flake.lock: Update

Flake lock file updates:

• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/c6245e8' (2025-12-18)
  → 'github:NixOS/nixpkgs/a653104' (2025-12-21)

.gitattributes

@@ -1,4 +1,5 @@
 secrets/soundcloud_token filter=git-crypt diff=git-crypt
+secrets/bandcamp_token filter=git-crypt diff=git-crypt
 assets/bitwig/activation.bwreg filter=lfs diff=lfs merge=lfs -text
 assets/bitwig/bitwig-studio.deb filter=lfs diff=lfs merge=lfs -text
 assets/bitwig/bitwig.jar filter=lfs diff=lfs merge=lfs -text

Makefile

@@ -1,8 +1,9 @@
 switch:
-	sudo nixos-rebuild switch --flake path://$(PWD)#
+	nixos-rebuild switch --target-host root@localhost \
+    --build-host root@localhost --flake path://$(PWD)#panacea
 
 update:
-	nix flake update . --commit-lock-file
+	nix flake update --commit-lock-file
 
 upgrade:
 	make update && make switch

configuration.nix

@@ -1,18 +1,28 @@
-{ config, lib, pkgs, inputs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
 
 with pkgs;
 
 {
   # Kernel configuration
   boot = {
-    kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
+    blacklistedKernelModules = [
-    kernelParams =
+      "btusb"
-      [ "zfs.zfs_arc_max=2147483648" "zfs.zfs_arc_meta_limit_percent=90" ];
+      "bluetooth"
-    blacklistedKernelModules = [ "btusb" "bluetooth" ];
+    ];
+    kernelParams = [
+      "zfs.zfs_arc_max=8589934592"
+      "zfs.zfs_arc_min=1073741824"
+    ];
     supportedFilesystems = [ "zfs" ];
     zfs = {
       requestEncryptionCredentials = true;
-      enableUnstable = true;
+      package = zfs_unstable;
     };
   };
 
@@ -38,7 +48,12 @@ with pkgs;
   nix = {
     settings = {
       auto-optimise-store = true;
-      trusted-users = [ "root" "coolneng" ];
+      trusted-users = [
+        "root"
+        "coolneng"
+      ];
+      lazy-trees = true;
+      eval-cores = 2;
     };
     gc = {
       automatic = true;
@@ -51,7 +66,6 @@ with pkgs;
       gc-keep-outputs = true
       experimental-features = nix-command flakes
     '';
-    package = nixUnstable;
   };
 
   # Clean tmp directory on shutdown
@@ -77,7 +91,12 @@ with pkgs;
   users.users.coolneng = {
     isNormalUser = true;
     home = "/home/coolneng";
-    extraGroups = [ "wheel" "video" "audio" "lp" ];
+    extraGroups = [
+      "wheel"
+      "video"
+      "audio"
+      "lp"
+    ];
     shell = fish;
   };
 
@@ -92,21 +111,30 @@ with pkgs;
       group = "systemd-network";
     };
     secrets.syncthing.file = secrets/syncthing.age;
-    secrets.samba-ugent.file = secrets/samba-ugent.age;
     secrets.msmtp.file = secrets/msmtp.age;
     identityPaths = [ "/etc/ssh/id_ed25519" ];
   };
 
   # Use same version of nixpkgs for nix-shell
-  nix.nixPath = let path = toString ./.;
+  nix.nixPath =
-  in [ "nixpkgs=${inputs.nixpkgs}" "nixos-config=${path}/configuration.nix" ];
+    let
+      path = toString ./.;
+    in
+    [
+      "nixpkgs=${inputs.nixpkgs}"
+      "nixos-config=${path}/configuration.nix"
+    ];
 
   # Auto-upgrade the system
   system.autoUpgrade = {
     enable = true;
     dates = "22:30";
     flake = "/home/coolneng/Projects/panacea";
-    flags = [ "update" "--commit-lock-file" ];
+    flags = [
+      "--update-input"
+      "nixpkgs"
+      "--commit-lock-file"
+    ];
   };
 
   # Add required dependencies to the auto-upgrade service
@@ -156,6 +184,7 @@ with pkgs;
     ./modules/periodic.nix
     ./modules/power.nix
     ./modules/monitoring.nix
+    ./modules/latest-zfs-kernel.nix
   ];
 
 }

flake.lock

@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1703433843,
+        "lastModified": 1762618334,
-        "narHash": "sha256-nmtA4KqFboWxxoOAA6Y1okHbZh+HsXaMPFkYHsoDRDw=",
+        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "417caa847f9383e111d1397039c9d4337d024bf0",
+        "rev": "fcdea223397448d35d9b31f798479227e80183f6",
         "type": "github"
       },
       "original": {
@@ -24,30 +24,12 @@
       }
     },
     "crane": {
-      "inputs": {
-        "flake-compat": [
-          "lanzaboote",
-          "flake-compat"
-        ],
-        "flake-utils": [
-          "lanzaboote",
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "lanzaboote",
-          "nixpkgs"
-        ],
-        "rust-overlay": [
-          "lanzaboote",
-          "rust-overlay"
-        ]
-      },
       "locked": {
-        "lastModified": 1681177078,
+        "lastModified": 1765739568,
-        "narHash": "sha256-ZNIjBDou2GOabcpctiQykEQVkI8BDwk7TyvlWlI4myE=",
+        "narHash": "sha256-gQYx35Of4UDKUjAYvmxjUEh/DdszYeTtT6MDin4loGE=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "0c9f468ff00576577d83f5019a66c557ede5acf6",
+        "rev": "67d2baff0f9f677af35db61b32b5df6863bcc075",
         "type": "github"
       },
       "original": {
@@ -80,11 +62,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1700795494,
+        "lastModified": 1744478979,
-        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
         "type": "github"
       },
       "original": {
@@ -94,14 +76,87 @@
         "type": "github"
       }
     },
+    "determinate": {
+      "inputs": {
+        "determinate-nixd-aarch64-darwin": "determinate-nixd-aarch64-darwin",
+        "determinate-nixd-aarch64-linux": "determinate-nixd-aarch64-linux",
+        "determinate-nixd-x86_64-linux": "determinate-nixd-x86_64-linux",
+        "nix": "nix",
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1765254444,
+        "narHash": "sha256-kAO/ZeBnjaF+uqOP6qweXlRk2ylocLuv/9Dn8FsuPlU=",
+        "rev": "3ccc0297525e51ac3d7905509e0616c9c8350108",
+        "revCount": 316,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.14.0/019b0160-c5de-7941-9c26-cb47bc17eec3/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/DeterminateSystems/determinate/%2A"
+      }
+    },
+    "determinate-nixd-aarch64-darwin": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-6PWoqx52nvlWzlElTjcn7KAPKitfcKZYEFSsC3PoEoE=",
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.14.0/macOS"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.14.0/macOS"
+      }
+    },
+    "determinate-nixd-aarch64-linux": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-b1e25BUPL7Qf0QVbYlfZ/+QiClrP/SHIjMPtA47aOLc=",
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.14.0/aarch64-linux"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.14.0/aarch64-linux"
+      }
+    },
+    "determinate-nixd-x86_64-linux": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-8EI2f8IftPcRFlR6K4+cpIEAVf5UIeMCjHysEtVqDw0=",
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.14.0/x86_64-linux"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.14.0/x86_64-linux"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1673956053,
+        "lastModified": 1696426674,
-        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1761588595,
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
         "type": "github"
       },
       "original": {
@@ -113,71 +168,64 @@
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
-          "lanzaboote",
+          "determinate",
+          "nix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1680392223,
+        "lastModified": 1748821116,
-        "narHash": "sha256-n3g7QFr85lDODKt250rkZj2IFS3i4/8HBU2yKHO3tqw=",
+        "narHash": "sha256-F82+gS044J1APL0n4hH50GYdPRv/5JWm34oCJYmVKdE=",
-        "owner": "hercules-ci",
+        "rev": "49f0870db23e8c1ca0b5259734a02cd9e1e371a1",
-        "repo": "flake-parts",
+        "revCount": 377,
-        "rev": "dcc36e45d054d7bb554c9cdab69093debd91a0b5",
+        "type": "tarball",
-        "type": "github"
+        "url": "https://api.flakehub.com/f/pinned/hercules-ci/flake-parts/0.1.377%2Brev-49f0870db23e8c1ca0b5259734a02cd9e1e371a1/01972f28-554a-73f8-91f4-d488cc502f08/source.tar.gz"
       },
       "original": {
-        "owner": "hercules-ci",
+        "type": "tarball",
-        "repo": "flake-parts",
+        "url": "https://flakehub.com/f/hercules-ci/flake-parts/0.1"
-        "type": "github"
       }
     },
-    "flake-utils": {
+    "git-hooks-nix": {
       "inputs": {
-        "systems": "systems_2"
+        "flake-compat": "flake-compat",
+        "gitignore": [
+          "determinate",
+          "nix"
+        ],
+        "nixpkgs": [
+          "determinate",
+          "nix",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1681202837,
+        "lastModified": 1747372754,
-        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
+        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
-        "owner": "numtide",
+        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
-        "repo": "flake-utils",
+        "revCount": 1026,
-        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
+        "type": "tarball",
-        "type": "github"
+        "url": "https://api.flakehub.com/f/pinned/cachix/git-hooks.nix/0.1.1026%2Brev-80479b6ec16fefd9c1db3ea13aeb038c60530f46/0196d79a-1b35-7b8e-a021-c894fb62163d/source.tar.gz"
       },
       "original": {
-        "owner": "numtide",
+        "type": "tarball",
-        "repo": "flake-utils",
+        "url": "https://flakehub.com/f/cachix/git-hooks.nix/0.1.941"
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
-      "locked": {
-        "lastModified": 1622445595,
-        "narHash": "sha256-m+JRe6Wc5OZ/mKw2bB3+Tl0ZbtyxxxfnAWln8Q5qs+Y=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "7d706970d94bc5559077eb1a6600afddcd25a7c8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
       }
     },
     "gitignore": {
       "inputs": {
         "nixpkgs": [
           "lanzaboote",
-          "pre-commit-hooks-nix",
+          "pre-commit",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1660459072,
+        "lastModified": 1709087332,
-        "narHash": "sha256-8DFJjXG8zqoONA1vXtgeKXy68KdJL5UaXR8NtVMUbx8=",
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
         "owner": "hercules-ci",
         "repo": "gitignore.nix",
-        "rev": "a20de23b925fd8264fd7fad6454652e142fd7f73",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
         "type": "github"
       },
       "original": {
@@ -194,11 +242,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1703113217,
+        "lastModified": 1745494811,
-        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
         "type": "github"
       },
       "original": {
@@ -210,26 +258,22 @@
     "lanzaboote": {
       "inputs": {
         "crane": "crane",
-        "flake-compat": "flake-compat",
-        "flake-parts": "flake-parts",
-        "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
         ],
-        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
+        "pre-commit": "pre-commit",
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1682802423,
+        "lastModified": 1765887029,
-        "narHash": "sha256-Fb5TeRTdvUlo/5Yi2d+FC8a6KoRLk2h1VE0/peMhWPs=",
+        "narHash": "sha256-s6LGO6kMlHRdnspV0LReSi47iaYaJ/Oveb4rM9fklPM=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "64b903ca87d18cef2752c19c098af275c6e51d63",
+        "rev": "5a8c9b5339588bb6ec388da5d0a6e701a46a82c4",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "v0.3.0",
         "repo": "lanzaboote",
         "type": "github"
       }
@@ -237,8 +281,8 @@
     "local-bitwig": {
       "flake": false,
       "locked": {
-        "lastModified": 1704673203,
+        "lastModified": 1765321606,
-        "narHash": "sha256-n8gLgN6QEVuHe30kQZ/gCWInDHwDpPWOB5RgVh1tSt8=",
+        "narHash": "sha256-WteEWi5GPrGGfzLNTEmgQaH5/DAT/zeZofbBE6D+Po8=",
         "path": "/home/coolneng/Projects/panacea/assets/bitwig",
         "type": "path"
       },
@@ -247,25 +291,25 @@
         "type": "path"
       }
     },
-    "nix-github-actions": {
+    "nix": {
       "inputs": {
-        "nixpkgs": [
+        "flake-parts": "flake-parts",
-          "openconnect-sso",
+        "git-hooks-nix": "git-hooks-nix",
-          "nixpkgs"
+        "nixpkgs": "nixpkgs",
-        ]
+        "nixpkgs-23-11": "nixpkgs-23-11",
+        "nixpkgs-regression": "nixpkgs-regression"
       },
       "locked": {
-        "lastModified": 1701208414,
+        "lastModified": 1765252170,
-        "narHash": "sha256-xrQ0FyhwTZK6BwKhahIkUVZhMNk21IEI1nUcWSONtpo=",
+        "narHash": "sha256-p98D44tYJMgB5Qet5S8cTQFdffk/GmoaGkpQtZ3hqJU=",
-        "owner": "nix-community",
+        "rev": "1ddd28880651054346c34009d7bb9de36f1db2c1",
-        "repo": "nix-github-actions",
+        "revCount": 23362,
-        "rev": "93e39cc1a087d65bcf7a132e75a650c44dd2b734",
+        "type": "tarball",
-        "type": "github"
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.14.0/019b0159-8907-7fab-a120-9d287c7e6d2e/source.tar.gz"
       },
       "original": {
-        "owner": "nix-community",
+        "type": "tarball",
-        "repo": "nix-github-actions",
+        "url": "https://flakehub.com/f/DeterminateSystems/nix-src/%2A"
-        "type": "github"
       }
     },
     "nix-index-database": {
@@ -275,11 +319,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1704596958,
+        "lastModified": 1765267181,
-        "narHash": "sha256-BK3Ohsz7m8X6qVKFxDtr8KVcHipfr5hYE9PDIJevHbQ=",
+        "narHash": "sha256-d3NBA9zEtBu2JFMnTBqWj7Tmi7R5OikoU2ycrdhQEws=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "f46800ac5a6e9f892fe36e50821c5d85794ecc62",
+        "rev": "82befcf7dc77c909b0f2a09f5da910ec95c5b78f",
         "type": "github"
       },
       "original": {
@@ -290,11 +334,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1704632650,
+        "lastModified": 1764440730,
-        "narHash": "sha256-83J/nd/NoLqo3vj0S0Ppqe8L+ijIFiGL6HNDfCCUD/Q=",
+        "narHash": "sha256-ZlJTNLUKQRANlLDomuRWLBCH5792x+6XUJ4YdFRjtO4=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "c478b3d56969006e015e55aaece4931f3600c1b2",
+        "rev": "9154f4569b6cdfd3c595851a6ba51bfaa472d9f3",
         "type": "github"
       },
       "original": {
@@ -305,141 +349,95 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1704194953,
+        "lastModified": 1761597516,
-        "narHash": "sha256-RtDKd8Mynhe5CFnVT8s0/0yqtWFMM9LmCzXv/YKxnq4=",
+        "narHash": "sha256-wxX7u6D2rpkJLWkZ2E932SIvDJW8+ON/0Yy8+a5vsDU=",
+        "rev": "daf6dc47aa4b44791372d6139ab7b25269184d55",
+        "revCount": 811874,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2505.811874%2Brev-daf6dc47aa4b44791372d6139ab7b25269184d55/019a3494-3498-707e-9086-1fb81badc7fe/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/NixOS/nixpkgs/0.2505"
+      }
+    },
+    "nixpkgs-23-11": {
+      "locked": {
+        "lastModified": 1717159533,
+        "narHash": "sha256-oamiKNfr2MS6yH64rUn99mIZjc45nGJlj9eGth/3Xuw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bd645e8668ec6612439a9ee7e71f7eac4099d4f6",
+        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
         "type": "github"
       },
       "original": {
-        "id": "nixpkgs",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
+        "type": "github"
+      }
+    },
+    "nixpkgs-regression": {
+      "locked": {
+        "lastModified": 1643052045,
+        "narHash": "sha256-uGJ0VXIhWKGXxkeNnq4TvV3CIOkUJ3PAoLZ3HMzNVMw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1764611609,
+        "narHash": "sha256-yU9BNcP0oadUKupw0UKmO9BKDOVIg9NStdJosEbXf8U=",
+        "rev": "8c29968b3a942f2903f90797f9623737c215737c",
+        "revCount": 905078,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.905078%2Brev-8c29968b3a942f2903f90797f9623737c215737c/019add91-3add-7a0d-8a25-9569cbe01efe/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/DeterminateSystems/nixpkgs-weekly/0.1"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1766309749,
+        "narHash": "sha256-3xY8CZ4rSnQ0NqGhMKAy5vgC+2IVK0NoVEzDoOh4DA4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a6531044f6d0bef691ea18d4d4ce44d0daa6e816",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
         "ref": "nixos-unstable",
-        "type": "indirect"
-      }
-    },
-    "nixpkgs-stable": {
-      "locked": {
-        "lastModified": 1678872516,
-        "narHash": "sha256-/E1YwtMtFAu2KUQKV/1+KFuReYPANM2Rzehk84VxVoc=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "9b8e5abb18324c7fe9f07cb100c3cd4a29cda8b8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-22.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "openconnect-sso": {
+    "pre-commit": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-compat": "flake-compat_2",
-        "nix-github-actions": "nix-github-actions",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "poetry2nix": "poetry2nix",
-        "systems": "systems_3",
-        "treefmt-nix": "treefmt-nix"
-      },
-      "locked": {
-        "lastModified": 1701455376,
-        "narHash": "sha256-FMLrMdi6JY7ZfqV5XnNj64jnDcGKznKZLn7O6OMO3u0=",
-        "owner": "ThinkChaos",
-        "repo": "openconnect-sso",
-        "rev": "20c0015c4264c72cc19ac272de0dc534309bd21b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ThinkChaos",
-        "ref": "fix/nix-flake",
-        "repo": "openconnect-sso",
-        "type": "github"
-      }
-    },
-    "poetry2nix": {
-      "inputs": {
-        "flake-utils": [
-          "openconnect-sso",
-          "flake-utils"
-        ],
-        "nix-github-actions": [
-          "openconnect-sso",
-          "nix-github-actions"
-        ],
-        "nixpkgs": [
-          "openconnect-sso",
-          "nixpkgs"
-        ],
-        "systems": [
-          "openconnect-sso",
-          "systems"
-        ],
-        "treefmt-nix": [
-          "openconnect-sso",
-          "treefmt-nix"
-        ]
-      },
-      "locked": {
-        "lastModified": 1701105783,
-        "narHash": "sha256-5IOI0xXGbhAkUZNNcPId48V78Q+/JlW0hzlif0zxRmM=",
-        "owner": "nix-community",
-        "repo": "poetry2nix",
-        "rev": "0b2bff39e9bd4e6db3208e09c276ca83a063b370",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "poetry2nix",
-        "type": "github"
-      }
-    },
-    "pp-to-amd-epp": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1700307756,
-        "narHash": "sha256-PlinfzkBIWJMO9y2kb1b/1CArG6pMJZ6wyolNMdKSJM=",
-        "owner": "marcinx64",
-        "repo": "pp-to-amd-epp",
-        "rev": "0fbac782cd32313864b4e5a0ff975673d6ceda6e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "marcinx64",
-        "repo": "pp-to-amd-epp",
-        "type": "github"
-      }
-    },
-    "pre-commit-hooks-nix": {
-      "inputs": {
-        "flake-compat": [
-          "lanzaboote",
-          "flake-compat"
-        ],
-        "flake-utils": [
-          "lanzaboote",
-          "flake-utils"
-        ],
         "gitignore": "gitignore",
         "nixpkgs": [
           "lanzaboote",
           "nixpkgs"
-        ],
+        ]
-        "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1681413034,
+        "lastModified": 1765464257,
-        "narHash": "sha256-/t7OjNQcNkeWeSq/CFLYVBfm+IEnkjoSm9iKvArnUUI=",
+        "narHash": "sha256-dixPWKiHzh80PtD0aLuxYNQ0xP+843dfXG/yM3OzaYQ=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "d3de8f69ca88fb6f8b09e5b598be5ac98d28ede5",
+        "rev": "09e45f2598e1a8499c3594fe11ec2943f34fe509",
         "type": "github"
       },
       "original": {
@@ -452,32 +450,27 @@
       "inputs": {
         "agenix": "agenix",
         "cyrus-sasl-xoauth2": "cyrus-sasl-xoauth2",
+        "determinate": "determinate",
         "lanzaboote": "lanzaboote",
         "local-bitwig": "local-bitwig",
         "nix-index-database": "nix-index-database",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_3"
-        "openconnect-sso": "openconnect-sso",
-        "pp-to-amd-epp": "pp-to-amd-epp"
       }
     },
     "rust-overlay": {
       "inputs": {
-        "flake-utils": [
-          "lanzaboote",
-          "flake-utils"
-        ],
         "nixpkgs": [
           "lanzaboote",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1682129965,
+        "lastModified": 1765680428,
-        "narHash": "sha256-1KRPIorEL6pLpJR04FwAqqnt4Tzcm4MqD84yhlD+XSk=",
+        "narHash": "sha256-fyPmRof9SZeI14ChPk5rVPOm7ISiiGkwGCunkhM+eUg=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "2c417c0460b788328220120c698630947547ee83",
+        "rev": "eb3898d8ef143d4bf0f7f2229105fc51c7731b2f",
         "type": "github"
       },
       "original": {
@@ -500,57 +493,6 @@
         "repo": "default",
         "type": "github"
       }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_3": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "treefmt-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "openconnect-sso",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1699786194,
-        "narHash": "sha256-3h3EH1FXQkIeAuzaWB+nK0XK54uSD46pp+dMD3gAcB4=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "e82f32aa7f06bbbd56d7b12186d555223dc399d1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -2,24 +2,21 @@
   description = "System configuration for panacea";
 
   nixConfig = {
-    extra-substituters =
+    extra-substituters = "https://cachix.cachix.org https://nix-community.cachix.org https://install.determinate.systems";
-      "https://cachix.cachix.org https://nix-community.cachix.org";
     extra-trusted-public-keys = ''
       cachix.cachix.org-1:eWNHQldwUO7G2VkjpnjDbWwy4KQ/HNxht7H4SSoMckM=
-            nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs='';
+      nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
+      cache.flakehub.com-3:hJuILl5sVK4iKm86JzgdXW12Y2Hwd5G07qKtHTOcDCM=
+    '';
   };
 
   inputs = {
-    nixpkgs.url = "nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     nixos-hardware.url = "github:NixOS/nixos-hardware";
     agenix = {
       url = "github:ryantm/agenix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    openconnect-sso = {
-      url = "github:ThinkChaos/openconnect-sso/fix/nix-flake";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     cyrus-sasl-xoauth2 = {
       url = "github:robn/sasl2-oauth";
       flake = false;
@@ -29,20 +26,18 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     lanzaboote = {
-      url = "github:nix-community/lanzaboote/v0.3.0";
+      url = "github:nix-community/lanzaboote";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    pp-to-amd-epp = {
-      url = "github:marcinx64/pp-to-amd-epp";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    determinate.url = "https://flakehub.com/f/DeterminateSystems/determinate/*";
     local-bitwig = {
       url = "path:/home/coolneng/Projects/panacea/assets/bitwig";
       flake = false;
     };
   };
 
-  outputs = { self, nixpkgs, ... }@inputs:
+  outputs =
+    { self, nixpkgs, ... }@inputs:
     let
       system = "x86_64-linux";
 
@@ -51,16 +46,22 @@
         config.allowUnfree = true;
         overlays = [
           (final: prev: {
-            emacs-vterm =
+            emacs-vterm = (
-              ((pkgs.emacsPackagesFor pkgs.emacs29-pgtk).emacsWithPackages
+              (pkgs.emacsPackagesFor pkgs.emacs-pgtk).emacsWithPackages (
-                (epkgs: with epkgs; [ vterm mu4e ]));
+                epkgs: with epkgs; [
+                  vterm
+                  mu4e
+                ]
+              )
+            );
           })
         ];
       };
 
       lib = nixpkgs.lib;
 
-    in {
+    in
+    {
       nixosConfigurations.panacea = lib.nixosSystem {
         inherit system;
         modules = [
@@ -69,7 +70,7 @@
           inputs.agenix.nixosModules.age
           inputs.nix-index-database.nixosModules.nix-index
           inputs.lanzaboote.nixosModules.lanzaboote
-          inputs.pp-to-amd-epp.nixosModules.pp-to-amd-epp
+          inputs.determinate.nixosModules.default
         ];
         specialArgs = {
           inherit inputs;

modules/audio.nix

@@ -1,16 +1,26 @@
-{ config, lib, pkgs, inputs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
 
 with pkgs;
 
 let
   # HACK Replace youtube-dl with yt-dlp in mopidy-youtube
   mopidy-youtube-yt_dlp = mopidy-youtube.overrideAttrs (old: rec {
-    propagatedBuildInputs = old.propagatedBuildInputs
+    propagatedBuildInputs = old.propagatedBuildInputs ++ [
-      ++ [ python3.pkgs.yt-dlp python3.pkgs.ytmusicapi ];
+      python3.pkgs.yt-dlp
+      python3.pkgs.ytmusicapi
+    ];
   });
   soundcloud_token = builtins.readFile ../secrets/soundcloud_token;
+  bandcamp_token = builtins.readFile ../secrets/bandcamp_token;
 
-in {
+in
+{
   # Configure pipewire as sound server
   services.pipewire = {
     enable = true;
@@ -20,19 +30,18 @@ in {
     };
     pulse.enable = true;
     wireplumber.enable = true;
+    # Enable pipewire-pulse's audio via TCP
+    extraConfig.pipewire-pulse.tcp-server = {
+      "pulse.properties" = {
+        "server.address" = [
+          "unix:native"
+          "tcp:127.0.0.1:4713"
+        ];
+      };
+    };
   };
   security.rtkit.enable = true;
 
-  # Enable pipewire-pulse's audio via TCP
-  environment.etc."pipewire/pipewire-pulse.conf.d/pulse-server.conf".text = ''
-    pulse.properties = {
-      server.address = [
-        "unix:native"
-        "tcp:127.0.0.1:4713"
-      ]
-    }
-  '';
-
   # Set up Mopidy
   services.mopidy = {
     enable = true;
@@ -44,47 +53,53 @@ in {
       mopidy-somafm
       mopidy-soundcloud
     ];
-    configuration = ''
+    settings = {
-      [audio]
+      audio.output = "pulsesink server=127.0.0.1";
-      output = pulsesink server=127.0.0.1
 
-      [local]
+      local = {
-      media_dir = /home/coolneng/Music
+        media_dir = "/home/coolneng/Music";
-      directories =
+        directories = ''
-        Album Artists       local:directory?type=artist&role=albumartist
+          Album Artists       local:directory?type=artist&role=albumartist
-        Albums              local:directory?type=album
+          Albums              local:directory?type=album
-        Artists             local:directory?type=artist
+          Artists             local:directory?type=artist
-        Genres              local:directory?type=genre
+          Genres              local:directory?type=genre
-      excluded_file_extensions =
+        '';
-        .directory
+        excluded_file_extensions = ''
-        .html
+          .directory
-        .jpeg
+          .html
-        .jpg
+          .jpeg
-        .log
+          .jpg
-        .nfo
+          .log
-        .png
+          .nfo
-        .txt
+          .png
-      scan_timeout = 3000
+          .txt
+        '';
+        scan_timeout = 3000;
+      };
 
-      [mpd]
+      mpd.zeroconf = "";
-      zeroconf = ""
 
-      [m3u]
+      m3u = {
-      playlists_dir = /home/coolneng/.config/mpd/playlists
+        playlists_dir = "/home/coolneng/.config/mpd/playlists";
-      base_dir = /home/coolneng/Music
+        base_dir = "/home/coolneng/Music";
+      };
 
-      [youtube]
+      youtube = {
-      search_results = 50
+        search_results = 50;
-      youtube_dl_package = yt_dlp
+        youtube_dl_package = "yt_dlp";
-      musicapi_enabled = true
+        musicapi_enabled = true;
+      };
 
-      [somafm]
+      somafm = {
-      encoding = aac
+        encoding = "aac";
-      quality = highest
+        quality = "highest";
+      };
 
-      [soundcloud]
+      soundcloud = {
-      auth_token = ${soundcloud_token}
+        auth_token = soundcloud_token;
-      explore_songs = 100
+        explore_songs = 100;
-    '';
+      };
+      bandcamp.identity = bandcamp_token;
+    };
   };
 }

modules/cachix.nix

@@ -5,9 +5,9 @@ let
   folder = ../cachix;
   toImport = name: value: folder + ("/" + name);
   filterCaches = key: value: value == "regular" && lib.hasSuffix ".nix" key;
-  imports = lib.mapAttrsToList toImport
+  imports = lib.mapAttrsToList toImport (lib.filterAttrs filterCaches (builtins.readDir folder));
-    (lib.filterAttrs filterCaches (builtins.readDir folder));
+in
-in {
+{
   inherit imports;
   nix.binaryCaches = [ "https://cache.nixos.org/" ];
 }

modules/datasync.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
   # ZFS automatic snapshots
@@ -19,7 +24,7 @@
     settings = {
       devices.zion = {
         id = "FLI2RS7-GNI5PDM-SQRNF7P-YJIOXJ7-46FRPEI-NRLQGBC-HXRWG7O-RKOVLAF";
-        addresses = [ "tcp://192.168.13.2:22000" ];
+        addresses = [ "tcp://192.168.128.2:22000" ];
       };
       folders = {
         Documents = {
@@ -88,48 +93,4 @@
     };
   };
 
-  # Automount external storage
-  systemd.mounts = [
-    # UGent Samba
-    {
-      what = "//files.ugent.be/akasroua/home";
-      type = "cifs";
-      where = "/ugent";
-      options =
-        "credentials=${config.age.secrets.samba-ugent.path},noperm,vers=3.11,sec=ntlmv2i,noserverino";
-      mountConfig = { TimeoutSec = "5"; };
-    }
-  ];
-  systemd.automounts = [
-    # UGent Samba
-    {
-      where = "/ugent";
-      automountConfig = { TimeoutIdleSec = "5"; };
-      wantedBy = [ "default.target" ];
-    }
-  ];
-
-  # HACK Workaround to change the configuration of keyutils in order to get CIFS working
-  environment.etc."request-key.conf" = {
-    text = let
-      upcall = "${pkgs.cifs-utils}/bin/cifs.upcall";
-      keyctl = "${pkgs.keyutils}/bin/keyctl";
-    in ''
-      #OP     TYPE          DESCRIPTION  CALLOUT_INFO  PROGRAM
-      # -t is required for DFS share servers...
-      create  cifs.spnego   *            *             ${upcall} -t %k
-      create  dns_resolver  *            *             ${upcall} %k
-      # Everything below this point is essentially the default configuration,
-      # modified minimally to work under NixOS. Notably, it provides debug
-      # logging.
-      create  user          debug:*      negate        ${keyctl} negate %k 30 %S
-      create  user          debug:*      rejected      ${keyctl} reject %k 30 %c %S
-      create  user          debug:*      expired       ${keyctl} reject %k 30 %c %S
-      create  user          debug:*      revoked       ${keyctl} reject %k 30 %c %S
-      create  user          debug:loop:* *             |${pkgs.coreutils}/bin/cat
-      create  user          debug:*      *             ${pkgs.keyutils}/share/keyutils/request-key-debug.sh %k %d %c %S
-      negate  *             *            *             ${keyctl} negate %k 30 %S
-    '';
-  };
-
 }

modules/development.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
   # Improve nix-shell and direnv integration

modules/gui.nix

@@ -1,19 +1,22 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with pkgs;
 
 {
   # Display manager
-  services.xserver.enable = true;
+  services.greetd = {
-  services.xserver.displayManager = {
+    enable = true;
-    defaultSession = "sway";
+    settings = rec {
-    autoLogin = {
+      initial_session = {
-      enable = true;
+        command = "${sway}/bin/sway";
-      user = "coolneng";
+        user = "coolneng";
-    };
+      };
-    lightdm = {
+      default_session = initial_session;
-      enable = true;
-      greeter.enable = false;
     };
   };
 
@@ -25,13 +28,13 @@ with pkgs;
       swaylock
       swayidle
       swaybg
-      rofi-wayland
+      rofi
       waybar
-      clipman
+      cliphist
       wl-clipboard
       grim
       slurp
-      imv
+      swayimg
       kanshi
       kitty
       qt5.qtwayland
@@ -48,7 +51,7 @@ with pkgs;
       export NVIM_LISTEN_ADDRESS=/tmp/nvimsocket
       export GIT_CONFIG_NOSYSTEM=true
       export SYSTEMD_LESS=FRSMK
-      export LIBVA_DRIVER_NAME=iHD
+      export WLR_RENDERER=vulkan
     '';
     wrapperFeatures.gtk = true;
   };
@@ -72,7 +75,7 @@ with pkgs;
   # GPG agent
   programs.gnupg.agent = {
     enable = true;
-    pinentryFlavor = "gnome3";
+    pinentryPackage = pinentry-gnome3;
   };
 
   # Tmux

modules/hardware-configuration.nix

@@ -1,56 +1,66 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  ];
 
-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "usbhid" ];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "usbhid"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "syscea/stateful/root";
+    device = "syscea/stateful/root";
-      fsType = "zfs";
+    fsType = "zfs";
-    };
+  };
 
-  fileSystems."/nix" =
+  fileSystems."/nix" = {
-    { device = "syscea/ephemeral/nix";
+    device = "syscea/ephemeral/nix";
-      fsType = "zfs";
+    fsType = "zfs";
-    };
+  };
 
-  fileSystems."/ugent" =
+  fileSystems."/ugent" = {
-    { device = "systemd-1";
+    device = "systemd-1";
-      fsType = "autofs";
+    fsType = "autofs";
-    };
+  };
 
-  fileSystems."/home/coolneng" =
+  fileSystems."/home/coolneng" = {
-    { device = "syscea/stateful/home";
+    device = "syscea/stateful/home";
-      fsType = "zfs";
+    fsType = "zfs";
-    };
+  };
 
-  fileSystems."/tmp" =
+  fileSystems."/tmp" = {
-    { device = "syscea/ephemeral/tmp";
+    device = "syscea/ephemeral/tmp";
-      fsType = "zfs";
+    fsType = "zfs";
-    };
+  };
 
-  fileSystems."/home/coolneng/Downloads" =
+  fileSystems."/home/coolneng/Downloads" = {
-    { device = "syscea/stateful/home/downloads";
+    device = "syscea/stateful/home/downloads";
-      fsType = "zfs";
+    fsType = "zfs";
-    };
+  };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/C374-A2FD";
+    device = "/dev/disk/by-uuid/C374-A2FD";
-      fsType = "vfat";
+    fsType = "vfat";
-    };
+  };
 
-  swapDevices =
+  swapDevices = [
-    [ { device = "/dev/disk/by-uuid/1231a42f-a71a-4c67-b4d8-7506c02a8328"; }
+    { device = "/dev/disk/by-uuid/1231a42f-a71a-4c67-b4d8-7506c02a8328"; }
-    ];
+  ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

modules/latest-zfs-kernel.nix

@@ -0,0 +1,28 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+let
+  isUnstable = config.boot.zfs.package == pkgs.zfs_unstable;
+  zfsCompatibleKernelPackages = lib.filterAttrs (
+    name: kernelPackages:
+    (builtins.match "linux_[0-9]+_[0-9]+" name) != null
+    && (builtins.tryEval kernelPackages).success
+    && (
+      (!isUnstable && !kernelPackages.zfs.meta.broken)
+      || (isUnstable && !kernelPackages.zfs_unstable.meta.broken)
+    )
+  ) pkgs.linuxKernel.packages;
+  latestKernelPackage = lib.last (
+    lib.sort (a: b: (lib.versionOlder a.kernel.version b.kernel.version)) (
+      builtins.attrValues zfsCompatibleKernelPackages
+    )
+  );
+in
+{
+  # Note this might jump back and worth as kernel get added or removed.
+  boot.kernelPackages = lib.mkIf (lib.meta.availableOn pkgs.hostPlatform pkgs.zfs) latestKernelPackage;
+}

modules/monitoring.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with pkgs;
 
@@ -6,13 +11,14 @@ let
   sender = "akasroua@disroot.org";
   recipient = "akasroua+smart@disroot.org";
 
-in {
+in
+{
   # Notify when a disk starts going haywire
   services.smartd = {
     enable = true;
     defaults.monitored = "-H -f -t -C 197 -U 198 -d nvme";
     autodetect = false;
-    devices = [{ device = "/dev/nvme0"; }];
+    devices = [ { device = "/dev/nvme0"; } ];
     notifications.mail = {
       enable = true;
       sender = sender;

modules/networking.nix

@@ -1,8 +1,15 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
-let wireguard_port = "1194";
+let
+  wireguard_port = "1194";
 
-in {
+in
+{
   # Set hostname, hostid and enable WiFi
   networking = {
     hostName = "panacea";
@@ -46,11 +53,11 @@ in {
     name = "wlan0";
     matchConfig = {
       Name = "wlan0";
-      SSID = "Zingarata";
+      SSID = "anakinosi-5GHz";
     };
-    address = [ "192.168.13.131/24" ];
+    address = [ "192.168.129.3/23" ];
-    gateway = [ "192.168.13.1" ];
+    gateway = [ "192.168.128.1" ];
-    dns = [ "192.168.13.2" ];
+    dns = [ "192.168.128.2" ];
     networkConfig.MulticastDNS = "yes";
   };
 
@@ -62,7 +69,7 @@ in {
     };
     address = [ "192.168.13.3/24" ];
     gateway = [ "192.168.13.1" ];
-    dns = [ "192.168.13.2" ];
+    dns = [ "1.1.1.1" ];
     networkConfig.MulticastDNS = "yes";
   };
 
@@ -77,39 +84,45 @@ in {
       PrivateKeyFile = config.age.secrets.wireguard.path;
       FirewallMark = 34952;
     };
-    wireguardPeers = [{
+    wireguardPeers = [
-      wireguardPeerConfig = {
+      {
         PublicKey = "GN8lqPBZYOulh6xD4GhkoEWI65HMMCpSxJSH5871YnU=";
-        AllowedIPs = [ "0.0.0.0/0" ];
+        AllowedIPs = [
-        Endpoint = "coolneng.duckdns.org:1194";
+          "0.0.0.0/0"
-      };
+          "::0"
-    }];
+        ];
+        Endpoint = "psydnd.org:1194";
+      }
+    ];
   };
   systemd.network.networks."wg0" = {
     matchConfig.Name = "wg0";
-    linkConfig.ActivationPolicy = "manual";
     networkConfig = {
-      Address = "10.8.0.2/32";
+      Address = [
-      DNS = "10.8.0.1";
+        "10.8.0.2/32"
+        "fd00::2/128"
+      ];
+      DNS = [
+        "10.8.0.1"
+        "fd00::2"
+      ];
       DNSDefaultRoute = true;
-      Domains = "~.";
-      MulticastDNS = "yes";
     };
-    routingPolicyRules = [{
+    routingPolicyRules = [
-      routingPolicyRuleConfig = {
+      {
         FirewallMark = 34952;
         InvertRule = true;
         Table = 1000;
         Priority = 10;
-      };
+      }
-    }];
+    ];
-    routes = [{
+    routes = [
-      routeConfig = {
+      {
         Gateway = "10.8.0.1";
         GatewayOnLink = true;
         Table = 1000;
-      };
+      }
-    }];
+    ];
   };
 
   # Firewall configuration
@@ -131,4 +144,15 @@ in {
       iptables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport ${wireguard_port} -j RETURN || true
     '';
   };
+
+  # Enable localhost SSH
+  services.openssh = {
+    enable = true;
+    openFirewall = false;
+    startWhenNeeded = true;
+    settings = {
+      PermitRootLogin = "without-password";
+      PasswordAuthentication = false;
+    };
+  };
 }

modules/periodic.nix

@@ -1,94 +1,65 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with pkgs;
 
-let isync-oauth2 = (isync.override { withCyrusSaslXoauth2 = true; });
+let
+  isync-oauth2 = (isync.override { withCyrusSaslXoauth2 = true; });
 
-in {
+in
+{
   # Upgrade Doom Emacs daily
   systemd.user.services.doom-upgrade = {
     description = "Upgrade Doom Emacs";
-    path = [ bash emacs-vterm git coreutils ];
+    path = [
+      bash
+      emacs-vterm
+      git
+      coreutils
+    ];
     script = ''
-      ${pkgs.bash}/bin/bash -c "/home/coolneng/.emacs.d/bin/doom -! upgrade"
+      /home/coolneng/.emacs.d/bin/doom -! upgrade
     '';
     serviceConfig.Type = "oneshot";
     startAt = "22:00:00";
     after = [ "network-online.target" ];
   };
 
-  # Upgrade Neovim plugins weekly
-  systemd.user.services.vim-plug-upgrade = {
-    description = "Upgrade Vim-Plug";
-    path = [ git neovim ];
-    script = "${pkgs.neovim}/bin/nvim +PlugUpgrade +PlugUpdate +qa";
-    serviceConfig.Type = "oneshot";
-    startAt = "Wed 18:00:00";
-    after = [ "network-online.target" ];
-  };
-
   # Push password-store changes to git daily
   systemd.user.services.password-store-push = {
     description = "Push password-store changes to git";
-    path = [ pass-wayland git gitAndTools.pass-git-helper ];
+    path = [
+      pass-wayland
+      git
+      pass-git-helper
+    ];
     script = "${pkgs.pass-wayland}/bin/pass git push";
     serviceConfig.Type = "oneshot";
     startAt = "18:00:00";
     after = [ "network-online.target" ];
   };
 
-  # Sync mail using IDLE
+  # Sync mail using IMAP IDLE
-  systemd.user.services.goimapnotify-ugent = {
+  systemd.user.services.goimapnotify = {
-    description = "Sync UGent mail using IMAP IDLE";
+    description = "Sync mail using IMAP IDLE";
     wantedBy = [ "default.target" ];
     path = [
       goimapnotify
       pass-wayland
       isync-oauth2
       mu
-      python39
-      gnupg
-      nix
       procps
       emacs-vterm
     ];
     script = ''
-      ${pkgs.goimapnotify}/bin/goimapnotify -conf /home/coolneng/.config/goimapnotify/ugent.conf
+      ${pkgs.goimapnotify}/bin/goimapnotify -conf /home/coolneng/.config/goimapnotify/goimapnotify.yaml
     '';
     serviceConfig = {
-      ExecStartPre = "/home/coolneng/.local/share/scripts/mail-sync ugent";
+      ExecStartPre = "/home/coolneng/.local/share/scripts/mail-sync";
-      Type = "simple";
-      Restart = "always";
-      RestartSec = 20;
-    };
-    after = [ "network-online.target" ];
-  };
-
-  systemd.user.services.goimapnotify-gmail = {
-    description = "Sync gmail mail using IMAP IDLE";
-    wantedBy = [ "default.target" ];
-    path = [ goimapnotify pass-wayland isync-oauth2 mu procps emacs-vterm ];
-    script = ''
-      ${pkgs.goimapnotify}/bin/goimapnotify -conf /home/coolneng/.config/goimapnotify/gmail.conf
-    '';
-    serviceConfig = {
-      ExecStartPre = "/home/coolneng/.local/share/scripts/mail-sync gmail";
-      Type = "simple";
-      Restart = "always";
-      RestartSec = 20;
-    };
-    after = [ "network-online.target" ];
-  };
-
-  systemd.user.services.goimapnotify-disroot = {
-    description = "Sync disroot mail using IMAP IDLE";
-    wantedBy = [ "default.target" ];
-    path = [ goimapnotify pass-wayland isync-oauth2 mu procps emacs-vterm ];
-    script = ''
-      ${pkgs.goimapnotify}/bin/goimapnotify -conf /home/coolneng/.config/goimapnotify/disroot.conf
-    '';
-    serviceConfig = {
-      ExecStartPre = "/home/coolneng/.local/share/scripts/mail-sync disroot";
       Type = "simple";
       Restart = "always";
       RestartSec = 20;
@@ -100,8 +71,16 @@ in {
   systemd.user.services.periodic-mail-sync = {
     description = "Run a mail sync operation periodically";
     wantedBy = [ "default.target" ];
-    path =
+    path = [
-      [ pass-wayland isync-oauth2 mu procps emacs-vterm python39 gnupg nix ];
+      pass-wayland
+      isync-oauth2
+      mu
+      procps
+      emacs-vterm
+      python3
+      gnupg
+      nix
+    ];
     script = ''
       /home/coolneng/.local/share/scripts/mail-sync -a
     '';
@@ -116,26 +95,34 @@ in {
     script = "chmod 751 /home/coolneng";
     serviceConfig.Type = "oneshot";
     after = [ "home-coolneng.mount" ];
-    before = [ "mopidy.service" "mopidy-scan.service" ];
+    before = [
+      "mopidy.service"
+      "mopidy-scan.service"
+    ];
   };
 
   # Push panacea changes to git daily
   systemd.user.services.panacea-push = {
     description = "Push panacea changes to git";
-    path = [ pass-wayland git gitAndTools.pass-git-helper ];
+    path = [
+      pass-wayland
+      git
+      pass-git-helper
+    ];
     script = "${pkgs.git}/bin/git -C /home/coolneng/Projects/panacea push";
     serviceConfig.Type = "oneshot";
-    startAt = "14:00:00";
+    startAt = "18:00:00";
     after = [ "network-online.target" ];
   };
 
-  # Pull changes from zion daily
+  # Show notification when the battery is low
-  systemd.user.services.zion-pull = {
+  systemd.user.services.swaynag-battery = {
-    description = "Pull zion changes to git";
+    description = "Show notification when the battery is low";
-    path = [ git ];
+    path = [
-    script = "${pkgs.git}/bin/git -C /home/coolneng/Projects/zion pull";
+      swaynag-battery
-    serviceConfig.Type = "oneshot";
+      sway
-    startAt = "10:00:00";
+    ];
-    after = [ "network-online.target" ];
+    script = "${pkgs.swaynag-battery}/bin/swaynag-battery --threshold 10";
+    wantedBy = [ "sway-session.target" ];
   };
 }

modules/power.nix

@@ -1,16 +1,16 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
   # Enable power-profiles-daemon
   services.power-profiles-daemon.enable = true;
 
-  # Integration of AMD P-State EPP with power-profiles-daemon
+  # Suspend when the battery is critical
-  services.pp-to-amd-epp.enable = true;
-
-  # Suspend when the battery is critical and autosuspend USB and PCI
   services.udev.extraRules = ''
     SUBSYSTEM=="power_supply", ATTR{status}=="Discharging", ATTR{model_name}=="01AV405", ATTR{capacity}=="[0-5]", RUN+="${config.systemd.package}/bin/systemctl suspend -i"
-    ACTION=="add", SUBSYSTEM=="usb", TEST=="power/control", ATTR{power/control}="auto"
-    ACTION=="add", SUBSYSTEM=="pci", TEST=="power/control", ATTR{power/control}="auto"
   '';
 }

modules/printing.nix

@@ -1,10 +1,18 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
   # Enable CUPS
   services.printing = {
     enable = true;
-    drivers = with pkgs; [ brgenml1cupswrapper hplip ];
+    drivers = with pkgs; [
+      brgenml1cupswrapper
+      hplip
+    ];
   };
 
   # Enable SANE

modules/software.nix

@@ -1,11 +1,23 @@
-{ config, lib, pkgs, inputs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
 
 with pkgs;
 
 let
-  mpv-sponsorblock = (pkgs.wrapMpv pkgs.mpv-unwrapped {
+  custom-mpv = (
-    scripts = [ mpvScripts.sponsorblock ];
+    mpv-unwrapped.wrapper {
-  });
+      mpv = mpv-unwrapped;
+      scripts = with mpvScripts; [
+        sponsorblock-minimal
+        mpv-cheatsheet
+      ];
+    }
+  );
 
   patched-bitwig = bitwig-studio.overrideAttrs (old: rec {
     src = "${inputs.local-bitwig}/bitwig-studio.deb";
@@ -14,7 +26,8 @@ let
     '';
   });
 
-in {
+in
+{
   environment.systemPackages = [
     # Monitoring
     htop
@@ -23,7 +36,7 @@ in {
     gnupg
     pass-wayland
     passff-host
-    gitAndTools.pass-git-helper
+    pass-git-helper
     inputs.agenix.packages.${config.nixpkgs.localSystem.system}.default
     git-crypt
     git-lfs
@@ -35,7 +48,6 @@ in {
     texlab
     # Text editors
     neovim
-    neovim-remote
     emacs-vterm
     # Emacs dependencies
     (ripgrep.override { withPCRE2 = true; })
@@ -51,24 +63,23 @@ in {
     direnv
     nix-direnv
     gnumake
-    gitAndTools.pre-commit
+    pre-commit
+    emacs-lsp-booster
     # Rice
     adapta-gtk-theme
     paper-icon-theme
     # Audio
     mopidy
     ncmpcpp
-    mpc_cli
+    mpc
     pulsemixer
     easyeffects
     patched-bitwig
     # Productivity
     zathura
     libreoffice-fresh
-    gnome.simple-scan
+    simple-scan
     bc
-    citrix_workspace
-    teams-for-linux
     pdfgrep
     # Mail stack
     mu
@@ -76,22 +87,18 @@ in {
     msmtp
     # Media
     gimp
-    mpv-sponsorblock
+    custom-mpv
-    nodePackages.webtorrent-cli
     deluge
     yt-dlp-light
+    ffmpeg
     calibre
     beets
     # File management
     zip
     unzip
     unar
-    cifs-utils
-    keyutils
     # Overlays
     cachix
-    # Networking
-    inputs.openconnect-sso.packages.${config.nixpkgs.localSystem.system}.default
     # Budgeting
     beancount
     beancount-language-server
@@ -101,10 +108,10 @@ in {
     shellcheck
     shfmt
     ## Nix
-    nixfmt
+    nixfmt-rfc-style
     ## Python
-    nodePackages.pyright
+    ty
-    black
+    ruff
     ## C/C++
     clang-tools
     ## Go
@@ -117,11 +124,11 @@ in {
   # Fonts declaration
   fonts.packages = with pkgs; [
     google-fonts
-    inconsolata-nerdfont
     terminus_font_ttf
     iosevka-bin
     libertine
-    (nerdfonts.override { fonts = [ "NerdFontsSymbolsOnly" ]; })
+    nerd-fonts.inconsolata
+    nerd-fonts.symbols-only
   ];
 
 }

secrets/secrets.nix

@@ -1,9 +1,8 @@
 let
-  coolneng =
+  coolneng = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC57m1j/G6iQyi2EpU3nj3+df5Z4PL/XbiOmDcqA7ODg";
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC57m1j/G6iQyi2EpU3nj3+df5Z4PL/XbiOmDcqA7ODg";
+in
-in {
+{
   "wireguard.age".publicKeys = [ coolneng ];
   "syncthing.age".publicKeys = [ coolneng ];
-  "samba-ugent.age".publicKeys = [ coolneng ];
   "msmtp.age".publicKeys = [ coolneng ];
 }