Fix ending video recording sessions.

This can be re-enabled after I have a flake building nixbsd so I can specify overlays.

nix/configuration/configuration.nix

@@ -1,9 +1,16 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
 
+let
+  alias_nix_pin_revision = pkgs.writeShellScriptBin "nix-pin-revision" ''
+    # Usage: nix-pin-revision nixpkgs 'github:NixOS/nixpkgs/00c21e4c93d963c50d4c0c89bfa84ed6e0694df2'
+    exec nix flake lock --override-input "''${@}"
+  '';
+in
 {
   imports = [
     ./roles/2ship2harkinian
@@ -47,6 +54,7 @@
     ./roles/iso_mount
     ./roles/jujutsu
     ./roles/kanshi
+    ./roles/kernel
     ./roles/kodi
     ./roles/kubernetes
     ./roles/latex
@@ -119,6 +127,9 @@
     nix.settings.max-free = 1000000000;
     nix.settings.fallback = true;
     nix.settings.warn-dirty = false;
+    nix.settings.fsync-metadata = true;
+    # Ensure store paths are durably written to disk before registering the paths so a crash mid-build does not leave us in a corrupted state.
+    nix.settings.fsync-store-paths = true;
 
     hardware.enableRedistributableFirmware = true;
 
@@ -129,7 +140,8 @@
     # Automatic garbage collection
     nix.gc = lib.mkIf (!config.me.buildingPortable) {
       # Runs nix-collect-garbage --delete-older-than 5d
-      automatic = true;
+      # automatic = true;
+      automatic = false;
       persistent = true;
       dates = "monthly";
       # randomizedDelaySec = "14m";
@@ -137,6 +149,10 @@
     };
     nix.settings.auto-optimise-store = !config.me.buildingPortable;
 
+    environment.systemPackages = [
+      alias_nix_pin_revision
+    ];
+
     environment.persistence."/persist" = lib.mkIf (config.me.mountPersistence) {
       hideMounts = true;
       directories = [
@@ -220,13 +236,32 @@
         );
       in
       [
-        (disableTests "coreutils")
-        (disableTests "coreutils-full")
-        (disableTests "libuv")
-        (final: prev: {
-          inherit (final.unoptimized) libtpms libjxl;
-        })
+        (disableTests "deno") # Tests use too much disk space
+        (disableOptimizations "libtpms")
         (disableOptimizationsPython3 "scipy")
+        (disableOptimizations "assimp")
+        (disableOptimizations "gsl")
+        (final: prev: {
+          rpcs3 = prev.rpcs3.override {
+            glew = (final.glew.override { enableEGL = false; });
+          };
+        })
+        (final: prev: {
+          fwupd = prev.fwupd.overrideAttrs (
+            finalAttrs: prevAttrs: {
+              version = "2.1.5";
+              src = final.fetchFromGitHub {
+                owner = "fwupd";
+                repo = "fwupd";
+                tag = finalAttrs.version;
+                hash = "sha256-DzQ+N99ZmFRqZc2rN6PSqmoIMXUyrE8Kkn+KnT/AWPc=";
+              };
+            }
+          );
+        })
+        (disableTests "onetbb") # oneTBB tests hang forever on machines with a single core (like my build virtual machine) https://github.com/uxlfoundation/oneTBB/issues/1557
+        (disableTests "aws-c-common") # aws-c-common tests time out on my build virtual machine but run fine on my laptop.
+
         # Works but probably sets python2's scipy to be python3:
         #
         # (final: prev: {

nix/configuration/flake.lock

@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769524058,
-        "narHash": "sha256-zygdD6X1PcVNR2PsyK4ptzrVEiAdbMqLos7utrMDEWE=",
+        "lastModified": 1780894562,
+        "narHash": "sha256-c3430xwxwhHipl3jigUGMMBfpaMylDqytW/kdmB3ZGs=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "71a3fc97d80881e91710fe721f1158d3b96ae14d",
+        "rev": "24fed06cac83bcc44ac8efbb57cab1a82fa0bedc",
         "type": "github"
       },
       "original": {
@@ -162,13 +162,34 @@
         "type": "github"
       }
     },
+    "nix_builder": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay_2"
+      },
+      "locked": {
+        "lastModified": 1783278211,
+        "narHash": "sha256-/1u+MIQIge+cNPukQoK4Jp8nLuFZRbx4U+MyyxG0RpM=",
+        "ref": "refs/heads/main",
+        "rev": "9281ba7e10d362d4edb489d0df0e78936dfe7b58",
+        "revCount": 32,
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/nix_builder.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/nix_builder.git"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1770197578,
-        "narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=",
+        "lastModified": 1780749050,
+        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2",
+        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
         "type": "github"
       },
       "original": {
@@ -178,6 +199,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-google": {
+      "locked": {
+        "lastModified": 1779893571,
+        "narHash": "sha256-wiwMyVCtmjRjlFCe2zaumCE6LRV9GzzN0ZH25NQkbAU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "45f6cfaa4605b706c870e75bd74bdb5e97eee11e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "45f6cfaa4605b706c870e75bd74bdb5e97eee11e",
+        "type": "github"
+      }
+    },
     "nixpkgs-stable": {
       "locked": {
         "lastModified": 1730741070,
@@ -226,7 +263,9 @@
         "disko": "disko",
         "impermanence": "impermanence",
         "lanzaboote": "lanzaboote",
-        "nixpkgs": "nixpkgs"
+        "nix_builder": "nix_builder",
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-google": "nixpkgs-google"
       }
     },
     "rust-overlay": {
@@ -249,6 +288,27 @@
         "repo": "rust-overlay",
         "type": "github"
       }
+    },
+    "rust-overlay_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nix_builder",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779506148,
+        "narHash": "sha256-OffE5yuMrSW71zIJNLvtl9MCO6WTAHEjlFPUCvkd/QM=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "d9973e2ab49747fada06ebbe26cda27eb0220cf1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
     }
   },
   "root": "root",

nix/configuration/flake.nix

@@ -20,6 +20,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs-google.url = "github:NixOS/nixpkgs/45f6cfaa4605b706c870e75bd74bdb5e97eee11e";
     lanzaboote = {
       url = "github:nix-community/lanzaboote/v0.4.2";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -28,15 +29,21 @@
       url = "github:nix-community/disko";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    nix_builder = {
+      url = "git+https://code.fizz.buzz/talexander/nix_builder.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
     {
       self,
       nixpkgs,
+      nixpkgs-google,
       disko,
       impermanence,
       lanzaboote,
+      nix_builder,
       ...
     }:
     let
@@ -68,7 +75,7 @@
         hostname: nodeConfig: format:
         nixpkgs.lib.nixosSystem {
           specialArgs = {
-            inherit self;
+            inherit self nix_builder;
 
             this_nixos_config = self.nixosConfigurations."${hostname}";
 
@@ -92,6 +99,9 @@
                       hostPlatform.gcc.arch = "default";
                       hostPlatform.gcc.tune = "default";
                     };
+                    google = import nixpkgs-google {
+                      system = prev.stdenv.hostPlatform.system;
+                    };
                   })
                 ];
               };

nix/configuration/hosts/odo/SELF_BUILD

@@ -5,7 +5,6 @@ IFS=$'\n\t'
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
-: "${NOM:="true"}"
 
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 

nix/configuration/hosts/odo/default.nix

@@ -110,6 +110,7 @@
     me.jujutsu.config = ../../roles/jujutsu/files/jujutsu_config_home.toml;
     me.jujutsu.enable = true;
     me.kanshi.enable = false;
+    me.kernel.enable = true;
     me.kubernetes.enable = true;
     me.latex.enable = true;
     me.launch_keyboard.enable = true;
@@ -164,7 +165,7 @@
     me.zsh.enable = true;
 
     me.sm64ex.enable = true;
-    me.shipwright.enable = true;
+    me.shipwright.enable = false;
     me.ship2harkinian.enable = true;
   };
 }

nix/configuration/hosts/odowork/default.nix

@@ -111,6 +111,7 @@
     me.iso_mount.enable = true;
     me.jujutsu.config = ../../roles/jujutsu/files/jujutsu_config_home.toml;
     me.jujutsu.enable = true;
+    me.kernel.enable = true;
     me.latex.enable = true;
     me.launch_keyboard.enable = true;
     me.lvfs.enable = true;

nix/configuration/hosts/quark/default.nix

@@ -104,6 +104,7 @@
     me.jujutsu.config = ../../roles/jujutsu/files/jujutsu_config_home.toml;
     me.jujutsu.enable = true;
     me.kanshi.enable = false;
+    me.kernel.enable = true;
     me.kubernetes.enable = true;
     me.latex.enable = true;
     me.launch_keyboard.enable = true;
@@ -159,7 +160,7 @@
     me.zsh.enable = true;
 
     me.sm64ex.enable = true;
-    me.shipwright.enable = true;
+    me.shipwright.enable = false;
     me.ship2harkinian.enable = true;
   };
 }

nix/configuration/roles/base/default.nix

@@ -14,6 +14,12 @@ let
   cleanup_temporary_files = (
     patchScriptBin "cleanup_temporary_files" (builtins.readFile ./files/cleanup_temporary_files.bash)
   );
+  decode_jwt = (patchScriptBin "decode_jwt" (builtins.readFile ./files/decode_jwt.bash));
+  git_find_merged_branches = (
+    patchScriptBin "git_find_merged_branches" (builtins.readFile ./files/git_find_merged_branches.bash)
+  );
+  git_fix_author = (patchScriptBin "git_fix_author" (builtins.readFile ./files/git_fix_author.bash));
+  rsync_clone = (patchScriptBin "rsync_clone" (builtins.readFile ./files/rsync_clone.bash));
   alias_rga = pkgs.writeShellScriptBin "rga" ''
     exec ${pkgs.ripgrep}/bin/rg -uuu "''${@}"
   '';
@@ -59,8 +65,12 @@ in
       nix-output-monitor # For better view into nixos-rebuild
       # nix-serve-ng # Serve nix store over http
       cleanup_temporary_files
+      decode_jwt
       jq
       inetutils # For whois
+      git_find_merged_branches
+      git_fix_author
+      rsync_clone
     ];
   };
 }

nix/configuration/roles/base/files/cleanup_temporary_files.bash

@@ -1,4 +1,7 @@
 #!/usr/bin/env bash
 #
 # Delete temporary files on entire disk
-find / -type f '(' -name '*.orig' -or -name '*~' -or -name '*.core' ')' -delete -print 2>/dev/null
+set -euo pipefail
+IFS=$'\n\t'
+
+exec find / -type f '(' -name '*.orig' -or -name '*~' -or -name '*.core' ')' -delete -print 2>/dev/null

nix/configuration/roles/base/files/decode_jwt.bash

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#
+# Decode the contents of a JWT
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+exec jq -R 'split(".") | .[0],.[1] | gsub("-"; "+") | gsub("_"; "/") | gsub("%3D"; "=")| @base64d | fromjson'

nix/configuration/roles/base/files/git_find_merged_branches.bash

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+#
+# Find local branches that have been merged
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+: ${MAIN_BRANCH:="main"}
+
+git checkout -q ${MAIN_BRANCH} && git for-each-ref refs/heads/ "--format=%(refname:short)" | while read branch; do mergeBase=$(git merge-base ${MAIN_BRANCH} $branch) && [[ $(git cherry ${MAIN_BRANCH} $(git commit-tree $(git rev-parse "$branch^{tree}") -p $mergeBase -m _)) == "-"* ]] && echo "$branch"; done

nix/configuration/roles/base/files/git_fix_author.bash

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+#
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+git filter-branch --env-filter '
+WRONG_EMAIL="old@email.foo"
+NEW_NAME="New Name"
+NEW_EMAIL="new@email.bar"
+
+if [ "$GIT_COMMITTER_EMAIL" = "$WRONG_EMAIL" ]
+then
+    export GIT_COMMITTER_NAME="$NEW_NAME"
+    export GIT_COMMITTER_EMAIL="$NEW_EMAIL"
+fi
+if [ "$GIT_AUTHOR_EMAIL" = "$WRONG_EMAIL" ]
+then
+    export GIT_AUTHOR_NAME="$NEW_NAME"
+    export GIT_AUTHOR_EMAIL="$NEW_EMAIL"
+fi
+' --tag-name-filter cat --commit-filter 'git commit-tree -S "$@";' -- --branches --tags

nix/configuration/roles/base/files/rsync_clone.bash

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#
+# Wrapper to set rsync flags for cloning a folder preserving attributes
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+exec rsync -aHAXS "$@"

nix/configuration/roles/distributed_build/default.nix

@@ -56,7 +56,7 @@ let
         # "aarch64-linux"
       ];
 
-      hostName = lib.mkForce "hydra?remote-store=local?root=/home/nixworker/persist/root";
+      hostName = lib.mkForce "hydra?remote-store=local?root=/.disk/root";
     };
   };
   joined_configs =
@@ -101,7 +101,7 @@ in
         # Using an ssh-based substituter slows down the build because querying the remote store for paths takes ages.
         #
         # nix.settings.substituters = lib.mkForce [
-        #   "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=/home/nixworker/persist/root"
+        #   "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=/.disk/root"
         # ];
         # nix.settings.substitute = lib.mkForce true;
 

nix/configuration/roles/firewall/default.nix

@@ -24,7 +24,16 @@
     networking.firewall.allowedUDPPorts = [
       5353 # mDNS
     ];
+
+    # networking.firewall.enable = true;
+    # networking.nftables.enable = true;
+
     # Or disable the firewall altogether.
-    # networking.firewall.enable = false;
+    networking.firewall.enable = false;
+
+    # Debugging
+    # networking.firewall.logRefusedConnections = true;
+    # networking.firewall.logRefusedPackets = true;
+    # networking.firewall.logReversePathDrops = true;
   };
 }

nix/configuration/roles/gcloud/default.nix

@@ -18,7 +18,7 @@
   };
 
   config = lib.mkIf config.me.gcloud.enable {
-    environment.systemPackages = with pkgs; [
+    environment.systemPackages = with pkgs.google; [
       (google-cloud-sdk.withExtraComponents [ google-cloud-sdk.components.gke-gcloud-auth-plugin ])
     ];
 

nix/configuration/roles/graphics/default.nix

@@ -34,7 +34,7 @@
         environment.systemPackages = with pkgs; [
           mesa-demos # for glxgears
           vulkan-tools # for vkcube
-          xorg.xeyes # to test which windows are using x11
+          xeyes # to test which windows are using x11
         ];
         hardware.graphics.enable = true;
         # hardware.graphics.enable32Bit = true;

nix/configuration/roles/hydra/default.nix

@@ -2,56 +2,10 @@
   config,
   lib,
   pkgs,
+  nix_builder,
   ...
 }:
 
-let
-  # patchScriptBin =
-  #   {
-  #     filename,
-  #     contents,
-  #     path ? [ ],
-  #   }:
-  #   ((pkgs.writeScriptBin filename contents).overrideAttrs (old: {
-  #     buildInputs = [ pkgs.makeWrapper ];
-  #     buildCommand = "${old.buildCommand}\n patchShebangs $out\nwrapProgram $out/bin/${filename} --prefix PATH : ${lib.makeBinPath path}";
-  #   }));
-  nix_builder = pkgs.rustPlatform.buildRustPackage rec {
-    pname = "nix_builder";
-    version = "0.0.0";
-
-    src = pkgs.fetchgit {
-      url = "https://code.fizz.buzz/talexander/nix_builder.git";
-      # tag = version;
-      rev = "606832f505a1ccc9702cd12c236c3188f9282e82";
-      hash = "sha256-WHvnkCIPDBw0BnrQMnBpmwmYuhlxR4FfkoNWw2DY6XE=";
-      leaveDotGit = false;
-    };
-
-    cargoLock = {
-      lockFile = "${src}/Cargo.lock";
-    };
-
-    meta = with lib; {
-      description = "A builder of nix configs for a build server.";
-      homepage = "https://code.fizz.buzz/talexander/nix_builder";
-      license = licenses.bsd0;
-      maintainers = [ ];
-    };
-
-    nativeBuildInputs = [ pkgs.makeWrapper ];
-
-    postInstall = ''
-      wrapProgram $out/bin/nix-builder --prefix PATH : ${
-        lib.makeBinPath [
-          pkgs.git
-          pkgs.nix
-          pkgs.nixos-rebuild
-        ]
-      }
-    '';
-  };
-in
 {
   imports = [ ];
 
@@ -66,7 +20,7 @@ in
 
   config = lib.mkIf config.me.hydra.enable {
     environment.systemPackages = with pkgs; [
-      nix_builder
+      nix_builder.packages.x86_64-linux.default
       sqlite # For manually inspecting the database.
     ];
 
@@ -85,11 +39,11 @@ in
     };
 
     # Nix 2.30.0 (2025-07-07) changed the build directory from /tmp to /nix/var/nix/builds which broke a number of builds because my ZFS datasets were utf8only.
-    fileSystems."/home/nixworker/persist/root/nix/var/nix/builds" = {
+    fileSystems."/.disk/root/nix/var/nix/builds" = {
       device = "tmpfs";
       fsType = "tmpfs";
       options = [
-        "size=40G" # adjust for your situation and needs
+        "size=50G" # adjust for your situation and needs
         "mode=700"
         "uid=11400"
         "gid=11400"
@@ -104,33 +58,65 @@ in
       };
     };
 
-    systemd.services."build-cache" = {
-      script = ''
-        set -euo pipefail
-        IFS=$'\n\t'
-        DIR="$( cd "$( dirname "''${BASH_SOURCE[0]}" )" && pwd )"
+    systemd.services."build-cache" =
+      let
+        enabled_targets = [
+          "odo"
+          "odo_update"
+          "odowork"
+          "odowork_update"
+          "quark"
+          "quark_update"
+          "hydra"
+          "hydra_update"
+          "controller0"
+          "controller0_update"
+          "controller1"
+          "controller1_update"
+          "controller2"
+          "controller2_update"
+          "worker0"
+          "worker0_update"
+          "worker1"
+          "worker1_update"
+          "worker2"
+          "worker2_update"
+          "family_disks"
+          "family_disks_update"
+          # "nixbsd" # Disabled due to onetbb tests hanging on one-cpu machines.
+        ];
+        build_flags = lib.concatMap (target: [
+          "--target"
+          (lib.escapeShellArg target)
+        ]) enabled_targets;
+      in
+      {
+        script = ''
+          set -euo pipefail
+          IFS=$'\n\t'
+          DIR="$( cd "$( dirname "''${BASH_SOURCE[0]}" )" && pwd )"
 
-        NIX_REMOTE='local?root=/home/nixworker/persist/root' RUST_BACKTRACE=1 RUST_LOG=nix_builder=DEBUG ${nix_builder}/bin/nix-builder build --config ${./files/nix_builder.toml} --target odo --target odo_update --target odowork --target odowork_update --target quark --target quark_update --target hydra --target hydra_update --target controller0 --target controller0_update --target controller1 --target controller1_update --target controller2 --target controller2_update --target worker0 --target worker0_update --target worker1 --target worker1_update --target worker2 --target worker2_update --target family_disks --target family_disks_update
-      '';
-      restartIfChanged = false;
-      serviceConfig = {
-        Type = "simple";
-        User = "nixworker";
-        # restartIfChanged = false;
-        # RemainAfterExit = true; # Prevents the service from automatically starting on rebuild. See https://discourse.nixos.org/t/how-to-prevent-custom-systemd-service-from-restarting-on-nixos-rebuild-switch/43431
-        LimitNOFILE = 8192;
+          NIX_REMOTE='local?root=/.disk/root' RUST_BACKTRACE=1 RUST_LOG=nix_builder=DEBUG ${nix_builder.packages.x86_64-linux.default}/bin/nix-builder build --config ${./files/nix_builder.toml} ${builtins.concatStringsSep " " build_flags}
+        '';
+        restartIfChanged = false;
+        serviceConfig = {
+          Type = "simple";
+          User = "nixworker";
+          # restartIfChanged = false;
+          # RemainAfterExit = true; # Prevents the service from automatically starting on rebuild. See https://discourse.nixos.org/t/how-to-prevent-custom-systemd-service-from-restarting-on-nixos-rebuild-switch/43431
+          LimitNOFILE = 8192;
+        };
       };
-    };
 
     # TODO: This should move into nix-builder so we can only run clean when builds are passing. Otherwise partial builds will lose progress.
     # TODO: In nix-builder maybe include setting to auto delete to make room during builds if we run out of space, just in case builds are failing for a long time and prevent cleanup from running.
-    systemd.timers."clean-cache" = {
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnCalendar = "*-*-01 02:00:00 America/New_York";
-        Unit = "clean-cache.service";
-      };
-    };
+    # systemd.timers."clean-cache" = {
+    #   wantedBy = [ "timers.target" ];
+    #   timerConfig = {
+    #     OnCalendar = "*-*-01 02:00:00 America/New_York";
+    #     Unit = "clean-cache.service";
+    #   };
+    # };
 
     systemd.services."clean-cache" = {
       script = ''
@@ -138,7 +124,7 @@ in
         IFS=$'\n\t'
         DIR="$( cd "$( dirname "''${BASH_SOURCE[0]}" )" && pwd )"
 
-        NIX_REMOTE='local?root=/home/nixworker/persist/root' nix-collect-garbage -d
+        NIX_REMOTE='local?root=/.disk/root' nix-collect-garbage -d
       '';
       path = with pkgs; [
         pkgs.nix

nix/configuration/roles/hydra/files/nix_builder.toml

@@ -165,15 +165,22 @@ output_directory = "/home/nixworker/persist/nix_builder"
 [[targets]]
   name = "family_disks"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "family_disks"
+  branch = "nix"
   path = "nix/configuration"
   attr = "nixosConfigurations.family_disks.config.system.build.toplevel"
 
 [[targets]]
   name = "family_disks_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "family_disks"
+  branch = "nix"
   path = "nix/configuration"
   attr = "nixosConfigurations.family_disks.config.system.build.toplevel"
   update = true
   update_branch = "nix_update"
+
+# [[targets]]
+#   name = "nixbsd"
+#   repo = "https://github.com/nixos-bsd/nixbsd.git"
+#   revision = "828ff7a3c4ee91f548de65a963fca40eaedb171c"
+#   path = "."
+#   attr = "base.vmClosureInfo"

nix/configuration/roles/kernel/default.nix

@@ -0,0 +1,194 @@
+# Check current config:
+#   nix build '/persist/machine_setup/nix/configuration#nixosConfigurations.hydra.pkgs.linux_me.configfile'
+#   cat $(nix eval --raw '/persist/machine_setup/nix/configuration#nixosConfigurations.hydra.pkgs.linux_me.configfile') | less
+
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  preemption_type = with lib.kernel; {
+    full = {
+      PREEMPT_DYNAMIC = yes;
+      PREEMPT = yes;
+      PREEMPT_VOLUNTARY = lib.mkForce no;
+      PREEMPT_LAZY = lib.mkForce no;
+      PREEMPT_NONE = no;
+    };
+    lazy = {
+      PREEMPT_DYNAMIC = yes;
+      PREEMPT = no;
+      PREEMPT_VOLUNTARY = lib.mkForce no;
+      PREEMPT_LAZY = yes;
+      PREEMPT_NONE = no;
+    };
+    voluntary = {
+      PREEMPT_DYNAMIC = no;
+      PREEMPT = no;
+      PREEMPT_VOLUNTARY = yes;
+      PREEMPT_LAZY = lib.mkForce no;
+      PREEMPT_NONE = no;
+    };
+    none = {
+      PREEMPT_DYNAMIC = no;
+      PREEMPT = no;
+      PREEMPT_VOLUNTARY = lib.mkForce no;
+      PREEMPT_LAZY = lib.mkForce no;
+      PREEMPT_NONE = yes;
+    };
+  };
+  tick_hz =
+    with lib.kernel;
+    {
+      "1000" = {
+        HZ_1000 = yes;
+        HZ = freeform "1000";
+      };
+    }
+    // lib.genAttrs [ "100" "250" "300" "500" "600" "750" ] (hz: {
+      HZ_1000 = no;
+      "HZ_${hz}" = yes;
+      HZ = freeform hz;
+    });
+  performance_governor = with lib.kernel; {
+    default = {
+      CPU_FREQ_DEFAULT_GOV_SCHEDUTIL = yes;
+    };
+    performance = {
+      CPU_FREQ_DEFAULT_GOV_SCHEDUTIL = no;
+      CPU_FREQ_DEFAULT_GOV_PERFORMANCE = yes;
+    };
+  };
+  tick_rate = with lib.kernel; {
+    # Always tick at the hz frequency.
+    periodic = {
+      NO_HZ_IDLE = no;
+      NO_HZ_FULL = no;
+      NO_HZ = no;
+      NO_HZ_COMMON = no;
+      HZ_PERIODIC = yes;
+    };
+    # Idle - Do not disturb the CPU when idle. This can save power but increase latency.
+    idle = {
+      HZ_PERIODIC = no;
+      NO_HZ_FULL = no;
+      NO_HZ_IDLE = yes;
+      NO_HZ = yes;
+      NO_HZ_COMMON = yes;
+    };
+    # Full dyntick system (tickless) - The kernel tries to shut down the tick whenever possible.
+    tickless = {
+      HZ_PERIODIC = no;
+      NO_HZ_IDLE = no;
+      NO_HZ_FULL = yes;
+      NO_HZ = yes;
+      NO_HZ_COMMON = yes;
+      CONTEXT_TRACKING = yes;
+    };
+  };
+  huge_page = with lib.kernel; {
+    always = {
+      TRANSPARENT_HUGEPAGE_MADVISE = no;
+      TRANSPARENT_HUGEPAGE_ALWAYS = yes;
+    };
+    madvise = {
+      TRANSPARENT_HUGEPAGE_ALWAYS = no;
+      TRANSPARENT_HUGEPAGE_MADVISE = yes;
+    };
+  };
+  common_config =
+    with lib.kernel;
+    {
+      # Google's BBRv3 TCP congestion Control
+      TCP_CONG_BBR = yes;
+      DEFAULT_BBR = yes;
+    };
+  flavors = {
+    server = lib.mkMerge [
+      preemption_type.none
+      tick_hz."300"
+      performance_governor.default
+      tick_rate.tickless
+      huge_page.madvise
+    ];
+    interactive =
+      with lib.kernel;
+      lib.mkMerge [
+        {
+          # Enable RCU Lazy - Reduces power consumption when idle or lightly loaded. Useful for battery-powered devices like laptops.
+          RCU_LAZY = yes;
+        }
+        preemption_type.lazy
+        tick_hz."300"
+        performance_governor.default
+        tick_rate.tickless
+        huge_page.madvise
+      ];
+  };
+in
+{
+  imports = [ ];
+
+  options.me = {
+    kernel.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install kernel.";
+    };
+
+    kernel.version = lib.mkOption {
+      type = lib.types.str;
+      default = "linux"; # LTS
+      example = "linux_6_18";
+      description = "What version of the kernl should we use.";
+    };
+
+    kernel.flavor = lib.mkOption {
+      type = lib.types.str;
+      default = "interactive";
+      example = "server";
+      description = "What type of kernel should be built.";
+    };
+  };
+
+  config = lib.mkIf config.me.kernel.enable (
+    lib.mkMerge [
+      {
+        boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_me;
+      }
+      (lib.mkIf (!config.me.optimizations.enable) {
+        nixpkgs.overlays = [
+          (final: prev: {
+            linux_me = final."${config.me.kernel.version}";
+          })
+        ];
+      })
+      (lib.mkIf (config.me.optimizations.enable) {
+        nixpkgs.overlays = [
+          (
+            final: prev:
+            let
+              addConfig =
+                additionalConfig: pkg:
+                pkg.override (oldconfig: {
+                  structuredExtraConfig = lib.mkMerge ([ pkg.structuredExtraConfig ] ++ additionalConfig);
+                  # stdenv = pkgs.llvmPackages_latest.stdenv;
+                  # stdenv = pkgs.clangStdenv;
+                });
+            in
+            {
+              linux_me = addConfig ([
+                common_config
+                flavors."${config.me.kernel.flavor}"
+              ]) final."${config.me.kernel.version}";
+            }
+          )
+        ];
+      })
+    ]
+  );
+}

nix/configuration/roles/minimal_base/default.nix

@@ -19,6 +19,7 @@
 
   config = lib.mkIf config.me.minimal_base.enable {
     me.doas.enable = true;
+    me.kernel.enable = true;
     me.network.enable = true;
     me.nvme.enable = true;
     me.ssh.enable = true;

nix/configuration/roles/network/default.nix

@@ -56,15 +56,19 @@ in
     # TODO: The 127.0.0.1 address should probably be moved to a host-specific file.
     networking.extraHosts = ''
       127.0.0.1 ${config.networking.hostName}.home.arpa
-      10.216.1.1		homeserver
+      10.216.1.32		homeserver
+      fdfd:5e8a:ee2d::1:32	homeserver
       10.216.1.6		media
       10.216.1.12		odo
+      fdfd:5e8a:ee2d::1:2	odo
       10.216.1.14		neelix
       10.216.1.15		quark
+      fdfd:5e8a:ee2d::1:3	quark
       10.217.1.1		drmario
       10.217.2.1		mrmanager
-      172.16.16.245 turtle
-      172.16.16.251 stream
+      fdfd:5e8a:ee2d::2:2 mrmanager
+      172.16.16.245		turtle
+      172.16.16.251		stream
     '';
 
     networking.wireless.iwd = {

nix/configuration/roles/optimized_build/default.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   ...
 }:
 
@@ -49,65 +48,13 @@
   };
 
   config = lib.mkMerge [
-    (lib.mkIf (!config.me.optimizations.enable) (
-      lib.mkMerge [
-        {
-          boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_6_18;
-          # boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux;
-        }
-      ]
-    ))
     (lib.mkIf config.me.optimizations.enable (
       lib.mkMerge [
         {
-          boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_me;
-
           nixpkgs.hostPlatform = {
             gcc.arch = config.me.optimizations.arch;
             gcc.tune = config.me.optimizations.arch;
           };
-
-          nixpkgs.overlays = [
-            (
-              final: prev:
-              let
-                addConfig =
-                  additionalConfig: pkg:
-                  pkg.override (oldconfig: {
-                    structuredExtraConfig = pkg.structuredExtraConfig // additionalConfig;
-                  });
-              in
-              {
-                linux_me = addConfig {
-                  # Full preemption
-                  PREEMPT = lib.mkOverride 60 lib.kernel.yes;
-                  PREEMPT_VOLUNTARY = lib.mkOverride 60 lib.kernel.no;
-
-                  # Google's BBRv3 TCP congestion Control
-                  TCP_CONG_BBR = lib.kernel.yes;
-                  DEFAULT_BBR = lib.kernel.yes;
-
-                  # Preemptive Full Tickless Kernel at 300Hz
-                  HZ = lib.kernel.freeform "300";
-                  HZ_300 = lib.kernel.yes;
-                  HZ_1000 = lib.kernel.no;
-                } prev.linux_6_18; # or prev.linux
-              }
-            )
-            (final: prev: {
-              inherit (final.unoptimized)
-                assimp
-                binaryen
-                gsl
-                rapidjson
-                ffmpeg-headless
-                ffmpeg
-                pipewire
-                chromaprint
-                gtkmm
-                ;
-            })
-          ];
         }
       ]
     ))

nix/configuration/roles/qemu/files/qemurc.bash

@@ -355,6 +355,7 @@ function start_body {
         -smp cores="$CPU_CORES"
         -m "$MEMORY"
         -rtc base=localtime
+        -device virtio-rng-pci
         -drive "file=\"@OVMFfd@/FV/OVMF_CODE.fd\",if=pflash,format=raw,readonly=on"
         -drive "if=pflash,format=raw,file=\"$(readlink -f "${mount_path}/OVMF_VARS.fd")\""
         -drive "if=none,file=/dev/zvol/${zfs_path}/disk0,format=raw,id=hd0"

nix/configuration/roles/recovery/default.nix

@@ -29,7 +29,7 @@
       }
       (lib.mkIf config.me.graphical {
         environment.systemPackages = with pkgs; [
-          ddrescueview
+          #ddrescueview
         ];
       })
     ]

nix/configuration/roles/rpcs3/default.nix

@@ -53,6 +53,8 @@ in
       rpcs3
     ];
 
+    allowedUnfree = [ "rpcs3" ];
+
     security.pam.loginLimits = [
       {
         domain = "@wheel";

nix/configuration/roles/shikane/default.nix

@@ -37,6 +37,9 @@ in
     me.install.user.talexander.file = {
       ".config/shikane/config.toml" = {
         source = ./files/config.toml;
+        # Shikane opens with write permissions, so we need a regular file, not a symlink to the nix store.
+        method = "overwrite";
+        mode = "0644";
       };
     };
   };

nix/configuration/roles/sm64ex/default.nix

@@ -18,7 +18,10 @@
   };
 
   config = lib.mkIf (config.me.sm64ex.enable && config.me.graphical) {
-    allowedUnfree = [ "sm64ex" ];
+    allowedUnfree = [
+      "sm64ex"
+      "baserom.us.z64"
+    ];
 
     environment.systemPackages = with pkgs; [
       sm64ex

nix/configuration/roles/sound/default.nix

@@ -30,7 +30,7 @@
           # If you want to use JACK applications, uncomment this
           #jack.enable = true;
 
-          extraLv2Packages = [ pkgs.rnnoise-plugin ];
+          extraLadspaPackages = [ pkgs.rnnoise-plugin.ladspa ];
           configPackages = [
             (pkgs.writeTextDir "share/pipewire/pipewire.conf.d/99-input-denoising.conf" ''
               context.modules = [
@@ -43,7 +43,7 @@
                               {
                                   type = ladspa
                                   name = rnnoise
-                                  plugin = "${pkgs.rnnoise-plugin}/lib/ladspa/librnnoise_ladspa.so"
+                                  plugin = "librnnoise_ladspa"
                                   label = noise_suppressor_mono
                                   control = {
                                       "VAD Threshold (%)" = 50.0

nix/configuration/roles/sway/screenshot.nix

@@ -26,7 +26,7 @@ let
           # Maybe add --audio flag? can optionally specify specific device name from `@pactl@ list sources | @grep@ Name`
           bindsym $mod+Shift+print exec @wl-screenrec@ -g "$(@slurp@)" --codec av1 -f "$HOME/$(date +'screencast_%Y-%m-%d-%H%M%S.mkv')"
           bindsym Shift+print exec @wl-screenrec@ --codec av1 -f "$HOME/$(date +'screencast_%Y-%m-%d-%H%M%S.mkv')"
-          bindsym $mod+ctrl+Shift+print exec pkill -SIGINT @wl-screenrec@
+          bindsym $mod+ctrl+Shift+print exec pkill -SIGINT -f @wl-screenrec@
           # Need to make a hotkey to end the recording
         '';
   };

nix/configuration/roles/thunderbolt/default.nix

@@ -21,5 +21,18 @@
     environment.systemPackages = with pkgs; [
       bolt # For boltctl
     ];
+
+    services.hardware.bolt.enable = true;
+
+    # Trust all thunderbolt devices
+    # services.udev.packages = [
+    #   (pkgs.writeTextFile {
+    #     name = "removable";
+    #     text = ''
+    #       ACTION=="add", SUBSYSTEM=="thunderbolt", ATTR{authorized}=="0", ATTR{authorized}="1"
+    #     '';
+    #     destination = "/etc/udev/rules.d/99-removable.rules";
+    #   })
+    # ];
   };
 }

nix/configuration/roles/vscode/default.nix

@@ -121,6 +121,12 @@ in
             group = "talexander";
             mode = "0755";
           }
+          {
+            directory = ".vscode-shared";
+            user = "talexander";
+            group = "talexander";
+            mode = "0755";
+          }
         ];
       };
     };

nix/configuration/roles/zfs/default.nix

@@ -44,6 +44,9 @@ in
 
     boot.zfs.devNodes = "/dev/disk/by-partuuid";
 
+    # Do not force import your root pool during boot. Force importing would be useful if the pool had been imported by a different machine most recently.
+    boot.zfs.forceImportRoot = false;
+
     services.zfs = {
       autoScrub = {
         enable = true;