACE_CLOSE",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K2D": [
+      "BACKSLASH",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K2E": [
+      "PGDN",
+      "VOLUME_DOWN",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K30": [
+      "CAPS",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K31": [
+      "A",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K32": [
+      "S",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K33": [
+      "D",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K34": [
+      "F",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K35": [
+      "G",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K36": [
+      "H",
+      "LEFT",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K37": [
+      "J",
+      "DOWN",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K38": [
+      "K",
+      "UP",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K39": [
+      "L",
+      "RIGHT",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K3A": [
+      "SEMICOLON",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K3B": [
+      "QUOTE",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K3C": [
+      "ENTER",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K3D": [
+      "END",
+      "MUTE",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K40": [
+      "LEFT_SHIFT",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K41": [
+      "Z",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K42": [
+      "X",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K43": [
+      "C",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K44": [
+      "V",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K45": [
+      "B",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K46": [
+      "N",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K47": [
+      "M",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K48": [
+      "COMMA",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K49": [
+      "PERIOD",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K4A": [
+      "SLASH",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K4B": [
+      "RIGHT_SHIFT",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K4C": [
+      "UP",
+      "PGUP",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K50": [
+      "LEFT_CTRL",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K51": [
+      "LEFT_SUPER",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K52": [
+      "LEFT_ALT",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K53": [
+      "FN",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K54": [
+      "SPACE",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K55": [
+      "SPACE",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K56": [
+      "RIGHT_CTRL",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K57": [
+      "RIGHT_ALT",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K58": [
+      "PRINT_SCREEN",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K59": [
+      "LEFT",
+      "HOME",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K5A": [
+      "DOWN",
+      "PGDN",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K5B": [
+      "RIGHT",
+      "END",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ]
+  },
+  "key_leds": {
+    "K00": [
+      0,
+      0
+    ],
+    "K01": [
+      0,
+      0
+    ],
+    "K02": [
+      0,
+      0
+    ],
+    "K03": [
+      0,
+      0
+    ],
+    "K04": [
+      0,
+      0
+    ],
+    "K05": [
+      0,
+      0
+    ],
+    "K06": [
+      0,
+      0
+    ],
+    "K07": [
+      0,
+      0
+    ],
+    "K08": [
+      0,
+      0
+    ],
+    "K09": [
+      0,
+      0
+    ],
+    "K0A": [
+      0,
+      0
+    ],
+    "K0B": [
+      0,
+      0
+    ],
+    "K0C": [
+      0,
+      0
+    ],
+    "K0D": [
+      0,
+      0
+    ],
+    "K0E": [
+      0,
+      0
+    ],
+    "K10": [
+      0,
+      0
+    ],
+    "K11": [
+      0,
+      0
+    ],
+    "K12": [
+      0,
+      0
+    ],
+    "K13": [
+      0,
+      0
+    ],
+    "K14": [
+      0,
+      0
+    ],
+    "K15": [
+      0,
+      0
+    ],
+    "K16": [
+      0,
+      0
+    ],
+    "K17": [
+      0,
+      0
+    ],
+    "K18": [
+      0,
+      0
+    ],
+    "K19": [
+      0,
+      0
+    ],
+    "K1A": [
+      0,
+      0
+    ],
+    "K1B": [
+      0,
+      0
+    ],
+    "K1C": [
+      0,
+      0
+    ],
+    "K1D": [
+      0,
+      0
+    ],
+    "K1E": [
+      0,
+      0
+    ],
+    "K20": [
+      0,
+      0
+    ],
+    "K21": [
+      0,
+      0
+    ],
+    "K22": [
+      0,
+      0
+    ],
+    "K23": [
+      0,
+      0
+    ],
+    "K24": [
+      0,
+      0
+    ],
+    "K25": [
+      0,
+      0
+    ],
+    "K26": [
+      0,
+      0
+    ],
+    "K27": [
+      0,
+      0
+    ],
+    "K28": [
+      0,
+      0
+    ],
+    "K29": [
+      0,
+      0
+    ],
+    "K2A": [
+      0,
+      0
+    ],
+    "K2B": [
+      0,
+      0
+    ],
+    "K2C": [
+      0,
+      0
+    ],
+    "K2D": [
+      0,
+      0
+    ],
+    "K2E": [
+      0,
+      0
+    ],
+    "K30": [
+      0,
+      0
+    ],
+    "K31": [
+      0,
+      0
+    ],
+    "K32": [
+      0,
+      0
+    ],
+    "K33": [
+      0,
+      0
+    ],
+    "K34": [
+      0,
+      0
+    ],
+    "K35": [
+      0,
+      0
+    ],
+    "K36": [
+      0,
+      0
+    ],
+    "K37": [
+      0,
+      0
+    ],
+    "K38": [
+      0,
+      0
+    ],
+    "K39": [
+      0,
+      0
+    ],
+    "K3A": [
+      0,
+      0
+    ],
+    "K3B": [
+      0,
+      0
+    ],
+    "K3C": [
+      0,
+      0
+    ],
+    "K3D": [
+      0,
+      0
+    ],
+    "K40": [
+      0,
+      0
+    ],
+    "K41": [
+      0,
+      0
+    ],
+    "K42": [
+      0,
+      0
+    ],
+    "K43": [
+      0,
+      0
+    ],
+    "K44": [
+      0,
+      0
+    ],
+    "K45": [
+      0,
+      0
+    ],
+    "K46": [
+      0,
+      0
+    ],
+    "K47": [
+      0,
+      0
+    ],
+    "K48": [
+      0,
+      0
+    ],
+    "K49": [
+      0,
+      0
+    ],
+    "K4A": [
+      0,
+      0
+    ],
+    "K4B": [
+      0,
+      0
+    ],
+    "K4C": [
+      0,
+      0
+    ],
+    "K50": [
+      0,
+      0
+    ],
+    "K51": [
+      0,
+      0
+    ],
+    "K52": [
+      0,
+      0
+    ],
+    "K53": [
+      0,
+      0
+    ],
+    "K54": [
+      0,
+      0
+    ],
+    "K55": [
+      0,
+      0
+    ],
+    "K56": [
+      0,
+      0
+    ],
+    "K57": [
+      0,
+      0
+    ],
+    "K58": [
+      0,
+      0
+    ],
+    "K59": [
+      0,
+      0
+    ],
+    "K5A": [
+      0,
+      0
+    ],
+    "K5B": [
+      0,
+      0
+    ]
+  },
+  "layers": [
+    {
+      "mode": [
+        0,
+        127
+      ],
+      "brightness": 109,
+      "color": [
+        0,
+        0
+      ]
+    },
+    {
+      "mode": [
+        13,
+        127
+      ],
+      "brightness": 109,
+      "color": [
+        21,
+        255
+      ]
+    },
+    {
+      "mode": [
+        13,
+        127
+      ],
+      "brightness": 109,
+      "color": [
+        142,
+        255
+      ]
+    },
+    {
+      "mode": [
+        13,
+        127
+      ],
+      "brightness": 109,
+      "color": [
+        142,
+        255
+      ]
+    }
+  ]
+}

nix/configuration/roles/lvfs/default.nix

@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    lvfs.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install lvfs.";
+    };
+  };
+
+  config = lib.mkIf config.me.lvfs.enable (
+    lib.mkMerge [
+      {
+        services.fwupd.enable = true;
+        environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          directories = [
+            {
+              directory = "/var/lib/fwupd";
+              user = "root";
+              group = "root";
+              mode = "0755";
+            }
+          ];
+        };
+      }
+      (lib.mkIf config.me.graphical {
+        environment.systemPackages = with pkgs; [
+          gnome-firmware
+        ];
+      })
+    ]
+  );
+}

nix/configuration/roles/media/default.nix

@@ -0,0 +1,64 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cast_file_vaapi =
+    (pkgs.writeScriptBin "cast_file" (builtins.readFile ./files/cast_file_vaapi)).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+  cast_file_nvidia =
+    (pkgs.writeScriptBin "cast_file" (builtins.readFile ./files/cast_file_nvidia)).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+in
+{
+  imports = [ ];
+
+  options.me = {
+    media.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install media.";
+    };
+  };
+
+  config = lib.mkIf config.me.media.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+          ffmpeg
+        ];
+      }
+      (lib.mkIf config.me.graphical {
+        environment.systemPackages = with pkgs; [
+          mpv
+          evince
+          gimp
+          # So far I prefer imv over swayimg because imv supports the 'p' hotkey to print the currently-viewed file to stdout (useful for pipelines) and afaik doesn't support the exec:// protocol which seems like a massive risk.
+          imv
+        ];
+
+        home-manager.users.talexander =
+          { pkgs, ... }:
+          {
+            home.file.".config/mpv/mpv.conf" = {
+              source = ./files/mpv.conf;
+            };
+          };
+      })
+      (lib.mkIf (config.me.graphics_card_type == "amd" || config.me.graphics_card_type == "intel") {
+        environment.systemPackages = with pkgs; [
+          cast_file_vaapi
+        ];
+      })
+    ]
+  );
+}

nix/configuration/roles/media/files/cast_file_nvidia

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+#
+
+ffmpeg -re -i "$1" -vcodec h264_nvenc -r 30 -g 30 -loop -1 -c:a aac -b:a 160k -ar 44100 -strict -2 -f flv rtmp:172.16.16.44/live/test &
+ffmpegpid=$!
+
+sleep 1
+castnow --exit 'https://broadcast.fizz.buzz/hls/hls/test.m3u8'
+wait "$ffmpegpid"
+
+sleep 10

nix/configuration/roles/media/files/cast_file_vaapi

@@ -0,0 +1,237 @@
+#!/usr/bin/env bash
+#
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+: ${VIDEO_BITRATE:="1M"} # Only for encoding modes targeting bitrate
+: ${AUDIO_BITRATE:="192k"}
+
+############## Setup #########################
+
+function die {
+    local status_code="$1"
+    shift
+    (>&2 echo "${@}")
+    exit "$status_code"
+}
+
+function log {
+    (>&2 echo "${@}")
+}
+
+############## Program #########################
+
+function main {
+    local cmd
+    cmd=$1
+    shift
+    if [ "$cmd" = "copy" ]; then
+        copy "${@}"
+    elif [ "$cmd" = "convert" ]; then
+        convert "${@}"
+    elif [ "$cmd" = "stream" ]; then
+        stream "${@}"
+    elif [ "$cmd" = "webcam" ]; then
+        webcam "${@}"
+    elif [ "$cmd" = "encode_webcam" ]; then
+        encode_webcam "${@}"
+    else
+        (>&2 echo "Unknown command: $cmd")
+        exit 1
+    fi
+}
+
+function copy {
+    local file_to_cast
+    file_to_cast="$3"
+
+    local USERNAME PASSWORD
+    USERNAME="$1"
+    PASSWORD="$2"
+
+    set -x
+    </dev/null exec ffmpeg \
+        -re \
+        -stream_loop -1 \
+        -i "$file_to_cast" \
+        -c copy \
+        -strict experimental \
+        -f rtsp \
+        -rtsp_transport tcp \
+        "rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch"
+}
+
+function convert {
+    local args=()
+    local acceleration_type="$1" # "software" or "hardware"
+    local codec="$2" # "h264" or "av1"
+    local file_to_cast="$3"
+    local file_to_save="$4"
+
+
+
+    # Verify parameters
+
+
+    if [ "$acceleration_type" == "software" ]; then
+        true
+    elif [ "$acceleration_type" == "hardware" ]; then
+        true
+    else
+        die 1 "Unknown acceleration type: $acceleration_type"
+    fi
+
+    if [ "$codec" == "h264" ]; then
+        true
+    elif [ "$codec" == "av1" ]; then
+        true
+    else
+        die 1 "Unknown codec: $codec"
+    fi
+
+
+
+    # Build command
+
+
+
+    if [ "$acceleration_type" == "software" ]; then
+        true
+    elif [ "$acceleration_type" == "hardware" ]; then
+        args+=(-vaapi_device /dev/dri/renderD128)
+    fi
+
+    args+=(-i "$file_to_cast")
+
+    if [ "$codec" == "h264" ]; then
+        if [ "$acceleration_type" == "software" ]; then
+            args+=(-c:v h264)
+            args+=(-profile:v high)
+            args+=(-b:v "$VIDEO_BITRATE")
+        elif [ "$acceleration_type" == "hardware" ]; then
+            args+=(-vf 'format=nv12|vaapi,hwupload')
+            args+=(-c:v h264_vaapi)
+            args+=(-profile:v high)
+            args+=(-b:v "$VIDEO_BITRATE")
+        fi
+    elif [ "$codec" == "av1" ]; then
+        if [ "$acceleration_type" == "software" ]; then
+            args+=(-c:v libsvtav1)
+            args+=(-preset 4) # [0-13] default 10, lower = higher quality / slower encode
+            args+=(-crf 20) # [0-63] default 35, lower = higher quality / larger file
+            # Parameters: https://gitlab.com/AOMediaCodec/SVT-AV1/-/blob/master/Docs/Parameters.md
+            # fast-decode [0-2] default 0 (off), higher = faster decode
+            # tune [0-2] default 1, Specifies whether to use PSNR or VQ as the tuning metric [0 = VQ, 1 = PSNR, 2 = SSIM]
+            # film-grain-denoise, setting to 0 uses the original frames instead of denoising the film grain
+            args+=(-svtav1-params "fast-decode=1:film-grain-denoise=0")
+        elif [ "$acceleration_type" == "hardware" ]; then
+            # -c:v av1_amf -quality quality
+            args+=(-vf 'format=nv12|vaapi,hwupload')
+            args+=(-c:v av1_vaapi)
+            args+=(-b:v "$VIDEO_BITRATE")
+        fi
+    fi
+
+
+
+    # -bf 0 :: Disable b-frames because webrtc doesn't support h264 streams with b-frames.
+    args+=(-bf 0)
+    args+=(-strict -2)
+    args+=(-c:a opus)
+    args+=(-ac 2)
+    args+=(-b:a "$AUDIO_BITRATE")
+    args+=(-ar 48000)
+    args+=("$file_to_save")
+    set -x
+    </dev/null exec ffmpeg "${args[@]}"
+}
+
+function stream {
+    local args=()
+    local acceleration_type="$1" # "software" or "hardware"
+    local codec="$2" # "h264" or "av1"
+
+    local USERNAME="$3"
+    local PASSWORD="$4"
+    local file_to_cast="$5"
+
+
+    args+=(-re -stream_loop -1)
+
+    args+=(-f rtsp)
+    args+=(-rtsp_transport tcp)
+    args+=("rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch")
+}
+
+function webcam {
+    # Uses on-webcam h264 encoding.
+
+    local USERNAME PASSWORD
+    USERNAME="$1"
+    PASSWORD="$2"
+
+    set -x
+
+    </dev/null exec ffmpeg \
+        -re \
+        -input_format h264 \
+        -video_size 1920x1080 \
+        -i /dev/video0 \
+        -c:v copy \
+        -an \
+        -f rtsp \
+        -rtsp_transport tcp \
+        "rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch"
+}
+
+function encode_webcam {
+    # Uses hardware accelerated gpu-based encoding.
+
+    local USERNAME PASSWORD
+    USERNAME="$1"
+    PASSWORD="$2"
+
+    set -x
+
+    </dev/null exec ffmpeg \
+        -re \
+        -vaapi_device /dev/dri/renderD128 \
+        -i /dev/video0 \
+        -vf 'format=nv12,hwupload' \
+        -c:v h264_vaapi \
+        -an \
+        -f rtsp \
+        -rtsp_transport tcp \
+        "rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch"
+}
+
+function speed_up_preprocess_vp8 {
+    local file_to_cast file_to_save
+    file_to_cast="$1"
+    file_to_save="$2"
+
+    set -x
+
+    # -bf 0 :: Disable b-frames because webrtc doesn't support h264 streams with b-frames.
+    # -strict -2 :: Enable support for experimental codecs like opus.
+    # -b:v 2M :: Target 2 megabit/s
+    # -crf 10 :: Target a quality level and adjust bitrate accordingly. This should be preferred, but ideally both should be used.
+    # Could also use -filter_complex "[0:v]setpts=0.5*PTS[v];[0:a]atempo=2.0[a]" -map "[v]" -map "[a]"
+    </dev/null exec ffmpeg \
+               -i "$file_to_cast" \
+               -filter:v "setpts=0.66666666*PTS" \
+               -filter:a "atempo=1.5" \
+               -c:v vp8 \
+               -b:v 2M \
+               -crf 10 \
+               -bf 0 \
+               -c:a opus \
+               -b:a 320k \
+               -ar 48000 \
+               -strict -2 \
+               "$file_to_save"
+}
+
+
+main "${@}"

nix/configuration/roles/media/files/mpv.conf

@@ -0,0 +1,25 @@
+# To debug hardware video acceleration:
+# mpv --hwdec=auto --msg-level=vd=v,vo=v,vo/gpu/vaapi-egl=trace
+
+# GPU Decoding
+hwdec=auto
+# Allow CPU processing via filters:
+#hwdec=auto-copy
+
+# Use higher quality gpu rendering
+profile=gpu-hq
+scale=ewa_lanczossharp
+cscale=ewa_lanczossharp
+
+# Instead of dropping frames, re-sample audio which may cause a slight pitch change
+# ISSUE: caused frame stutter on Louie S01E03
+# video-sync=display-resample
+
+# Make motion smoother when video frame rate != monitor refresh rate
+interpolation
+tscale=oversample
+
+# Load a lot of the file into memory
+# cache=yes
+# demuxer-max-bytes=123400KiB
+# demuxer-readahead-secs=20

nix/configuration/roles/memtest86/default.nix

@@ -0,0 +1,17 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+  config = lib.mkMerge [
+    { }
+    (lib.mkIf (config.me.buildingIso) {
+      # boot.loader.systemd-boot.memtest86.enable = true;
+      boot.loader.grub.memtest86.enable = true;
+    })
+  ];
+}

nix/configuration/roles/network/default.nix

@@ -5,6 +5,16 @@
   ...
 }:
 
+# Alternative DNS servers:
+# "1.0.0.1#cloudflare-dns.com"
+# "1.1.1.1#cloudflare-dns.com"
+# "2606:4700:4700::1001#cloudflare-dns.com"
+# "2606:4700:4700::1111#cloudflare-dns.com"
+# "8.8.4.4#dns.google"
+# "8.8.8.8#dns.google"
+# "2001:4860:4860::8844#dns.google"
+# "2001:4860:4860::8888#dns.google"
+
 {
   imports = [ ];
 
@@ -16,7 +26,7 @@
   ];
   services.resolved = {
     enable = true;
-    dnssec = "true";
+    # dnssec = "true";
     domains = [ "~." ];
     fallbackDns = [ ];
     dnsovertls = "true";
@@ -25,7 +35,15 @@
   # Without this, systemd-resolved will send DNS requests for <X>.home.arpa to the per-link DNS server (172.16.0.1) which does not support DNS-over-TLS. This leads to the connection anging and timing out. This causes firefox startup to take an extra 10+ seconds.
   #
   # Test with: drill @127.0.0.53 odo.home.arpa
-  networking.extraHosts = "127.0.0.1 odo.home.arpa";
+  networking.extraHosts = ''
+    127.0.0.1 odo.home.arpa
+    10.216.1.1		homeserver
+    10.216.1.6		media
+    #10.216.1.12		odo
+    10.216.1.14		neelix
+    10.217.1.1		drmario
+    10.217.2.1		mrmanager
+  '';
 
   networking.wireless.iwd = {
     enable = true;
@@ -42,5 +60,11 @@
     iw
     iwd
     ldns # for drill
+    arp-scan # To find devices on the network
   ];
+
+  boot.extraModprobeConfig = ''
+    # Set wifi to US
+    options cfg80211 ieee80211_regdom=US
+  '';
 }

nix/configuration/roles/nix_index/default.nix

@@ -0,0 +1,44 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    nix_index.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install nix_index.";
+    };
+  };
+
+  config = lib.mkIf config.me.nix_index.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+          nix-index-unwrapped
+        ];
+
+        environment.persistence."/state" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          users.talexander = {
+            directories = [
+              {
+                directory = ".cache/nix-index";
+                user = "talexander";
+                group = "talexander";
+                mode = "0755";
+              }
+            ];
+          };
+        };
+
+      }
+    ]
+  );
+}

nix/configuration/roles/nvme/default.nix

@@ -0,0 +1,14 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    nvme-cli
+  ];
+}

nix/configuration/roles/python/default.nix

@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    python.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install python.";
+    };
+  };
+
+  config = lib.mkIf config.me.python.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+          (python3.withPackages (python-pkgs: [
+            python-pkgs.distro # For https://gitlab.freedesktop.org/drm/amd/-/blob/master/scripts/amd_s2idle.py
+            python-pkgs.pyudev # For https://gitlab.freedesktop.org/drm/amd/-/blob/master/scripts/amd_s2idle.py
+            python-pkgs.systemd # For https://gitlab.freedesktop.org/drm/amd/-/blob/master/scripts/amd_s2idle.py
+            python-pkgs.packaging # For https://gitlab.freedesktop.org/drm/amd/-/blob/master/scripts/amd_s2idle.py
+          ]))
+          poetry
+          pyright
+          isort
+          black
+        ];
+      }
+    ]
+  );
+}

nix/configuration/roles/qemu/default.nix

@@ -8,7 +8,22 @@
 {
   imports = [ ];
 
+  options.me = {
+    qemu.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install qemu.";
+    };
+  };
+
+  config = lib.mkIf config.me.qemu.enable (
+    lib.mkMerge [
+      {
         environment.systemPackages = with pkgs; [
           qemu
         ];
       }
+    ]
+  );
+}

nix/configuration/roles/reset/default.nix

@@ -9,5 +9,8 @@
   imports = [ ];
 
   # Reset some defaults to start from a minimal more-arch-linux-like state. Think of this like a CSS reset sheet.
-
+  config = {
+    # Do not use default packages (nixos includes some defaults like nano)
+    environment.defaultPackages = lib.mkForce [ ];
+  };
 }

nix/configuration/roles/rust/default.nix

@@ -0,0 +1,54 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    rust.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install rust.";
+    };
+  };
+
+  config = lib.mkIf config.me.rust.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+          rustup
+          lldb # for lldb-vscode
+          musl # for building static binaries
+          rust-analyzer
+          cargo-semver-checks
+          # ? cargo-bloat
+          # ? cargo-outdated
+          # ? cargo-public-api
+        ];
+
+        home-manager.users.talexander =
+          { pkgs, ... }:
+          {
+            home.file = {
+              ".cargo/config.toml" = {
+                source = ./files/cargo_config.toml;
+              };
+              # # TODO: Figure out what to do with credentials.
+              # ".cargo/credentials.toml" = {
+              #   source = ./files/cargo_credentials.toml;
+              # };
+            };
+          };
+
+      }
+    ]
+  );
+}
+
+# TODO: Install clippy, cranelift, rust-src
+# TODO: Install rust targets x86_64-unknown-linux-musl and wasm32-unknown-unknown

nix/configuration/roles/rust/files/cargo_config.toml

@@ -0,0 +1,12 @@
+[target.x86_64-unknown-linux-gnu]
+rustflags = ["-C", "target-cpu=native", "-Zthreads=0"]
+
+[unstable]
+codegen-backend = true
+
+[profile.dev]
+codegen-backend = "cranelift"
+
+[profile.dev.package."*"]
+codegen-backend = "llvm"
+opt-level = 3

nix/configuration/roles/shipwright/default.nix

@@ -0,0 +1,48 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    shipwright.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install shipwright.";
+    };
+  };
+
+  config = lib.mkIf config.me.shipwright.enable (
+    lib.mkMerge [
+      {
+        allowedUnfree = [ "shipwright" ];
+      }
+      (lib.mkIf config.me.graphical {
+        environment.systemPackages = with pkgs; [
+          shipwright
+        ];
+
+        # TODO perhaps install ~/.local/share/soh/shipofharkinian.json
+
+        environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          users.talexander = {
+            directories = [
+              {
+                directory = ".local/share/soh";
+                user = "talexander";
+                group = "talexander";
+                mode = "0755";
+              }
+            ];
+          };
+        };
+      })
+    ]
+  );
+}

nix/configuration/roles/sm64ex/default.nix

@@ -0,0 +1,55 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    sm64ex.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install sm64ex.";
+    };
+  };
+
+  config = lib.mkIf config.me.sm64ex.enable (
+    lib.mkMerge [
+      (lib.mkIf config.me.graphical {
+        allowedUnfree = [ "sm64ex" ];
+
+        environment.systemPackages = with pkgs; [
+          sm64ex
+        ];
+
+        # nixpkgs.overlays = [
+        #   (final: prev: {
+        #     sm4ex = prev.sm64ex.override {
+        #       baseRom.name = "SuperMario64.z64";
+        #     };
+        #   })
+        # ];
+
+        # TODO perhaps install ~/.local/share/sm64ex/sm64config.txt
+
+        environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          users.talexander = {
+            directories = [
+              {
+                directory = ".local/share/sm64ex";
+                user = "talexander";
+                group = "talexander";
+                mode = "0755";
+              }
+            ];
+          };
+        };
+      })
+    ]
+  );
+}

nix/configuration/roles/sound/default.nix

@@ -8,10 +8,18 @@
 {
   imports = [ ];
 
-  environment.systemPackages = with pkgs; [
-    pavucontrol
-  ];
+  options.me = {
+    sound.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install sound.";
+    };
+  };
 
+  config = lib.mkIf config.me.sound.enable (
+    lib.mkMerge [
+      {
         # rtkit is optional but recommended
         security.rtkit.enable = true;
         services.pipewire = {
@@ -21,5 +29,64 @@
           pulse.enable = true;
           # If you want to use JACK applications, uncomment this
           #jack.enable = true;
+
+          extraLv2Packages = [ pkgs.rnnoise-plugin ];
+          configPackages = [
+            (pkgs.writeTextDir "share/pipewire/pipewire.conf.d/99-input-denoising.conf" ''
+              context.modules = [
+              {   name = libpipewire-module-filter-chain
+                  args = {
+                      node.description = "Noise Canceling source"
+                      media.name = "Noise Canceling source"
+                      filter.graph = {
+                          nodes = [
+                              {
+                                  type = ladspa
+                                  name = rnnoise
+                                  plugin = "${pkgs.rnnoise-plugin}/lib/ladspa/librnnoise_ladspa.so"
+                                  label = noise_suppressor_mono
+                                  control = {
+                                      "VAD Threshold (%)" = 50.0
+                                      "VAD Grace Period (ms)" = 200
+                                      "Retroactive VAD Grace (ms)" = 0
+                                  }
+                              }
+                          ]
+                      }
+                      capture.props = {
+                          node.name =  "capture.rnnoise_source"
+                          node.passive = true
+                          audio.rate = 48000
+                          # Optionally specify a specific input: (ID from `pactl list`)
+                          # target.object = "alsa_input.usb-Shure_Incorporated_Shure_Digital-00.analog-stereo"
+                      }
+                      playback.props = {
+                          node.name =  "rnnoise_source"
+                          media.class = Audio/Source
+                          audio.rate = 48000
+                      }
+                  }
+              }
+              ]
+            '')
+          ];
+        };
+
+        environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          users.talexander = {
+            directories = [
+              ".local/state/wireplumber" # Sound settings
+            ];
+          };
         };
       }
+      (lib.mkIf config.me.graphical {
+        environment.systemPackages = with pkgs; [
+          pavucontrol
+        ];
+
+      })
+    ]
+  );
+}

nix/configuration/roles/ssh/default.nix

@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    sshfs
+  ];
+
+  environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+    hideMounts = true;
+    users.talexander = {
+      files = [
+        ".ssh/known_hosts"
+      ];
+    };
+  };
+}

nix/configuration/roles/steam/default.nix

@@ -0,0 +1,50 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    steam.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install steam.";
+    };
+  };
+
+  config = lib.mkIf config.me.steam.enable (
+    lib.mkMerge [
+      (lib.mkIf config.me.graphical {
+        allowedUnfree = [
+          "steam"
+          "steam-original"
+          "steam-unwrapped"
+          "steam-run"
+        ];
+
+        programs.steam = {
+          enable = true;
+          remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
+          # dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
+          localNetworkGameTransfers.openFirewall = true; # Open ports in the firewall for Steam Local Network Game Transfers
+        };
+
+        environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          users.talexander = {
+            directories = [
+              ".local/share/Steam"
+              ".steam"
+              ".factorio"
+            ];
+          };
+        };
+      })
+    ]
+  );
+}

nix/configuration/roles/sway/default.nix

@@ -30,22 +30,16 @@ let
       # Your preferred application launcher
       # Note: it's recommended that you pass the final command to sway
       # set $menu dmenu_path | dmenu | xargs swaymsg exec
-      set $menu ${pkgs.wofi}/bin/wofi --show drun --gtk-dark
+      set $menu ${pkgs.tofi}/bin/tofi-drun | xargs swaymsg exec --
+      #set $menu ${pkgs.wofi}/bin/wofi --show drun --gtk-dark
 
       # Do not show a title bar on windows
       default_border pixel 2
+      hide_edge_borders smart_no_gaps
 
       bindsym $mod+grave exec $term
 
-      include ${base-hotkeys}
-      include ${display-configs}
-      include ${window-management}
-      include ${movement}
-      include ${disable-focus-follows-mouse}
-      include ${background}
-      include ${touchpad_input}
-      include ${waybar}
-      include ${announce_sway_start}
+      ${lib.concatMapStringsSep "\n" (item: "include ${item}") config.me.swayIncludes}
     '';
   };
   base-hotkeys = pkgs.writeTextFile {
@@ -231,33 +225,12 @@ let
       }
     '';
   };
-  waybar = pkgs.writeTextFile {
-    name = "waybar.conf";
-    text = ''
-      #
-      # Status Bar:
-      #
-      # Read `man 5 sway-bar` for more information about this section.
-      bar {
-          position top
-
-          font pango:Cascadia Mono, FontAwesome 10
-          swaybar_command waybar
-
-          colors {
-              statusline #ffffff
-              background #323232
-              inactive_workspace #32323200 #32323200 #5c5c5c
-          }
-      }
-    '';
-  };
   announce_sway_start = pkgs.writeTextFile {
     name = "announce_sway_start.conf";
     text = ''
       # announce a running sway session to systemd
-      exec systemctl --user import-environment XDG_SESSION_TYPE XDG_CURRENT_DESKTOP
-      exec dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP=sway
+      exec systemctl --user import-environment WAYLAND_DISPLAY DISPLAY XDG_CURRENT_DESKTOP SWAYSOCK I3SOCK XCURSOR_SIZE XCURSOR_THEME
+      exec dbus-update-activation-environment WAYLAND_DISPLAY DISPLAY XDG_CURRENT_DESKTOP SWAYSOCK I3SOCK XCURSOR_SIZE XCURSOR_THEME
     '';
   };
 
@@ -281,11 +254,39 @@ let
 
     swaymsg output "'Dell Inc. DELL U3014 P1V6N35M329L'" scale 1
   '';
-
 in
 {
-  imports = [ ];
+  imports = [
+    ./graphical_session_target.nix
+    ./iso.nix
+    ./rofimoji.nix
+    ./lockscreen.nix
+    ./screenshot.nix
+    ./force_focus.nix
+    ./notification.nix
+  ];
 
+  options.me = {
+    sway.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install sway.";
+    };
+  };
+
+  options.me.swayIncludes = lib.mkOption {
+    type = lib.types.listOf lib.types.package;
+    default = [ ];
+    example = lib.literalExpression ''
+      [ (pkgs.writeTextFile {
+          name = "launch-kanshi.conf";
+          text = "exec kanshi";
+        }) ]'';
+    description = "List of packages to import as sway configs.";
+  };
+
+  config = lib.mkIf (config.me.graphical && config.me.sway.enable) {
     environment.systemPackages = with pkgs; [
       alacritty
       pcmanfm
@@ -293,15 +294,36 @@ in
       stop_screen_share
     ];
 
+    programs.sway.extraPackages = lib.mkForce [ ];
+
+    me.swayIncludes = [
+      base-hotkeys
+      display-configs
+      window-management
+      movement
+      disable-focus-follows-mouse
+      background
+      touchpad_input
+      announce_sway_start
+    ];
+
+    services.seatd.enable = true;
+    # TODO: Maybe use `seatd-launch -- sway` instead of running the seatd daemon
+    users.users.talexander.extraGroups = [ "seat" ];
+
     # Probably would be cleaner to use environment.sessionVariables but programs.sway.extraSessionCommands is sway-specific.
     programs.sway.extraSessionCommands =
       if config.me.buildingIso then
         ''
-        export WLR_RENDERER_ALLOW_SOFTWARE=1;
+          export WLR_RENDERER_ALLOW_SOFTWARE=1
+          export NIXOS_OZONE_WL=1 # Wayland support for chromium and electron
+          export QT_QPA_PLATFORMTHEME=gtk3 # Use gtk theme in Qt applications
         ''
       else
         ''
           export WLR_RENDERER=vulkan
+          export NIXOS_OZONE_WL=1 # Wayland support for chromium and electron
+          export QT_QPA_PLATFORMTHEME=gtk3 # Use gtk theme in Qt applications
         '';
 
     programs.sway = {
@@ -310,14 +332,12 @@ in
       extraOptions =
         if config.me.buildingIso then
           [
-          "--debug"
             "--config"
             "${sway-config}"
             "--unsupported-gpu"
           ]
         else
           [
-          "--debug"
             "--config"
             "${sway-config}"
           ];
@@ -327,7 +347,8 @@ in
       hideMounts = true;
       users.talexander = {
         files = [
-        ".cache/wofi-drun" # Execution history for wofi to sort results
+          ".local/state/tofi-drun-history" # A cache of the desktop files for tofi
+          ".cache/tofi-drun" # Execution history for tofi to sort results
         ];
       };
     };
@@ -336,7 +357,6 @@ in
       portal = {
         enable = true;
         extraPortals = with pkgs; [
-        xdg-desktop-portal-wlr
           xdg-desktop-portal-gtk
         ];
         wlr = {
@@ -355,4 +375,35 @@ in
         };
       };
     };
+
+    home-manager.users.talexander =
+      { pkgs, ... }:
+      {
+        home.file = {
+          # Configure default programs (for example, default browser)
+          ".config/mimeapps.list" = {
+            source = ./files/mimeapps.list;
+          };
+        };
+        home.file = {
+          ".config/gtk-3.0/settings.ini" = {
+            source = ./files/settings.ini;
+          };
+        };
+        home.file = {
+          ".icons/default" = {
+            source = "${pkgs.adwaita-icon-theme}/share/icons/Adwaita";
+          };
+        };
+      };
+
+    # For mounting drives in pcmanfm
+    services.gvfs.enable = true;
+
+    # Auto-launch sway
+    # Run sway as the absolute last command in the login shell init. mkBefore = 500, plain = 1000, mkAfter = 1500
+    environment.loginShellInit = lib.mkOrder 2000 ''
+      [ -z "$WAYLAND_DISPLAY" ] && [ -n "$XDG_VTNR" ] && [ "$XDG_VTNR" -eq 1 ] && [ "$(tty)" = "/dev/tty1" ] && exec ${pkgs.systemd}/bin/systemd-cat --identifier=sway sway
+    '';
+  };
 }

nix/configuration/roles/sway/files/mimeapps.list

@@ -0,0 +1,23 @@
+[Default Applications]
+x-scheme-handler/http=firefox.desktop
+x-scheme-handler/https=firefox.desktop
+x-scheme-handler/chrome=firefox.desktop
+text/html=firefox.desktop
+application/x-extension-htm=firefox.desktop
+application/x-extension-html=firefox.desktop
+application/x-extension-shtml=firefox.desktop
+application/xhtml+xml=firefox.desktop
+application/x-extension-xhtml=firefox.desktop
+application/x-extension-xht=firefox.desktop
+
+[Added Associations]
+x-scheme-handler/http=firefox.desktop;
+x-scheme-handler/https=firefox.desktop;
+x-scheme-handler/chrome=firefox.desktop;
+text/html=firefox.desktop;
+application/x-extension-htm=firefox.desktop;
+application/x-extension-html=firefox.desktop;
+application/x-extension-shtml=firefox.desktop;
+application/xhtml+xml=firefox.desktop;
+application/x-extension-xhtml=firefox.desktop;
+application/x-extension-xht=firefox.desktop;

nix/configuration/roles/sway/files/settings.ini

@@ -0,0 +1,2 @@
+[Settings]
+gtk-application-prefer-dark-theme=1

nix/configuration/roles/sway/files/tofi-config

@@ -0,0 +1,3 @@
+border-width = 4
+outline-width = 1
+border-color = #FF6600

nix/configuration/roles/sway/force_focus.nix

@@ -0,0 +1,27 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  force_focus_sway_config = pkgs.writeTextFile {
+    name = "force_focus.conf";
+    text = ''
+      mode "force focus" {
+          bindsym $mod+Shift+Escape fullscreen; mode "default"
+      }
+      bindsym $mod+Shift+f fullscreen; mode "force focus"
+    '';
+  };
+in
+{
+  imports = [ ];
+
+  config = lib.mkIf (config.me.graphical && config.me.sway.enable) {
+    me.swayIncludes = [
+      force_focus_sway_config
+    ];
+  };
+}

nix/configuration/roles/sway/graphical_session_target.nix

@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  start_sway_session = pkgs.writeTextFile {
+    name = "start_sway_session.conf";
+    text = ''
+      # Trigger graphical-session.target through sway-session.target so systemd user units can depend on it.
+      exec systemctl --user start sway-session.target
+      exec swaymsg -t subscribe '["shutdown"]' && systemctl --user stop sway-session.target
+    '';
+  };
+in
+{
+  imports = [ ];
+
+  me.swayIncludes = lib.mkAfter [
+    start_sway_session
+  ];
+
+}

nix/configuration/roles/sway/iso.nix

@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  launch_terminal = pkgs.writeTextFile {
+    name = "launch_terminal.conf";
+    text = ''
+      exec ${pkgs.alacritty}/bin/alacritty
+    '';
+  };
+in
+{
+  imports = [ ];
+
+  config = lib.mkIf (config.me.buildingIso && config.me.graphical && config.me.sway.enable) {
+    # Launch a terminal at boot in the live ISO for when hotkeys don't work.
+    me.swayIncludes = [
+      launch_terminal
+    ];
+  };
+}

nix/configuration/roles/sway/lockscreen.nix

@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  lockscreen_sway_config = pkgs.writeTextFile {
+    name = "lockscreen.conf";
+    text = ''
+      set $lock ${pkgs.swaylock}/bin/swaylock -f -c 000000
+
+      # Hotkey to lock the screen
+      bindsym $mod+l exec $lock
+
+      exec ${pkgs.swayidle}/bin/swayidle -w \
+         timeout 300 '$lock' \
+         timeout 600 '${pkgs.sway}/bin/swaymsg "output * dpms off"' \
+              resume '${pkgs.sway}/bin/swaymsg "output * dpms on"' \
+         before-sleep '$lock'
+    '';
+  };
+in
+{
+  imports = [ ];
+
+  config = lib.mkIf (config.me.graphical && config.me.sway.enable) {
+    me.swayIncludes = [
+      lockscreen_sway_config
+    ];
+  };
+}

nix/configuration/roles/sway/notification.nix

@@ -0,0 +1,32 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  notification_sway_config = pkgs.writeTextFile {
+    name = "notification.conf";
+    text =
+      builtins.replaceStrings
+        [ "@mako@" "@makoctl@" ]
+        [ "${pkgs.mako}/bin/mako" "${pkgs.mako}/bin/makoctl" ]
+        ''
+          bindsym $mod+Escape exec @makoctl@ dismiss
+          bindsym $mod+Shift+Escape exec @makoctl@ invoke
+
+          # Notifications
+          exec @mako@
+        '';
+  };
+in
+{
+  imports = [ ];
+
+  config = lib.mkIf (config.me.graphical && config.me.sway.enable) {
+    me.swayIncludes = [
+      notification_sway_config
+    ];
+  };
+}

nix/configuration/roles/sway/rofimoji.nix

@@ -0,0 +1,63 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  rofimoji_sway_config = pkgs.writeTextFile {
+    name = "rofimoji.conf";
+    text = ''
+      # Emoji selector
+      bindsym $mod+backslash exec ${pkgs.rofimoji}/bin/rofimoji --selector tofi
+    '';
+  };
+in
+{
+  imports = [ ];
+
+  config = lib.mkIf (config.me.graphical && config.me.sway.enable) {
+    me.swayIncludes = [
+      rofimoji_sway_config
+    ];
+
+    environment.persistence."/state" = lib.mkIf (!config.me.buildingIso) {
+      hideMounts = true;
+      users.talexander = {
+        directories = [
+          {
+            directory = ".local/share/rofimoji";
+            user = "talexander";
+            group = "talexander";
+            mode = "0755";
+          }
+        ];
+      };
+    };
+
+    nixpkgs.overlays = [
+      (final: prev: {
+        rofimoji = prev.rofimoji.overrideAttrs (old: {
+          propagatedBuildInputs = old.propagatedBuildInputs ++ [ pkgs.tofi ];
+          src = builtins.fetchGit {
+            # https://github.com/fdw/rofimoji/issues/209
+            url = "https://github.com/fdw/rofimoji.git";
+            rev = "615f00abeb984f3e648ef712164aa4e61f2e1808";
+          };
+        });
+      })
+      (final: prev: {
+        tofi = pkgs.symlinkJoin {
+          name = "tofi";
+          paths = [ prev.tofi ];
+          buildInputs = [ pkgs.makeWrapper ];
+          postBuild = ''
+            wrapProgram $out/bin/tofi-drun --add-flags --font=${pkgs.source-sans-pro}/share/fonts/opentype/SourceSansPro-Regular.otf --add-flags --config=${./files/tofi-config}
+            wrapProgram $out/bin/tofi --add-flags --config=${./files/tofi-config}
+          '';
+        };
+      })
+    ];
+  };
+}

nix/configuration/roles/sway/screenshot.nix

@@ -0,0 +1,42 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  screenshot_sway_config = pkgs.writeTextFile {
+    name = "screenshot.conf";
+    text =
+      builtins.replaceStrings
+        [ "@grim@" "@wl-screenrec@" "@pactl@" "@grep@" "@slurp@" ]
+        [
+          "${pkgs.grim}/bin/grim"
+          "${pkgs.wl-screenrec}/bin/wl-screenrec"
+          "${pkgs.pulseaudio}/bin/pactl"
+          "${pkgs.gnugrep}/bin/grep"
+          "${pkgs.slurp}/bin/slurp"
+        ]
+        ''
+          # Screenshots
+          #bindsym $mod+print exec @slurp@ | @grim@ -g - $(xdg-user-dir PICTURES)/$(date +'screenshot_%Y-%m-%d-%H%M%S.png')
+          bindsym $mod+print exec @slurp@ | @grim@ -g - "$HOME/$(date +'screenshot_%Y-%m-%d-%H%M%S.png')"
+          bindsym print exec @grim@ "$HOME/$(date +'screenshot_%Y-%m-%d-%H%M%S.png')"
+          # Maybe add --audio flag? can optionally specify specific device name from `@pactl@ list sources | @grep@ Name`
+          bindsym $mod+Shift+print exec @wl-screenrec@ -g "$(@slurp@)" --codec av1 -f "$HOME/$(date +'screencast_%Y-%m-%d-%H%M%S.mkv')"
+          bindsym Shift+print exec @wl-screenrec@ --codec av1 -f "$HOME/$(date +'screencast_%Y-%m-%d-%H%M%S.mkv')"
+          bindsym $mod+ctrl+Shift+print exec pkill -SIGINT @wl-screenrec@
+          # Need to make a hotkey to end the recording
+        '';
+  };
+in
+{
+  imports = [ ];
+
+  config = lib.mkIf (config.me.graphical && config.me.sway.enable) {
+    me.swayIncludes = [
+      screenshot_sway_config
+    ];
+  };
+}

nix/configuration/roles/terraform/default.nix

@@ -0,0 +1,53 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  alias_tf = pkgs.writeShellScriptBin "tf" ''
+    exec ${pkgs.terraform}/bin/terraform "''${@}"
+  '';
+in
+{
+  imports = [ ];
+
+  options.me = {
+    terraform.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install terraform.";
+    };
+  };
+
+  config = lib.mkIf config.me.terraform.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+          terraform
+          alias_tf
+        ];
+
+        allowedUnfree = [
+          "terraform"
+        ];
+
+        environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          users.talexander = {
+            directories = [
+              {
+                directory = ".terraform.d";
+                user = "talexander";
+                group = "talexander";
+                mode = "0755";
+              }
+            ];
+          };
+        };
+      }
+    ]
+  );
+}

nix/configuration/roles/vnc_client/default.nix

@@ -0,0 +1,29 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    vnc_client.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install vnc_client.";
+    };
+  };
+
+  config = lib.mkIf config.me.vnc_client.enable (
+    lib.mkMerge [
+      (lib.mkIf config.me.graphical {
+        environment.systemPackages = with pkgs; [
+          wlvncc
+        ];
+      })
+    ]
+  );
+}

nix/configuration/roles/vscode/default.nix

@@ -0,0 +1,62 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    vscode.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install vscode.";
+    };
+  };
+
+  config = lib.mkIf config.me.vscode.enable (
+    lib.mkMerge [
+      (lib.mkIf config.me.graphical {
+        allowedUnfree = [
+          "vscode"
+          "vscode-with-extensions"
+          "vscode-extension-ms-vscode-remote-remote-ssh"
+        ];
+
+        environment.systemPackages = with pkgs; [
+          (vscode-with-extensions.override {
+            vscodeExtensions = with vscode-extensions; [
+              bbenoist.nix
+              ms-python.python
+              ms-azuretools.vscode-docker
+              ms-vscode-remote.remote-ssh
+            ]
+            # ++ pkgs.vscode-utils.extensionsFromVscodeMarketplace [
+            #   {
+            #     name = "remote-ssh-edit";
+            #     publisher = "ms-vscode-remote";
+            #     version = "0.47.2";
+            #     sha256 = "1hp6gjh4xp2m1xlm1jsdzxw9d8frkiidhph6nvl24d0h8z34w49g";
+            #   }
+            # ]
+            ;
+          })
+        ];
+
+        home-manager.users.talexander =
+          { pkgs, ... }:
+          {
+            home.file.".config/Code/User/settings.json" = {
+              source = ./files/settings.json;
+            };
+            home.file.".config/Code/User/keybindings.json" = {
+              source = ./files/keybindings.json;
+            };
+          };
+      })
+    ]
+  );
+}

nix/configuration/roles/vscode/files/keybindings.json

@@ -0,0 +1,280 @@
+// Place your key bindings in this file to override the defaultsauto[]
+[
+    {
+        "key": "alt+.",
+        "command": "editor.action.revealDefinition",
+        "when": "editorHasDefinitionProvider && editorTextFocus && !isInEmbeddedEditor"
+    },
+    {
+        "key": "f12",
+        "command": "-editor.action.revealDefinition",
+        "when": "editorHasDefinitionProvider && editorTextFocus && !isInEmbeddedEditor"
+    },
+    {
+        "key": "alt+,",
+        "command": "workbench.action.navigateBack",
+        "when": "canNavigateBack"
+    },
+    {
+        "key": "ctrl+alt+-",
+        "command": "-workbench.action.navigateBack",
+        "when": "canNavigateBack"
+    },
+    {
+        "key": "shift+alt+/",
+        "command": "editor.action.goToReferences",
+        "when": "editorHasReferenceProvider && editorTextFocus && !inReferenceSearchEditor && !isInEmbeddedEditor"
+    },
+    {
+        "key": "shift+f12",
+        "command": "-editor.action.goToReferences",
+        "when": "editorHasReferenceProvider && editorTextFocus && !inReferenceSearchEditor && !isInEmbeddedEditor"
+    },
+    {
+        "key": "ctrl+alt+.",
+        "command": "workbench.action.showAllSymbols"
+    },
+    {
+        "key": "ctrl+t",
+        "command": "-workbench.action.showAllSymbols"
+    },
+    {
+        "key": "alt+;",
+        "command": "editor.action.commentLine",
+        "when": "editorTextFocus && !editorReadonly"
+    },
+    {
+        "key": "ctrl+/",
+        "command": "-editor.action.commentLine",
+        "when": "editorTextFocus && !editorReadonly"
+    },
+    {
+        "key": "ctrl+x",
+        "command": "-editor.action.clipboardCutAction"
+    },
+    {
+        "key": "ctrl+x",
+        "command": "-filesExplorer.cut",
+        "when": "filesExplorerFocus && foldersViewVisible && !explorerResourceIsRoot && !explorerResourceReadonly && !inputFocus"
+    },
+    {
+        "key": "ctrl+x 3",
+        "command": "workbench.action.splitEditor"
+    },
+    {
+        "key": "ctrl+\\",
+        "command": "-workbench.action.splitEditor"
+    },
+    {
+        "key": "ctrl+x 2",
+        "command": "workbench.action.splitEditorDown"
+    },
+    {
+        "key": "ctrl+k ctrl+\\",
+        "command": "-workbench.action.splitEditorDown"
+    },
+    {
+        "key": "ctrl+x 1",
+        "command": "workbench.action.joinAllGroups"
+    },
+    {
+        "key": "ctrl+x 0",
+        "command": "workbench.action.closeEditorsAndGroup"
+    },
+    {
+        "key": "ctrl+x shift+=",
+        "command": "workbench.action.evenEditorWidths"
+    },
+    {
+        "key": "shift+up",
+        "command": "workbench.action.focusAboveGroup"
+    },
+    {
+        "key": "ctrl+k ctrl+up",
+        "command": "-workbench.action.focusAboveGroup"
+    },
+    {
+        "key": "shift+down",
+        "command": "workbench.action.focusBelowGroup"
+    },
+    {
+        "key": "ctrl+k ctrl+down",
+        "command": "-workbench.action.focusBelowGroup"
+    },
+    {
+        "key": "shift+left",
+        "command": "workbench.action.focusLeftGroup"
+    },
+    {
+        "key": "ctrl+k ctrl+left",
+        "command": "-workbench.action.focusLeftGroup"
+    },
+    {
+        "key": "shift+right",
+        "command": "workbench.action.focusRightGroup"
+    },
+    {
+        "key": "ctrl+k ctrl+right",
+        "command": "-workbench.action.focusRightGroup"
+    },
+    {
+        "key": "ctrl+x ctrl+s",
+        "command": "workbench.action.files.save"
+    },
+    {
+        "key": "ctrl+s",
+        "command": "-workbench.action.files.save"
+    },
+    {
+        "key": "alt+g g",
+        "command": "workbench.action.gotoLine"
+    },
+    {
+        "key": "ctrl+g",
+        "command": "-workbench.action.gotoLine"
+    },
+    {
+        "key": "ctrl+space",
+        "command": "editor.action.setSelectionAnchor",
+        "when": "editorTextFocus"
+    },
+    {
+        "key": "ctrl+k ctrl+b",
+        "command": "-editor.action.setSelectionAnchor",
+        "when": "editorTextFocus"
+    },
+    {
+        "key": "alt+w",
+        "command": "editor.action.clipboardCopyAction"
+    },
+    {
+        "key": "ctrl+c",
+        "command": "-editor.action.clipboardCopyAction"
+    },
+    {
+        "key": "ctrl+w",
+        "command": "editor.action.clipboardCutAction"
+    },
+    {
+        "key": "ctrl+y",
+        "command": "editor.action.clipboardPasteAction"
+    },
+    {
+        "key": "ctrl+v",
+        "command": "-editor.action.clipboardPasteAction"
+    },
+    {
+        "key": "ctrl+x p f",
+        "command": "workbench.action.quickOpen"
+    },
+    {
+        "key": "ctrl+e",
+        "command": "-workbench.action.quickOpen"
+    },
+    {
+        "key": "ctrl+a",
+        "command": "cursorLineStart"
+    },
+    {
+        "key": "ctrl+e",
+        "command": "cursorLineEnd"
+    },
+    {
+        "key": "ctrl+s",
+        "command": "actions.find",
+        "when": "editorFocus || editorIsOpen"
+    },
+    {
+        "key": "ctrl+f",
+        "command": "-actions.find",
+        "when": "editorFocus || editorIsOpen"
+    },
+    {
+        "key": "ctrl+shift+-",
+        "command": "undo"
+    },
+    {
+        "key": "ctrl+z",
+        "command": "-undo"
+    },
+    {
+        "key": "alt+x",
+        "command": "workbench.action.showCommands"
+    },
+    {
+        "key": "ctrl+shift+p",
+        "command": "-workbench.action.showCommands"
+    },
+    {
+        "key": "ctrl+c ctrl+a",
+        "command": "editor.action.quickFix",
+        "when": "editorHasCodeActionsProvider && textInputFocus && !editorReadonly"
+    },
+    {
+        "key": "ctrl+.",
+        "command": "-editor.action.quickFix",
+        "when": "editorHasCodeActionsProvider && textInputFocus && !editorReadonly"
+    },
+    {
+        "key": "shift+alt+5",
+        "command": "editor.action.startFindReplaceAction",
+        "when": "editorFocus || editorIsOpen"
+    },
+    {
+        "key": "ctrl+h",
+        "command": "-editor.action.startFindReplaceAction",
+        "when": "editorFocus || editorIsOpen"
+    },
+    {
+        "key": "shift+1",
+        "command": "editor.action.replaceAll",
+        "when": "editorFocus && findWidgetVisible"
+    },
+    {
+        "key": "ctrl+alt+enter",
+        "command": "-editor.action.replaceAll",
+        "when": "editorFocus && findWidgetVisible"
+    },
+    {
+        "key": "shift+alt+,",
+        "command": "cursorTop",
+        "when": "textInputFocus"
+    },
+    {
+        "key": "ctrl+home",
+        "command": "-cursorTop",
+        "when": "textInputFocus"
+    },
+    {
+        "key": "shift+alt+.",
+        "command": "cursorBottom",
+        "when": "textInputFocus"
+    },
+    {
+        "key": "ctrl+end",
+        "command": "-cursorBottom",
+        "when": "textInputFocus"
+    },
+    {
+        "key": "ctrl+x ctrl+f",
+        "command": "workbench.action.files.openFile",
+        "when": "true"
+    },
+    {
+        "key": "ctrl+o",
+        "command": "-workbench.action.files.openFile",
+        "when": "true"
+    },
+    {
+        "key": "ctrl+x k",
+        "command": "workbench.action.closeEditorInAllGroups"
+    },
+    {
+        "key": "ctrl+x b",
+        "command": "workbench.action.showAllEditors"
+    },
+    {
+        "key": "ctrl+k ctrl+p",
+        "command": "-workbench.action.showAllEditors"
+    }
+]

nix/configuration/roles/vscode/files/settings.json

@@ -0,0 +1,41 @@
+{
+  "application.shellEnvironmentResolutionTimeout": 90,
+  "workbench.colorTheme": "Default High Contrast",
+  "remote.SSH.connectTimeout": 90,
+  "remote.SSH.enableDynamicForwarding": false,
+  "remote.SSH.enableAgentForwarding": false,
+  "remote.SSH.enableX11Forwarding": false,
+  "python.analysis.inlayHints.functionReturnTypes": true,
+  "python.analysis.inlayHints.variableTypes": true,
+  "editor.minimap.enabled": false,
+  "editor.fontSize": 12,
+  "editor.cursorStyle": "block",
+  "editor.fontFamily": "'Cascadia Mono', 'monospace', monospace",
+  "workbench.colorCustomizations": {
+    "editorCursor.foreground": "#ccff66",
+    "terminalCursor.foreground": "#ccff66"
+  },
+  "workbench.editor.showTabs": "none",
+  "workbench.activityBar.location": "hidden",
+  "window.menuBarVisibility": "toggle",
+  "explorer.autoReveal": false,
+  "[python]": {
+    "editor.defaultFormatter": "ms-python.black-formatter",
+    "editor.formatOnSave": true
+  },
+  "[terraform]": {
+    "editor.defaultFormatter": "hashicorp.terraform",
+    "editor.formatOnSave": true
+  },
+  "[terraform-vars]": {
+    "editor.defaultFormatter": "hashicorp.terraform",
+    "editor.formatOnSave": true
+  },
+  "black-formatter.importStrategy": "fromEnvironment",
+  "workbench.statusBar.visible": false,
+  "git.openRepositoryInParentFolders": "never",
+  "files.autoSave": "afterDelay",
+  "editor.rulers": [
+    100
+  ]
+}

nix/configuration/roles/wasm/default.nix

@@ -0,0 +1,31 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    wasm.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install wasm.";
+    };
+  };
+
+  config = lib.mkIf config.me.wasm.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+          wabt
+          wasm-bindgen-cli
+          binaryen # for wasm-opt
+        ];
+      }
+    ]
+  );
+}

nix/configuration/roles/waybar/default.nix

@@ -5,13 +5,114 @@
   ...
 }:
 
+let
+  waybar_sway_config = pkgs.writeTextFile {
+    name = "waybar.conf";
+    text = ''
+      #
+      # Status Bar:
+      #
+      # Read `man 5 sway-bar` for more information about this section.
+      bar {
+          position top
+
+          font pango:Cascadia Mono, FontAwesome 10
+          swaybar_command waybar
+
+          colors {
+              statusline #ffffff
+              background #323232
+              inactive_workspace #32323200 #32323200 #5c5c5c
+          }
+      }
+    '';
+  };
+
+  waybar_available_memory =
+    (pkgs.writeScriptBin "waybar_custom_available_memory" (
+      builtins.readFile ./files/waybar_scripts/waybar_available_memory_linux.bash
+    )).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+  waybar_battery =
+    (pkgs.writeScriptBin "waybar_custom_battery" (
+      builtins.readFile ./files/waybar_scripts/waybar_battery_linux.bash
+    )).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+  waybar_clock =
+    (pkgs.writeScriptBin "waybar_custom_clock" (
+      builtins.readFile ./files/waybar_scripts/waybar_custom_clock.py
+    )).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+  waybar_night_mode =
+    (pkgs.writeScriptBin "waybar_night_mode" (
+      builtins.readFile ./files/waybar_scripts/waybar_night_mode.bash
+    )).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+  waybar_sound =
+    (pkgs.writeScriptBin "waybar_custom_sound" (
+      builtins.readFile ./files/waybar_scripts/waybar_sound_linux.bash
+    )).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+  waybar_temperature =
+    (pkgs.writeScriptBin "waybar_custom_temperature" (
+      builtins.readFile ./files/waybar_scripts/waybar_temperature_linux.bash
+    )).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+in
 {
   imports = [ ];
 
+  options.me = {
+    waybar.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install waybar.";
+    };
+  };
+
+  config = lib.mkIf config.me.waybar.enable (
+    lib.mkMerge [
+      (lib.mkIf config.me.graphical {
         environment.systemPackages = with pkgs; [
           waybar
+          waybar_available_memory
+          waybar_battery
+          waybar_clock
+          waybar_night_mode
+          waybar_sound
+          waybar_temperature
+          python3 # for clock TODO python should not be in the system packages, maybe switch to a venv? ref https://nixos.wiki/wiki/Python
+          bc # for temperature and sound
+          jq # for memory, battery, sound, night mode, and temperature
+          upower # for battery
+          wlsunset # for night mode
         ];
 
+        me.swayIncludes = [
+          waybar_sway_config
+        ];
+
+        services.upower.enable = true; # for battery
+
         home-manager.users.talexander =
           { pkgs, ... }:
           {
@@ -24,5 +125,7 @@
               };
             };
           };
-
+      })
+    ]
+  );
 }

nix/configuration/roles/waybar/files/waybar_scripts/waybar_available_memory_linux.bash

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+#
+# Read memory usage in Linux
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+SLEEP_INTERVAL=${SLEEP_INTERVAL:-30}
+
+while true; do
+    memory_usage=$(free --bytes --wide)
+    total_bytes=$(grep 'Mem:' <<<"$memory_usage" | awk '{print $2}')
+    free_bytes=$(grep 'Mem:' <<<"$memory_usage" | awk '{print $4}')
+
+    free_percent=$((100 * free_bytes / total_bytes))
+    text=""
+
+    if [ $free_bytes -ge $((1024 * 1024 * 1024)) ]; then
+        text="$((free_bytes / 1024 / 1024 / 1024)) GiB"
+    fi
+
+    tooltip="${free_percent}%"
+
+    jq --unbuffered --compact-output <<EOF
+{
+"text":"${text}",
+"tooltip":"${tooltip}",
+"percentage":${free_percent}
+}
+EOF
+    sleep $SLEEP_INTERVAL
+done

nix/configuration/roles/waybar/files/waybar_scripts/waybar_battery_linux.bash

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+#
+# Read battery status in Linux
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+batteries=$(upower --enumerate | grep BAT)
+
+function generate_battery_update {
+    local battery_path=$1
+    local battery_status=$(upower --show-info "$battery_path")
+    local battery_state=$(grep 'state:' <<<"$battery_status" | awk '{print $2}')
+    local battery_percentage=$(grep 'percentage:' <<<"$battery_status" | awk '{print $2}')
+    battery_percentage=${battery_percentage%\%}
+    set +e
+    local time_remaining=$(grep 'time to empty:' <<<"$battery_status" | sed 's/\W*time to empty:\W*//g')
+    local tooltip="$time_remaining until empty"
+    if [ -z "$time_remaining" ]; then
+        time_remaining=$(grep 'time to full:' <<<"$battery_status" | sed 's/\W*time to full:\W*//g')
+        if [ -z "$time_remaining" ]; then
+            tooltip="fully charged"
+        else
+            tooltip="$time_remaining until full"
+        fi
+    fi
+    set -e
+    local battery_icon=""
+    local class=""
+
+    if [ $battery_state = "charging" ]; then
+        if [ $battery_percentage -eq 100 ]; then
+            battery_icon="⚡"
+        else
+            battery_icon="⚡"
+        fi
+    elif [ $battery_percentage -le 12 ]; then
+        battery_icon="⚠"
+    elif [ $battery_percentage -le 25 ]; then
+        battery_icon="▁"
+    elif [ $battery_percentage -le 37 ]; then
+        battery_icon="▂"
+    elif [ $battery_percentage -le 50 ]; then
+        battery_icon="▃"
+    elif [ $battery_percentage -le 62 ]; then
+        battery_icon="▄"
+    elif [ $battery_percentage -le 75 ]; then
+        battery_icon="▅"
+    elif [ $battery_percentage -le 87 ]; then
+        battery_icon="▆"
+    elif [ $battery_percentage -lt 100 ]; then
+        battery_icon="▇"
+    else
+        battery_icon="█"
+    fi
+
+    if [ $battery_percentage -le 15 ]; then
+        class="critical"
+    elif [ $battery_percentage -le 30 ]; then
+        class="warning"
+    fi
+        jq --unbuffered --compact-output <<EOF
+{
+"text":"${battery_percentage}% ${battery_icon}",
+"tooltip":"$tooltip",
+"percentage":${battery_percentage},
+"class":"${class}"
+}
+EOF
+}
+
+while read bat; do
+    generate_battery_update "$bat"
+done<<<"$batteries"
+
+upower --monitor | grep --line-buffered 'device changed:' | while read l; do
+    while read bat; do
+        generate_battery_update "$bat"
+    done<<<"$batteries"
+done

nix/configuration/roles/waybar/files/waybar_scripts/waybar_custom_clock.py

@@ -0,0 +1,107 @@
+#!/usr/bin/env python
+#
+# Custom waybar module for clocks. Implemented because the official clock module was downloading timezone definitions on every boot.
+import datetime
+import json
+import sys
+import time
+from dataclasses import dataclass
+from functools import lru_cache
+from typing import Final, List, Optional
+from zoneinfo import ZoneInfo
+
+LOCAL_TIMEZONE = datetime.datetime.now(datetime.timezone.utc).astimezone().tzinfo
+
+
+@dataclass
+class Update:
+    text: Optional[str]
+    alt: Optional[str]
+    tooltip: Optional[str]
+    css_class: Optional[List[str]]
+    percentage: Optional[str]
+
+    def dump(self) -> str:
+        # Dump a dict because we can't name our member variable "class"
+        return json.dumps(
+            {
+                k: v
+                for k, v in {
+                    "text": self.text,
+                    "alt": self.alt,
+                    "tooltip": self.tooltip,
+                    "class": self.css_class,
+                    "percentage": self.percentage,
+                }.items()
+                if v is not None
+            }
+        )
+
+
+@lru_cache(maxsize=1)
+def make_calendar(today: datetime.date, tz: datetime.tzinfo):
+    width: Final[int] = 20
+    start_of_month = today.replace(day=1)
+    month_header = today.strftime("%B %Y")
+    padding = width - len(month_header)
+    right_padding = " " * (padding // 2)
+    left_padding = right_padding + (" " if padding % 2 == 1 else "")
+    header = f"{left_padding}{month_header}{right_padding}"
+    days_of_week = "Su Mo Tu We Th Fr Sa"
+
+    timezone_str = str(tz)
+
+    # Make the grid
+    first_day_padding = " " * (
+        0 if start_of_month.weekday() == 6 else (3 * (1 + start_of_month.weekday())) - 1
+    )
+    output = f"{header}\n{days_of_week}\n{first_day_padding}"
+
+    print_day = start_of_month
+    while print_day.month == today.month:
+        if print_day.weekday() == 6:
+            output += "\n"
+        else:
+            output += " "
+        if print_day == today:
+            output += '<span foreground="#323232" background="#CCCCCC">'
+        output += f"{print_day.day: >2}"
+        if print_day == today:
+            output += "</span>"
+        print_day += datetime.timedelta(days=1)
+
+    output += f'\n<span size="small">{timezone_str}</span>'
+    return output
+
+
+def main():
+    tz: Optional[datetime.tzinfo] = (
+        ZoneInfo(sys.argv[1]) if len(sys.argv) >= 2 else LOCAL_TIMEZONE
+    )
+    if tz is None:
+        raise Exception("Failed to detect timezone.")
+
+    next_update = time.time()
+    while True:
+        time_before_next_update = next_update - time.time()
+        if time_before_next_update > 0:
+            time.sleep(time_before_next_update)
+        next_update = 60 * (1 + int(time.time()) // 60)
+
+        now = datetime.datetime.now(tz=tz)
+        text = now.strftime("%Y-%m-%d %H:%M:%S")
+        tooltip = make_calendar(now.date(), tz)
+
+        out = Update(
+            text=text,
+            alt="foo",
+            tooltip=f"<tt>{tooltip}</tt>",
+            css_class=["foo"],
+            percentage="100",
+        )
+
+        print(out.dump(), flush=True)
+
+
+if __name__ == "__main__":
+    main()

nix/configuration/roles/waybar/files/waybar_scripts/waybar_night_mode.bash

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+#
+# Power an icon for tinting the screen at night.
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+SLEEP_INTERVAL=${SLEEP_INTERVAL:-30}
+
+# ◓◒●◌◎
+# 🔴🔵🟠🟡🟢🟣🟤
+# 🟥🟦🟧🟨🟩🟪🟫
+# ☀☯⭐🌝🌞⏾
+# 🌑🌓🌗🌕
+# 👓
+
+############## Setup #########################
+
+function cleanup {
+    log "Killing child process $wlsunset_pid"
+    kill "$wlsunset_pid"
+    true
+}
+for sig in EXIT; do
+  trap "set +e; cleanup" "$sig"
+done
+
+function die {
+    local status_code="$1"
+    shift
+    (>&2 echo "${@}")
+    exit "$status_code"
+}
+
+function log {
+    (>&2 echo "${@}")
+}
+
+############## Program #########################
+
+function main {
+    local night_mode_icon night_mode_text night_mode_class
+    night_mode_mode="auto"
+    night_mode_class=""
+    wlsunset -S 07:00 -s 22:00 &
+    wlsunset_pid=$!
+
+    while true; do
+        if [ "$night_mode_mode" == "auto" ]; then
+            night_mode_icon="🌗"
+            night_mode_text="auto"
+        elif [ "$night_mode_mode" == "on" ]; then
+            night_mode_icon="🌑"
+            night_mode_text="night"
+        elif [ "$night_mode_mode" == "off" ]; then
+            night_mode_icon="🌕"
+            night_mode_text="day"
+        fi
+
+        render
+        sleep "$SLEEP_INTERVAL" &
+        wait $! || true
+    done
+}
+
+function render {
+    jq --unbuffered --compact-output <<EOF
+{
+"text":"${night_mode_icon}",
+"tooltip":"${night_mode_text}",
+"percentage":100,
+"class":"${night_mode_class}"
+}
+EOF
+}
+
+function handle_click {
+    if [ "$night_mode_mode" == "auto" ]; then
+        log "Setting night mode to force-day."
+        night_mode_mode="off"
+    elif [ "$night_mode_mode" == "on" ]; then
+        log "Setting night mode to auto."
+        night_mode_mode="auto"
+    elif [ "$night_mode_mode" == "off" ]; then
+        log "Setting night mode to force-night."
+        night_mode_mode="on"
+    fi
+    kill -s SIGUSR1 "$wlsunset_pid"
+}
+
+trap "handle_click" SIGUSR1
+
+main "${@}"

nix/configuration/roles/waybar/files/waybar_scripts/waybar_sound_linux.bash

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+#
+# Read volume status in Linux
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+SLEEP_INTERVAL=${SLEEP_INTERVAL:-30}
+
+while true; do
+    current_vol_decimal=$(wpctl get-volume @DEFAULT_AUDIO_SINK@ | sed 's/Volume: //g')
+    if [[ "$current_vol_decimal" = *MUTED* ]]; then
+        current_vol_percent=0
+    else
+        current_vol_percent=$(bc -s <<<"$current_vol_decimal * 100")
+        current_vol_percent=${current_vol_percent%.*} # Remove decimal
+    fi
+    tooltip="<tt>$(wpctl status)</tt>"
+    tooltip=${tooltip//$'\n'/\\n}
+    tooltip=${tooltip//$'\t'/\\t}
+    class=""
+    icon=""
+
+    if [ $current_vol_percent -eq 0 ]; then
+        icon="🔇"
+    elif [ $current_vol_percent -le 50 ]; then
+        icon="🔉"
+    else
+        icon="🔊"
+    fi
+
+    jq --unbuffered --compact-output <<EOF
+{
+"text":"${current_vol_percent}% ${icon}",
+"tooltip":"${tooltip}",
+"percentage":${current_vol_percent},
+"class":"${class}"
+}
+EOF
+    sleep $SLEEP_INTERVAL
+done