Replace wofi with tofi.

I will probably move to a similar import system to what I am doing with sway.

nix/configuration/configuration.nix

@@ -0,0 +1,228 @@
+{
+  config,
+  lib,
+  pkgs,
+  home-manager,
+  ...
+}:
+
+{
+  imports = [
+    ./roles/reset
+    ./util/unfree_polyfill
+    ./roles/iso
+    ./hosts/odo
+    "${
+      builtins.fetchTarball {
+        url = "https://github.com/nix-community/disko/archive/refs/tags/v1.9.0.tar.gz";
+        sha256 = "0j76ar4qz320fakdii4659w5lww8wiz6yb7g47npywqvf2lbp388";
+      }
+    }/module.nix"
+    ./roles/boot
+    ./roles/zfs
+    ./roles/network
+    ./roles/firewall
+    ./roles/zsh
+    ./roles/zrepl
+    ./roles/graphics
+    ./roles/sound
+    ./roles/sway
+    ./roles/kanshi
+    ./roles/alacritty
+    ./roles/firefox
+    ./roles/chromium
+    ./roles/emacs
+    ./roles/git
+    ./roles/fonts
+    ./roles/gpg
+    ./roles/waybar
+    ./roles/qemu
+    ./roles/wireguard
+    ./roles/ares
+    ./roles/ssh
+    ./roles/python
+    ./roles/docker
+    ./roles/kubernetes
+    ./roles/rust
+    ./roles/media
+    ./roles/steam
+    ./roles/latex
+    ./roles/launch_keyboard
+    ./roles/lvfs
+    ./roles/nvme
+    ./roles/terraform
+    ./roles/vscode
+    ./roles/wasm
+    ./roles/vnc_client
+  ];
+
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+  nix.settings.trusted-users = [ "@wheel" ];
+
+  # boot.kernelPackages = pkgs.linuxPackages_6_11;
+  hardware.enableRedistributableFirmware = true;
+
+  services.getty = {
+    autologinUser = "talexander"; # I use full disk encryption so the user password is irrelevant.
+    autologinOnce = true;
+  };
+  users.mutableUsers = false;
+  users.users.talexander = {
+    isNormalUser = true;
+    createHome = true; # https://github.com/NixOS/nixpkgs/issues/6481
+    group = "talexander";
+    extraGroups = [ "wheel" ];
+    uid = 11235;
+    packages = with pkgs; [
+      tree
+    ];
+    # Generate with `mkpasswd -m scrypt`
+    hashedPassword = "$7$CU..../....VXvNQ8za3wSGpdzGXNT50/$HcFtn/yvwPMCw4888BelpiAPLAxe/zU87fD.d/N6U48";
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGu+k5lrirokdW5zVdRVBOqEOAvAPlIkG/MdJNc9g5ky"
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIEI6mu6I5Jp+Ib0vJxapGHbEShZjyvzV8jz5DnzDrI39AAAABHNzaDo="
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIAFNcSXwvy+brYTOGo56G93Ptuq2MmZsjvRWAfMqbmMLAAAABHNzaDo="
+    ];
+  };
+  users.groups.talexander.gid = 11235;
+  home-manager.users.talexander =
+    { pkgs, ... }:
+    {
+      home.packages = [
+        pkgs.atool
+        pkgs.httpie
+      ];
+      programs.bash.enable = true;
+
+      # The state version is required and should stay at the version you
+      # originally installed.
+      home.stateVersion = "24.11";
+    };
+
+  # Automatic garbage collection
+  nix.gc = lib.mkIf (!config.me.buildingIso) {
+    # Runs nix-collect-garbage --delete-older-than 5d
+    automatic = true;
+    randomizedDelaySec = "14m";
+    options = "--delete-older-than 30d";
+  };
+  # nix.settings.auto-optimise-store = true;
+
+  # Use doas instead of sudo
+  security.doas.enable = true;
+  security.doas.wheelNeedsPassword = false;
+  security.sudo.enable = false;
+  security.doas.extraRules = [
+    {
+      # Retain environment (for example NIX_PATH)
+      keepEnv = true;
+      persist = true; # Only ask for a password the first time.
+    }
+  ];
+
+  # Do not use default packages (nixos includes some defaults like nano)
+  environment.defaultPackages = lib.mkForce [ ];
+
+  environment.systemPackages = with pkgs; [
+    wget
+    mg
+    rsync
+    libinput
+    htop
+    tmux
+    file
+    usbutils # for lsusb
+    pciutils # for lspci
+    ripgrep
+    strace
+    ltrace
+    trace-cmd # ftrace
+    tcpdump
+    git-crypt
+    nix-index-unwrapped
+    gnumake
+  ];
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+    };
+    hostKeys = [
+      {
+        path = "/persist/ssh/ssh_host_ed25519_key";
+        type = "ed25519";
+      }
+      {
+        path = "/persist/ssh/ssh_host_rsa_key";
+        type = "rsa";
+        bits = 4096;
+      }
+    ];
+  };
+
+  environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+    hideMounts = true;
+    directories = [
+      "/var/lib/iwd" # Wifi settings
+      "/var/lib/nixos" # Contains user information (uids/gids)
+      "/var/lib/systemd" # Systemd state directory for random seed, persistent timers, core dumps, persist hardware state like backlight and rfkill
+      "/var/log/journal" # Logs, alternatively set `services.journald.storage = "volatile";` to write to /run/log/journal
+    ];
+    files = [
+      "/etc/machine-id" # Systemd unique machine id "otherwise, the system journal may fail to list earlier boots, etc"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+    ];
+    # users.talexander = {
+    #   directories = [];
+    #   files = [];
+    # };
+  };
+
+  # Write a list of the currently installed packages to /etc/current-system-packages
+  environment.etc."current-system-packages".text =
+    let
+      packages = builtins.map (p: "${p.name}") config.environment.systemPackages;
+      sortedUnique = builtins.sort builtins.lessThan (lib.unique packages);
+      formatted = builtins.concatStringsSep "\n" sortedUnique;
+    in
+    formatted;
+
+  # nixpkgs.overlays = [
+  #   (final: prev: {
+  #     nix = pkgs-unstable.nix;
+  #   })
+  # ];
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "24.11"; # Did you read the comment?
+
+}

nix/configuration/flake.lock

@@ -0,0 +1,342 @@
+{
+  "nodes": {
+    "crane": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1717535930,
+        "narHash": "sha256-1hZ/txnbd/RmiBPNUs7i8UQw2N89uAK3UzrGAWdnFfU=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "55e7754ec31dac78980c8be45f8a28e80e370946",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1717285511,
+        "narHash": "sha256-iKzJcpdXih14qYVcZ9QC9XuZYnPc6T8YImb6dX166kw=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "pre-commit-hooks-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1737120639,
+        "narHash": "sha256-p5e/45V41YD3tMELuiNIoVCa25/w4nhOTm0B9MtdHFI=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "a0046af169ce7b1da503974e1b22c48ef4d71887",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "impermanence": {
+      "locked": {
+        "lastModified": 1736688610,
+        "narHash": "sha256-1Zl9xahw399UiZSJ9Vxs1W4WRFjO1SsNdVZQD4nghz0=",
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "rev": "c64bed13b562fc3bb454b48773d4155023ac31b7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "type": "github"
+      }
+    },
+    "lanzaboote": {
+      "inputs": {
+        "crane": "crane",
+        "flake-compat": "flake-compat",
+        "flake-parts": "flake-parts",
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1718178907,
+        "narHash": "sha256-eSZyrQ9uoPB9iPQ8Y5H7gAmAgAvCw3InStmU3oEjqsE=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "b627ccd97d0159214cee5c7db1412b75e4be6086",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "v0.4.1",
+        "repo": "lanzaboote",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1737062831,
+        "narHash": "sha256-Tbk1MZbtV2s5aG+iM99U8FqwxU/YNArMcWAv6clcsBc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "5df43628fdf08d642be8ba5b3625a6c70731c19c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-b93b4e9b5": {
+      "locked": {
+        "lastModified": 1713721570,
+        "narHash": "sha256-R0s+O5UjTePQRb72XPgtkTmEiOOW8n+1q9Gxt/OJnKU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b93b4e9b527904aadf52dba6ca35efde2067cbd4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b93b4e9b527904aadf52dba6ca35efde2067cbd4",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1710695816,
+        "narHash": "sha256-3Eh7fhEID17pv9ZxrPwCLfqXnYP006RKzSs0JptsN84=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "614b4613980a522ba49f0d194531beddbb7220d3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "pre-commit-hooks-nix": {
+      "inputs": {
+        "flake-compat": [
+          "lanzaboote",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": "nixpkgs-stable"
+      },
+      "locked": {
+        "lastModified": 1717664902,
+        "narHash": "sha256-7XfBuLULizXjXfBYy/VV+SpYMHreNRHk9nKMsm1bgb4=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "cc4d466cb1254af050ff7bdf47f6d404a7c646d1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "home-manager": "home-manager",
+        "impermanence": "impermanence",
+        "lanzaboote": "lanzaboote",
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-b93b4e9b5": "nixpkgs-b93b4e9b5",
+        "zsh-histdb": "zsh-histdb"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "flake-utils": [
+          "lanzaboote",
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1717813066,
+        "narHash": "sha256-wqbRwq3i7g5EHIui0bIi84mdqZ/It1AXBSLJ5tafD28=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "6dc3e45fe4aee36efeed24d64fc68b1f989d5465",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "zsh-histdb": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-5DWw7GnwVZ98HUp/UUJcyUmmy9Bh/mcQB8MQQ0t3ZRo=",
+        "path": "flakes/zsh-histdb",
+        "type": "path"
+      },
+      "original": {
+        "path": "flakes/zsh-histdb",
+        "type": "path"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

nix/configuration/flake.nix

@@ -0,0 +1,107 @@
+# Build ISO image
+#   nix build --extra-experimental-features nix-command --extra-experimental-features flakes .#iso.odo
+#   output: result/iso/nixos.iso
+
+# Run the ISO image
+#   "$(nix-build '<nixpkgs>' --no-out-link -A 'qemu')/bin/qemu-system-x86_64" \
+#        -accel kvm \
+#        -cpu host \
+#        -smp cores=8 \
+#        -m 32768 \
+#        -drive "file=$(nix-build '<nixpkgs>' --no-out-link -A 'OVMF.fd')/FV/OVMF.fd,if=pflash,format=raw,readonly=on" \
+#        -drive if=pflash,format=raw,file="/tmp/OVMF_VARS.fd" \
+#        -nic user,hostfwd=tcp::60022-:22 \
+#        -boot order=d \
+#        -cdrom "$(readlink -f ./result/iso/nixos.iso)" \
+#        -display vnc=127.0.0.1:0
+#
+# doas cp "$(nix-build '<nixpkgs>' --no-out-link -A 'OVMF.fd')/FV/OVMF_VARS.fd" /tmp/OVMF_VARS.fd
+# doas "$(nix-build '<nixpkgs>' --no-out-link -A 'qemu')/bin/qemu-system-x86_64" -accel kvm -cpu host -smp cores=8 -m 32768 -drive "file=$(nix-build '<nixpkgs>' --no-out-link -A 'OVMF.fd')/FV/OVMF.fd,if=pflash,format=raw,readonly=on" -drive if=pflash,format=raw,file="/tmp/OVMF_VARS.fd" -nic user,hostfwd=tcp::60022-:22 -boot order=d -cdrom /persist/machine_setup/nix/configuration/result/iso/nixos*.iso -display vnc=127.0.0.1:0
+
+# Get a repl for this flake
+#   nix repl --expr "builtins.getFlake \"$PWD\""
+
+# TODO maybe use `nix eval --raw .#iso.odo.outPath`
+# iso.odo.isoName == "nixos.iso"
+# full path = <outPath> / iso / <isoName>
+
+{
+  description = "My system configuration";
+
+  inputs = {
+    impermanence.url = "github:nix-community/impermanence";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs-b93b4e9b5.url = "github:NixOS/nixpkgs/b93b4e9b527904aadf52dba6ca35efde2067cbd4";
+    home-manager.url = "github:nix-community/home-manager";
+    home-manager.inputs.nixpkgs.follows = "nixpkgs";
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/v0.4.1";
+
+      # Optional but recommended to limit the size of your system closure.
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    zsh-histdb = {
+      url = "path:flakes/zsh-histdb";
+
+      # Optional but recommended to limit the size of your system closure.
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      nixpkgs-b93b4e9b5,
+      impermanence,
+      home-manager,
+      lanzaboote,
+      zsh-histdb,
+      ...
+    }@inputs:
+    let
+      base_x86_64_linux = rec {
+        system = "x86_64-linux";
+        specialArgs = {
+          pkgs-b93b4e9b5 = import nixpkgs-b93b4e9b5 {
+            inherit system;
+          };
+        };
+        modules = [
+          impermanence.nixosModules.impermanence
+          home-manager.nixosModules.home-manager
+          lanzaboote.nixosModules.lanzaboote
+          {
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+          }
+          { nixpkgs.overlays = [ zsh-histdb.overlays.default ]; }
+          ./configuration.nix
+        ];
+      };
+      systems = {
+        odo = {
+          main = nixpkgs.lib.nixosSystem (base_x86_64_linux // { });
+          iso = nixpkgs.lib.nixosSystem (
+            base_x86_64_linux
+            // {
+              modules = base_x86_64_linux.modules ++ [
+                (nixpkgs + "/nixos/modules/installer/cd-dvd/iso-image.nix")
+                # TODO: Figure out how to do image based appliances
+                # (nixpkgs + "/nixos/modules/profiles/image-based-appliance.nix")
+                {
+                  isoImage.makeEfiBootable = true;
+                  isoImage.makeUsbBootable = true;
+                  me.buildingIso = true;
+                }
+              ];
+            }
+          );
+        };
+      };
+    in
+    {
+      nixosConfigurations.odo = systems.odo.main;
+      iso.odo = systems.odo.iso.config.system.build.isoImage;
+    };
+}

nix/configuration/flakes/zsh-histdb/flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1735141468,
+        "narHash": "sha256-VIAjBr1qGcEbmhLwQJD6TABppPMggzOvqFsqkDoMsAY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "4005c3ff7505313cbc21081776ad0ce5dfd7a3ce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

nix/configuration/flakes/zsh-histdb/flake.nix

@@ -0,0 +1,34 @@
+{
+  description = "A slightly better history for zsh";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+  inputs.flake-utils.url = "github:numtide/flake-utils";
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      flake-utils,
+      ...
+    }:
+    let
+      out =
+        system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+          # Maybe pkgs = import nixpkgs { inherit system; }; ?
+          appliedOverlay = self.overlays.default pkgs pkgs;
+        in
+        {
+          packages = rec {
+            default = zsh-histdb;
+            zsh-histdb = appliedOverlay.zsh-histdb;
+          };
+        };
+    in
+    flake-utils.lib.eachDefaultSystem out
+    // {
+      overlays.default = final: prev: {
+        zsh-histdb = final.callPackage ./package.nix { };
+      };
+    };
+}

nix/configuration/flakes/zsh-histdb/package.nix

@@ -0,0 +1,36 @@
+# unpackPhase
+# patchPhase
+# configurePhase
+# buildPhase
+# checkPhase
+# installPhase
+# fixupPhase
+# installCheckPhase
+# distPhase
+{
+  stdenv,
+  pkgs,
+  sqlite,
+  ...
+}:
+stdenv.mkDerivation {
+  name = "zsh-histdb";
+  src = pkgs.fetchgit {
+    url = "https://github.com/larkery/zsh-histdb.git";
+    rev = "90a6c104d0fcc0410d665e148fa7da28c49684eb";
+    sha256 = "sha256-vtG1poaRVbfb/wKPChk1WpPgDq+7udLqLfYfLqap4Vg=";
+  };
+  buildInputs = [ sqlite ];
+  phases = [
+    "installPhase"
+  ];
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/zsh/plugins/zsh-histdb
+    cp -r $src/histdb-* $src/*.zsh $src/db_migrations $out/share/zsh/plugins/zsh-histdb/
+    runHook postInstall
+  '';
+  postInstall = ''
+    substituteInPlace $out/share/zsh/plugins/zsh-histdb/sqlite-history.zsh $out/share/zsh/plugins/zsh-histdb/histdb-merge $out/share/zsh/plugins/zsh-histdb/histdb-migrate --replace-fail "sqlite3" "${sqlite}/bin/sqlite3"
+  '';
+}

nix/configuration/hosts/odo/default.nix

@@ -0,0 +1,34 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./disk-config.nix
+    ./optimized_build.nix
+    ./power_management.nix
+    ./screen_brightness.nix
+    ./wifi.nix
+  ];
+
+  # Generate with `head -c4 /dev/urandom | od -A none -t x4`
+  networking.hostId = "908cbf04";
+
+  networking.hostName = "odo"; # Define your hostname.
+
+  time.timeZone = "America/New_York";
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  me.secureBoot.enable = true;
+
+  # Early KMS
+  boot.initrd.kernelModules = [ "amdgpu" ];
+
+  # Mount tmpfs at /tmp
+  boot.tmp.useTmpfs = true;
+
+  environment.systemPackages = with pkgs; [
+    fw-ectool
+  ];
+
+  me.graphical = true;
+  me.graphicsCardType = "amd";
+}

nix/configuration/hosts/odo/disk-config.nix

@@ -0,0 +1,145 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+lib.mkIf (!config.me.buildingIso) {
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/nvme0n1";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [
+                  "umask=0077"
+                  "noatime"
+                  "discard"
+                ];
+              };
+            };
+            zfs = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        # mode = "mirror";
+        # Workaround: cannot import 'zroot': I/O error in disko tests
+        options.cachefile = "none";
+        options = {
+          ashift = "12";
+          compatibility = "openzfs-2.2-freebsd";
+          autotrim = "on";
+        };
+        rootFsOptions = {
+          acltype = "posixacl";
+          atime = "off";
+          relatime = "off";
+          xattr = "sa";
+          mountpoint = "none";
+          compression = "lz4";
+          canmount = "off";
+          utf8only = "on";
+          dnodesize = "auto";
+          normalization = "formD";
+        };
+
+        datasets = {
+          "linux/nix" = {
+            type = "zfs_fs";
+            options.mountpoint = "none";
+            options = {
+              encryption = "aes-256-gcm";
+              keyformat = "passphrase";
+              # keylocation = "file:///tmp/secret.key";
+            };
+          };
+          "linux/nix/root" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/";
+            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/root@blank$' || zfs snapshot zroot/linux/nix/root@blank";
+          };
+          "linux/nix/nix" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/nix";
+            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/nix@blank$' || zfs snapshot zroot/linux/nix/nix@blank";
+            options = {
+              recordsize = "16MiB";
+              compression = "zstd-19";
+            };
+          };
+          "linux/nix/home" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/home";
+            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/home@blank$' || zfs snapshot zroot/linux/nix/home@blank";
+          };
+          "linux/nix/persist" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/persist";
+            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/persist@blank$' || zfs snapshot zroot/linux/nix/persist@blank";
+          };
+          "linux/nix/state" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/state";
+            postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/state@blank$' || zfs snapshot zroot/linux/nix/state@blank";
+          };
+        };
+      };
+    };
+  };
+
+  # Make sure all persistent volumes are marked as neededForBoot
+  #
+  # Also mounts /home so it is mounted before the user home directories are created.
+  fileSystems."/persist".neededForBoot = true;
+  fileSystems."/state".neededForBoot = true;
+  fileSystems."/home".neededForBoot = true;
+
+  fileSystems."/".options = [
+    "noatime"
+    "norelatime"
+  ];
+  fileSystems."/nix".options = [
+    "noatime"
+    "norelatime"
+  ];
+  fileSystems."/persist".options = [
+    "noatime"
+    "norelatime"
+  ];
+  fileSystems."/state".options = [
+    "noatime"
+    "norelatime"
+  ];
+  fileSystems."/home".options = [
+    "noatime"
+    "norelatime"
+  ];
+
+  # Only attempt to decrypt the main pool. Otherwise it attempts to decrypt pools that aren't even used.
+  boot.zfs.requestEncryptionCredentials = [ "zroot/linux/nix" ];
+}

nix/configuration/hosts/odo/hardware-configuration.nix

@@ -0,0 +1,36 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "thunderbolt"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp58s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

nix/configuration/hosts/odo/optimized_build.nix

@@ -0,0 +1,94 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  imports = [ ];
+
+  nix.settings.system-features = lib.mkForce [
+    "gccarch-znver4"
+    "gccarch-skylake"
+    # "gccarch-alderlake" missing WAITPKG
+    "gccarch-x86-64-v3"
+    "gccarch-x86-64-v4"
+    "benchmark"
+    "big-parallel"
+    "kvm"
+    "nixos-test"
+  ];
+
+  # nixpkgs.hostPlatform = {
+  #   gcc.arch = "znver4";
+  #   gcc.tune = "znver4";
+  #   system = "x86_64-linux";
+  # };
+
+  nixpkgs.overlays = [
+    (
+      self: super:
+      let
+        optimizeWithFlags =
+          pkg: flags:
+          pkg.overrideAttrs (old: {
+            NIX_CFLAGS_COMPILE = [ (old.NIX_CFLAGS_COMPILE or "") ] ++ flags;
+          });
+      in
+      {
+        # linux
+        # linux_6_11
+        # linux_zen
+        linux_znver4 = optimizeWithFlags super.linux_6_12 [
+          "-march=znver4"
+          "-mtune=znver4"
+        ];
+      }
+    )
+    # (
+    #   self: super:
+    #   let
+    #     optimizeWithFlags =
+    #       pkg: flags:
+    #       pkg.overrideAttrs (old: {
+    #         NIX_CFLAGS_COMPILE = [ (old.NIX_CFLAGS_COMPILE or "") ] ++ flags;
+    #       });
+    #     addConfig =
+    #       additionalConfig: pkg:
+    #       pkg.override (oldconfig: {
+    #         structuredExtraConfig = pkg.structuredExtraConfig // additionalConfig;
+    #       });
+    #   in
+    #   {
+    #     linux_znver4 =
+    #       addConfig
+    #         {
+    #           # CPUFreq governor Performance
+    #           CPU_FREQ_DEFAULT_GOV_PERFORMANCE = lib.mkOverride 60 lib.kernel.yes;
+    #           CPU_FREQ_DEFAULT_GOV_SCHEDUTIL = lib.mkOverride 60 lib.kernel.no;
+
+    #           # Full preemption
+    #           PREEMPT = lib.mkOverride 60 lib.kernel.yes;
+    #           PREEMPT_VOLUNTARY = lib.mkOverride 60 lib.kernel.no;
+
+    #           # Google's BBRv3 TCP congestion Control
+    #           TCP_CONG_BBR = lib.kernel.yes;
+    #           DEFAULT_BBR = lib.kernel.yes;
+
+    #           # Preemptive Full Tickless Kernel at 250Hz
+    #           HZ = lib.kernel.freeform "250";
+    #           HZ_250 = lib.kernel.yes;
+    #           HZ_1000 = lib.kernel.no;
+    #         }
+    #         (
+    #           optimizeWithFlags super.linux_6_11 [
+    #             "-march=znver4"
+    #             "-mtune=znver4"
+    #           ]
+    #         );
+    #   }
+    # )
+  ];
+
+  boot.kernelPackages = lib.mkIf (!config.me.buildingIso) (pkgs.linuxPackagesFor pkgs.linux_znver4);
+}

nix/configuration/hosts/odo/power_management.nix

@@ -0,0 +1,59 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    powertop
+  ];
+
+  # amdgpu.abmlevel=3 :: Automatically reduce screen brightness but tweak colors to compensate for power reduction.
+  # pcie_aspm=force pcie_aspm.policy=powersupersave :: Enable PCIe active state power management for power reduction.
+  # nowatchdog :: Disable watchdog for power savings (related to disable_sp5100_watchdog above).
+  # amd_pstate=passive :: Fully automated hardware pstate control.
+  # amd_pstate=active :: Same as passive except we can set the energy performance preference (EPP) to suggest how much we prefer performance or energy efficiency.
+  # amd_pstate=guided :: Same as passive except we can set upper and lower frequency bounds.
+  # amdgpu.dcdebugmask=0x10 :: Allegedly disables Panel Replay from https://community.frame.work/t/tracking-freezing-arch-linux-amd/39495/32
+  boot.kernelParams = [
+    "amdgpu.abmlevel=3"
+    "pcie_aspm=force"
+    "pcie_aspm.policy=powersupersave"
+    "nowatchdog"
+    # I don't see a measurable benefit from these two:
+    # "cpufreq.default_governor=powersave"
+    # "initcall_blacklist=cpufreq_gov_userspace_init"
+  ];
+
+  systemd.tmpfiles.rules = [
+    "w- /sys/firmware/acpi/platform_profile - - - - low-power"
+    "w- /sys/devices/system/cpu/cpufreq/policy0/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy1/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy2/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy3/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy4/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy5/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy6/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy7/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy8/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy9/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy10/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy11/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy12/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy13/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy14/energy_performance_preference - - - - power"
+    "w- /sys/devices/system/cpu/cpufreq/policy15/energy_performance_preference - - - - power"
+  ];
+
+  boot.extraModprobeConfig = ''
+    # Disable the hardware watchdog inside AMD 700 chipset series for power savings.
+    blacklist sp5100_tco
+
+    # Sound power-saving was causing chat notifications to be inaudible.
+    # options snd_hda_intel power_save=1
+  '';
+}

nix/configuration/hosts/odo/screen_brightness.nix

@@ -0,0 +1,14 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  systemd.tmpfiles.rules = [
+    "w- /sys/class/backlight/amdgpu_bl1/brightness - - - - 85"
+  ];
+}

nix/configuration/hosts/odo/wifi.nix

@@ -0,0 +1,16 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  config = {
+    environment.loginShellInit = lib.mkIf (!config.me.buildingIso) ''
+      doas iw dev wlan0 set power_save off
+    '';
+  };
+}

nix/configuration/roles/alacritty/default.nix

@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    alacritty
+    xdg-utils # for xdg-open
+  ];
+
+  home-manager.users.talexander =
+    { pkgs, ... }:
+    {
+      home.file.".config/alacritty/alacritty.toml" = {
+        source = ./files/alacritty.toml;
+      };
+    };
+
+}

nix/configuration/roles/alacritty/files/alacritty.toml

@@ -0,0 +1,44 @@
+[colors]
+draw_bold_text_with_bright_colors = true
+indexed_colors = []
+
+[colors.bright]
+black = "0x666666"
+blue = "0x7aa6da"
+cyan = "0x54ced6"
+green = "0x9ec400"
+magenta = "0xb77ee0"
+red = "0xff3334"
+white = "0xffffff"
+yellow = "0xe7c547"
+
+[colors.normal]
+black = "0x000000"
+blue = "0x7aa6da"
+cyan = "0x70c0ba"
+green = "0xb9ca4a"
+magenta = "0xc397d8"
+red = "0xd54e53"
+white = "0xeaeaea"
+yellow = "0xe6c547"
+
+[colors.primary]
+background = "0x000000"
+foreground = "0xeaeaea"
+
+[font]
+size = 11.0
+
+[[hints.enabled]]
+command = "xdg-open"
+post_processing = true
+regex = "(ipfs:|ipns:|magnet:|mailto:|gemini:|gopher:|https:|http:|news:|file:|git:|ssh:|ftp:)[^\u0000-\u001F\u007F-<>\"\\s{-}\\^⟨⟩`]+"
+
+[hints.enabled.mouse]
+enabled = false
+mods = "None"
+
+[scrolling]
+history = 10000
+# Lines moved per scroll.
+multiplier = 3

nix/configuration/roles/ares/default.nix

@@ -0,0 +1,14 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    ares
+  ];
+}

nix/configuration/roles/blank/default.nix

@@ -0,0 +1,13 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+  ];
+}

nix/configuration/roles/boot/default.nix

@@ -0,0 +1,103 @@
+# ISO does not work with systemd initrd yet https://github.com/NixOS/nixpkgs/pull/291750
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options = {
+    me.secureBoot = {
+      enable = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Enable to use secure boot.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkMerge [
+    {
+      environment.systemPackages = with pkgs; [
+        tpm2-tools # For tpm2_eventlog to check for OptionRoms
+        # cp /sys/kernel/security/tpm0/binary_bios_measurements eventlog
+        # tpm2_eventlog eventlog | grep "BOOT_SERVICES_DRIVER"
+        sbctl # For debugging and troubleshooting Secure Boot.
+      ];
+    }
+    (lib.mkIf (!config.me.buildingIso) {
+
+      boot.loader.grub.enable = false;
+      # Use the systemd-boot EFI boot loader.
+      boot.loader.systemd-boot.enable = true;
+      # TODO: make not write bootx64.efi
+      boot.loader.efi.canTouchEfiVariables = false;
+
+      # Automatically delete old generations
+      boot.loader.systemd-boot.configurationLimit = 3;
+
+      # Check what will be lost with `zfs diff zroot/linux/root@blank`
+      boot.initrd.systemd.enable = lib.mkDefault true;
+      boot.initrd.systemd.services.zfs-rollback = {
+        description = "Rollback ZFS root dataset to blank snapshot";
+        wantedBy = [
+          "initrd.target"
+        ];
+        after = [
+          "zfs-import-zroot.service"
+        ];
+        before = [
+          "sysroot.mount"
+        ];
+        path = with pkgs; [
+          zfs
+        ];
+        unitConfig.DefaultDependencies = "no";
+        serviceConfig.Type = "oneshot";
+        script = ''
+          zfs rollback -r zroot/linux/nix/root@blank
+          zfs rollback -r zroot/linux/nix/home@blank
+          echo "rollback complete"
+        '';
+      };
+
+      # boot.loader.systemd-boot.extraEntries = {
+      #   "windows.conf" = ''
+      #     title Windows
+      #     efi /EFI/Microsoft/Boot/bootmgfw.efi
+      #     options root=PARTUUID=17e325bf-a378-4d1d-be6a-f6df5476f0fa
+      #   '';
+      # };
+    })
+    (lib.mkIf (config.me.secureBoot.enable) {
+
+      environment.systemPackages = with pkgs; [
+        sbctl
+      ];
+      boot.loader.systemd-boot.enable = lib.mkForce false;
+      boot.lanzaboote = {
+        enable = true;
+        pkiBundle = "/var/lib/sbctl";
+      };
+      environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+        hideMounts = true;
+        directories = [
+          "/var/lib/sbctl" # Secure Boot Keys
+        ];
+      };
+    })
+  ];
+}
+# efibootmgr -c -d /dev/sda -p 1 -L NixOS-boot -l '\EFI\NixOS-boot\grubx64.efi'
+
+# Text-only:
+# sudo cp "$(nix-build '<nixpkgs>' --no-out-link -A 'refind')/share/refind/refind_x64.efi" /boot/EFI/boot/bootx64.efi
+
+# Full graphics:
+# $ sudo nix-shell -p refind efibootmgr
+# $ refind-install

nix/configuration/roles/chromium/default.nix

@@ -0,0 +1,52 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  # TODO: Read https://bbs.archlinux.org/viewtopic.php?pid=2209507#p2209507 and apply desired settings.
+
+  environment.systemPackages = with pkgs; [
+    (chromium.override { enableWideVine = true; })
+  ];
+
+  allowedUnfree = [
+    "chromium"
+    "chromium-unwrapped"
+    "widevine-cdm"
+  ];
+
+  environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+    hideMounts = true;
+    users.talexander = {
+      directories = [
+        {
+          directory = ".config/chromium";
+          user = "talexander";
+          group = "talexander";
+          mode = "0700";
+        }
+      ];
+    };
+  };
+  environment.persistence."/state" = lib.mkIf (!config.me.buildingIso) {
+    hideMounts = true;
+    users.talexander = {
+      directories = [
+        {
+          directory = ".cache/chromium";
+          user = "talexander";
+          group = "talexander";
+          mode = "0700";
+        }
+      ];
+    };
+  };
+
+  # Enabling vulkan causes video to render as white
+  # nixpkgs.config.chromium.commandLineArgs = "--enable-features=Vulkan";
+}

nix/configuration/roles/docker/default.nix

@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  virtualisation.docker.enable = true;
+  # Use docker activation
+  virtualisation.docker.enableOnBoot = false;
+  # Rootless docker breaks access to ssh for buildkit.
+  # virtualisation.docker.rootless = {
+  #   enable = true;
+  #   setSocketVariable = true;
+  # };
+  # Give docker access to ssh for fetching repos with buildkit.
+  virtualisation.docker.extraPackages = [ pkgs.openssh ];
+  environment.systemPackages = with pkgs; [
+    docker-buildx
+  ];
+
+  environment.persistence."/state" = lib.mkIf (!config.me.buildingIso) {
+    hideMounts = true;
+    directories = [
+      {
+        directory = "/var/lib/docker";
+        user = "root";
+        group = "root";
+        mode = "0740";
+      }
+    ];
+    # users.talexander = {
+    #   directories = [
+    #     {
+    #       directory = ".local/share/docker";
+    #       user = "talexander";
+    #       group = "talexander";
+    #       mode = "0740";
+    #     }
+    #   ];
+    # };
+  };
+
+  # Needed for non-rootless docker
+  users.users.talexander.extraGroups = [ "docker" ];
+}

nix/configuration/roles/emacs/default.nix

@@ -0,0 +1,81 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  plainmacs = pkgs.writeShellScriptBin "plainmacs" ''
+    INIT_SCRIPT=$(cat <<EOF
+    (progn
+      (setq make-backup-files nil auto-save-default nil create-lockfiles nil)
+      (load-theme 'tango-dark t)
+      (set-face-attribute 'default nil :background "black")
+      ;; Bright yellow highlighting for selected region
+      (set-face-attribute 'region nil :background "#ffff50" :foreground "black")
+      ;; Bright green cursor to distinguish from yellow region
+      (set-cursor-color "#ccff66")
+      ;; Hightlight the current line
+      (set-face-attribute 'line-number-current-line nil :foreground "white")
+      ;; Set default font
+      (set-face-attribute 'default nil :height 100 :width 'regular :weight 'regular :family "Cascadia Mono")
+      ;; Set fallback font for unicode glyphs
+      (when (display-graphic-p)
+        (set-fontset-font "fontset-default" nil (font-spec :name "Noto Color Emoji")))
+      (menu-bar-mode -1)
+      (when (fboundp 'tool-bar-mode)
+        (tool-bar-mode -1))
+      (when (  fboundp 'scroll-bar-mode)
+        (scroll-bar-mode -1))
+      (pixel-scroll-precision-mode)
+      (setq frame-resize-pixelwise t)
+      )
+    EOF
+    )
+
+    exec ${pkgs.emacs29-pgtk}/bin/emacs -q --eval "$INIT_SCRIPT" "''${@}"
+  '';
+  e_shorthand = pkgs.writeShellScriptBin "e" ''
+    exec ${pkgs.emacs29-pgtk}/bin/emacs "''${@}"
+  '';
+in
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    plainmacs
+    e_shorthand
+    emacs29-pgtk
+    clang # To compile tree-sitter grammars
+    nixd # nix language server
+    nixfmt-rfc-style # auto-formatting nix files through nixd
+  ];
+
+  home-manager.users.talexander =
+    { pkgs, ... }:
+    {
+      home.file.".config/emacs" = {
+        source = ./files/emacs;
+        recursive = true;
+      };
+    };
+
+  environment.persistence."/state" = lib.mkIf (!config.me.buildingIso) {
+    hideMounts = true;
+    users.talexander = {
+      directories = [
+        ".config/emacs/eln-cache" # Installed packages
+        ".config/emacs/elpa" # Installed packages
+        ".config/emacs/private" # For recentf
+        ".config/emacs/tree-sitter" # Compiled tree-sitter grammars
+      ];
+      files = [
+        ".config/emacs/history" # For savehist
+        ".config/emacs/.last-package-update-day" # For use-package
+      ];
+    };
+  };
+
+  environment.variables.EDITOR = "${plainmacs}/bin/plainmacs";
+}

nix/configuration/roles/emacs/files/emacs/early-init.el

@@ -0,0 +1,25 @@
+(setq gc-cons-threshold (* 128 1024 1024)) ;; 128MiB Increase garbage collection threshold for performance (default 800000)
+;; Increase amount of data read from processes, default 4k
+(when (version<= "27.0" emacs-version)
+  (setq read-process-output-max (* 10 1024 1024)) ;; 10MiB
+  )
+
+;; Suppress warnings
+(setq byte-compile-warnings '(not obsolete))
+(setq warning-suppress-log-types '((comp) (bytecomp)))
+(setq native-comp-async-report-warnings-errors 'silent)
+
+;; Set up default visual settings
+(setq frame-resize-pixelwise t)
+;; Disable toolbar & menubar
+(menu-bar-mode -1)
+(when (fboundp 'tool-bar-mode)
+  (tool-bar-mode -1))
+(when (display-graphic-p)
+  (context-menu-mode +1))
+
+(setq default-frame-alist '((fullscreen . maximized)
+                            (vertical-scroll-bars . nil)
+                            (horizontal-scroll-bars . nil)
+                            ;; Set dark colors in early-init to prevent flashes of white.
+                            (background-color . "#000000")))

nix/configuration/roles/emacs/files/emacs/elisp/base-extensions.el

@@ -0,0 +1,86 @@
+(use-package diminish)
+
+;; Eglot recommends pulling the latest of the standard libraries it
+;; uses from ELPA if you're not tracking the current.config/emacsevelopment
+;; branch.
+(use-package xref
+  :pin gnu
+  )
+
+(use-package eldoc
+  :pin gnu
+  :diminish
+  )
+
+;; Other packages
+
+(use-package emacs
+  :config
+  (setq enable-recursive-minibuffers t)
+
+  ;; Filter the M-x list base on the current mode
+  (setq read-extended-command-predicate #'command-completion-default-include-p)
+
+  ;; Enable triggering completion with the tab key.
+  (setq tab-always-indent 'complete)
+  )
+
+(use-package dashboard
+  :config
+  (dashboard-setup-startup-hook))
+
+(when (version<= "26.0.50" emacs-version )
+  (add-hook 'prog-mode-hook 'display-line-numbers-mode)
+  (add-hook 'prog-mode-hook 'column-number-mode)
+  )
+
+;; Display a horizontal line instead of ^L for page break characters
+(use-package page-break-lines
+  :diminish
+  :config
+  (global-page-break-lines-mode +1)
+  )
+
+(use-package recentf
+  ;; This is an emacs built-in but we're pulling the latest version
+  :config
+  (setq recentf-max-saved-items 100)
+  (setq recentf-save-file (recentf-expand-file-name "~/.config/emacs/private/cache/recentf"))
+  (recentf-mode 1))
+
+;; Persist history over Emacs restarts. Vertico sorts by history position.
+(use-package savehist
+  ;; This is an emacs built-in but we're pulling the latest version
+  :config
+  (savehist-mode))
+
+(use-package which-key
+  :diminish
+  :config
+  (which-key-mode))
+
+(use-package windmove
+  :config
+  (windmove-default-keybindings))
+
+(setq tramp-default-method "ssh")
+
+(use-package nginx-mode
+  :mode (
+         ("headers\\.include\\'" . nginx-mode)
+         )
+  :config
+  (setq nginx-indent-level 4))
+
+(use-package systemd
+  :mode
+  (("\\.service\\'" . systemd-mode)
+   ("\\.timer\\'" . systemd-mode))
+  )
+
+(use-package pkgbuild-mode
+  :mode
+  (("PKGBUILD\\'" . pkgbuild-mode))
+  )
+
+(provide 'base-extensions)

nix/configuration/roles/emacs/files/emacs/elisp/base-functions.el

@@ -0,0 +1,127 @@
+;; ========== Function to reload current file =================
+
+(defun reload-file ()
+    "Revert buffer without confirmation."
+    (interactive)
+    (revert-buffer :ignore-auto :noconfirm))
+
+;; ===========================================================
+;; ============= Run commands ================================
+(defun run-command-on-buffer (cmd &rest args)
+  "Run a command using the current buffer as stdin and replacing its contents if the command succeeds with the stdout from the command. This is useful for code formatters."
+  (let (
+        (stdout-buffer (generate-new-buffer "tmp-stdout" t))
+        (full-cmd (append '(call-process-region nil nil cmd nil stdout-buffer nil) args))
+        )
+    (unwind-protect
+        (let ((exit-status (eval full-cmd)))
+          (if (eq exit-status 0)
+              (save-excursion
+                (replace-buffer-contents stdout-buffer)
+                )
+            (message "FAILED running command on buffer %s" (append (list cmd) args))
+            )
+          )
+      (kill-buffer stdout-buffer)
+      )
+    )
+  )
+
+(defun run-command-in-directory (dir cmd &rest args)
+  "Run a command in the specified directory. If the directory is nil, the directory of the file is used. The stdout result is trimmed of whitespace and returned."
+  (let (
+        (default-directory (or dir default-directory))
+        (stdout-buffer (generate-new-buffer "tmp-stdout" t))
+        (full-cmd (append '(call-process cmd nil (list stdout-buffer nil) nil) args))
+        )
+    (unwind-protect
+        (let ((exit-status (condition-case nil (eval full-cmd) (file-missing nil))))
+          (if (eq exit-status 0)
+              (progn
+                (with-current-buffer stdout-buffer
+                  (string-trim (buffer-string))
+                  )
+                )
+            )
+          )
+      (kill-buffer stdout-buffer)
+      )
+    )
+  )
+
+(defun load-directory (dir)
+  (let ((load-it (lambda (f)
+                   (load-file (concat (file-name-as-directory dir) f)))
+                 ))
+    (mapc load-it (directory-files dir nil "\\.el$"))))
+
+(defun generate-vc-link ()
+  (interactive)
+  (or
+   (generate-github-link)
+   (generate-source-hut-link)
+   )
+  )
+
+(defun generate-github-link ()
+  "Generate a permalink to the current line."
+  (interactive)
+  (let (
+        (current-rev (vc-working-revision buffer-file-name))
+        (line-number (line-number-at-pos))
+        (repository-url (vc-git-repository-url buffer-file-name))
+        (relative-path (file-relative-name buffer-file-name (vc-root-dir)))
+        )
+    (save-match-data
+      (and (string-match "\\(git@github\.com:\\|https://github\.com/\\)\\([^/]+\\)/\\([^.]+\\).git" repository-url)
+           (let* (
+                 (gh-org (match-string 2 repository-url))
+                 (gh-repo (match-string 3 repository-url))
+                 (full-url (format "https://github.com/%s/%s/blob/%s/%s?plain=1#L%s" gh-org gh-repo current-rev relative-path line-number))
+                 )
+             (message "%s" full-url)
+             (kill-new full-url)
+             t
+             )
+           )
+      )
+    )
+  )
+
+(defun generate-source-hut-link ()
+  "Generate a permalink to the current line."
+  (interactive)
+  (let (
+        (current-rev (vc-working-revision buffer-file-name))
+        (line-number (line-number-at-pos))
+        (repository-url (vc-git-repository-url buffer-file-name))
+        (relative-path (file-relative-name buffer-file-name (vc-root-dir)))
+        )
+    (message "Using repo url %s" repository-url)
+    (save-match-data
+      (and (string-match "https://git.sr.ht/\\([^/]+\\)/\\([^/]+\\)" repository-url)
+           (let* (
+                 (sh-org (match-string 1 repository-url))
+                 (sh-repo (match-string 2 repository-url))
+                 (full-url (format "https://git.sr.ht/%s/%s/tree/%s/%s#L%s" sh-org sh-repo current-rev relative-path line-number))
+                 )
+             (message "%s" full-url)
+             (kill-new full-url)
+             t
+             )
+           )
+      )
+    )
+  )
+
+(defmacro when-linux (&rest body)
+  "Execute only when on Linux."
+  (declare (indent defun))
+  `(when (eq system-type 'gnu/linux) ,@body))
+
+(defmacro when-freebsd (&rest body)
+  "Execute only when on FreeBSD."
+  (declare (indent defun))
+  `(when (eq system-type 'berkeley-unix) ,@body))
+
+(provide 'base-functions)

nix/configuration/roles/emacs/files/emacs/elisp/base-global-keys.el

@@ -0,0 +1,12 @@
+;; Add your keys here, as such
+
+;; Disable the suspend frame hotkeys
+(global-unset-key (kbd "C-z"))
+(global-unset-key (kbd "C-x C-z"))
+
+;; dabbrev-expand. Seems to be some sort of dumb-expand. Accidentally hitting it when trying to use M-?
+(global-unset-key (kbd "M-/"))
+
+(global-set-key (kbd "C-x g l") 'generate-vc-link)
+
+(provide 'base-global-keys)

nix/configuration/roles/emacs/files/emacs/elisp/base-theme.el

@@ -0,0 +1,15 @@
+;; Set theme
+(load-theme 'tango-dark t)
+(set-face-attribute 'default nil :background "black")
+;; Bright yellow highlighting for selected region
+(set-face-attribute 'region nil :background "#ffff50" :foreground "black")
+;; Bright green cursor to distinguish from yellow region
+(set-face-attribute 'cursor nil :background "#ccff66")
+;; Hightlight the current line
+(set-face-attribute 'line-number-current-line nil :foreground "white")
+;; Set default font
+(set-face-attribute 'default nil :height 100 :width 'regular :weight 'regular :family "Cascadia Mono")
+;; Set fallback font for unicode glyphs
+(set-fontset-font t 'emoji (font-spec :name "Noto Color Emoji") nil 'prepend)
+
+(provide 'base-theme)

nix/configuration/roles/emacs/files/emacs/elisp/base.el

@@ -0,0 +1,94 @@
+(package-initialize)
+(use-package use-package)
+
+(add-to-list 'package-archives
+             '("melpa" . "https://melpa.org/packages/")
+             )
+
+(use-package auto-package-update
+   :ensure t
+   :config
+   (setq auto-package-update-delete-old-versions t
+         auto-package-update-interval 14)
+   (auto-package-update-maybe))
+
+(defun assert-directory (p)
+  (unless (file-exists-p p) (make-directory p t))
+  p
+  )
+
+(defconst private-dir  (expand-file-name "private" user-emacs-directory))
+(defconst temp-dir (format "%s/cache" private-dir)
+  "Hostname-based elisp temp directories")
+(assert-directory (concat temp-dir "/auto-save-list/"))
+(setq autoload-directory (concat user-emacs-directory (file-name-as-directory "elisp") (file-name-as-directory "autoload")))
+(add-to-list 'load-path (assert-directory autoload-directory))
+
+(setq-default
+ ;; Disable backup files and lockfiles
+ make-backup-files nil
+ auto-save-default nil
+ create-lockfiles nil
+ ;; Unless otherwise specified, always install packages if they are absent.
+ use-package-always-ensure t
+ ;; Point custom-file at /dev/null so emacs does not write any settings to my dotfiles.
+ custom-file "/dev/null"
+ ;; Don't pop up a small window at the bottom of emacs at launch.
+ inhibit-startup-screen t
+ inhibit-startup-message t
+ ;; Don't show the list of buffers when opening many files.
+ inhibit-startup-buffer-menu t
+ ;; Give the scratch buffer a clean slate.
+ initial-major-mode 'fundamental-mode
+ initial-scratch-message nil
+ ;; Send prompts to mini-buffer not the GUI
+ use-dialog-box nil
+ ;; End files with line break
+ require-final-newline t
+ ;; Use spaces, not tabs
+ indent-tabs-mode nil
+ ;; Use a better frame title
+ frame-title-format '("" invocation-name ": "(:eval (if (buffer-file-name)
+                                                        (abbreviate-file-name (buffer-file-name))
+                                                      "%b")))
+ ;; Use 'y' or 'n' instead of 'yes' or 'no'
+ use-short-answers t
+ ;; Natively compile packages
+ package-native-compile t
+ ;; Confirm when opening a file that does not exist
+ confirm-nonexistent-file-or-buffer t
+ ;; Do not require double space to end a sentence.
+ sentence-end-double-space nil
+ ;; Show trailing whitespace
+ show-trailing-whitespace t
+ ;; Remove the line when killing it with ctrl-k
+ kill-whole-line t
+ )
+
+;; (setq-default fringes-outside-margins t)
+
+;; Per-pixel scrolling instead of per-line
+(pixel-scroll-precision-mode)
+
+;; Typed text replaces selection
+(delete-selection-mode)
+
+
+;; Delete trailing whitespace before save
+(add-hook 'before-save-hook 'delete-trailing-whitespace)
+
+;; If the underlying file changes, reload it automatically. This is useful for moving around in git without confusing language servers.
+(setopt auto-revert-avoid-polling t)
+(setopt auto-revert-interval 5)
+(setopt auto-revert-check-vc-info t)
+(global-auto-revert-mode)
+
+;;;;; Performance
+;; Run garbage collect when emacs is idle
+(run-with-idle-timer 5 t (lambda () (garbage-collect)))
+(add-function :after after-focus-change-function
+              (lambda ()
+                (unless (frame-focus-state)
+                  (garbage-collect))))
+
+(provide 'base)

nix/configuration/roles/emacs/files/emacs/elisp/common-lsp.el

@@ -0,0 +1,47 @@
+(use-package eglot
+  :pin gnu
+  :commands (eglot eglot-ensure)
+  :bind (:map eglot-mode-map
+              ;; M-.
+              ;; ([remap xref-find-definitions] . lsp-ui-peek-find-definitions)
+              ;; M-?
+              ;; ([remap xref-find-references] . lsp-ui-peek-find-references)
+              ("C-c C-a" . eglot-code-actions)
+              ;; C-M-.
+              ([remap xref-find-apropos] . #'consult-eglot-symbols)
+              )
+  ;; :hook (
+  ;;        (eglot-managed-mode . (lambda ()
+  ;;                                (when (eglot-managed-p)
+  ;;                                  (corfu-mode +1)
+  ;;                                  )
+  ;;                                ))
+  ;;        )
+  :config
+  (fset #'jsonrpc--log-event #'ignore) ;; Disable logging LSP traffic for performance boost
+  (set-face-attribute 'eglot-highlight-symbol-face nil :background "#0291a1" :foreground "black")
+  (set-face-attribute 'eglot-mode-line nil :inherit 'mode-line :bold nil)
+
+
+  :custom
+  (eglot-autoshutdown t "Shut down server when last buffer is killed.")
+  (eglot-sync-connect 0 "Don't block on language server starting.")
+  (eglot-send-changes-idle-time 0.1)
+  )
+
+(use-package consult-eglot
+  :commands (consult-eglot-symbols)
+  )
+
+(use-package company
+  :after eglot
+  :hook (eglot-managed-mode . company-mode)
+  :config
+  (setq company-backends '((company-capf)))
+  (setq company-idle-delay 0) ;; Default 0.2
+  )
+
+;; (use-package company-box
+;;   :hook (company-mode . company-box-mode))
+
+(provide 'common-lsp)

nix/configuration/roles/emacs/files/emacs/elisp/lang-bash.el

@@ -0,0 +1,16 @@
+(require 'util-tree-sitter)
+
+(use-package bash-ts-mode
+  :ensure nil
+  :commands (bash-ts-mode)
+  :hook (
+         (bash-ts-mode . (lambda ()
+                           (flymake-mode +1)
+                           )))
+  :init
+  (add-to-list 'major-mode-remap-alist '(sh-mode . bash-ts-mode))
+  (add-to-list 'treesit-language-source-alist '(bash "https://github.com/tree-sitter/tree-sitter-bash"))
+  (unless (treesit-ready-p 'bash) (treesit-install-language-grammar 'bash))
+  )
+
+(provide 'lang-bash)

nix/configuration/roles/emacs/files/emacs/elisp/lang-c.el

@@ -0,0 +1,49 @@
+(require 'common-lsp)
+(require 'util-tree-sitter)
+
+(defun locate-compile-commands-file ()
+  "See if compile_commands.json exists."
+  ;; This can be generated by prefixing the make command with `intercept-build15 --append`
+  (let ((compile-commands-file (locate-dominating-file (buffer-file-name) "compile_commands.json")))
+    compile-commands-file
+    )
+  )
+
+(defun activate-c-eglot ()
+  "Activate eglot for the c family of languages."
+  (when (locate-compile-commands-file)
+    (eglot-ensure)
+    (defclass my/eglot-c (eglot-lsp-server) ()
+      :documentation
+      "Own eglot server class.")
+
+    (add-to-list 'eglot-server-programs
+                 '(c-ts-mode . (my/eglot-c "/usr/local/bin/clangd15")))
+    (add-hook 'before-save-hook 'eglot-format-buffer nil 'local)
+    )
+  )
+
+(use-package c-mode
+  :mode (
+         ("\\.c\\'" . c-ts-mode)
+         ("\\.h\\'" . c-or-c++-ts-mode)
+         )
+  :commands (c-mode c-ts-mode)
+  :pin manual
+  :ensure nil
+  :hook (
+         (c-ts-mode . (lambda ()
+                        (activate-c-eglot)
+                        ))
+         )
+  :init
+  (add-to-list 'major-mode-remap-alist '(c-mode . c-ts-mode))
+  (add-to-list 'major-mode-remap-alist '(c++-mode . c++-ts-mode))
+  (add-to-list 'major-mode-remap-alist '(c-or-c++-mode . c-or-c++-ts-mode))
+  (add-to-list 'treesit-language-source-alist '(c "https://github.com/tree-sitter/tree-sitter-c"))
+  (add-to-list 'treesit-language-source-alist '(cpp "https://github.com/tree-sitter/tree-sitter-cpp"))
+  (unless (treesit-ready-p 'c) (treesit-install-language-grammar 'c))
+  (unless (treesit-ready-p 'cpp) (treesit-install-language-grammar 'cpp))
+  )
+
+(provide 'lang-c)

nix/configuration/roles/emacs/files/emacs/elisp/lang-dockerfile.el

@@ -0,0 +1,13 @@
+(use-package dockerfile-ts-mode
+  :pin manual
+  :mode (
+         ("Dockerfile\\'" . dockerfile-ts-mode)
+         )
+  :commands (dockerfile-mode dockerfile-ts-mode)
+  :init
+  (add-to-list 'major-mode-remap-alist '(dockerfile-mode . dockerfile-ts-mode))
+  (add-to-list 'treesit-language-source-alist '(dockerfile "https://github.com/camdencheek/tree-sitter-dockerfile"))
+  (unless (treesit-ready-p 'dockerfile) (treesit-install-language-grammar 'dockerfile))
+  )
+
+(provide 'lang-dockerfile)

nix/configuration/roles/emacs/files/emacs/elisp/lang-go.el

@@ -0,0 +1,33 @@
+(require 'common-lsp)
+(require 'util-tree-sitter)
+
+(use-package go-ts-mode
+  :pin manual
+  :mode (
+         ("\\.go\\'" . go-ts-mode)
+         ("/go\\.mod\\'" . go-mod-ts-mode)
+         )
+  :commands (go-ts-mode go-mod-ts-mode)
+  :hook (
+         (go-ts-mode . (lambda ()
+                         (when-linux
+                           (eglot-ensure)
+                           )
+                         ))
+
+         (go-mod-ts-mode . (lambda ()
+                         (when-linux
+                           (eglot-ensure)
+                           )
+                         ))
+
+         ;; (before-save . lsp-format-buffer)
+         )
+  :init
+  (add-to-list 'treesit-language-source-alist '(go "https://github.com/tree-sitter/tree-sitter-go"))
+  (add-to-list 'treesit-language-source-alist '(gomod "https://github.com/camdencheek/tree-sitter-go-mod"))
+  (unless (treesit-ready-p 'go) (treesit-install-language-grammar 'go))
+  (unless (treesit-ready-p 'gomod) (treesit-install-language-grammar 'gomod))
+  )
+
+(provide 'lang-go)

nix/configuration/roles/emacs/files/emacs/elisp/lang-javascript.el

@@ -0,0 +1,177 @@
+(require 'common-lsp)
+(require 'util-tree-sitter)
+
+(use-package json-ts-mode
+  :ensure nil
+  :pin manual
+  :mode (
+         ("\\.json\\'" . json-ts-mode)
+         )
+  :commands (json-ts-mode)
+  :hook (
+         (json-ts-mode . (lambda ()
+                           (add-hook 'before-save-hook 'json-fmt-jq nil 'local)
+                           ))
+         )
+  :init
+  (add-to-list 'treesit-language-source-alist '(json "https://github.com/tree-sitter/tree-sitter-json"))
+  (unless (treesit-ready-p 'json) (treesit-install-language-grammar 'json))
+  )
+
+(defun json-fmt-jq ()
+  "Run jq."
+  (run-command-on-buffer "jq" "--monochrome-output" ".")
+  )
+
+(defun configure-typescript-language-server ()
+  "Configures the typescript language server."
+  (when-linux
+    ;; Either initializationOptions or workspace/didChangeConfiguration works.
+    (setq eglot-workspace-configuration
+          (list (cons ':typescript '(:inlayHints (:includeInlayParameterNameHints
+                                                  "all"
+                                                  :includeInlayParameterNameHintsWhenArgumentMatchesName
+                                                  t
+                                                  :includeInlayFunctionParameterTypeHints
+                                                  t
+                                                  :includeInlayVariableTypeHints
+                                                  t
+                                                  :includeInlayVariableTypeHintsWhenTypeMatchesName
+                                                  t
+                                                  :includeInlayPRopertyDeclarationTypeHints
+                                                  t
+                                                  :includeInlayFunctionLikeReturnTypeHints
+                                                  t
+                                                  :includeInlayEnumMemberValueHints
+                                                  t)))))
+    (eglot-ensure)
+    ;; (defclass my/eglot-typescript (eglot-lsp-server) ()
+    ;;   :documentation
+    ;;   "Own eglot server class.")
+
+    ;; (add-to-list 'eglot-server-programs
+    ;;              '((js-mode js-ts-mode tsx-ts-mode typescript-ts-mode typescript-mode) . (my/eglot-typescript "typescript-language-server" "--stdio" :initializationOptions (:preferences (:includeInlayParameterNameHints
+    ;;                                                                                                                                                                                        "all"
+    ;;                                                                                                                                                                                        :includeInlayParameterNameHintsWhenArgumentMatchesName
+    ;;                                                                                                                                                                                        t
+    ;;                                                                                                                                                                                        :includeInlayFunctionParameterTypeHints
+    ;;                                                                                                                                                                                        t
+    ;;                                                                                                                                                                                        :includeInlayVariableTypeHints
+    ;;                                                                                                                                                                                        t
+    ;;                                                                                                                                                                                        :includeInlayVariableTypeHintsWhenTypeMatchesName
+    ;;                                                                                                                                                                                        t
+    ;;                                                                                                                                                                                        :includeInlayPRopertyDeclarationTypeHints
+    ;;                                                                                                                                                                                        t
+    ;;                                                                                                                                                                                        :includeInlayFunctionLikeReturnTypeHints
+    ;;                                                                                                                                                                                        t
+    ;;                                                                                                                                                                                        :includeInlayEnumMemberValueHints
+    ;;                                                                                                                                                                                        t)))))
+    )
+  )
+
+(use-package tsx-ts-mode
+  :ensure nil
+  :pin manual
+  :mode (
+         ("\\.tsx\\'" . tsx-ts-mode)
+         )
+  :commands (tsx-ts-mode)
+  :hook (
+         (tsx-ts-mode . (lambda ()
+                          (when-linux
+                            (configure-typescript-language-server)
+                            )
+                          ))
+         )
+  :init
+  (add-to-list 'treesit-language-source-alist '(tsx . ("https://github.com/tree-sitter/tree-sitter-typescript" "master" "tsx/src")))
+  (unless (treesit-ready-p 'tsx) (treesit-install-language-grammar 'tsx))
+  )
+
+
+(use-package typescript-ts-mode
+  :ensure nil
+  :pin manual
+  :mode (
+         ("\\.ts\\'" . typescript-ts-mode)
+         )
+  :commands (typescript-ts-mode)
+  :hook (
+         (typescript-ts-mode . (lambda ()
+                                 (configure-typescript-language-server)
+                                 ))
+         )
+  :init
+  (add-to-list 'treesit-language-source-alist '(typescript . ("https://github.com/tree-sitter/tree-sitter-typescript" "master" "typescript/src")))
+  (unless (treesit-ready-p 'typescript) (treesit-install-language-grammar 'typescript))
+  )
+
+(use-package js-ts-mode
+  :ensure nil
+  :pin manual
+  :mode (
+         ("\\.js\\'" . js-ts-mode)
+         )
+  :commands (js-ts-mode)
+  :hook (
+         (js-ts-mode . (lambda ()
+                                 (when-linux
+                                   (eglot-ensure)
+                                   )
+                                 ))
+         )
+  :init
+  (add-to-list 'treesit-language-source-alist '(javascript . ("https://github.com/tree-sitter/tree-sitter-javascript" "master" "src")))
+  (unless (treesit-ready-p 'javascript) (treesit-install-language-grammar 'javascript))
+  )
+
+(defun prettier-fmt ()
+  "Run prettier."
+  (run-command-on-buffer "prettier" "--stdin-filepath" buffer-file-name)
+  )
+
+
+(use-package css-ts-mode
+  :ensure nil
+  :pin manual
+  :mode (
+         ("\\.css\\'" . css-ts-mode)
+         )
+  :commands (css-ts-mode)
+  :custom (css-indent-offset 2)
+  :init
+  (add-to-list 'treesit-language-source-alist '(css "https://github.com/tree-sitter/tree-sitter-css"))
+  (unless (treesit-ready-p 'css) (treesit-install-language-grammar 'css))
+  :hook (
+         (css-ts-mode . (lambda ()
+                             (eglot-ensure)
+                             (defclass my/eglot-css (eglot-lsp-server) ()
+                               :documentation
+                               "Own eglot server class.")
+
+                             (add-to-list 'eglot-server-programs
+                                          '(css-ts-mode . (my/eglot-css "vscode-css-language-server" "--stdio")))
+                             ;; (add-hook 'before-save-hook 'eglot-format-buffer nil 'local)
+                             (add-hook 'before-save-hook 'prettier-fmt nil 'local)
+                             ))
+         )
+  )
+
+
+(use-package web-mode
+  :mode (("\\.dust\\'" . dust-mode)
+         )
+  :config
+  (setq web-mode-markup-indent-offset 2)
+  (setq web-mode-enable-current-element-highlight t)
+  )
+
+;; Define a custom mode for dust so that org-mode handle #+BEGIN_SRC dust blocks
+(define-derived-mode dust-mode web-mode "WebDust"
+  "Major mode for editing dust templates in web-mode."
+  (web-mode)
+  (web-mode-set-engine "dust")
+  ;; (setq web-mode-content-type "html")
+  )
+
+(provide 'lang-javascript)

nix/configuration/roles/emacs/files/emacs/elisp/lang-lua.el

@@ -0,0 +1,21 @@
+(defun lua-format-buffer ()
+  "Run stylua."
+  (interactive)
+  (run-command-on-buffer "stylua" "--search-parent-directories" "--stdin-filepath" buffer-file-name "-")
+  )
+
+(use-package lua-mode
+  :mode
+  (("\\.lua\\'" . lua-mode)
+   ("\\.rockspec\\'" . lua-mode))
+  :commands lua-mode
+  :hook (
+         (lua-mode . (lambda ()
+                        (add-hook 'before-save-hook 'lua-format-buffer nil 'local)
+                        ))
+         )
+  :custom
+  (lua-indent-level 4)
+  )
+
+(provide 'lang-lua)

nix/configuration/roles/emacs/files/emacs/elisp/lang-markdown.el

@@ -0,0 +1,14 @@
+(use-package markdown-mode
+  :ensure t
+  :commands (markdown-mode gfm-mode)
+  :mode (("README\\.md\\'" . gfm-mode)
+         ("\\.md\\'" . markdown-mode)
+         ("\\.markdown\\'" . markdown-mode))
+  :init (setq markdown-command "multimarkdown"))
+
+;; For code block editing
+(use-package edit-indirect
+  :commands (edit-indirect-region edit-indirect-save edit-indirect-abort edit-indirect-commit edit-indirect-display-active-buffer)
+  )
+
+(provide 'lang-markdown)

nix/configuration/roles/emacs/files/emacs/elisp/lang-nix.el

@@ -0,0 +1,22 @@
+(require 'common-lsp)
+(require 'util-tree-sitter)
+
+(use-package nix-mode
+  :mode (("\\.nix\\'" . nix-mode)
+         )
+  :commands nix-mode
+  :hook (
+         (nix-mode . (lambda ()
+                       (eglot-ensure)
+                       (defclass my/eglot-nix (eglot-lsp-server) ()
+                         :documentation
+                         "Own eglot server class.")
+
+                       (add-to-list 'eglot-server-programs
+                                    '(nix-mode . (my/eglot-nix "nixd")))
+                       (add-hook 'before-save-hook 'eglot-format-buffer nil 'local)
+                       ))
+         )
+  )
+
+(provide 'lang-nix)

nix/configuration/roles/emacs/files/emacs/elisp/lang-org.el

@@ -0,0 +1,83 @@
+(use-package org
+  :ensure nil
+  :commands org-mode
+  :bind (
+         ("C-c l" . org-store-link)
+         ("C-c a" . org-agenda)
+         ("C--" . org-timestamp-down)
+         ("C-=" . org-timestamp-up)
+         )
+  :hook (
+         (org-mode . (lambda ()
+                       (org-indent-mode +1)
+                        ))
+         )
+  :config
+  (require 'org-tempo)
+  (setq org-export-latex-listings t)
+  (setq org-startup-truncated nil)
+  (setq org-startup-folded nil)
+  (setq org-src-fontify-natively t
+        org-src-tab-acts-natively t
+        org-confirm-babel-evaluate nil
+        )
+
+  ;; Show the full source of org-mode links instead of condensing them. I.E. render "[[foo]]" instead of "foo"
+  (setq org-descriptive-links nil)
+
+  ;; Only interpret _ and ^ and sub and superscripts if they're of the form _{subscript} and ^{superscript}
+  (setq org-export-with-sub-superscripts '{})
+  ;; Don't include a "validate" link at the bottom of html export
+  (setq org-html-validation-link nil)
+
+
+  (setq org-latex-listings 'minted)
+  (setq org-latex-minted-options '(("breaklines" "true")
+                                   ("breakanywhere" "true")
+                                   ("bgcolor" "mintedbg") ("frame" "single") ("framesep" "6pt") ("fontsize" "\\footnotesize")))
+
+  ;; TODO: There is an option to set the compiler, could be better than manually doing this here https://orgmode.org/manual/LaTeX_002fPDF-export-commands.html
+  ;; (setq org-latex-compiler "lualatex")
+  ;; TODO: nixos latex page recommends this line, figure out what it does / why its needed:
+  ;; (setq org-preview-latex-default-process 'dvisvgm)
+  (setq org-latex-pdf-process
+        '("lualatex -shell-escape -interaction nonstopmode -output-directory %o %f"
+          "lualatex -shell-escape -interaction nonstopmode -output-directory %o %f"
+          "lualatex -shell-escape -interaction nonstopmode -output-directory %o %f"))
+  (add-to-list 'org-latex-packages-alist '("cache=false" "minted"))
+  (add-to-list 'org-latex-packages-alist '("" "svg"))
+  (add-to-list 'org-latex-packages-alist '("margin=2cm" "geometry" nil))
+
+  (add-to-list 'org-src-lang-modes '("dot" . "graphviz-dot"))
+
+  (org-babel-do-load-languages 'org-babel-load-languages
+                               '((shell      . t)
+                                 (js         . t)
+                                 (emacs-lisp . t)
+                                 (python     . t)
+                                 (dot        . t)
+                                 (css        . t)
+                                 (gnuplot    . t)
+                                 (sqlite     . t)
+                                 ))
+
+  (require 'color)
+
+  (let ((bg (face-attribute 'default :background)))
+    (custom-set-faces
+     `(org-block ((t (:inherit default :background ,(color-lighten-name bg 15) :extend ,t))))
+     `(org-block-begin-line ((t (:inherit default :background ,"#472300" :extend ,t))))
+     `(org-block-end-line ((t (:inherit default :background ,"#472300" :extend ,t))))
+     ))
+  )
+
+(use-package org-bullets
+  :commands org-bullets-mode
+  :hook (org-mode . org-bullets-mode)
+  )
+
+(use-package gnuplot-mode)
+(use-package gnuplot)
+(use-package graphviz-dot-mode)
+
+(provide 'lang-org)

nix/configuration/roles/emacs/files/emacs/elisp/lang-python.el

@@ -0,0 +1,92 @@
+(require 'common-lsp)
+(require 'util-tree-sitter)
+
+(defun python-backspace (arg)
+  "Special handling of python backspace."
+  (interactive "*p")
+  (if mark-active
+      (backward-delete-char-untabify arg)
+    (python-indent-dedent-line-backspace arg)
+    )
+  )
+
+(defun locate-venv-poetry ()
+  "Find a poetry venv."
+  (run-command-in-directory nil "poetry" "env" "info" "-p")
+  )
+
+(defun locate-pyproject-directory ()
+  "Adapt lsp-python-ms for poetry."
+  (let ((pypoetry-file (locate-dominating-file (buffer-file-name) "pyproject.toml")))
+    pypoetry-file
+    )
+  )
+
+
+(defun python-fmt ()
+  "format python."
+  (python-fmt-black)
+  (python-fmt-isort)
+  )
+
+(defun python-fmt-black ()
+  "Run black."
+  (run-command-on-buffer "black" "--quiet" "--fast" "-")
+  )
+
+(defun python-fmt-isort ()
+  "Run isort."
+  (run-command-on-buffer "isort" "-")
+  )
+
+(defun add-poetry-venv-to-path ()
+  "Add the bin folder in the poetry venv to exec-path."
+  (let (
+        (venv-path (locate-venv-poetry))
+        )
+    (when venv-path
+      (make-local-variable 'exec-path)
+      (add-to-list 'exec-path (concat venv-path "/bin"))
+      )
+    )
+  )
+
+(use-package python
+  :mode ("\\.py\\'" . python-ts-mode)
+  :commands (python-mode python-ts-mode)
+  :pin manual
+  :hook (
+         (python-ts-mode . (lambda ()
+                             (when-linux
+                               (when (executable-find "poetry")
+                                 (add-poetry-venv-to-path)
+                                 (let ((venv (locate-venv-poetry))) (when venv
+                                                                      (setq eglot-workspace-configuration
+                                                                            (list (cons ':python (list ':venvPath venv ':pythonPath (concat venv "/bin/python")))))
+                                                                      ))
+                                 )
+                               (eglot-ensure)
+                               )
+
+                             ;; (when-freebsd
+                             ;;   (eglot-ensure)
+                             ;;   (defclass my/eglot-pylyzer (eglot-lsp-server) ()
+                             ;;     :documentation
+                             ;;     "Own eglot server class.")
+
+                             ;;   (add-to-list 'eglot-server-programs
+                             ;;                '(python-ts-mode . (my/eglot-pylyzer "pylyzer" "--server")))
+                             ;;   )
+
+                             (add-hook 'before-save-hook 'python-fmt nil 'local)
+                             ))
+         )
+  :bind ((:map python-ts-mode-map ([backspace] . python-backspace))
+         )
+  :init
+  (add-to-list 'major-mode-remap-alist '(python-mode . python-ts-mode))
+  (add-to-list 'treesit-language-source-alist '(python "https://github.com/tree-sitter/tree-sitter-python"))
+  (unless (treesit-ready-p 'python) (treesit-install-language-grammar 'python))
+  )
+
+(provide 'lang-python)

nix/configuration/roles/emacs/files/emacs/elisp/lang-rust.el

@@ -0,0 +1,92 @@
+(require 'common-lsp)
+(require 'util-tree-sitter)
+
+(defun locate-rust-analyzer ()
+  "Find rust-analyzer."
+  (let ((rust-analyzer-paths (list (locate-rust-analyzer-rustup) (locate-rust-analyzer-ansible-built) (locate-rust-analyzer-in-path))))
+    (let ((first-non-nil-path (seq-find (lambda (elt) elt) rust-analyzer-paths)))
+      first-non-nil-path
+      )
+    )
+  )
+
+(defun locate-rust-analyzer-rustup ()
+  "Find rust-analyzer through rustup."
+  (run-command-in-directory nil "rustup" "which" "rust-analyzer")
+  )
+
+(defun locate-rust-analyzer-ansible-built ()
+  "Find rust-analyzer where the ansible playbook built it."
+  (let ((rust-analyzer-path "/opt/rust-analyzer/target/release/rust-analyzer"))
+    (when (file-exists-p rust-analyzer-path)
+      rust-analyzer-path
+      )
+    )
+  )
+
+(defun locate-rust-analyzer-in-path ()
+  "Find rust-analyzer in $PATH."
+  (executable-find "rust-analyzer")
+  )
+
+(use-package rust-ts-mode
+  :pin manual
+  :mode (
+         ("\\.rs\\'" . rust-ts-mode)
+         )
+  :commands (rust-ts-mode)
+  :hook (
+         (rust-ts-mode . (lambda ()
+                           (eglot-ensure)
+                           ;; Disable on-type formatting which was incorrectly injecting parenthesis into my code.
+                           (make-local-variable 'eglot-ignored-server-capabilities)
+                           (add-to-list 'eglot-ignored-server-capabilities :documentOnTypeFormattingProvider)
+                           ;; Configure initialization options
+                           (let ((rust-analyzer-command (locate-rust-analyzer)))
+                             (when rust-analyzer-command
+                               ;; (add-to-list 'eglot-server-programs `(rust-ts-mode . (,rust-analyzer-command)))
+                               (add-to-list 'eglot-server-programs `(rust-ts-mode . (,rust-analyzer-command :initializationOptions (:imports (:granularity (:enforce t :group "item")
+                                                                                                                                                           :merge (:glob nil)
+                                                                                                                                                           :prefix "self")
+                                                                                                                                             ))))
+                               )
+                             )
+                           (add-hook 'before-save-hook 'eglot-format-buffer nil 'local)
+                           ))
+         )
+  :init
+  (add-to-list 'major-mode-remap-alist '(rust-mode . rust-ts-mode))
+  (add-to-list 'treesit-language-source-alist '(rust "https://github.com/tree-sitter/tree-sitter-rust"))
+  (unless (treesit-ready-p 'rust) (treesit-install-language-grammar 'rust))
+  :config
+  ;; Add keybindings for interacting with Cargo
+  (use-package cargo
+    :hook (rust-ts-mode . cargo-minor-mode))
+  )
+
+(use-package toml-ts-mode
+  :ensure nil
+  :pin manual
+  :mode (
+         ("\\.toml\\'" . toml-ts-mode)
+         )
+  :commands (toml-ts-mode)
+  :init
+  (add-to-list 'treesit-language-source-alist '(toml "https://github.com/tree-sitter/tree-sitter-toml"))
+  (unless (treesit-ready-p 'toml) (treesit-install-language-grammar 'toml))
+  )
+
+;; Set additional rust-analyzer settings:
+;;
+;; (add-to-list 'eglot-server-programs `(rust-ts-mode . (,rust-analyzer-command :initializationOptions (:cargo (:features "all")))))
+;;
+;; In addition to the above, directory-specific settings can be written to a .dir-locals.el with the contents:
+;;
+;; (
+;;  (rust-ts-mode . ((eglot-workspace-configuration
+;;                    . (:rust-analyzer (:cargo (:noDefaultFeatures t :features ["compare" "tracing"]))))
+;;                   ))
+;;  )
+
+
+(provide 'lang-rust)

nix/configuration/roles/emacs/files/emacs/elisp/lang-terraform.el

@@ -0,0 +1,38 @@
+(require 'common-lsp)
+(require 'util-tree-sitter)
+
+(defun terraform-fmt ()
+  "Run terraform fmt."
+  (run-command-on-buffer "terraform" "fmt" "-")
+  )
+
+
+(use-package hcl-mode
+  :mode (("\\.hcl\\'" . hcl-mode))
+  :commands hcl-mode
+  :custom (hcl-indent-level 2)
+  :hook (
+         (hcl-mode . (lambda () (unless (derived-mode-p 'terraform-mode) (add-hook 'before-save-hook 'terraform-fmt nil 'local))))
+         )
+  )
+
+(use-package terraform-mode
+  :mode (("\\.tf\\'" . terraform-mode)
+         ("\\.tfvars\\'" . terraform-mode))
+  :commands terraform-mode
+  :custom (terraform-indent-level 2)
+  :hook (
+         (terraform-mode . (lambda ()
+                             (eglot-ensure)
+                             (defclass my/eglot-terraform (eglot-lsp-server) ()
+                               :documentation
+                               "Own eglot server class.")
+
+                             (add-to-list 'eglot-server-programs
+                                          '(terraform-mode . (my/eglot-terraform "terraform-ls" "serve")))
+                             (add-hook 'before-save-hook 'eglot-format-buffer nil 'local)
+                             ))
+         )
+  )
+
+(provide 'lang-terraform)

nix/configuration/roles/emacs/files/emacs/elisp/lang-xml.el

@@ -0,0 +1,17 @@
+(defun xml-fmt ()
+  "Run xmllint --format."
+  (run-command-on-buffer "xmllint" "--format" "-")
+  )
+
+(use-package nxml-mode
+  :commands (nxml-mode)
+  :pin manual
+  :ensure nil
+  :hook (
+         (nxml-mode . (lambda ()
+                        (add-hook 'before-save-hook 'xml-fmt nil 'local)
+                        ))
+         )
+  )
+
+(provide 'lang-xml)

nix/configuration/roles/emacs/files/emacs/elisp/lang-yaml.el

@@ -0,0 +1,27 @@
+(defun yaml-format-buffer ()
+  "Run prettier."
+  (interactive)
+  (run-command-on-buffer "prettier" "--stdin-filepath" buffer-file-name)
+  )
+
+(use-package yaml-ts-mode
+  :mode
+  (
+   ("\\.y[a]?ml\\'" . yaml-ts-mode)
+   ("playbook\\.tmp\\'" . yaml-ts-mode)
+   ("environments/[^/]*/group_vars/[^/]*\\'" . yaml-ts-mode)
+   ("environments/[^/]*/host_vars/[^/]*\\'" . yaml-ts-mode)
+   )
+  :commands (yaml-ts-mode)
+  :hook (
+         (yaml-ts-mode . (lambda ()
+                        (add-hook 'before-save-hook 'yaml-format-buffer nil 'local)
+                        ))
+         )
+  :init
+  (add-to-list 'major-mode-remap-alist '(yaml-mode . yaml-ts-mode))
+  (add-to-list 'treesit-language-source-alist '(yaml "https://github.com/ikatyang/tree-sitter-yaml"))
+  (unless (treesit-ready-p 'yaml) (treesit-install-language-grammar 'yaml))
+  )
+
+(provide 'lang-yaml)

nix/configuration/roles/emacs/files/emacs/elisp/util-flymake.el

@@ -0,0 +1,10 @@
+(use-package flymake
+  :pin manual
+  :ensure nil
+  :commands (flymake-mode)
+  :config
+  ;; Set the text before the brackets for flymake's modeline output to an empty string to make it less verbose.
+  (setq flymake-mode-line-lighter "")
+  )
+
+(provide 'util-flymake)

nix/configuration/roles/emacs/files/emacs/elisp/util-tree-sitter.el

@@ -0,0 +1,16 @@
+(use-package treesit
+  :pin manual
+  :ensure nil
+  :commands (treesit-install-language-grammar treesit-ready-p)
+  :init
+  (setq treesit-language-source-alist '())
+  :config
+  ;; Default to the max level of detail in treesitter highlighting. This
+  ;; can be overridden in each language's use-package call with:
+  ;;
+  ;;   :custom
+  ;;   (treesit-font-lock-level 3)
+  (setq treesit-font-lock-level 4)
+  )
+
+(provide 'util-tree-sitter)

nix/configuration/roles/emacs/files/emacs/elisp/util-vertico.el

@@ -0,0 +1,61 @@
+(defun my/minibuffer-delete (arg)
+  "When looking for files, go up an entire directory with the backspace button if theres no text after the directory."
+  (interactive "p")
+  (if minibuffer-completing-file-name
+      (if (string-match-p ".*/$" (minibuffer-contents))
+          (vertico-directory-delete-word arg)
+        (vertico-directory-delete-char arg))
+      (delete-backward-char arg)))
+
+(use-package vertico
+  :config
+  (vertico-mode)
+  (vertico-mouse-mode)
+
+  ;; Remove prefix when switching to tilde or root ("/")
+  (setq file-name-shadow-properties '(invisible t intangible t))
+  (file-name-shadow-mode +1)
+
+  (set-face-attribute 'vertico-current nil :inherit nil :background "#383b01")
+  :custom
+  (vertico-count 20)
+  )
+
+;; Create an ido/ivy-like experience when selecting files.
+(use-package vertico-directory
+  :after vertico
+  :ensure nil
+  :bind ( :map vertico-map
+          ("RET" . vertico-directory-enter)
+          :map minibuffer-local-map
+          ("DEL" . my/minibuffer-delete)
+          )
+  )
+
+(use-package consult
+  :custom
+  (completion-in-region-function #'consult-completion-in-region)
+  (xref-show-xrefs-function #'consult-xref)
+  (xref-show-definitions-function #'consult-xref)
+  (consult-project-root-function #'deadgrep--project-root)
+  :bind (
+         ("C-. s" . consult-ripgrep)
+         ("C-s" . consult-line)
+         ("M-g g" . consult-goto-line)
+         ("C-. e" . consult-flymake)
+         )
+  )
+
+;; (use-package corfu
+;;   :commands (corfu-mode global-corfu-mode)
+;;   :custom
+;;   (corfu-auto t)
+;;   )
+
+(use-package marginalia
+  :config (marginalia-mode))
+
+(use-package orderless
+  :custom (completion-styles '(orderless)))
+
+(provide 'util-vertico)

nix/configuration/roles/emacs/files/emacs/init.el

@@ -0,0 +1,41 @@
+(add-to-list 'load-path (concat user-emacs-directory "elisp"))
+
+(require 'base)
+(require 'base-theme)
+(require 'base-extensions)
+(require 'base-functions)
+(require 'base-global-keys)
+
+(require 'util-vertico)
+
+(require 'util-flymake)
+
+(require 'lang-python)
+
+(require 'lang-javascript)
+
+(require 'lang-rust)
+
+(require 'lang-yaml)
+
+(require 'lang-org)
+
+(require 'lang-bash)
+
+(require 'lang-markdown)
+
+(require 'lang-lua)
+
+(require 'lang-terraform)
+
+(require 'lang-go)
+
+(require 'lang-dockerfile)
+
+(require 'lang-c)
+
+(require 'lang-xml)
+
+(require 'lang-nix)
+
+(load-directory autoload-directory)

nix/configuration/roles/firefox/default.nix

@@ -0,0 +1,121 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  programs.firefox = {
+    enable = true;
+    package = (pkgs.wrapFirefox (pkgs.firefox-unwrapped.override { pipewireSupport = true; }) { });
+    languagePacks = [ "en-US" ];
+    preferences = {
+      # "identity.sync.tokenserver.uri": "https://ffsync.fizz.buzz/token/1.0/sync/1.5";
+      "media.hardware-video-decoding.force-enabled" = true;
+      "media.ffmpeg.vaapi.enabled" = true;
+      "doh-rollout.doorhanger-decision" = "UIDisabled";
+      "dom.security.https_only_mode" = true;
+      "dom.security.https_only_mode_ever_enabled" = true;
+      "extensions.activeThemeID" = "firefox-compact-dark@mozilla.org";
+      # Disable ads
+      "extensions.pocket.enabled" = false;
+      "browser.newtabpage.activity-stream.showSponsored" = false;
+      "browser.newtabpage.activity-stream.showSponsoredTopSites" = false;
+      "browser.newtabpage.activity-stream.feeds.section.topstories" = false;
+      "browser.newtabpage.pinned" = "[]";
+      "browser.newtabpage.activity-stream.section.highlights.includePocket" = false;
+      "browser.topsites.contile.enabled" = false;
+      # Disable cache when devtools are open.
+      "devtools.cache.disabled" = true;
+      # Do not track header.
+      "privacy.donottrackheader.enabled" = true;
+      # Tell websites not to share or sell my data.
+      "privacy.globalprivacycontrol.enabled" = true;
+      # Disable "studies" (slice testing)
+      "app.shield.optoutstudies.enabled" = false;
+      # Disable attribution which is used by advertisers to track you.
+      "dom.private-attribution.submission.enabled" = false;
+      # Disable battery status, used to track users.
+      "dom.battery.enabled" = false;
+
+      # Disable that websites can get notifications if you copy, paste, or cut something from a web page, and it lets them know which part of the page had been selected.
+      #
+      # This breaks copying from BigQuery https://github.com/microsoft/monaco-editor/issues/1540
+      # dom.event.clipboardevents.enabled: false
+
+      # Isolates all browser identifier sources (e.g. cookies) to the first party domain, with the goal of preventing tracking across different domains.
+      "privacy.firstparty.isolate" = true;
+      # Do not preload URLs that auto-complete in the address bar.
+      "browser.urlbar.speculativeConnect.enabled" = false;
+      # Do not resist fingerprinting because that tells websites to use light mode.
+      # https://bugzilla.mozilla.org/show_bug.cgi?id=1732114
+      "privacy.resistFingerprinting" = false; # (default false)
+      # Instead, enable fingerprinting protection, which allows configuring an override.
+      "privacy.fingerprintingProtection" = true;
+      # Allow sending dark mode preference to websites.
+      # Allow sending timezone to websites.
+      "privacy.fingerprintingProtection.overrides" =
+        "+AllTargets,-CSSPrefersColorScheme,-JSDateTimeUTC,-CanvasExtractionBeforeUserInputIsBlocked";
+      # Disable weather on new tab page
+      "browser.newtabpage.activity-stream.showWeather" = false;
+    };
+    # Check about:policies#documentation and https://mozilla.github.io/policy-templates/ for options.
+    policies = {
+      DisableTelemetry = true;
+      DisplayBookmarksToolbar = "newtab";
+
+      # Check about:support for extension/add-on ID strings.
+      # Valid strings for installation_mode are "allowed", "blocked",
+      # "force_installed" and "normal_installed".
+      ExtensionSettings = {
+        # "*".installation_mode = "blocked"; # blocks all addons except the ones specified below
+        "uBlock0@raymondhill.net" = {
+          install_url = "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi";
+          installation_mode = "force_installed";
+        };
+        "firefox@teleparty.com" = {
+          install_url = "https://addons.mozilla.org/firefox/downloads/latest/netflix-party-is-now-teleparty/latest.xpi";
+          installation_mode = "normal_installed";
+        };
+        "@ublacklist" = {
+          install_url = "https://addons.mozilla.org/firefox/downloads/latest/ublacklist/latest.xpi";
+          installation_mode = "normal_installed";
+        };
+        "@react-devtools" = {
+          install_url = "https://addons.mozilla.org/firefox/downloads/latest/react-devtools/latest.xpi";
+          installation_mode = "normal_installed";
+        };
+      };
+    };
+  };
+
+  environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+    hideMounts = true;
+    users.talexander = {
+      directories = [
+        {
+          directory = ".mozilla";
+          user = "talexander";
+          group = "talexander";
+          mode = "0700";
+        }
+      ];
+    };
+  };
+  environment.persistence."/state" = lib.mkIf (!config.me.buildingIso) {
+    hideMounts = true;
+    users.talexander = {
+      directories = [
+        {
+          directory = ".cache/mozilla";
+          user = "talexander";
+          group = "talexander";
+          mode = "0700";
+        }
+      ];
+    };
+  };
+}

nix/configuration/roles/firewall/default.nix

@@ -0,0 +1,20 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [
+    22 # ssh
+  ];
+  networking.firewall.allowedUDPPorts = [
+    5353 # mDNS
+  ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+}

nix/configuration/roles/fonts/default.nix

@@ -0,0 +1,27 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  fonts = {
+    enableDefaultPackages = false;
+    packages = with pkgs; [
+      cascadia-code
+      source-sans-pro
+      source-serif-pro
+      noto-fonts-cjk-sans
+      noto-fonts-cjk-serif
+      noto-fonts-color-emoji
+    ];
+
+    fontconfig = {
+      localConf = (builtins.readFile ./files/fonts.conf);
+      useEmbeddedBitmaps = true;
+    };
+  };
+}

nix/configuration/roles/fonts/files/fonts.conf

@@ -0,0 +1,99 @@
+<?xml version="1.0"?>
+<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+<fontconfig>
+  <!-- reject all bitmap fonts, with the exception of 'terminus' -->
+  <selectfont>
+    <!-- <acceptfont> -->
+    <!--   <pattern> -->
+    <!--     <patelt name="family"> <string>Terminus</string> </patelt> -->
+    <!--   </pattern> -->
+    <!-- </acceptfont> -->
+    <rejectfont>
+      <pattern>
+        <patelt name="scalable"> <bool>false</bool> </patelt>
+      </pattern>
+    </rejectfont>
+    <rejectfont>
+      <!-- You don't want ghostscript fonts in your web browsing because of annoying ligatures like ffi -->
+      <glob>/usr/share/fonts/gsfonts/*</glob>
+    </rejectfont>
+  </selectfont>
+
+  <!-- preferred aliases -->
+  <alias>
+    <family>serif</family>
+    <prefer>
+      <family>Source Serif Pro</family>
+      <family>Source Sans Pro</family>
+    </prefer>
+  </alias>
+
+  <!-- preferred aliases -->
+  <alias>
+    <family>sans-serif</family>
+    <prefer>
+      <family>Source Sans Pro</family>
+      <family>Source Serif Pro</family>
+    </prefer>
+  </alias>
+
+  <!-- preferred aliases -->
+  <alias>
+    <family>monospace</family>
+    <prefer>
+      <family>Cascadia Mono</family>
+      <family>Cascadia Code</family>
+    </prefer>
+  </alias>
+
+
+  <!-- Screw it. Force Liberation Mono to be source code pro. -->
+  <match target="pattern">
+    <test qual="any" name="family"><string>Liberation Mono</string></test>
+    <edit name="family" mode="assign" binding="same"><string>Cascadia Mono</string></edit>
+  </match>
+
+  <!-- Dejavu Sans Mono keeps coming back when I query "monospace". Doesn't happen when I'm using Souce Code Pro but does happen with cascadia... force it to cascadia -->
+  <match target="pattern">
+    <test qual="any" name="family"><string>monospace</string></test>
+    <edit name="family" mode="assign" binding="same"><string>Cascadia Mono</string></edit>
+  </match>
+
+  <!-- Disable ligatures in monospace fonts. -->
+  <match target="font">
+    <test name="family" compare="eq" ignore-blanks="true">
+      <string>Cascadia Code</string>
+    </test>
+    <edit name="fontfeatures" mode="append">
+      <string>liga off</string>
+      <string>dlig off</string>
+    </edit>
+  </match>
+
+  <!-- Font Display Settings -->
+  <match target="font" >
+    <edit mode="assign" name="rgba" >
+      <const>rgb</const>
+    </edit>
+  </match>
+  <match target="font" >
+    <edit mode="assign" name="hinting" >
+      <bool>true</bool>
+    </edit>
+  </match>
+  <match target="font" >
+    <edit mode="assign" name="hintstyle" >
+      <const>hintslight</const>
+    </edit>
+  </match>
+  <match target="font" >
+    <edit mode="assign" name="antialias" >
+      <bool>true</bool>
+    </edit>
+  </match>
+  <match target="font" >
+    <edit mode="assign" name="lcdfilter" >
+      <const>lcddefault</const>
+    </edit>
+  </match>
+</fontconfig>

nix/configuration/roles/git/default.nix

@@ -0,0 +1,22 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    git
+  ];
+
+  home-manager.users.talexander =
+    { pkgs, ... }:
+    {
+      home.file.".gitconfig" = {
+        source = ./files/gitconfig_home;
+      };
+    };
+}

nix/configuration/roles/git/files/gitconfig_home

@@ -0,0 +1,35 @@
+[user]
+	email = tom@fizz.buzz
+	name = Tom Alexander
+	signingkey = D3A179C9A53C0EDE
+[push]
+	default = simple
+[alias]
+	lg = log --color --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit
+	bh = log --oneline --branches=* --remotes=* --graph --decorate
+	amend = commit --amend --no-edit
+[core]
+	excludesfile = ~/.gitignore_global
+[commit]
+	gpgsign = true
+[pull]
+	rebase = true
+[log]
+	date = local
+[init]
+	defaultBranch = main
+
+# Use meld for `git difftool` and `git mergetool`
+[diff]
+	tool = meld
+[difftool]
+	prompt = false
+[difftool "meld"]
+	cmd = meld "$LOCAL" "$REMOTE"
+[merge]
+	tool = meld
+[mergetool "meld"]
+        # Make the middle pane start with partially-merged contents:
+	cmd = meld "$LOCAL" "$MERGED" "$REMOTE" --output "$MERGED"
+        # Make the middle pane start without any merge progress:
+	# cmd = meld "$LOCAL" "$BASE" "$REMOTE" --output "$MERGED"

nix/configuration/roles/gpg/default.nix

@@ -0,0 +1,173 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  gpg_test_wkd =
+    (pkgs.writeScriptBin "gpg_test_wkd" (builtins.readFile ./files/gpg_test_wkd.bash)).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+in
+{
+  imports = [ ];
+
+  # Fetch public keys:
+  # gpg --locate-keys tom@fizz.buzz
+  #
+  # gpg -vvv --auto-key-locate local,wkd --locate-keys tom@fizz.buzz
+
+  hardware.gpgSmartcards.enable = true;
+  services.udev.packages = [
+    pkgs.yubikey-personalization
+    pkgs.libfido2
+    (pkgs.writeTextFile {
+      name = "my-rules";
+      text = ''
+        ACTION=="add", SUBSYSTEM=="usb", ENV{ID_VENDOR_ID}=="1050", ENV{ID_MODEL_ID}=="0406", MODE="660", GROUP="wheel"
+        KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0406", TAG+="uaccess", GROUP="wheel", MODE="0660"
+      '';
+      destination = "/etc/udev/rules.d/50-yubikey.rules";
+    })
+  ];
+  services.pcscd.enable = true;
+  # services.gnome.gnome-keyring.enable = true;
+
+  # services.dbus.packages = [ pkgs.gcr ];
+
+  # services.pcscd.plugins = lib.mkForce [ ];
+
+  #   programs.gpg.scdaemonSettings = {
+  #   disable-ccid = true;
+  # };
+
+  # .gnupg/scdaemon.conf
+  home-manager.users.talexander =
+    { pkgs, ... }:
+    {
+      home.file.".gnupg/scdaemon.conf" = {
+        source = ./files/scdaemon.conf;
+      };
+    };
+
+  # programs.gnupg.dirmngr.enable = true;
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+    pinentryPackage = pkgs.pinentry-qt;
+    # settings = {
+    #   disable-ccid = true;
+    # };
+  };
+
+  environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+    hideMounts = true;
+    users.talexander = {
+      directories = [
+        {
+          directory = ".gnupg";
+          user = "talexander";
+          group = "talexander";
+          mode = "0700";
+        } # Local keyring
+      ];
+    };
+  };
+
+  nixpkgs.overlays = [
+    (final: prev: {
+      # pcsclite = prev.pcsclite.overrideAttrs (old: {
+      #   postPatch = ''
+      #     substituteInPlace src/libredirect.c src/spy/libpcscspy.c \
+      #       --replace-fail "libpcsclite_real.so.1" "$lib/lib/libpcsclite_real.so.1"
+      #   '';
+      # });
+
+      # pcsclite = prev.pcsclite.overrideAttrs (old: {
+      #   postPatch =
+      #     old.postPatch
+      #     + (lib.optionalString
+      #       (!(lib.strings.hasInfix ''--replace-fail "libpcsclite_real.so.1"'' old.postPatch))
+      #       ''
+      #         substituteInPlace src/libredirect.c src/spy/libpcscspy.c \
+      #           --replace-fail "libpcsclite_real.so.1" "$lib/lib/libpcsclite_real.so.1"
+      #       ''
+      #     );
+      # });
+
+      # pcsclite = prev.pcsclite.overrideAttrs (old: {
+      #   postPatch =
+      #     old.postPatch
+      #     + ''
+      #       substituteInPlace src/libredirect.c src/spy/libpcscspy.c \
+      #         --replace-fail "libpcsclite_real.so.1" "$lib/lib/libpcsclite_real.so.1"
+      #     '';
+      # });
+
+      # gnupg = prev.gnupg.override {
+      #   pcsclite = pkgs.pcsclite.overrideAttrs (old: {
+      #     postPatch =
+      #       old.postPatch
+      #       + (lib.optionalString
+      #         (!(lib.strings.hasInfix ''--replace-fail "libpcsclite_real.so.1"'' old.postPatch))
+      #         ''
+      #           substituteInPlace src/libredirect.c src/spy/libpcscspy.c \
+      #             --replace-fail "libpcsclite_real.so.1" "$lib/lib/libpcsclite_real.so.1"
+      #         ''
+      #       );
+      #   });
+      # };
+    })
+  ];
+
+  # security.polkit.extraConfig = ''
+  #   polkit.addRule(function(action, subject) {
+  #     if (action.id == "org.debian.pcsc-lite.access_card") {
+  #       return polkit.Result.YES;
+  #     }
+  #   });
+
+  #   polkit.addRule(function(action, subject) {
+  #     if (action.id == "org.debian.pcsc-lite.access_pcsc") {
+  #       return polkit.Result.YES;
+  #     }
+  #   });
+  # '';
+
+  environment.systemPackages = with pkgs; [
+    pcsclite
+    pcsctools
+    yubikey-personalization
+    yubikey-manager
+    glibcLocales
+    ccid
+    libusb-compat-0_1
+    gpg_test_wkd
+  ];
+
+  # nixpkgs.overlays = [
+  #   (final: prev: {
+  #     gnupg = pkgs-unstable.gnupg;
+  #     scdaemon = pkgs-unstable.scdaemon;
+  #     libgcrypt = pkgs-unstable.libgcrypt;
+  #   })
+  # ];
+
+  # nixpkgs.overlays = [
+  #   (final: prev: {
+  #     gnupg = prev.gnupg.overrideAttrs (old: rec {
+  #       version = "2.4.7";
+  #       src = prev.fetchurl {
+  #         url = "https://www.gnupg.org/ftp/gcrypt/gnupg/gnupg-${version}.tar.bz2";
+  #         hash = "sha256-eyRwbk2n4OOwbKBoIxAnQB8jgQLEHJCWMTSdzDuF60Y=";
+  #       };
+  #     });
+  #   })
+  # ];
+
+  programs.gnupg.agent.enableExtraSocket = true;
+}

nix/configuration/roles/gpg/files/gpg_test_wkd.bash

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#
+# Test that we can retrieve a PGP key using Web Key Directory (WKD)
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+gpg --no-default-keyring --keyring /tmp/gpg-$$ --auto-key-locate clear,wkd --locate-keys "${@}"

nix/configuration/roles/gpg/files/scdaemon.conf

@@ -0,0 +1,7 @@
+reader-port Yubico Yubi
+disable-ccid
+
+log-file /home/talexander/scd.log
+verbose
+debug cardio
+debug-level 5

nix/configuration/roles/graphics/default.nix

@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me.graphicsCardType = lib.mkOption {
+    type = lib.types.nullOr (
+      lib.types.enum [
+        "amd"
+        "intel"
+        "nvidia"
+      ]
+    );
+    default = null;
+    example = "amd";
+    description = "What graphics card type is in the computer.";
+  };
+
+  options.me.graphical = lib.mkOption {
+    type = lib.types.bool;
+    default = false;
+    example = true;
+    description = "Whether we want to install graphical programs.";
+  };
+
+  config = (
+    lib.mkMerge [
+      (lib.mkIf config.me.graphical {
+        environment.systemPackages = with pkgs; [
+          mesa-demos # for glxgears
+          vulkan-tools # for vkcube
+          xorg.xeyes # to test which windows are using x11
+        ];
+        hardware.graphics.enable = true;
+      })
+    ]
+  );
+}

nix/configuration/roles/iso/default.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me.buildingIso = lib.mkOption {
+    type = lib.types.bool;
+    default = false;
+    example = true;
+    description = "Whether we are building an ISO image.";
+  };
+
+}

nix/configuration/roles/kanshi/default.nix

@@ -0,0 +1,37 @@
+# TODO: Maybe replace with https://gitlab.com/w0lff/shikane because its written in rust
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  exec_kanshi = pkgs.writeTextFile {
+    name = "exec_kanshi.conf";
+    text = ''
+      exec kanshi
+    '';
+  };
+in
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    kanshi
+  ];
+
+  me.swayIncludes = [
+    exec_kanshi
+  ];
+
+  home-manager.users.talexander =
+    { pkgs, ... }:
+    {
+      home.file = {
+        ".config/kanshi/config" = {
+          source = ./files/config_kanshi;
+        };
+      };
+    };
+}

nix/configuration/roles/kanshi/files/config_kanshi

@@ -0,0 +1,7 @@
+profile docked {
+	output eDP-1 disable
+	output "Dell Inc. DELL U3014 P1V6N35M329L" enable
+}
+profile laptop {
+	output eDP-1 enable
+}

nix/configuration/roles/kubernetes/default.nix

@@ -0,0 +1,62 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  alias_kx = pkgs.writeShellScriptBin "kx" ''
+    exec ${pkgs.kubeswitch}/bin/switcher "''${@}"
+  '';
+  alias_ks = pkgs.writeShellScriptBin "ks" ''
+    exec ${pkgs.kubeswitch}/bin/switcher namespace "''${@}"
+  '';
+  alias_k = pkgs.writeShellScriptBin "k" ''
+    exec ${pkgs.kubectl}/bin/kubectl "''${@}"
+  '';
+  alias_ka = pkgs.writeShellScriptBin "ka" ''
+    exec ${pkgs.kubectl}/bin/kubectl "''${@}" --all-namespaces
+  '';
+  alias_kdel = pkgs.writeShellScriptBin "kdel" ''
+    exec ${pkgs.kubectl}/bin/kubectl delete --all "''${@}"
+  '';
+  alias_kd = pkgs.writeShellScriptBin "kd" ''
+    export KUBECTL_EXTERNAL_DIFF="${pkgs.colordiff}/bin/colordiff -N -u"
+    exec ${pkgs.kubectl}/bin/kubectl diff "''${@}"
+  '';
+  alias_klog = pkgs.writeShellScriptBin "klog" ''
+    exec ${pkgs.kubectl}/bin/kubectl logs --all-containers "$@"
+  '';
+in
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    kubectl
+    kubeswitch
+    stern
+    alias_kx
+    alias_ks
+    alias_k
+    alias_ka
+    alias_kdel
+    alias_kd
+    alias_klog
+  ];
+
+  environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+    hideMounts = true;
+    users.talexander = {
+      directories = [
+        {
+          directory = ".kube";
+          user = "talexander";
+          group = "talexander";
+          mode = "0750";
+        }
+      ];
+    };
+  };
+
+}

nix/configuration/roles/latex/default.nix

@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  tex = (
+    pkgs.texlive.combine {
+      inherit (pkgs.texlive)
+        scheme-basic
+        dvisvgm
+        dvipng # for preview and export as html in org-mode
+        wrapfig
+        amsmath
+        ulem
+        hyperref
+        capt-of
+        ;
+    }
+  );
+in
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    tex
+  ];
+
+}

nix/configuration/roles/launch_keyboard/default.nix

@@ -0,0 +1,35 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  config = lib.mkIf config.me.graphical {
+    environment.systemPackages = with pkgs; [
+      system76-keyboard-configurator
+      dfu-programmer # For flashing keyboard https://support.system76.com/articles/launch_2-firmware-update/
+      avrdude # For flashing keyboard https://support.system76.com/articles/launch_2-firmware-update/
+      lxqt.lxqt-policykit # Need a polkit agent to launch the keyboard configurator
+    ];
+
+    systemd = {
+      user.services.lxqt-policykit-agent = {
+        description = "lxqt-policykit-agent";
+        wantedBy = [ "graphical-session.target" ];
+        wants = [ "graphical-session.target" ];
+        after = [ "graphical-session.target" ];
+        serviceConfig = {
+          Type = "simple";
+          ExecStart = "${pkgs.lxqt.lxqt-policykit}/bin/lxqt-policykit-agent";
+          Restart = "on-failure";
+          RestartSec = 1;
+          TimeoutStopSec = 10;
+        };
+      };
+    };
+  };
+}

nix/configuration/roles/launch_keyboard/files/launch_keyboard_layout.json

@@ -0,0 +1,894 @@
+{
+  "model": "system76/launch_2",
+  "version": 1,
+  "map": {
+    "K00": [
+      "ESC",
+      "RESET",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K01": [
+      "F1",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K02": [
+      "F2",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K03": [
+      "F3",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K04": [
+      "F4",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K05": [
+      "F5",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K06": [
+      "F6",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K07": [
+      "F7",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K08": [
+      "F8",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K09": [
+      "F9",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K0A": [
+      "F10",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K0B": [
+      "F11",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K0C": [
+      "F12",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K0D": [
+      "DEL",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K0E": [
+      "HOME",
+      "PLAY_PAUSE",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K10": [
+      "TICK",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K11": [
+      "1",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K12": [
+      "2",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K13": [
+      "3",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K14": [
+      "4",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K15": [
+      "5",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K16": [
+      "6",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K17": [
+      "7",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K18": [
+      "8",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K19": [
+      "9",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K1A": [
+      "0",
+      "KBD_TOGGLE",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K1B": [
+      "MINUS",
+      "KBD_DOWN",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K1C": [
+      "EQUALS",
+      "KBD_UP",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K1D": [
+      "BKSP",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K1E": [
+      "PGUP",
+      "VOLUME_UP",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K20": [
+      "TAB",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K21": [
+      "Q",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K22": [
+      "W",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K23": [
+      "E",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K24": [
+      "R",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K25": [
+      "T",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K26": [
+      "Y",
+      "HOME",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K27": [
+      "U",
+      "PGDN",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K28": [
+      "I",
+      "PGUP",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K29": [
+      "O",
+      "END",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K2A": [
+      "P",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K2B": [
+      "BRACE_OPEN",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K2C": [
+      "BRACE_CLOSE",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K2D": [
+      "BACKSLASH",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K2E": [
+      "PGDN",
+      "VOLUME_DOWN",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K30": [
+      "CAPS",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K31": [
+      "A",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K32": [
+      "S",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K33": [
+      "D",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K34": [
+      "F",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K35": [
+      "G",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K36": [
+      "H",
+      "LEFT",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K37": [
+      "J",
+      "DOWN",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K38": [
+      "K",
+      "UP",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K39": [
+      "L",
+      "RIGHT",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K3A": [
+      "SEMICOLON",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K3B": [
+      "QUOTE",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K3C": [
+      "ENTER",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K3D": [
+      "END",
+      "MUTE",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K40": [
+      "LEFT_SHIFT",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K41": [
+      "Z",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K42": [
+      "X",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K43": [
+      "C",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K44": [
+      "V",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K45": [
+      "B",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K46": [
+      "N",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K47": [
+      "M",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K48": [
+      "COMMA",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K49": [
+      "PERIOD",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K4A": [
+      "SLASH",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K4B": [
+      "RIGHT_SHIFT",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K4C": [
+      "UP",
+      "PGUP",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K50": [
+      "LEFT_CTRL",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K51": [
+      "LEFT_SUPER",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K52": [
+      "LEFT_ALT",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K53": [
+      "FN",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K54": [
+      "SPACE",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K55": [
+      "SPACE",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K56": [
+      "RIGHT_CTRL",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K57": [
+      "RIGHT_ALT",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K58": [
+      "PRINT_SCREEN",
+      "ROLL_OVER",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K59": [
+      "LEFT",
+      "HOME",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K5A": [
+      "DOWN",
+      "PGDN",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ],
+    "K5B": [
+      "RIGHT",
+      "END",
+      "ROLL_OVER",
+      "ROLL_OVER"
+    ]
+  },
+  "key_leds": {
+    "K00": [
+      0,
+      0
+    ],
+    "K01": [
+      0,
+      0
+    ],
+    "K02": [
+      0,
+      0
+    ],
+    "K03": [
+      0,
+      0
+    ],
+    "K04": [
+      0,
+      0
+    ],
+    "K05": [
+      0,
+      0
+    ],
+    "K06": [
+      0,
+      0
+    ],
+    "K07": [
+      0,
+      0
+    ],
+    "K08": [
+      0,
+      0
+    ],
+    "K09": [
+      0,
+      0
+    ],
+    "K0A": [
+      0,
+      0
+    ],
+    "K0B": [
+      0,
+      0
+    ],
+    "K0C": [
+      0,
+      0
+    ],
+    "K0D": [
+      0,
+      0
+    ],
+    "K0E": [
+      0,
+      0
+    ],
+    "K10": [
+      0,
+      0
+    ],
+    "K11": [
+      0,
+      0
+    ],
+    "K12": [
+      0,
+      0
+    ],
+    "K13": [
+      0,
+      0
+    ],
+    "K14": [
+      0,
+      0
+    ],
+    "K15": [
+      0,
+      0
+    ],
+    "K16": [
+      0,
+      0
+    ],
+    "K17": [
+      0,
+      0
+    ],
+    "K18": [
+      0,
+      0
+    ],
+    "K19": [
+      0,
+      0
+    ],
+    "K1A": [
+      0,
+      0
+    ],
+    "K1B": [
+      0,
+      0
+    ],
+    "K1C": [
+      0,
+      0
+    ],
+    "K1D": [
+      0,
+      0
+    ],
+    "K1E": [
+      0,
+      0
+    ],
+    "K20": [
+      0,
+      0
+    ],
+    "K21": [
+      0,
+      0
+    ],
+    "K22": [
+      0,
+      0
+    ],
+    "K23": [
+      0,
+      0
+    ],
+    "K24": [
+      0,
+      0
+    ],
+    "K25": [
+      0,
+      0
+    ],
+    "K26": [
+      0,
+      0
+    ],
+    "K27": [
+      0,
+      0
+    ],
+    "K28": [
+      0,
+      0
+    ],
+    "K29": [
+      0,
+      0
+    ],
+    "K2A": [
+      0,
+      0
+    ],
+    "K2B": [
+      0,
+      0
+    ],
+    "K2C": [
+      0,
+      0
+    ],
+    "K2D": [
+      0,
+      0
+    ],
+    "K2E": [
+      0,
+      0
+    ],
+    "K30": [
+      0,
+      0
+    ],
+    "K31": [
+      0,
+      0
+    ],
+    "K32": [
+      0,
+      0
+    ],
+    "K33": [
+      0,
+      0
+    ],
+    "K34": [
+      0,
+      0
+    ],
+    "K35": [
+      0,
+      0
+    ],
+    "K36": [
+      0,
+      0
+    ],
+    "K37": [
+      0,
+      0
+    ],
+    "K38": [
+      0,
+      0
+    ],
+    "K39": [
+      0,
+      0
+    ],
+    "K3A": [
+      0,
+      0
+    ],
+    "K3B": [
+      0,
+      0
+    ],
+    "K3C": [
+      0,
+      0
+    ],
+    "K3D": [
+      0,
+      0
+    ],
+    "K40": [
+      0,
+      0
+    ],
+    "K41": [
+      0,
+      0
+    ],
+    "K42": [
+      0,
+      0
+    ],
+    "K43": [
+      0,
+      0
+    ],
+    "K44": [
+      0,
+      0
+    ],
+    "K45": [
+      0,
+      0
+    ],
+    "K46": [
+      0,
+      0
+    ],
+    "K47": [
+      0,
+      0
+    ],
+    "K48": [
+      0,
+      0
+    ],
+    "K49": [
+      0,
+      0
+    ],
+    "K4A": [
+      0,
+      0
+    ],
+    "K4B": [
+      0,
+      0
+    ],
+    "K4C": [
+      0,
+      0
+    ],
+    "K50": [
+      0,
+      0
+    ],
+    "K51": [
+      0,
+      0
+    ],
+    "K52": [
+      0,
+      0
+    ],
+    "K53": [
+      0,
+      0
+    ],
+    "K54": [
+      0,
+      0
+    ],
+    "K55": [
+      0,
+      0
+    ],
+    "K56": [
+      0,
+      0
+    ],
+    "K57": [
+      0,
+      0
+    ],
+    "K58": [
+      0,
+      0
+    ],
+    "K59": [
+      0,
+      0
+    ],
+    "K5A": [
+      0,
+      0
+    ],
+    "K5B": [
+      0,
+      0
+    ]
+  },
+  "layers": [
+    {
+      "mode": [
+        0,
+        127
+      ],
+      "brightness": 109,
+      "color": [
+        0,
+        0
+      ]
+    },
+    {
+      "mode": [
+        13,
+        127
+      ],
+      "brightness": 109,
+      "color": [
+        21,
+        255
+      ]
+    },
+    {
+      "mode": [
+        13,
+        127
+      ],
+      "brightness": 109,
+      "color": [
+        142,
+        255
+      ]
+    },
+    {
+      "mode": [
+        13,
+        127
+      ],
+      "brightness": 109,
+      "color": [
+        142,
+        255
+      ]
+    }
+  ]
+}

nix/configuration/roles/lvfs/default.nix

@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  config = lib.mkMerge [
+    {
+      services.fwupd.enable = true;
+
+      environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+        hideMounts = true;
+        directories = [
+          {
+            directory = "/var/lib/fwupd";
+            user = "root";
+            group = "root";
+            mode = "0755";
+          }
+        ];
+      };
+    }
+    (lib.mkIf config.me.graphical {
+      environment.systemPackages = with pkgs; [
+        gnome-firmware
+      ];
+    })
+  ];
+}

nix/configuration/roles/media/default.nix

@@ -0,0 +1,55 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cast_file_vaapi =
+    (pkgs.writeScriptBin "cast_file" (builtins.readFile ./files/cast_file_vaapi)).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+  cast_file_nvidia =
+    (pkgs.writeScriptBin "cast_file" (builtins.readFile ./files/cast_file_nvidia)).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+in
+{
+  imports = [ ];
+
+  config = (
+    lib.mkMerge [
+      {
+        environment.systemPackages = with pkgs; [
+          ffmpeg
+        ];
+
+        home-manager.users.talexander =
+          { pkgs, ... }:
+          {
+            home.file.".config/mpv/mpv.conf" = {
+              source = ./files/mpv.conf;
+            };
+          };
+      }
+      (lib.mkIf config.me.graphical {
+        environment.systemPackages = with pkgs; [
+          mpv
+          evince
+          gimp
+          # So far I prefer imv over swayimg because imv supports the 'p' hotkey to print the currently-viewed file to stdout (useful for pipelines) and afaik doesn't support the exec:// protocol which seems like a massive risk.
+          imv
+        ];
+      })
+      (lib.mkIf (config.me.graphicsCardType == "amd" || config.me.graphicsCardType == "intel") {
+        environment.systemPackages = with pkgs; [
+          cast_file_vaapi
+        ];
+      })
+    ]
+  );
+}

nix/configuration/roles/media/files/cast_file_nvidia

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+#
+
+ffmpeg -re -i "$1" -vcodec h264_nvenc -r 30 -g 30 -loop -1 -c:a aac -b:a 160k -ar 44100 -strict -2 -f flv rtmp:172.16.16.44/live/test &
+ffmpegpid=$!
+
+sleep 1
+castnow --exit 'https://broadcast.fizz.buzz/hls/hls/test.m3u8'
+wait "$ffmpegpid"
+
+sleep 10

nix/configuration/roles/media/files/cast_file_vaapi

@@ -0,0 +1,237 @@
+#!/usr/bin/env bash
+#
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+: ${VIDEO_BITRATE:="1M"} # Only for encoding modes targeting bitrate
+: ${AUDIO_BITRATE:="192k"}
+
+############## Setup #########################
+
+function die {
+    local status_code="$1"
+    shift
+    (>&2 echo "${@}")
+    exit "$status_code"
+}
+
+function log {
+    (>&2 echo "${@}")
+}
+
+############## Program #########################
+
+function main {
+    local cmd
+    cmd=$1
+    shift
+    if [ "$cmd" = "copy" ]; then
+        copy "${@}"
+    elif [ "$cmd" = "convert" ]; then
+        convert "${@}"
+    elif [ "$cmd" = "stream" ]; then
+        stream "${@}"
+    elif [ "$cmd" = "webcam" ]; then
+        webcam "${@}"
+    elif [ "$cmd" = "encode_webcam" ]; then
+        encode_webcam "${@}"
+    else
+        (>&2 echo "Unknown command: $cmd")
+        exit 1
+    fi
+}
+
+function copy {
+    local file_to_cast
+    file_to_cast="$3"
+
+    local USERNAME PASSWORD
+    USERNAME="$1"
+    PASSWORD="$2"
+
+    set -x
+    </dev/null exec ffmpeg \
+        -re \
+        -stream_loop -1 \
+        -i "$file_to_cast" \
+        -c copy \
+        -strict experimental \
+        -f rtsp \
+        -rtsp_transport tcp \
+        "rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch"
+}
+
+function convert {
+    local args=()
+    local acceleration_type="$1" # "software" or "hardware"
+    local codec="$2" # "h264" or "av1"
+    local file_to_cast="$3"
+    local file_to_save="$4"
+
+
+
+    # Verify parameters
+
+
+    if [ "$acceleration_type" == "software" ]; then
+        true
+    elif [ "$acceleration_type" == "hardware" ]; then
+        true
+    else
+        die 1 "Unknown acceleration type: $acceleration_type"
+    fi
+
+    if [ "$codec" == "h264" ]; then
+        true
+    elif [ "$codec" == "av1" ]; then
+        true
+    else
+        die 1 "Unknown codec: $codec"
+    fi
+
+
+
+    # Build command
+
+
+
+    if [ "$acceleration_type" == "software" ]; then
+        true
+    elif [ "$acceleration_type" == "hardware" ]; then
+        args+=(-vaapi_device /dev/dri/renderD128)
+    fi
+
+    args+=(-i "$file_to_cast")
+
+    if [ "$codec" == "h264" ]; then
+        if [ "$acceleration_type" == "software" ]; then
+            args+=(-c:v h264)
+            args+=(-profile:v high)
+            args+=(-b:v "$VIDEO_BITRATE")
+        elif [ "$acceleration_type" == "hardware" ]; then
+            args+=(-vf 'format=nv12|vaapi,hwupload')
+            args+=(-c:v h264_vaapi)
+            args+=(-profile:v high)
+            args+=(-b:v "$VIDEO_BITRATE")
+        fi
+    elif [ "$codec" == "av1" ]; then
+        if [ "$acceleration_type" == "software" ]; then
+            args+=(-c:v libsvtav1)
+            args+=(-preset 4) # [0-13] default 10, lower = higher quality / slower encode
+            args+=(-crf 20) # [0-63] default 35, lower = higher quality / larger file
+            # Parameters: https://gitlab.com/AOMediaCodec/SVT-AV1/-/blob/master/Docs/Parameters.md
+            # fast-decode [0-2] default 0 (off), higher = faster decode
+            # tune [0-2] default 1, Specifies whether to use PSNR or VQ as the tuning metric [0 = VQ, 1 = PSNR, 2 = SSIM]
+            # film-grain-denoise, setting to 0 uses the original frames instead of denoising the film grain
+            args+=(-svtav1-params "fast-decode=1:film-grain-denoise=0")
+        elif [ "$acceleration_type" == "hardware" ]; then
+            # -c:v av1_amf -quality quality
+            args+=(-vf 'format=nv12|vaapi,hwupload')
+            args+=(-c:v av1_vaapi)
+            args+=(-b:v "$VIDEO_BITRATE")
+        fi
+    fi
+
+
+
+    # -bf 0 :: Disable b-frames because webrtc doesn't support h264 streams with b-frames.
+    args+=(-bf 0)
+    args+=(-strict -2)
+    args+=(-c:a opus)
+    args+=(-ac 2)
+    args+=(-b:a "$AUDIO_BITRATE")
+    args+=(-ar 48000)
+    args+=("$file_to_save")
+    set -x
+    </dev/null exec ffmpeg "${args[@]}"
+}
+
+function stream {
+    local args=()
+    local acceleration_type="$1" # "software" or "hardware"
+    local codec="$2" # "h264" or "av1"
+
+    local USERNAME="$3"
+    local PASSWORD="$4"
+    local file_to_cast="$5"
+
+
+    args+=(-re -stream_loop -1)
+
+    args+=(-f rtsp)
+    args+=(-rtsp_transport tcp)
+    args+=("rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch")
+}
+
+function webcam {
+    # Uses on-webcam h264 encoding.
+
+    local USERNAME PASSWORD
+    USERNAME="$1"
+    PASSWORD="$2"
+
+    set -x
+
+    </dev/null exec ffmpeg \
+        -re \
+        -input_format h264 \
+        -video_size 1920x1080 \
+        -i /dev/video0 \
+        -c:v copy \
+        -an \
+        -f rtsp \
+        -rtsp_transport tcp \
+        "rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch"
+}
+
+function encode_webcam {
+    # Uses hardware accelerated gpu-based encoding.
+
+    local USERNAME PASSWORD
+    USERNAME="$1"
+    PASSWORD="$2"
+
+    set -x
+
+    </dev/null exec ffmpeg \
+        -re \
+        -vaapi_device /dev/dri/renderD128 \
+        -i /dev/video0 \
+        -vf 'format=nv12,hwupload' \
+        -c:v h264_vaapi \
+        -an \
+        -f rtsp \
+        -rtsp_transport tcp \
+        "rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch"
+}
+
+function speed_up_preprocess_vp8 {
+    local file_to_cast file_to_save
+    file_to_cast="$1"
+    file_to_save="$2"
+
+    set -x
+
+    # -bf 0 :: Disable b-frames because webrtc doesn't support h264 streams with b-frames.
+    # -strict -2 :: Enable support for experimental codecs like opus.
+    # -b:v 2M :: Target 2 megabit/s
+    # -crf 10 :: Target a quality level and adjust bitrate accordingly. This should be preferred, but ideally both should be used.
+    # Could also use -filter_complex "[0:v]setpts=0.5*PTS[v];[0:a]atempo=2.0[a]" -map "[v]" -map "[a]"
+    </dev/null exec ffmpeg \
+               -i "$file_to_cast" \
+               -filter:v "setpts=0.66666666*PTS" \
+               -filter:a "atempo=1.5" \
+               -c:v vp8 \
+               -b:v 2M \
+               -crf 10 \
+               -bf 0 \
+               -c:a opus \
+               -b:a 320k \
+               -ar 48000 \
+               -strict -2 \
+               "$file_to_save"
+}
+
+
+main "${@}"

nix/configuration/roles/media/files/mpv.conf

@@ -0,0 +1,25 @@
+# To debug hardware video acceleration:
+# mpv --hwdec=auto --msg-level=vd=v,vo=v,vo/gpu/vaapi-egl=trace
+
+# GPU Decoding
+hwdec=auto
+# Allow CPU processing via filters:
+#hwdec=auto-copy
+
+# Use higher quality gpu rendering
+profile=gpu-hq
+scale=ewa_lanczossharp
+cscale=ewa_lanczossharp
+
+# Instead of dropping frames, re-sample audio which may cause a slight pitch change
+# ISSUE: caused frame stutter on Louie S01E03
+# video-sync=display-resample
+
+# Make motion smoother when video frame rate != monitor refresh rate
+interpolation
+tscale=oversample
+
+# Load a lot of the file into memory
+# cache=yes
+# demuxer-max-bytes=123400KiB
+# demuxer-readahead-secs=20

nix/configuration/roles/network/default.nix

@@ -0,0 +1,69 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+# Alternative DNS servers:
+# "1.0.0.1#cloudflare-dns.com"
+# "1.1.1.1#cloudflare-dns.com"
+# "2606:4700:4700::1001#cloudflare-dns.com"
+# "2606:4700:4700::1111#cloudflare-dns.com"
+# "8.8.4.4#dns.google"
+# "8.8.8.8#dns.google"
+# "2001:4860:4860::8844#dns.google"
+# "2001:4860:4860::8888#dns.google"
+
+{
+  imports = [ ];
+
+  networking.dhcpcd.enable = false;
+  networking.useDHCP = false;
+  networking.nameservers = [
+    "194.242.2.2#doh.mullvad.net"
+    "2a07:e340::2#doh.mullvad.net"
+  ];
+  services.resolved = {
+    enable = true;
+    # dnssec = "true";
+    domains = [ "~." ];
+    fallbackDns = [ ];
+    dnsovertls = "true";
+  };
+
+  # Without this, systemd-resolved will send DNS requests for <X>.home.arpa to the per-link DNS server (172.16.0.1) which does not support DNS-over-TLS. This leads to the connection anging and timing out. This causes firefox startup to take an extra 10+ seconds.
+  #
+  # Test with: drill @127.0.0.53 odo.home.arpa
+  networking.extraHosts = ''
+    127.0.0.1 odo.home.arpa
+    10.216.1.1		homeserver
+    10.216.1.6		media
+    #10.216.1.12		odo
+    10.217.1.1		drmario
+    10.217.2.1		mrmanager
+  '';
+
+  networking.wireless.iwd = {
+    enable = true;
+
+    settings = {
+      General = {
+        EnableNetworkConfiguration = true;
+        AddressRandomization = "network";
+        ControlPortOverNL80211 = false;
+      };
+    };
+  };
+  environment.systemPackages = with pkgs; [
+    iw
+    iwd
+    ldns # for drill
+    arp-scan # To find devices on the network
+  ];
+
+  boot.extraModprobeConfig = ''
+    # Set wifi to US
+    options cfg80211 ieee80211_regdom=US
+  '';
+}

nix/configuration/roles/nvme/default.nix

@@ -0,0 +1,14 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    nvme-cli
+  ];
+}

nix/configuration/roles/python/default.nix

@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    (python3.withPackages (python-pkgs: [
+      python-pkgs.distro # For https://gitlab.freedesktop.org/drm/amd/-/blob/master/scripts/amd_s2idle.py
+      python-pkgs.pyudev # For https://gitlab.freedesktop.org/drm/amd/-/blob/master/scripts/amd_s2idle.py
+      python-pkgs.systemd # For https://gitlab.freedesktop.org/drm/amd/-/blob/master/scripts/amd_s2idle.py
+      python-pkgs.packaging # For https://gitlab.freedesktop.org/drm/amd/-/blob/master/scripts/amd_s2idle.py
+    ]))
+    poetry
+    pyright
+    isort
+    black
+  ];
+}

nix/configuration/roles/qemu/default.nix

@@ -0,0 +1,14 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    qemu
+  ];
+}

nix/configuration/roles/reset/default.nix

@@ -0,0 +1,13 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  # Reset some defaults to start from a minimal more-arch-linux-like state. Think of this like a CSS reset sheet.
+
+}

nix/configuration/roles/rust/default.nix

@@ -0,0 +1,39 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    rustup
+    lldb # for lldb-vscode
+    musl # for building static binaries
+    rust-analyzer
+    cargo-semver-checks
+    # ? cargo-bloat
+    # ? cargo-outdated
+    # ? cargo-public-api
+  ];
+
+  home-manager.users.talexander =
+    { pkgs, ... }:
+    {
+      home.file = {
+        ".cargo/config.toml" = {
+          source = ./files/cargo_config.toml;
+        };
+        # # TODO: Figure out what to do with credentials.
+        # ".cargo/credentials.toml" = {
+        #   source = ./files/cargo_credentials.toml;
+        # };
+      };
+    };
+
+}
+
+# TODO: Install clippy, cranelift, rust-src
+# TODO: Install rust targets x86_64-unknown-linux-musl and wasm32-unknown-unknown

nix/configuration/roles/rust/files/cargo_config.toml

@@ -0,0 +1,12 @@
+[target.x86_64-unknown-linux-gnu]
+rustflags = ["-C", "target-cpu=native", "-Zthreads=0"]
+
+[unstable]
+codegen-backend = true
+
+[profile.dev]
+codegen-backend = "cranelift"
+
+[profile.dev.package."*"]
+codegen-backend = "llvm"
+opt-level = 3

nix/configuration/roles/sound/default.nix

@@ -0,0 +1,76 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    pavucontrol
+  ];
+
+  # rtkit is optional but recommended
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    # If you want to use JACK applications, uncomment this
+    #jack.enable = true;
+
+    extraLv2Packages = [ pkgs.rnnoise-plugin ];
+    configPackages = [
+      (pkgs.writeTextDir "share/pipewire/pipewire.conf.d/99-input-denoising.conf" ''
+        context.modules = [
+        {   name = libpipewire-module-filter-chain
+            args = {
+                node.description = "Noise Canceling source"
+                media.name = "Noise Canceling source"
+                filter.graph = {
+                    nodes = [
+                        {
+                            type = ladspa
+                            name = rnnoise
+                            plugin = "${pkgs.rnnoise-plugin}/lib/ladspa/librnnoise_ladspa.so"
+                            label = noise_suppressor_mono
+                            control = {
+                                "VAD Threshold (%)" = 50.0
+                                "VAD Grace Period (ms)" = 200
+                                "Retroactive VAD Grace (ms)" = 0
+                            }
+                        }
+                    ]
+                }
+                capture.props = {
+                    node.name =  "capture.rnnoise_source"
+                    node.passive = true
+                    audio.rate = 48000
+                    # Optionally specify a specific input: (ID from `pactl list`)
+                    # target.object = "alsa_input.usb-Shure_Incorporated_Shure_Digital-00.analog-stereo"
+                }
+                playback.props = {
+                    node.name =  "rnnoise_source"
+                    media.class = Audio/Source
+                    audio.rate = 48000
+                }
+            }
+        }
+        ]
+      '')
+    ];
+  };
+
+  environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+    hideMounts = true;
+    users.talexander = {
+      directories = [
+        ".local/state/wireplumber" # Sound settings
+      ];
+    };
+  };
+
+}

nix/configuration/roles/ssh/default.nix

@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    sshfs
+  ];
+
+  environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+    hideMounts = true;
+    users.talexander = {
+      files = [
+        ".ssh/known_hosts"
+      ];
+    };
+  };
+}

nix/configuration/roles/steam/default.nix

@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me.games = lib.mkOption {
+    type = lib.types.bool;
+    default = config.me.graphical;
+    example = true;
+    description = "Whether we want to install games.";
+  };
+
+  config = (
+    lib.mkMerge [
+      (lib.mkIf config.me.games {
+        allowedUnfree = [
+          "steam"
+          "steam-original"
+          "steam-unwrapped"
+          "steam-run"
+        ];
+
+        programs.steam = {
+          enable = true;
+          remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
+          # dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
+          localNetworkGameTransfers.openFirewall = true; # Open ports in the firewall for Steam Local Network Game Transfers
+        };
+
+        environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+          hideMounts = true;
+          users.talexander = {
+            directories = [
+              ".local/share/Steam"
+              ".steam"
+              ".factorio"
+            ];
+          };
+        };
+      })
+    ]
+  );
+
+}

nix/configuration/roles/sway/default.nix

@@ -0,0 +1,394 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  sway-config = pkgs.writeTextFile {
+    name = "config";
+    text = ''
+      # Default config for sway
+      #
+      # Copy this to ~/.config/sway/config and edit it to your liking.
+      #
+      # Read `man 5 sway` for a complete reference.
+
+      ### Variables
+      #
+      # Logo key. Use Mod1 for Alt.
+      set $mod Mod4
+      # set $mod Mod1
+      # Home row direction keys, like vim
+      set $left h
+      set $down j
+      set $up k
+      set $right l
+      # Your preferred terminal emulator
+      set $term ${pkgs.alacritty}/bin/alacritty
+      # Your preferred application launcher
+      # Note: it's recommended that you pass the final command to sway
+      # set $menu dmenu_path | dmenu | xargs swaymsg exec
+      set $menu ${pkgs.tofi}/bin/tofi-drun | xargs swaymsg exec --
+      #set $menu ${pkgs.wofi}/bin/wofi --show drun --gtk-dark
+
+      # Do not show a title bar on windows
+      default_border pixel 2
+      hide_edge_borders smart_no_gaps
+
+      bindsym $mod+grave exec $term
+
+      ${lib.concatMapStringsSep "\n" (item: "include ${item}") config.me.swayIncludes}
+    '';
+  };
+  base-hotkeys = pkgs.writeTextFile {
+    name = "base-hotkeys.conf";
+    text = ''
+      ### Key bindings
+      #
+      # Basics:
+      #
+          # kill focused window
+          bindsym $mod+Shift+q kill
+
+          # start your launcher
+          bindsym $mod+Return exec $menu
+
+          # Drag floating windows by holding down $mod and left mouse button.
+          # Resize them with right mouse button + $mod.
+          # Despite the name, also works for non-floating windows.
+          # Change normal to inverse to use left mouse button for resizing and right
+          # mouse button for dragging.
+          floating_modifier $mod normal
+
+          # reload the configuration file
+          bindsym $mod+Shift+c reload
+
+          # exit sway (logs you out of your Wayland session)
+          bindsym $mod+Shift+e exec swaynag -t warning -m 'You pressed the exit shortcut. Do you really want to exit sway? This will end your Wayland session.' -b 'Yes, exit sway' 'swaymsg exit'
+    '';
+  };
+  display-configs = pkgs.writeTextFile {
+    name = "display-configs.conf";
+    text = ''
+      output 'Unknown 0x095F 0x00000000' scale 1.5
+      output 'BOE 0x095F Unknown' scale 1.5
+      output 'BOE 0x0BCA Unknown' scale 1.5
+    '';
+  };
+  window-management = pkgs.writeTextFile {
+    name = "window-management.conf";
+    text = ''
+      #
+      # Layout stuff:
+      #
+          # You can "split" the current object of your focus with
+          # $mod+b or $mod+v, for horizontal and vertical splits
+          # respectively.
+          bindsym $mod+h splith
+          bindsym $mod+v splitv
+
+          # Switch the current container between different layout styles
+          bindsym $mod+s layout stacking
+          bindsym $mod+w layout tabbed
+          bindsym $mod+e layout toggle split
+
+          # Make the current focus fullscreen
+          bindsym $mod+f fullscreen
+
+          # Toggle the current focus between tiling and floating mode
+          bindsym $mod+Shift+space floating toggle
+
+          # Swap focus between the tiling area and the floating area
+          bindsym $mod+space focus mode_toggle
+
+          # move focus to the parent container
+          bindsym $mod+a focus parent
+      #
+      # Scratchpad:
+      #
+          # Sway has a "scratchpad", which is a bag of holding for windows.
+          # You can send windows there and get them back later.
+
+          # Move the currently focused window to the scratchpad
+          bindsym $mod+Shift+minus move scratchpad
+
+          # Show the next scratchpad window or hide the focused scratchpad window.
+          # If there are multiple scratchpad windows, this command cycles through them.
+          bindsym $mod+minus scratchpad show
+      #
+      # Resizing containers:
+      #
+      mode "resize" {
+          # left will shrink the containers width
+          # right will grow the containers width
+          # up will shrink the containers height
+          # down will grow the containers height
+          bindsym $left resize shrink width 10px
+          bindsym $down resize grow height 10px
+          bindsym $up resize shrink height 10px
+          bindsym $right resize grow width 10px
+
+          # ditto, with arrow keys
+          bindsym Left resize shrink width 10px
+          bindsym Down resize grow height 10px
+          bindsym Up resize shrink height 10px
+          bindsym Right resize grow width 10px
+
+          # return to default mode
+          bindsym Return mode "default"
+          bindsym Escape mode "default"
+      }
+      bindsym $mod+r mode "resize"
+    '';
+  };
+  movement = pkgs.writeTextFile {
+    name = "movement.conf";
+    text = ''
+      #
+      # Moving around:
+      #
+          # Move your focus around
+          # bindsym $mod+$left focus left
+          # bindsym $mod+$down focus down
+          # bindsym $mod+$up focus up
+          # bindsym $mod+$right focus right
+          # or use $mod+[up|down|left|right]
+          bindsym $mod+Left focus left
+          bindsym $mod+Down focus down
+          bindsym $mod+Up focus up
+          bindsym $mod+Right focus right
+
+          # _move_ the focused window with the same, but add Shift
+          bindsym $mod+Shift+$left move left
+          bindsym $mod+Shift+$down move down
+          bindsym $mod+Shift+$up move up
+          bindsym $mod+Shift+$right move right
+          # ditto, with arrow keys
+          bindsym $mod+Shift+Left move left
+          bindsym $mod+Shift+Down move down
+          bindsym $mod+Shift+Up move up
+          bindsym $mod+Shift+Right move right
+      #
+      # Workspaces:
+      #
+          # switch to workspace
+          bindsym $mod+1 workspace 1
+          bindsym $mod+2 workspace 2
+          bindsym $mod+3 workspace 3
+          bindsym $mod+4 workspace 4
+          bindsym $mod+5 workspace 5
+          bindsym $mod+6 workspace 6
+          bindsym $mod+7 workspace 7
+          bindsym $mod+8 workspace 8
+          bindsym $mod+9 workspace 9
+          bindsym $mod+0 workspace 10
+          # move focused container to workspace
+          bindsym $mod+Shift+1 move container to workspace 1
+          bindsym $mod+Shift+2 move container to workspace 2
+          bindsym $mod+Shift+3 move container to workspace 3
+          bindsym $mod+Shift+4 move container to workspace 4
+          bindsym $mod+Shift+5 move container to workspace 5
+          bindsym $mod+Shift+6 move container to workspace 6
+          bindsym $mod+Shift+7 move container to workspace 7
+          bindsym $mod+Shift+8 move container to workspace 8
+          bindsym $mod+Shift+9 move container to workspace 9
+          bindsym $mod+Shift+0 move container to workspace 10
+          # Note: workspaces can have any name you want, not just numbers.
+          # We just use 1-10 as the default.
+    '';
+  };
+  disable-focus-follows-mouse = pkgs.writeTextFile {
+    name = "disable-focus-follows-mouse.conf";
+    text = ''
+      # Disable focus following mouse
+      focus_follows_mouse no
+    '';
+  };
+  background = pkgs.writeTextFile {
+    name = "background.conf";
+    text = ''
+      output * bg ${./files/bliss.jpg} fill
+    '';
+  };
+  touchpad_input = pkgs.writeTextFile {
+    name = "touchpad_input.conf";
+    text = ''
+      input * xkb_rules "evdev"
+
+      # All touchpads
+      input type:touchpad {
+            dwt enabled
+            click_method clickfinger
+            tap enabled
+      }
+    '';
+  };
+  announce_sway_start = pkgs.writeTextFile {
+    name = "announce_sway_start.conf";
+    text = ''
+      # announce a running sway session to systemd
+      exec systemctl --user import-environment WAYLAND_DISPLAY DISPLAY XDG_CURRENT_DESKTOP SWAYSOCK I3SOCK XCURSOR_SIZE XCURSOR_THEME
+      exec dbus-update-activation-environment WAYLAND_DISPLAY DISPLAY XDG_CURRENT_DESKTOP SWAYSOCK I3SOCK XCURSOR_SIZE XCURSOR_THEME
+    '';
+  };
+
+  start_screen_share = pkgs.writeShellScriptBin "start_screen_share" ''
+    # Disable displaying notifications. This is useful for video conference screen sharing.
+    set -euo pipefail
+    IFS=$'\n\t'
+    DIR="$( cd "$( dirname "''${BASH_SOURCE[0]}" )" && pwd )"
+
+    makoctl set-mode do-not-disturb
+
+    swaymsg output "'Dell Inc. DELL U3014 P1V6N35M329L'" scale 2
+  '';
+  stop_screen_share = pkgs.writeShellScriptBin "stop_screen_share" ''
+    # Allow mako to show notifications again.
+    set -euo pipefail
+    IFS=$'\n\t'
+    DIR="$( cd "$( dirname "''${BASH_SOURCE [ 0 ]}" )" && pwd )"
+
+    makoctl set-mode default
+
+    swaymsg output "'Dell Inc. DELL U3014 P1V6N35M329L'" scale 1
+  '';
+in
+{
+  imports = [
+    ./graphical_session_target.nix
+    ./iso.nix
+    ./rofimoji.nix
+  ];
+
+  options.me.swayIncludes = lib.mkOption {
+    type = lib.types.listOf lib.types.package;
+    default = [ ];
+    example = lib.literalExpression ''
+      [ (pkgs.writeTextFile {
+          name = "launch-kanshi.conf";
+          text = "exec kanshi";
+        }) ]'';
+    description = "List of packages to import as sway configs.";
+  };
+
+  config = {
+    environment.systemPackages = with pkgs; [
+      alacritty
+      pcmanfm
+      start_screen_share
+      stop_screen_share
+    ];
+
+    me.swayIncludes = [
+      base-hotkeys
+      display-configs
+      window-management
+      movement
+      disable-focus-follows-mouse
+      background
+      touchpad_input
+      announce_sway_start
+    ];
+
+    services.seatd.enable = true;
+    # TODO: Maybe use `seatd-launch -- sway` instead of running the seatd daemon
+    users.users.talexander.extraGroups = [ "seat" ];
+
+    # Probably would be cleaner to use environment.sessionVariables but programs.sway.extraSessionCommands is sway-specific.
+    programs.sway.extraSessionCommands =
+      if config.me.buildingIso then
+        ''
+          export WLR_RENDERER_ALLOW_SOFTWARE=1
+          export NIXOS_OZONE_WL=1 # Wayland support for chromium and electron
+          export QT_QPA_PLATFORMTHEME=gtk3 # Use gtk theme in Qt applications
+        ''
+      else
+        ''
+          export WLR_RENDERER=vulkan
+          export NIXOS_OZONE_WL=1 # Wayland support for chromium and electron
+          export QT_QPA_PLATFORMTHEME=gtk3 # Use gtk theme in Qt applications
+        '';
+
+    programs.sway = {
+      enable = true;
+      wrapperFeatures.gtk = true;
+      extraOptions =
+        if config.me.buildingIso then
+          [
+            "--config"
+            "${sway-config}"
+            "--unsupported-gpu"
+          ]
+        else
+          [
+            "--config"
+            "${sway-config}"
+          ];
+    };
+
+    environment.persistence."/state" = lib.mkIf (!config.me.buildingIso) {
+      hideMounts = true;
+      users.talexander = {
+        files = [
+          ".local/state/tofi-drun-history" # A cache of the desktop files for tofi
+          ".cache/tofi-drun" # Execution history for tofi to sort results
+        ];
+      };
+    };
+
+    xdg = {
+      portal = {
+        enable = true;
+        extraPortals = with pkgs; [
+          xdg-desktop-portal-gtk
+        ];
+        wlr = {
+          enable = true;
+          settings = {
+            # uninteresting for this problem, for completeness only
+            screencast = {
+              # output_name = "eDP-1";
+              max_fps = 30;
+              exec_before = "${start_screen_share}";
+              exec_after = "${stop_screen_share}";
+              chooser_type = "simple";
+              chooser_cmd = "${pkgs.slurp}/bin/slurp -f %o -or";
+            };
+          };
+        };
+      };
+    };
+
+    home-manager.users.talexander =
+      { pkgs, ... }:
+      {
+        home.file = {
+          # Configure default programs (for example, default browser)
+          ".config/mimeapps.list" = {
+            source = ./files/mimeapps.list;
+          };
+        };
+        home.file = {
+          ".config/gtk-3.0/settings.ini" = {
+            source = ./files/settings.ini;
+          };
+        };
+        home.file = {
+          ".icons/default" = {
+            source = "${pkgs.adwaita-icon-theme}/share/icons/Adwaita";
+          };
+        };
+      };
+
+    # For mounting drives in pcmanfm
+    services.gvfs.enable = true;
+
+    # Auto-launch sway
+    # Run sway as the absolute last command in the login shell init. mkBefore = 500, plain = 1000, mkAfter = 1500
+    environment.loginShellInit = lib.mkOrder 2000 ''
+      [ -z "$WAYLAND_DISPLAY" ] && [ -n "$XDG_VTNR" ] && [ "$XDG_VTNR" -eq 1 ] && [ "$(tty)" = "/dev/tty1" ] && exec ${pkgs.systemd}/bin/systemd-cat --identifier=sway sway
+    '';
+  };
+}

nix/configuration/roles/sway/files/mimeapps.list

@@ -0,0 +1,23 @@
+[Default Applications]
+x-scheme-handler/http=firefox.desktop
+x-scheme-handler/https=firefox.desktop
+x-scheme-handler/chrome=firefox.desktop
+text/html=firefox.desktop
+application/x-extension-htm=firefox.desktop
+application/x-extension-html=firefox.desktop
+application/x-extension-shtml=firefox.desktop
+application/xhtml+xml=firefox.desktop
+application/x-extension-xhtml=firefox.desktop
+application/x-extension-xht=firefox.desktop
+
+[Added Associations]
+x-scheme-handler/http=firefox.desktop;
+x-scheme-handler/https=firefox.desktop;
+x-scheme-handler/chrome=firefox.desktop;
+text/html=firefox.desktop;
+application/x-extension-htm=firefox.desktop;
+application/x-extension-html=firefox.desktop;
+application/x-extension-shtml=firefox.desktop;
+application/xhtml+xml=firefox.desktop;
+application/x-extension-xhtml=firefox.desktop;
+application/x-extension-xht=firefox.desktop;

nix/configuration/roles/sway/files/settings.ini

@@ -0,0 +1,2 @@
+[Settings]
+gtk-application-prefer-dark-theme=1

nix/configuration/roles/sway/files/tofi-config

@@ -0,0 +1,3 @@
+border-width = 4
+outline-width = 1
+border-color = #FF6600

nix/configuration/roles/sway/graphical_session_target.nix

@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  start_sway_session = pkgs.writeTextFile {
+    name = "start_sway_session.conf";
+    text = ''
+      # Trigger graphical-session.target through sway-session.target so systemd user units can depend on it.
+      exec systemctl --user start sway-session.target
+    '';
+  };
+in
+{
+  imports = [ ];
+
+  me.swayIncludes = lib.mkAfter [
+    start_sway_session
+  ];
+
+}

nix/configuration/roles/sway/iso.nix

@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  launch_terminal = pkgs.writeTextFile {
+    name = "launch_terminal.conf";
+    text = ''
+      exec ${pkgs.alacritty}/bin/alacritty
+    '';
+  };
+in
+{
+  imports = [ ];
+
+  config = lib.mkIf (config.me.buildingIso) {
+    # Launch a terminal at boot in the live ISO for when hotkeys don't work.
+    me.swayIncludes = [
+      launch_terminal
+    ];
+  };
+}

nix/configuration/roles/sway/rofimoji.nix

@@ -0,0 +1,69 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  rofimoji_sway_config = pkgs.writeTextFile {
+    name = "rofimoji.conf";
+    text = ''
+      # Emoji selector
+      bindsym $mod+backslash exec ${pkgs.rofimoji}/bin/rofimoji --selector tofi
+    '';
+  };
+in
+{
+  imports = [ ];
+
+  config = lib.mkIf config.me.graphical {
+    me.swayIncludes = [
+      rofimoji_sway_config
+    ];
+
+    environment.persistence."/state" = lib.mkIf (!config.me.buildingIso) {
+      hideMounts = true;
+      users.talexander = {
+        directories = [
+          {
+            directory = ".local/share/rofimoji";
+            user = "talexander";
+            group = "talexander";
+            mode = "0755";
+          }
+        ];
+      };
+    };
+
+    nixpkgs.overlays = [
+      (final: prev: {
+        rofimoji = prev.rofimoji.overrideAttrs (old: {
+          propagatedBuildInputs = old.propagatedBuildInputs ++ [ pkgs.tofi ];
+          # postInstall =
+          #   old.postInstall
+          #   + ''
+          #     wrapProgram $out/bin/rofimoji --prefix PATH : ${lib.makeBinPath [ pkgs.wofi ]}
+          #   '';
+          src = builtins.fetchGit {
+            # https://github.com/fdw/rofimoji/issues/209
+            url = "https://github.com/fdw/rofimoji.git";
+            rev = "615f00abeb984f3e648ef712164aa4e61f2e1808";
+          };
+        });
+      })
+      (final: prev: {
+        tofi = prev.tofi.overrideAttrs (old: {
+          nativeBuildInputs = old.nativeBuildInputs or [ ] ++ [ pkgs.makeWrapper ];
+          postInstall =
+            old.postInstall or ""
+            + ''
+              wrapProgram $out/bin/tofi-drun --add-flags --font=${pkgs.source-sans-pro}/share/fonts/opentype/SourceSansPro-Regular.otf --add-flags --config=${./files/tofi-config}
+              wrapProgram $out/bin/tofi --add-flags --config=${./files/tofi-config}
+            '';
+        });
+      })
+
+    ];
+  };
+}

nix/configuration/roles/terraform/default.nix

@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  alias_tf = pkgs.writeShellScriptBin "tf" ''
+    exec ${pkgs.terraform}/bin/terraform "''${@}"
+  '';
+in
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    terraform
+    alias_tf
+  ];
+
+  allowedUnfree = [
+    "terraform"
+  ];
+
+  environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
+    hideMounts = true;
+    users.talexander = {
+      directories = [
+        {
+          directory = ".terraform.d";
+          user = "talexander";
+          group = "talexander";
+          mode = "0755";
+        }
+      ];
+    };
+  };
+}

nix/configuration/roles/vnc_client/default.nix

@@ -0,0 +1,16 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  config = lib.mkIf config.me.graphical {
+    environment.systemPackages = with pkgs; [
+      wlvncc
+    ];
+  };
+}

nix/configuration/roles/vscode/default.nix

@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  config = lib.mkIf config.me.graphical {
+    allowedUnfree = [
+      "vscode"
+      "vscode-with-extensions"
+      "vscode-extension-ms-vscode-remote-remote-ssh"
+    ];
+
+    environment.systemPackages = with pkgs; [
+      (vscode-with-extensions.override {
+        vscodeExtensions = with vscode-extensions; [
+          bbenoist.nix
+          ms-python.python
+          ms-azuretools.vscode-docker
+          ms-vscode-remote.remote-ssh
+        ]
+        # ++ pkgs.vscode-utils.extensionsFromVscodeMarketplace [
+        #   {
+        #     name = "remote-ssh-edit";
+        #     publisher = "ms-vscode-remote";
+        #     version = "0.47.2";
+        #     sha256 = "1hp6gjh4xp2m1xlm1jsdzxw9d8frkiidhph6nvl24d0h8z34w49g";
+        #   }
+        # ]
+        ;
+      })
+    ];
+
+    home-manager.users.talexander =
+      { pkgs, ... }:
+      {
+        home.file.".config/Code/User/settings.json" = {
+          source = ./files/settings.json;
+        };
+        home.file.".config/Code/User/keybindings.json" = {
+          source = ./files/keybindings.json;
+        };
+      };
+  };
+}

nix/configuration/roles/vscode/files/keybindings.json

@@ -0,0 +1,280 @@
+// Place your key bindings in this file to override the defaultsauto[]
+[
+    {
+        "key": "alt+.",
+        "command": "editor.action.revealDefinition",
+        "when": "editorHasDefinitionProvider && editorTextFocus && !isInEmbeddedEditor"
+    },
+    {
+        "key": "f12",
+        "command": "-editor.action.revealDefinition",
+        "when": "editorHasDefinitionProvider && editorTextFocus && !isInEmbeddedEditor"
+    },
+    {
+        "key": "alt+,",
+        "command": "workbench.action.navigateBack",
+        "when": "canNavigateBack"
+    },
+    {
+        "key": "ctrl+alt+-",
+        "command": "-workbench.action.navigateBack",
+        "when": "canNavigateBack"
+    },
+    {
+        "key": "shift+alt+/",
+        "command": "editor.action.goToReferences",
+        "when": "editorHasReferenceProvider && editorTextFocus && !inReferenceSearchEditor && !isInEmbeddedEditor"
+    },
+    {
+        "key": "shift+f12",
+        "command": "-editor.action.goToReferences",
+        "when": "editorHasReferenceProvider && editorTextFocus && !inReferenceSearchEditor && !isInEmbeddedEditor"
+    },
+    {
+        "key": "ctrl+alt+.",
+        "command": "workbench.action.showAllSymbols"
+    },
+    {
+        "key": "ctrl+t",
+        "command": "-workbench.action.showAllSymbols"
+    },
+    {
+        "key": "alt+;",
+        "command": "editor.action.commentLine",
+        "when": "editorTextFocus && !editorReadonly"
+    },
+    {
+        "key": "ctrl+/",
+        "command": "-editor.action.commentLine",
+        "when": "editorTextFocus && !editorReadonly"
+    },
+    {
+        "key": "ctrl+x",
+        "command": "-editor.action.clipboardCutAction"
+    },
+    {
+        "key": "ctrl+x",
+        "command": "-filesExplorer.cut",
+        "when": "filesExplorerFocus && foldersViewVisible && !explorerResourceIsRoot && !explorerResourceReadonly && !inputFocus"
+    },
+    {
+        "key": "ctrl+x 3",
+        "command": "workbench.action.splitEditor"
+    },
+    {
+        "key": "ctrl+\\",
+        "command": "-workbench.action.splitEditor"
+    },
+    {
+        "key": "ctrl+x 2",
+        "command": "workbench.action.splitEditorDown"
+    },
+    {
+        "key": "ctrl+k ctrl+\\",
+        "command": "-workbench.action.splitEditorDown"
+    },
+    {
+        "key": "ctrl+x 1",
+        "command": "workbench.action.joinAllGroups"
+    },
+    {
+        "key": "ctrl+x 0",
+        "command": "workbench.action.closeEditorsAndGroup"
+    },
+    {
+        "key": "ctrl+x shift+=",
+        "command": "workbench.action.evenEditorWidths"
+    },
+    {
+        "key": "shift+up",
+        "command": "workbench.action.focusAboveGroup"
+    },
+    {
+        "key": "ctrl+k ctrl+up",
+        "command": "-workbench.action.focusAboveGroup"
+    },
+    {
+        "key": "shift+down",
+        "command": "workbench.action.focusBelowGroup"
+    },
+    {
+        "key": "ctrl+k ctrl+down",
+        "command": "-workbench.action.focusBelowGroup"
+    },
+    {
+        "key": "shift+left",
+        "command": "workbench.action.focusLeftGroup"
+    },
+    {
+        "key": "ctrl+k ctrl+left",
+        "command": "-workbench.action.focusLeftGroup"
+    },
+    {
+        "key": "shift+right",
+        "command": "workbench.action.focusRightGroup"
+    },
+    {
+        "key": "ctrl+k ctrl+right",
+        "command": "-workbench.action.focusRightGroup"
+    },
+    {
+        "key": "ctrl+x ctrl+s",
+        "command": "workbench.action.files.save"
+    },
+    {
+        "key": "ctrl+s",
+        "command": "-workbench.action.files.save"
+    },
+    {
+        "key": "alt+g g",
+        "command": "workbench.action.gotoLine"
+    },
+    {
+        "key": "ctrl+g",
+        "command": "-workbench.action.gotoLine"
+    },
+    {
+        "key": "ctrl+space",
+        "command": "editor.action.setSelectionAnchor",
+        "when": "editorTextFocus"
+    },
+    {
+        "key": "ctrl+k ctrl+b",
+        "command": "-editor.action.setSelectionAnchor",
+        "when": "editorTextFocus"
+    },
+    {
+        "key": "alt+w",
+        "command": "editor.action.clipboardCopyAction"
+    },
+    {
+        "key": "ctrl+c",
+        "command": "-editor.action.clipboardCopyAction"
+    },
+    {
+        "key": "ctrl+w",
+        "command": "editor.action.clipboardCutAction"
+    },
+    {
+        "key": "ctrl+y",
+        "command": "editor.action.clipboardPasteAction"
+    },
+    {
+        "key": "ctrl+v",
+        "command": "-editor.action.clipboardPasteAction"
+    },
+    {
+        "key": "ctrl+x p f",
+        "command": "workbench.action.quickOpen"
+    },
+    {
+        "key": "ctrl+e",
+        "command": "-workbench.action.quickOpen"
+    },
+    {
+        "key": "ctrl+a",
+        "command": "cursorLineStart"
+    },
+    {
+        "key": "ctrl+e",
+        "command": "cursorLineEnd"
+    },
+    {
+        "key": "ctrl+s",
+        "command": "actions.find",
+        "when": "editorFocus || editorIsOpen"
+    },
+    {
+        "key": "ctrl+f",
+        "command": "-actions.find",
+        "when": "editorFocus || editorIsOpen"
+    },
+    {
+        "key": "ctrl+shift+-",
+        "command": "undo"
+    },
+    {
+        "key": "ctrl+z",
+        "command": "-undo"
+    },
+    {
+        "key": "alt+x",
+        "command": "workbench.action.showCommands"
+    },
+    {
+        "key": "ctrl+shift+p",
+        "command": "-workbench.action.showCommands"
+    },
+    {
+        "key": "ctrl+c ctrl+a",
+        "command": "editor.action.quickFix",
+        "when": "editorHasCodeActionsProvider && textInputFocus && !editorReadonly"
+    },
+    {
+        "key": "ctrl+.",
+        "command": "-editor.action.quickFix",
+        "when": "editorHasCodeActionsProvider && textInputFocus && !editorReadonly"
+    },
+    {
+        "key": "shift+alt+5",
+        "command": "editor.action.startFindReplaceAction",
+        "when": "editorFocus || editorIsOpen"
+    },
+    {
+        "key": "ctrl+h",
+        "command": "-editor.action.startFindReplaceAction",
+        "when": "editorFocus || editorIsOpen"
+    },
+    {
+        "key": "shift+1",
+        "command": "editor.action.replaceAll",
+        "when": "editorFocus && findWidgetVisible"
+    },
+    {
+        "key": "ctrl+alt+enter",
+        "command": "-editor.action.replaceAll",
+        "when": "editorFocus && findWidgetVisible"
+    },
+    {
+        "key": "shift+alt+,",
+        "command": "cursorTop",
+        "when": "textInputFocus"
+    },
+    {
+        "key": "ctrl+home",
+        "command": "-cursorTop",
+        "when": "textInputFocus"
+    },
+    {
+        "key": "shift+alt+.",
+        "command": "cursorBottom",
+        "when": "textInputFocus"
+    },
+    {
+        "key": "ctrl+end",
+        "command": "-cursorBottom",
+        "when": "textInputFocus"
+    },
+    {
+        "key": "ctrl+x ctrl+f",
+        "command": "workbench.action.files.openFile",
+        "when": "true"
+    },
+    {
+        "key": "ctrl+o",
+        "command": "-workbench.action.files.openFile",
+        "when": "true"
+    },
+    {
+        "key": "ctrl+x k",
+        "command": "workbench.action.closeEditorInAllGroups"
+    },
+    {
+        "key": "ctrl+x b",
+        "command": "workbench.action.showAllEditors"
+    },
+    {
+        "key": "ctrl+k ctrl+p",
+        "command": "-workbench.action.showAllEditors"
+    }
+]

nix/configuration/roles/vscode/files/settings.json

@@ -0,0 +1,41 @@
+{
+  "application.shellEnvironmentResolutionTimeout": 90,
+  "workbench.colorTheme": "Default High Contrast",
+  "remote.SSH.connectTimeout": 90,
+  "remote.SSH.enableDynamicForwarding": false,
+  "remote.SSH.enableAgentForwarding": false,
+  "remote.SSH.enableX11Forwarding": false,
+  "python.analysis.inlayHints.functionReturnTypes": true,
+  "python.analysis.inlayHints.variableTypes": true,
+  "editor.minimap.enabled": false,
+  "editor.fontSize": 12,
+  "editor.cursorStyle": "block",
+  "editor.fontFamily": "'Cascadia Mono', 'monospace', monospace",
+  "workbench.colorCustomizations": {
+    "editorCursor.foreground": "#ccff66",
+    "terminalCursor.foreground": "#ccff66"
+  },
+  "workbench.editor.showTabs": "none",
+  "workbench.activityBar.location": "hidden",
+  "window.menuBarVisibility": "toggle",
+  "explorer.autoReveal": false,
+  "[python]": {
+    "editor.defaultFormatter": "ms-python.black-formatter",
+    "editor.formatOnSave": true
+  },
+  "[terraform]": {
+    "editor.defaultFormatter": "hashicorp.terraform",
+    "editor.formatOnSave": true
+  },
+  "[terraform-vars]": {
+    "editor.defaultFormatter": "hashicorp.terraform",
+    "editor.formatOnSave": true
+  },
+  "black-formatter.importStrategy": "fromEnvironment",
+  "workbench.statusBar.visible": false,
+  "git.openRepositoryInParentFolders": "never",
+  "files.autoSave": "afterDelay",
+  "editor.rulers": [
+    100
+  ]
+}

nix/configuration/roles/wasm/default.nix

@@ -0,0 +1,16 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    wabt
+    wasm-bindgen-cli
+    binaryen # for wasm-opt
+  ];
+}

nix/configuration/roles/waybar/default.nix

@@ -0,0 +1,116 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  waybar_sway_config = pkgs.writeTextFile {
+    name = "waybar.conf";
+    text = ''
+      #
+      # Status Bar:
+      #
+      # Read `man 5 sway-bar` for more information about this section.
+      bar {
+          position top
+
+          font pango:Cascadia Mono, FontAwesome 10
+          swaybar_command waybar
+
+          colors {
+              statusline #ffffff
+              background #323232
+              inactive_workspace #32323200 #32323200 #5c5c5c
+          }
+      }
+    '';
+  };
+
+  waybar_available_memory =
+    (pkgs.writeScriptBin "waybar_custom_available_memory" (
+      builtins.readFile ./files/waybar_scripts/waybar_available_memory_linux.bash
+    )).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+  waybar_battery =
+    (pkgs.writeScriptBin "waybar_custom_battery" (
+      builtins.readFile ./files/waybar_scripts/waybar_battery_linux.bash
+    )).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+  waybar_clock =
+    (pkgs.writeScriptBin "waybar_custom_clock" (
+      builtins.readFile ./files/waybar_scripts/waybar_custom_clock.py
+    )).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+  waybar_night_mode =
+    (pkgs.writeScriptBin "waybar_night_mode" (
+      builtins.readFile ./files/waybar_scripts/waybar_night_mode.bash
+    )).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+  waybar_sound =
+    (pkgs.writeScriptBin "waybar_custom_sound" (
+      builtins.readFile ./files/waybar_scripts/waybar_sound_linux.bash
+    )).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+  waybar_temperature =
+    (pkgs.writeScriptBin "waybar_custom_temperature" (
+      builtins.readFile ./files/waybar_scripts/waybar_temperature_linux.bash
+    )).overrideAttrs
+      (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+
+      });
+in
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    waybar
+    waybar_available_memory
+    waybar_battery
+    waybar_clock
+    waybar_night_mode
+    waybar_sound
+    waybar_temperature
+    python3 # for clock TODO python should not be in the system packages, maybe switch to a venv? ref https://nixos.wiki/wiki/Python
+    bc # for temperature and sound
+    jq # for memory, battery, sound, night mode, and temperature
+    upower # for battery
+    wlsunset # for night mode
+  ];
+
+  me.swayIncludes = [
+    waybar_sway_config
+  ];
+
+  services.upower.enable = true; # for battery
+
+  home-manager.users.talexander =
+    { pkgs, ... }:
+    {
+      home.file = {
+        ".config/waybar/config" = {
+          source = ./files/waybar_config.json;
+        };
+        ".config/waybar/style.css" = {
+          source = ./files/style.css;
+        };
+      };
+    };
+
+}

nix/configuration/roles/waybar/files/style.css

@@ -0,0 +1,211 @@
+/* Work-around for regressions introduced in 0.9.15 */
+* {
+  all: unset;
+}
+
+/* Reset all styles */
+* {
+  border: none;
+  border-radius: 0;
+  min-height: 0;
+  margin: 0;
+  padding: 0;
+}
+
+/* -----------------------------------------------------------------------------
+ * Keyframes
+ * -------------------------------------------------------------------------- */
+
+@keyframes blink-warning {
+  70% {
+    color: white;
+  }
+
+  to {
+    color: white;
+    background-color: orange;
+  }
+}
+
+@keyframes blink-critical {
+  70% {
+    color: white;
+  }
+
+  to {
+    color: white;
+    background-color: red;
+  }
+}
+
+/* -----------------------------------------------------------------------------
+ * Base styles
+ * -------------------------------------------------------------------------- */
+
+/* The whole bar */
+#waybar {
+  background: #323232;
+  color: white;
+  font-family:
+    Cascadia Mono,
+    monospace;
+  font-size: 10px;
+}
+
+tooltip {
+  background-color: #323232;
+}
+
+/* Each module */
+#battery,
+#clock,
+#cpu,
+#custom-available_memory,
+#custom-battery,
+#custom-clock,
+#custom-night_mode,
+#custom-sound,
+#custom-temperature,
+#idle_inhibitor,
+#memory,
+#mode,
+#network,
+#pulseaudio,
+#temperature,
+#tray {
+  padding-left: 10px;
+  padding-right: 10px;
+  border: 1px solid white;
+}
+
+/* -----------------------------------------------------------------------------
+ * Module styles
+ * -------------------------------------------------------------------------- */
+
+#battery {
+  animation-timing-function: linear;
+  animation-iteration-count: infinite;
+  animation-direction: alternate;
+}
+
+#custom-battery.warning {
+  color: orange;
+}
+
+#custom-battery.critical {
+  color: red;
+}
+
+#battery.warning.discharging {
+  animation-name: blink-warning;
+  animation-duration: 3s;
+}
+
+#battery.critical.discharging {
+  animation-name: blink-critical;
+  animation-duration: 2s;
+}
+
+#clock {
+  font-weight: bold;
+}
+
+#custom-clock {
+  font-weight: bold;
+}
+
+#cpu {
+  /* No styles */
+}
+
+#cpu.warning {
+  color: orange;
+}
+
+#cpu.critical {
+  color: red;
+}
+
+#memory {
+  animation-timing-function: linear;
+  animation-iteration-count: infinite;
+  animation-direction: alternate;
+}
+
+#memory.warning {
+  color: orange;
+}
+
+#memory.critical {
+  color: red;
+  animation-name: blink-critical;
+  animation-duration: 2s;
+}
+
+#mode {
+  background: #64727d;
+  border-top: 2px solid white;
+  /* To compensate for the top border and still have vertical centering */
+  padding-bottom: 2px;
+}
+
+#window {
+  padding-left: 10px;
+  padding-right: 10px;
+}
+
+#network {
+  /* No styles */
+}
+
+#network.disconnected {
+  color: orange;
+}
+
+#pulseaudio {
+  /* No styles */
+}
+
+#pulseaudio.muted {
+  /* No styles */
+}
+
+#custom-spotify {
+  color: rgb(102, 220, 105);
+}
+
+#temperature {
+  /* No styles */
+}
+
+#temperature.critical {
+  color: red;
+}
+
+#tray {
+  /* No styles */
+}
+
+#window {
+  font-weight: bold;
+}
+
+#workspaces button {
+  border-top: 2px solid transparent;
+  /* To compensate for the top border and still have vertical centering */
+  padding-bottom: 2px;
+  padding-left: 10px;
+  padding-right: 10px;
+  color: #888888;
+}
+
+#workspaces button.focused {
+  border-color: #4c7899;
+  color: white;
+  background-color: #285577;
+}
+
+#workspaces button.urgent {
+  border-color: #c9545d;
+  color: #c9545d;
+}

nix/configuration/roles/waybar/files/waybar_config.json

@@ -0,0 +1,57 @@
+{
+  // "height": 10, // Waybar height (to be removed for auto height)
+  "modules-left": ["sway/workspaces", "sway/mode"],
+  "modules-center": ["sway/window"],
+  "modules-right": ["custom/night_mode", "custom/temperature", "custom/sound", "custom/available_memory", "custom/battery", "idle_inhibitor", "custom/clock", "tray"],
+  "sway/workspaces": {
+    "disable-scroll": true
+  },
+  "sway/mode": {
+    "format": "<span style=\"italic\">{}</span>"
+  },
+  "sway/window": {
+    "format": "{title}"
+  },
+  "idle_inhibitor": {
+    "format": "{icon}",
+    "format-icons": {
+      "activated": "☕",//☕
+      "deactivated": "💤"//☾☁⛾⛔⏾⌛⏳💤
+    }
+  },
+  "tray": {
+    // "icon-size": 21,
+    "spacing": 10
+  },
+  "custom/clock": {
+    "exec": "waybar_custom_clock",
+    "return-type": "json",
+    "restart-interval": 30
+  },
+  "custom/battery": {
+    "exec": "waybar_custom_battery",
+    "return-type": "json",
+    "restart-interval": 30
+  },
+  "custom/available_memory": {
+    "exec": "waybar_custom_available_memory",
+    "return-type": "json",
+    "restart-interval": 30
+  },
+  "custom/sound": {
+    "exec": "waybar_custom_sound",
+    "return-type": "json",
+    "restart-interval": 30
+  },
+  "custom/temperature": {
+    "exec": "waybar_custom_temperature",
+    "return-type": "json",
+    "restart-interval": 30
+  },
+  "custom/night_mode": {
+    "exec": "waybar_night_mode",
+    "return-type": "json",
+    "restart-interval": 30,
+    "on-click": "pkill -USR1 -f waybar_night_mode"
+  }
+}

nix/configuration/roles/waybar/files/waybar_scripts/waybar_available_memory_linux.bash

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+#
+# Read memory usage in Linux
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+SLEEP_INTERVAL=${SLEEP_INTERVAL:-30}
+
+while true; do
+    memory_usage=$(free --bytes --wide)
+    total_bytes=$(grep 'Mem:' <<<"$memory_usage" | awk '{print $2}')
+    free_bytes=$(grep 'Mem:' <<<"$memory_usage" | awk '{print $4}')
+
+    free_percent=$((100 * free_bytes / total_bytes))
+    text=""
+
+    if [ $free_bytes -ge $((1024 * 1024 * 1024)) ]; then
+        text="$((free_bytes / 1024 / 1024 / 1024)) GiB"
+    fi
+
+    tooltip="${free_percent}%"
+
+    jq --unbuffered --compact-output <<EOF
+{
+"text":"${text}",
+"tooltip":"${tooltip}",
+"percentage":${free_percent}
+}
+EOF
+    sleep $SLEEP_INTERVAL
+done

nix/configuration/roles/waybar/files/waybar_scripts/waybar_battery_linux.bash

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+#
+# Read battery status in Linux
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+batteries=$(upower --enumerate | grep BAT)
+
+function generate_battery_update {
+    local battery_path=$1
+    local battery_status=$(upower --show-info "$battery_path")
+    local battery_state=$(grep 'state:' <<<"$battery_status" | awk '{print $2}')
+    local battery_percentage=$(grep 'percentage:' <<<"$battery_status" | awk '{print $2}')
+    battery_percentage=${battery_percentage%\%}
+    set +e
+    local time_remaining=$(grep 'time to empty:' <<<"$battery_status" | sed 's/\W*time to empty:\W*//g')
+    local tooltip="$time_remaining until empty"
+    if [ -z "$time_remaining" ]; then
+        time_remaining=$(grep 'time to full:' <<<"$battery_status" | sed 's/\W*time to full:\W*//g')
+        if [ -z "$time_remaining" ]; then
+            tooltip="fully charged"
+        else
+            tooltip="$time_remaining until full"
+        fi
+    fi
+    set -e
+    local battery_icon=""
+    local class=""
+
+    if [ $battery_state = "charging" ]; then
+        if [ $battery_percentage -eq 100 ]; then
+            battery_icon="⚡"
+        else
+            battery_icon="⚡"
+        fi
+    elif [ $battery_percentage -le 12 ]; then
+        battery_icon="⚠"
+    elif [ $battery_percentage -le 25 ]; then
+        battery_icon="▁"
+    elif [ $battery_percentage -le 37 ]; then
+        battery_icon="▂"
+    elif [ $battery_percentage -le 50 ]; then
+        battery_icon="▃"
+    elif [ $battery_percentage -le 62 ]; then
+        battery_icon="▄"
+    elif [ $battery_percentage -le 75 ]; then
+        battery_icon="▅"
+    elif [ $battery_percentage -le 87 ]; then
+        battery_icon="▆"
+    elif [ $battery_percentage -lt 100 ]; then
+        battery_icon="▇"
+    else
+        battery_icon="█"
+    fi
+
+    if [ $battery_percentage -le 15 ]; then
+        class="critical"
+    elif [ $battery_percentage -le 30 ]; then
+        class="warning"
+    fi
+        jq --unbuffered --compact-output <<EOF
+{
+"text":"${battery_percentage}% ${battery_icon}",
+"tooltip":"$tooltip",
+"percentage":${battery_percentage},
+"class":"${class}"
+}
+EOF
+}
+
+while read bat; do
+    generate_battery_update "$bat"
+done<<<"$batteries"
+
+upower --monitor | grep --line-buffered 'device changed:' | while read l; do
+    while read bat; do
+        generate_battery_update "$bat"
+    done<<<"$batteries"
+done

nix/configuration/roles/waybar/files/waybar_scripts/waybar_custom_clock.py

@@ -0,0 +1,107 @@
+#!/usr/bin/env python
+#
+# Custom waybar module for clocks. Implemented because the official clock module was downloading timezone definitions on every boot.
+import datetime
+import json
+import sys
+import time
+from dataclasses import dataclass
+from functools import lru_cache
+from typing import Final, List, Optional
+from zoneinfo import ZoneInfo
+
+LOCAL_TIMEZONE = datetime.datetime.now(datetime.timezone.utc).astimezone().tzinfo
+
+
+@dataclass
+class Update:
+    text: Optional[str]
+    alt: Optional[str]
+    tooltip: Optional[str]
+    css_class: Optional[List[str]]
+    percentage: Optional[str]
+
+    def dump(self) -> str:
+        # Dump a dict because we can't name our member variable "class"
+        return json.dumps(
+            {
+                k: v
+                for k, v in {
+                    "text": self.text,
+                    "alt": self.alt,
+                    "tooltip": self.tooltip,
+                    "class": self.css_class,
+                    "percentage": self.percentage,
+                }.items()
+                if v is not None
+            }
+        )
+
+
+@lru_cache(maxsize=1)
+def make_calendar(today: datetime.date, tz: datetime.tzinfo):
+    width: Final[int] = 20
+    start_of_month = today.replace(day=1)
+    month_header = today.strftime("%B %Y")
+    padding = width - len(month_header)
+    right_padding = " " * (padding // 2)
+    left_padding = right_padding + (" " if padding % 2 == 1 else "")
+    header = f"{left_padding}{month_header}{right_padding}"
+    days_of_week = "Su Mo Tu We Th Fr Sa"
+
+    timezone_str = str(tz)
+
+    # Make the grid
+    first_day_padding = " " * (
+        0 if start_of_month.weekday() == 6 else (3 * (1 + start_of_month.weekday())) - 1
+    )
+    output = f"{header}\n{days_of_week}\n{first_day_padding}"
+
+    print_day = start_of_month
+    while print_day.month == today.month:
+        if print_day.weekday() == 6:
+            output += "\n"
+        else:
+            output += " "
+        if print_day == today:
+            output += '<span foreground="#323232" background="#CCCCCC">'
+        output += f"{print_day.day: >2}"
+        if print_day == today:
+            output += "</span>"
+        print_day += datetime.timedelta(days=1)
+
+    output += f'\n<span size="small">{timezone_str}</span>'
+    return output
+
+
+def main():
+    tz: Optional[datetime.tzinfo] = (
+        ZoneInfo(sys.argv[1]) if len(sys.argv) >= 2 else LOCAL_TIMEZONE
+    )
+    if tz is None:
+        raise Exception("Failed to detect timezone.")
+
+    next_update = time.time()
+    while True:
+        time_before_next_update = next_update - time.time()
+        if time_before_next_update > 0:
+            time.sleep(time_before_next_update)
+        next_update = 60 * (1 + int(time.time()) // 60)
+
+        now = datetime.datetime.now(tz=tz)
+        text = now.strftime("%Y-%m-%d %H:%M:%S")
+        tooltip = make_calendar(now.date(), tz)
+
+        out = Update(
+            text=text,
+            alt="foo",
+            tooltip=f"<tt>{tooltip}</tt>",
+            css_class=["foo"],
+            percentage="100",
+        )
+
+        print(out.dump(), flush=True)
+
+
+if __name__ == "__main__":
+    main()

nix/configuration/roles/waybar/files/waybar_scripts/waybar_night_mode.bash

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+#
+# Power an icon for tinting the screen at night.
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+SLEEP_INTERVAL=${SLEEP_INTERVAL:-30}
+
+# ◓◒●◌◎
+# 🔴🔵🟠🟡🟢🟣🟤
+# 🟥🟦🟧🟨🟩🟪🟫
+# ☀☯⭐🌝🌞⏾
+# 🌑🌓🌗🌕
+# 👓
+
+############## Setup #########################
+
+function cleanup {
+    log "Killing child process $wlsunset_pid"
+    kill "$wlsunset_pid"
+    true
+}
+for sig in EXIT; do
+  trap "set +e; cleanup" "$sig"
+done
+
+function die {
+    local status_code="$1"
+    shift
+    (>&2 echo "${@}")
+    exit "$status_code"
+}
+
+function log {
+    (>&2 echo "${@}")
+}
+
+############## Program #########################
+
+function main {
+    local night_mode_icon night_mode_text night_mode_class
+    night_mode_mode="auto"
+    night_mode_class=""
+    wlsunset -S 07:00 -s 22:00 &
+    wlsunset_pid=$!
+
+    while true; do
+        if [ "$night_mode_mode" == "auto" ]; then
+            night_mode_icon="🌗"
+            night_mode_text="auto"
+        elif [ "$night_mode_mode" == "on" ]; then
+            night_mode_icon="🌑"
+            night_mode_text="night"
+        elif [ "$night_mode_mode" == "off" ]; then
+            night_mode_icon="🌕"
+            night_mode_text="day"
+        fi
+
+        render
+        sleep "$SLEEP_INTERVAL" &
+        wait $! || true
+    done
+}
+
+function render {
+    jq --unbuffered --compact-output <<EOF
+{
+"text":"${night_mode_icon}",
+"tooltip":"${night_mode_text}",
+"percentage":100,
+"class":"${night_mode_class}"
+}
+EOF
+}
+
+function handle_click {
+    if [ "$night_mode_mode" == "auto" ]; then
+        log "Setting night mode to force-day."
+        night_mode_mode="off"
+    elif [ "$night_mode_mode" == "on" ]; then
+        log "Setting night mode to auto."
+        night_mode_mode="auto"
+    elif [ "$night_mode_mode" == "off" ]; then
+        log "Setting night mode to force-night."
+        night_mode_mode="on"
+    fi
+    kill -s SIGUSR1 "$wlsunset_pid"
+}
+
+trap "handle_click" SIGUSR1
+
+main "${@}"

nix/configuration/roles/waybar/files/waybar_scripts/waybar_sound_linux.bash

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+#
+# Read volume status in Linux
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+SLEEP_INTERVAL=${SLEEP_INTERVAL:-30}
+
+while true; do
+    current_vol_decimal=$(wpctl get-volume @DEFAULT_AUDIO_SINK@ | sed 's/Volume: //g')
+    if [[ "$current_vol_decimal" = *MUTED* ]]; then
+        current_vol_percent=0
+    else
+        current_vol_percent=$(bc -s <<<"$current_vol_decimal * 100")
+        current_vol_percent=${current_vol_percent%.*} # Remove decimal
+    fi
+    tooltip="<tt>$(wpctl status)</tt>"
+    tooltip=${tooltip//$'\n'/\\n}
+    tooltip=${tooltip//$'\t'/\\t}
+    class=""
+    icon=""
+
+    if [ $current_vol_percent -eq 0 ]; then
+        icon="🔇"
+    elif [ $current_vol_percent -le 50 ]; then
+        icon="🔉"
+    else
+        icon="🔊"
+    fi
+
+    jq --unbuffered --compact-output <<EOF
+{
+"text":"${current_vol_percent}% ${icon}",
+"tooltip":"${tooltip}",
+"percentage":${current_vol_percent},
+"class":"${class}"
+}
+EOF
+    sleep $SLEEP_INTERVAL
+done