import from old repo

.gitignore

@@ -0,0 +1,3 @@
+/wip
+result
+result-*

config/zsh/components/console-256color.zsh

@@ -0,0 +1,2 @@
+# works well enough
+[[ "$TERM" == "linux" ]] && TERM=xterm-256color

config/zsh/components/fuzzy-tab.zsh

@@ -0,0 +1,4 @@
+zstyle ':completion:*' matcher-list '' \
+  'm:{a-z\-}={A-Z\_}' \
+  'r:[^[:alpha:]]||[[:alpha:]]=** r:|=* m:{a-z\-}={A-Z\_}' \
+  'r:|?=** m:{a-z\-}={A-Z\_}'

config/zsh/components/highlight-theme.zsh

@@ -0,0 +1,31 @@
+# zsh-syntax-highlighting
+typeset -A ZSH_HIGHLIGHT_STYLES
+
+ZSH_HIGHLIGHT_STYLES[precommand]='fg=33'
+
+ZSH_HIGHLIGHT_STYLES[arg0]='fg=39'
+
+ZSH_HIGHLIGHT_STYLES[single-hyphen-option]='fg=229'
+ZSH_HIGHLIGHT_STYLES[double-hyphen-option]='fg=228'
+
+ZSH_HIGHLIGHT_STYLES[autodirectory]='fg=blue'
+
+ZSH_HIGHLIGHT_STYLES[path]='none'
+# HACK: performance fix assuming "none" isn't truly none
+ZSH_HIGHLIGHT_DIRS_BLACKLIST+=(/*)
+
+# fix aliased highlighting of suid precmds
+typeset -A ZSH_HIGHLIGHT_PATTERNS
+
+ZSH_HIGHLIGHT_PATTERNS+=('doas' 'fg=33')
+ZSH_HIGHLIGHT_PATTERNS+=('sudo' 'fg=33')
+
+ZSH_HIGHLIGHT_HIGHLIGHTERS=(main pattern)
+
+# set up LS_COLORS
+if which dircolors >/dev/null 2>&1; then
+	export $(dircolors)
+fi
+
+# colorful tab completion listings
+zstyle ':completion:*' list-colors "${(s.:.)LS_COLORS}"

config/zsh/components/history.zsh

@@ -0,0 +1,7 @@
+HISTFILE=~/.cache/zsh_history
+HISTSIZE=15000
+SAVEHIST=10000
+setopt share_history
+setopt hist_expire_dups_first
+setopt hist_no_functions hist_no_store hist_reduce_blanks
+setopt hist_verify

config/zsh/components/keybinds.zsh

@@ -0,0 +1,38 @@
+# partial outtake from ohmyzsh lib/key-bindings.zsh
+# https://github.com/ohmyzsh/ohmyzsh/pull/1355/files
+if (( ${+terminfo[smkx]} )) && (( ${+terminfo[rmkx]} )); then
+  function zle-line-init() {
+    echoti smkx
+  }
+  function zle-line-finish() {
+    echoti rmkx
+  }
+  zle -N zle-line-init
+  zle -N zle-line-finish
+fi
+
+bindkey -e                                          # Use emacs key bindings
+
+bindkey '\ew' kill-region                           # [Esc-w] - Kill from the cursor to the mark
+bindkey -s '\el' 'ls\n'                             # [Esc-l] - run command: ls
+bindkey '^r' history-incremental-search-backward    # [Ctrl-r] - Search backward incrementally for a specified string. The string may begin with ^ to anchor the search to the beginning of the line.
+bindkey "${terminfo[kpp]}" up-line-or-history       # [PageUp] - Up a line of history
+bindkey "${terminfo[knp]}" down-line-or-history     # [PageDown] - Down a line of history
+
+bindkey "${terminfo[kcuu1]}" history-substring-search-up
+bindkey "${terminfo[kcud1]}" history-substring-search-down
+
+bindkey "${terminfo[khome]}" beginning-of-line      # [Home] - Go to beginning of line
+bindkey "${terminfo[kend]}"  end-of-line            # [End] - Go to end of line
+
+bindkey ' ' magic-space                             # [Space] - do history expansion
+
+bindkey '^[[1;5C' forward-word                      # [Ctrl-RightArrow] - move forward one word
+bindkey '^[[1;5D' backward-word                     # [Ctrl-LeftArrow] - move backward one word
+
+bindkey "${terminfo[kcbt]}" reverse-menu-complete   # [Shift-Tab] - move through the completion menu backwards
+
+bindkey '^?' backward-delete-char                   # [Backspace] - delete backward
+bindkey "${terminfo[kdch1]}" delete-char            # [Delete] - delete forward
+
+

config/zsh/components/magic-space.zsh

@@ -0,0 +1,2 @@
+bindkey ' ' magic-space
+bindkey '^ ' autosuggest-accept

config/zsh/components/misc.zsh

@@ -0,0 +1,15 @@
+# allow using comments in interactive
+setopt interactive_comments
+
+# basic support for the omz theme format
+setopt prompt_subst
+
+# completions
+autoload -U compinit
+compinit
+# allow fully dynamic alias completion - like it's supposed to be
+unsetopt complete_aliases
+
+setopt glob_complete
+setopt glob_star_short
+unsetopt bad_pattern

config/zsh/components/navigation.zsh

@@ -0,0 +1,43 @@
+alias d="dirs -v | head -n10"
+
+# backdir auto expansion: ... -> ../..
+function rationalise-dot() {
+	local MATCH # keep the regex match from leaking to the environment
+	if [[ $LBUFFER =~ '(^|/| |      |'$'\n''|\||;|&)\.\.$' && ! $LBUFFER = p4* ]]; then
+			#if [[ ! $LBUFFER = p4* && $LBUFFER = *.. ]]; then
+			LBUFFER+=/..
+	else
+			zle self-insert
+	fi
+}
+zle -N rationalise-dot
+bindkey '\e.' rationalise-dot
+bindkey -M isearch . self-insert
+
+# absolutize a relative path, or vice versa, or alternatively insert the cwd
+function insert-cwd-or-absolute() {
+	local MATCH # keep the regex match from leaking to the environment
+	# match anything that could be a path
+	if [[ $LBUFFER =~ '(|'$'\n''|\||;|&)[^= ]+$' && ! $LBUFFER = p4* ]]; then
+		# make sure it exists
+		if [[ -e $MATCH ]]; then
+			local XMATCH="$MATCH"
+			# absolute - make relative
+			if [[ $XMATCH =~ '^/' ]]; then
+				# cut away the last piece of the buffer
+				local LENGTH=$(( $#LBUFFER - $#XMATCH ))
+				LBUFFER="${LBUFFER:0:${LENGTH}}"
+				# and replace it with a relative realpath
+				LBUFFER+="$(realpath --relative-to=. $XMATCH)"
+			else # relative - make absolute
+				local LENGTH=$(( $#LBUFFER - $#XMATCH ))
+				LBUFFER="${LBUFFER:0:${LENGTH}}"
+				LBUFFER+="$(realpath $XMATCH)"
+			fi
+		fi
+	else
+		LBUFFER+=$(pwd)
+	fi
+}
+zle -N insert-cwd-or-absolute
+bindkey '\ed' insert-cwd-or-absolute

config/zsh/components/theme-common-mod.zsh

@@ -0,0 +1,88 @@
+# vim: filetype=sh
+
+# Prompt symbol
+COMMON_PROMPT_SYMBOL="Ψ"
+
+# Colors
+COMMON_COLORS_HOST_ME=green
+COMMON_COLORS_HOST_AWS_VAULT=yellow
+COMMON_COLORS_CURRENT_DIR=blue
+COMMON_COLORS_RETURN_STATUS_TRUE=99
+COMMON_COLORS_RETURN_STATUS_FALSE=red
+COMMON_COLORS_GIT_STATUS_DEFAULT=green
+COMMON_COLORS_GIT_STATUS_STAGED=red
+COMMON_COLORS_GIT_STATUS_UNSTAGED=yellow
+COMMON_COLORS_GIT_PROMPT_SHA=green
+COMMON_COLORS_BG_JOBS=yellow
+
+# Left Prompt
+ PROMPT='$(common_host)$(common_current_dir)$(common_bg_jobs)$(common_return_status)'
+
+# Right Prompt
+ RPROMPT='$(common_git_status)'
+
+# Prompt with current SHA
+# PROMPT='$(common_host)$(common_current_dir)$(common_bg_jobs)$(common_return_status)'
+# RPROMPT='$(common_git_status) $(git_prompt_short_sha)'
+
+# Host
+common_host() {
+  if [[ -n $SSH_CONNECTION ]]; then
+    me="%n@%m"
+  elif [[ $LOGNAME != $USER ]]; then
+    me="%n"
+  fi
+  if [[ -n $me ]]; then
+    echo "%{$fg[$COMMON_COLORS_HOST_ME]%}$me%{$reset_color%}:"
+  fi
+  if [[ $AWS_VAULT ]]; then
+    echo "%{$fg[$COMMON_COLORS_HOST_AWS_VAULT]%}$AWS_VAULT%{$reset_color%} "
+  fi
+}
+
+# Current directory
+common_current_dir() {
+  echo -n "%{$fg[$COMMON_COLORS_CURRENT_DIR]%}%c "
+}
+
+# Prompt symbol
+common_return_status() {
+  echo -n "%(?.%F{$COMMON_COLORS_RETURN_STATUS_TRUE}.%F{$COMMON_COLORS_RETURN_STATUS_FALSE})$COMMON_PROMPT_SYMBOL%f "
+}
+
+# Git status
+common_git_status() {
+    local message=""
+    local message_color="%F{$COMMON_COLORS_GIT_STATUS_DEFAULT}"
+
+    # https://git-scm.com/docs/git-status#_short_format
+    local staged=$(git status --porcelain 2>/dev/null | grep -e "^[MADRCU]")
+    local unstaged=$(git status --porcelain 2>/dev/null | grep -e "^[MADRCU? ][MADRCU?]")
+
+    if [[ -n ${staged} ]]; then
+        message_color="%F{$COMMON_COLORS_GIT_STATUS_STAGED}"
+    elif [[ -n ${unstaged} ]]; then
+        message_color="%F{$COMMON_COLORS_GIT_STATUS_UNSTAGED}"
+    fi
+
+    local branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
+    if [[ -n ${branch} ]]; then
+        message+="${message_color}${branch}%f"
+    fi
+
+    echo -n "${message}"
+}
+
+# Git prompt SHA
+ZSH_THEME_GIT_PROMPT_SHA_BEFORE="%{%F{$COMMON_COLORS_GIT_PROMPT_SHA}%}"
+ZSH_THEME_GIT_PROMPT_SHA_AFTER="%{$reset_color%} "
+
+# Background Jobs
+common_bg_jobs() {
+  bg_status="%{$fg[$COMMON_COLORS_BG_JOBS]%}%(1j.↓%j .)"
+  echo -n $bg_status
+}
+
+# xterm title
+PROMPT_XTITLE=$'%{\033]0;%n@%M:%~\007%}'
+PROMPT="${PROMPT_XTITLE}${PROMPT}"

config/zsh/components/theme-delta-mod.zsh

@@ -0,0 +1,54 @@
+# Delta
+# Reference/Resources:
+#
+# Prompt Expansion:
+# http://zsh.sourceforge.net/Doc/Release/Prompt-Expansion.html
+# http://unix.stackexchange.com/questions/157693/howto-include-output-of-a-script-into-the-zsh-prompt
+#
+# vcs_info
+# https://github.com/zsh-users/zsh/blob/master/Misc/vcs_info-examples
+# http://zsh.sourceforge.net/Doc/Release/User-Contributions.html#Version-Control-Information
+
+delta_prompt_symbol() {
+	if [[ "$1" -eq 0 ]]; then
+		print -n '%F{red}'
+	else
+		print -n '%F{8}'
+	fi	
+}
+
+
+
+delta_prompt_init() {
+
+	local hostnamevar PRETTY_HOSTNAME CHASSIS LOCATION
+	if [[ -f /etc/machine-info ]]; then
+		. /etc/machine-info
+		if [[ -n $PRETTY_HOSTNAME ]]; then
+			hostnamevar=$PRETTY_HOSTNAME
+		fi
+	fi
+	if [[ -z $hostnamevar ]]; then
+		hostnamevar='%m'
+	fi
+
+
+	if [[ -n $SSH_CONNECTION ]]; then
+		PROMPT=" \$(delta_prompt_symbol \$?)Δ%f %F{8}$hostnamevar %c >%f "
+	else
+		PROMPT=" \$(delta_prompt_symbol \$?)Δ%f %F{8}%c >%f "
+	fi
+
+	zstyle ':vcs_info:*' enable git
+	zstyle ':vcs_info:*' use-simple true
+	zstyle ':vcs_info:git*' formats '%b'
+	zstyle ':vcs_info:git*' actionformats '%b|%a'
+
+	zstyle ':vcs_info:*' max-exports 2
+}
+
+delta_prompt_init "$@"
+
+# xterm title
+PROMPT_XTITLE=$'%{\033]0;%n@%M:%~\007%}'
+PROMPT="${PROMPT_XTITLE}${PROMPT}"

config/zsh/prompt.zsh

@@ -0,0 +1,95 @@
+# Delta
+# Reference/Resources:
+#
+# Prompt Expansion:
+# http://zsh.sourceforge.net/Doc/Release/Prompt-Expansion.html
+# http://unix.stackexchange.com/questions/157693/howto-include-output-of-a-script-into-the-zsh-prompt
+#
+# vcs_info
+# https://github.com/zsh-users/zsh/blob/master/Misc/vcs_info-examples
+# http://zsh.sourceforge.net/Doc/Release/User-Contributions.html#Version-Control-Information
+#
+delta_prompt_symbol() {
+	if [[ "$1" -eq 0 ]]; then
+		print -n "%F{$2}"
+	else
+		print -n '%F{8}'
+	fi	
+}
+
+delta_prompt_nix_shell() {
+	if [[ -n "$IN_NIX3_SHELL" || -n "$IN_NIX_SHELL" ]]; then
+		print -n " %F{cyan}>%F{blue}>%F{8}"
+		tr : '\n' <<<$PATH | grep '^/nix/store' | while read storepath; do
+			print -n " ${${storepath#*-}%/*}"
+		done
+		print -n '%f\n '
+	else
+		print -n ' '
+	fi
+}
+
+delta_prompt_init() {
+
+	local hostnamevar PRETTY_HOSTNAME CHASSIS LOCATION
+	if [[ -f /etc/machine-info ]]; then
+		. /etc/machine-info
+		if [[ -n $PRETTY_HOSTNAME ]]; then
+			hostnamevar=$PRETTY_HOSTNAME
+		fi
+	fi
+	if [[ -z $hostnamevar ]]; then
+		hostnamevar='%m'
+	fi
+
+	local symbol_color
+	if [[ -n "$IN_NIX3_SHELL" || -n "$IN_NIX_SHELL" ]]; then
+		symbol_color=blue
+	else
+		symbol_color=red
+	fi
+
+	if [[ -n $SSH_CONNECTION ]]; then
+		PROMPT="$(delta_prompt_nix_shell)\$(delta_prompt_symbol \$? $symbol_color)Δ%f %F{8}$hostnamevar %c >%f "
+	else
+		PROMPT="$(delta_prompt_nix_shell)\$(delta_prompt_symbol \$? $symbol_color)Δ%f %F{8}%c >%f "
+	fi
+	unfunction delta_prompt_nix_shell
+
+	zstyle ':vcs_info:*' enable git
+	zstyle ':vcs_info:*' use-simple true
+	zstyle ':vcs_info:git*' formats '%b'
+	zstyle ':vcs_info:git*' actionformats '%b|%a'
+
+	zstyle ':vcs_info:*' max-exports 2
+}
+
+delta_prompt_git_status() {
+    local message=""
+    local message_color="%F{green}"
+
+    # https://git-scm.com/docs/git-status#_short_format
+    local staged=$(git status --porcelain 2>/dev/null | grep -e "^[MADRCU]")
+    local unstaged=$(git status --porcelain 2>/dev/null | grep -e "^[MADRCU? ][MADRCU?]")
+
+    if [[ -n ${staged} ]]; then
+        message_color="%F{red}"
+    elif [[ -n ${unstaged} ]]; then
+        message_color="%F{yellow}"
+    fi
+
+    local branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
+    if [[ -n ${branch} ]]; then
+        message+="${message_color}${branch}%f"
+    fi
+
+    echo -n "${message}"
+}
+
+
+delta_prompt_init "$@"
+
+# xterm title
+PROMPT_XTITLE=$'%{\033]0;%n@%M:%~\007%}'
+PROMPT="${PROMPT_XTITLE}${PROMPT}"
+RPROMPT='$(delta_prompt_git_status)'

flake.lock

@@ -0,0 +1,337 @@
+{
+  "nodes": {
+    "agenix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1641576265,
+        "narHash": "sha256-G4W39k5hdu2kS13pi/RhyTOySAo7rmrs7yMUZRH0OZI=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "08b9c96878b2f9974fc8bde048273265ad632357",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
+    "deploy-rs": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "utils": "utils"
+      },
+      "locked": {
+        "lastModified": 1643452512,
+        "narHash": "sha256-X+ZZhxzSSI0UyNVbVn3YH53Iiai0cUPZLq2ls751z4I=",
+        "owner": "serokell",
+        "repo": "deploy-rs",
+        "rev": "3180b55ad44777edd90c08f9f9d4df74ec1549b9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "serokell",
+        "repo": "deploy-rs",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1627913399,
+        "narHash": "sha256-hY8g6H2KFL8ownSiFeMOjwPC8P0ueXpCVEbxgda3pko=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "12c64ca55c1014cdc1b16ed5a804aa8576601ff2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "locked": {
+        "lastModified": 1629481132,
+        "narHash": "sha256-JHgasjPR0/J1J3DRm4KxM4zTyAj4IOJY8vIl75v/kPI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "997f7efcb746a9c140ce1f13c72263189225f482",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1643579427,
+        "narHash": "sha256-tV4M4+Aqd/3ZjEz1Q07j89KIlkt1oFH34RzpBkUeO/0=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "a52aed72c84a2a10102a92397339fa01fc0fe9cf",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "master",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "kernel-clr": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1643572264,
+        "narHash": "sha256-qFQw0oGwBCQ+VVAYG6DuaVvEr6P/5ISjdkfQyMySOpc=",
+        "owner": "clearlinux-pkgs",
+        "repo": "linux",
+        "rev": "408f197e221f6b4b9c2c65fee7029365b1bf50b1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "clearlinux-pkgs",
+        "repo": "linux",
+        "type": "github"
+      }
+    },
+    "lowdown-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1633514407,
+        "narHash": "sha256-Dw32tiMjdK9t3ETl5fzGrutQTzh2rufgZV4A/BbxuD4=",
+        "owner": "kristapsdz",
+        "repo": "lowdown",
+        "rev": "d2c2b44ff6c27b936ec27358a2653caaef8f73b8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "kristapsdz",
+        "repo": "lowdown",
+        "type": "github"
+      }
+    },
+    "modular-nvim": {
+      "inputs": {
+        "neovim-nightly": "neovim-nightly",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1638630126,
+        "narHash": "sha256-zKGvpL4sdO9vku1hxxojgpIV6VPFttMJCOIzTUN8ghU=",
+        "ref": "master",
+        "rev": "3517ef35fd6e5438044fcf028930d59b6f914c09",
+        "revCount": 3,
+        "type": "git",
+        "url": "https://git.privatevoid.net/max/modular-neovim-prototype"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.privatevoid.net/max/modular-neovim-prototype"
+      }
+    },
+    "naersk": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1639947939,
+        "narHash": "sha256-pGsM8haJadVP80GFq4xhnSpNitYNQpaXk4cnA796Cso=",
+        "owner": "nmattia",
+        "repo": "naersk",
+        "rev": "2fc8ce9d3c025d59fee349c1f80be9785049d653",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nmattia",
+        "ref": "master",
+        "repo": "naersk",
+        "type": "github"
+      }
+    },
+    "neovim-nightly": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "modular-nvim",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "dir": "contrib",
+        "lastModified": 1638617502,
+        "narHash": "sha256-+ljeNkTqpLbZlAfRMcOqcB87FAitVKQqHuBblOewRe8=",
+        "owner": "neovim",
+        "repo": "neovim",
+        "rev": "76af219e3e481222e6fece34c7c022d6a58998e1",
+        "type": "github"
+      },
+      "original": {
+        "dir": "contrib",
+        "owner": "neovim",
+        "repo": "neovim",
+        "type": "github"
+      }
+    },
+    "nix-crx": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1643691840,
+        "narHash": "sha256-uxRMCcS7uauO5w1arF48obliKJrS4VTx0Q1NG7AT6fo=",
+        "ref": "master",
+        "rev": "e5337b96c318c277bc169bdbf59e09aa5973b5a2",
+        "revCount": 71,
+        "type": "git",
+        "url": "https://git.privatevoid.net/max/nix-crx"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.privatevoid.net/max/nix-crx"
+      }
+    },
+    "nix-super": {
+      "inputs": {
+        "nix": [
+          "nix-super-unstable-repin"
+        ]
+      },
+      "locked": {
+        "lastModified": 1643493331,
+        "narHash": "sha256-FEgmdOwBc+zRXzOPziUPhzwnGS+XD654tzzuoC7uZWQ=",
+        "ref": "master",
+        "rev": "c5e63d97363a4d911f2957b90e1c7a2a5f4db9c5",
+        "revCount": 42,
+        "type": "git",
+        "url": "https://git.privatevoid.net/max/nix-super"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.privatevoid.net/max/nix-super"
+      }
+    },
+    "nix-super-unstable-repin": {
+      "inputs": {
+        "lowdown-src": "lowdown-src",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "nixpkgs-regression": "nixpkgs-regression"
+      },
+      "locked": {
+        "lastModified": 1643708659,
+        "narHash": "sha256-RSSlepExjV0T0kCDuDhKymwnajWwq2I372/x71ScI08=",
+        "owner": "NixOS",
+        "repo": "nix",
+        "rev": "73d5f38a47e7c3dea62994cfb8f962976194f767",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nix",
+        "type": "github"
+      }
+    },
+    "nixos-hardware": {
+      "locked": {
+        "lastModified": 1641965797,
+        "narHash": "sha256-AfxfIzAZbt9aAzpVBn0Bwhd/M4Wix7G91kEjm9H6FPo=",
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "rev": "87a35a0d58f546dc23f37b4f6af575d0e4be6a7a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "master",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1643524588,
+        "narHash": "sha256-Qh5AazxdOQRORbGkkvpKoovDl6ej/4PhDabFsqnueqw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "efeefb2af1469a5d1f0ae7ca8f0dfd9bb87d5cfb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-regression": {
+      "locked": {
+        "lastModified": 1643052045,
+        "narHash": "sha256-uGJ0VXIhWKGXxkeNnq4TvV3CIOkUJ3PAoLZ3HMzNVMw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
+        "type": "indirect"
+      }
+    },
+    "root": {
+      "inputs": {
+        "agenix": "agenix",
+        "deploy-rs": "deploy-rs",
+        "home-manager": "home-manager",
+        "kernel-clr": "kernel-clr",
+        "modular-nvim": "modular-nvim",
+        "naersk": "naersk",
+        "nix-crx": "nix-crx",
+        "nix-super": "nix-super",
+        "nix-super-unstable-repin": "nix-super-unstable-repin",
+        "nixos-hardware": "nixos-hardware",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "utils": {
+      "locked": {
+        "lastModified": 1631561581,
+        "narHash": "sha256-3VQMV5zvxaVLvqqUrNz3iJelLw30mIVSfZmAaauM3dA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "7e5bf3925f6fbdfaf50a2a7ca0be2879c4261d19",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,105 @@
+{
+  description = "System and user config";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+
+    nix-super.url = "git+https://git.privatevoid.net/max/nix-super";
+    nix-super.inputs.nix.follows = "nix-super-unstable-repin";
+
+    nix-super-unstable-repin.url = "github:NixOS/nix";
+    nix-super-unstable-repin.inputs.nixpkgs.follows = "nixpkgs";
+
+    modular-nvim.url = "git+https://git.privatevoid.net/max/modular-neovim-prototype";
+    modular-nvim.inputs.nixpkgs.follows = "nixpkgs";
+
+    home-manager.url = "github:nix-community/home-manager/master";
+    home-manager.inputs.nixpkgs.follows = "nixpkgs";
+
+    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
+
+    nix-crx.url = "git+https://git.privatevoid.net/max/nix-crx";
+    nix-crx.inputs.nixpkgs.follows = "nixpkgs";
+
+    deploy-rs.url = "github:serokell/deploy-rs";
+    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
+    deploy-rs.inputs.naersk.follows = "naersk";
+
+    # re-pin naersk to fix deprecation warning in deploy-rs
+    naersk.url = "github:nmattia/naersk/master";
+    naersk.inputs.nixpkgs.follows = "nixpkgs";
+
+    agenix.url = "github:ryantm/agenix";
+    agenix.inputs.nixpkgs.follows = "nixpkgs";
+
+    kernel-clr = { url = "github:clearlinux-pkgs/linux"; flake = false; };
+  };
+  outputs = { self, nixpkgs, home-manager, nixos-hardware, ... }@inputs:
+    let
+      inherit (nixpkgs) lib;
+      system = "x86_64-linux";
+      pkgs = import nixpkgs {
+        inherit system;
+      };
+
+      deploy-rs-lib = inputs.deploy-rs.lib.${system};
+      agenixModule = inputs.agenix.nixosModules.age;
+
+      aspect = import ./modules inputs;
+      hosts = import ./hosts;
+      specialArgs = { inherit inputs hosts aspect; };
+
+      mkNixOS' = lib: name: lib.nixosSystem {
+        inherit system;
+        inherit specialArgs;
+        modules = [ hosts."${name}".nixos ];
+      };
+      mkNixOS = mkNixOS' nixpkgs.lib;
+    in {
+      nixosModules = aspect.modules;
+      nixosConfigurations = 
+      lib.genAttrs [ "TITAN" "jericho" ] mkNixOS;
+
+      deploy.nodes = with deploy-rs-lib; {
+        TITAN = {
+          hostname = "titan.hypr";
+          profiles.system = {
+            user = "root";
+            path = activate.nixos self.nixosConfigurations.TITAN;
+          };
+        };
+        jericho = {
+          hostname = "jericho.hypr";
+          profiles.system = {
+            user = "root";
+            path = activate.nixos self.nixosConfigurations.jericho;
+          };
+        };
+      };
+
+      packages.${system} = import ./packages {
+        nixpkgs = pkgs;
+        inherit inputs;
+      };
+
+      defaultApp.${system} = {
+        type = "app";
+        program = self.packages.${system}.flake-installer.outPath;
+      };
+
+      hydraJobs = {
+        systems.${system} = lib.mapAttrs (_: x: x.config.system.build.toplevel) self.nixosConfigurations;
+        packages = self.packages;
+      };
+
+      homeConfigurations = {
+        max = inputs.home-manager.lib.homeManagerConfiguration {
+          inherit system;
+          homeDirectory = "/home/max";
+          username = "max";
+          configuration.imports = [ ./users/max/home.nix ];
+          extraSpecialArgs = { inherit inputs; };
+        };
+      };
+    };
+}

hosts/TITAN/default.nix

@@ -0,0 +1,14 @@
+tools: {
+  ssh.id = with tools.dns; {
+    publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINH29WYsq4VNhx10Ms7WYQSNkPKknfK/JnHSQUf+RjlT";
+    extraHostNames = clientResolve "titan";
+  };
+  
+  hypr = {
+    id = "QmfJ5Tv2z9jFv9Aocevyn6QqRcfm9eYQZhvYvmAVfACfuM";
+    addr = "10.100.3.7";
+    listenPort = 443;
+  };
+
+  nixos = import ./system.nix;
+}

hosts/TITAN/extras/cachix-upload-daemon.nix

@@ -0,0 +1,21 @@
+{ config, pkgs, ... }:
+
+{
+  age.secrets.cachix-upload-key = {
+    file = ../../../secrets/cachix-upload-key.age;
+    mode = "0400";
+  };
+
+  systemd.services.cachix-upload = {
+    description = "Cachix Uploader";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network-online.target" ];
+    path = [ config.nix.package ];
+    serviceConfig = {
+      ExecStart = "${pkgs.cachix}/bin/cachix watch-store max";
+      Restart = "always";
+      DynamicUser = true;
+      EnvironmentFile = config.age.secrets.cachix-upload-key.path;
+    };
+  };
+}

hosts/TITAN/extras/ddcci-backlight.nix

@@ -0,0 +1,14 @@
+{ config, pkgs, ... }:
+{
+  systemd.targets.ddcci-backlight = rec {
+    before = [ "modprobe@ddcci.service" "modprobe@ddcci-backlight.service" ];
+    wants = before;
+  };
+
+  systemd.services.display-manager.wants = [ "ddcci-backlight.target" ];
+
+  boot.extraModulePackages = [ (pkgs.ddcci-driver-with-global-control.override {
+      inherit (config.boot.kernelPackages) kernel;
+    })
+  ];
+}

hosts/TITAN/extras/fbi-downloader.nix

@@ -0,0 +1,74 @@
+{ config, ... }:
+
+{
+  age.secrets = {
+    transmission-rpc-password = {
+      file = ../../../secrets/transmission-rpc-password.age;
+      mode = "0400";
+    };
+    wireguard-key-upload = {
+      file = ../../../secrets/wireguard-key-upload.age;
+      mode = "0400";
+    };
+  };
+
+  users.groups.mediamanagers = {
+    gid = 646000020;
+    members = [ "transmission" "lidarr" ];
+  };
+  services.lidarr.group = "mediamanagers";
+  services.transmission = {
+    enable = true;
+    group = "mediamanagers";
+    settings = {
+      download-dir = "/srv/data/DOWNLOAD";
+      incomplete-dir = "/srv/data/DOWNLOAD/.incomplete";
+
+      # being a leech
+      speed-limit-up = 20;
+      ratio-limit = 0.01;
+      idle-seeding-limit = 1;
+      speed-limit-up-enabled = true;
+      ratio-limit-enabled = true;
+      idle-seeding-limit-enabled = true;
+
+      utp-enabled = false;
+      rpc-bind-address = "0.0.0.0";
+      rpc-whitelist = "127.0.0.1,::1,10.100.0.1,10.100.0.*,10.100.1.*,10.100.3.*";
+      rpc-authentication-required = true;
+    };
+    credentialsFile = config.age.secrets.transmission-rpc-password.path;
+  };
+  systemd.services.transmission = {
+    after = [ "mnt-media\\x2duploads.mount" ];
+    unitConfig = {
+      RequiresMountsFor = [ "/mnt/media-uploads" ];
+    };
+    serviceConfig = {
+      BindPaths = [ "/mnt/media-uploads" ];
+    };
+  };
+
+  networking.firewall.interfaces.tungsten.allowedTCPPorts = [ 9091 ];
+  networking.wireguard = {
+    enable = true;
+    interfaces.wgupload = {
+      ips = [ "10.150.0.2/24" ];
+      privateKeyFile = config.age.secrets.wireguard-key-upload.path;
+      allowedIPsAsRoutes = true;
+      peers = [
+        {
+          publicKey = "apKXnlMtcOe8WqCVXJAXEjzppN+qTmESlt0NjMTaclQ=";
+          allowedIPs = [ "10.150.0.0/24" ];
+          endpoint = "116.202.226.86:6969";
+        }
+      ];
+    };
+  };
+  fileSystems."/mnt/media-uploads" = {
+    device = "10.150.0.254:/mnt/storage/media/media/uploads";
+    fsType = "nfs4";
+    noCheck = true;
+    options = [ "rsize=1024" "wsize=1024" "x-systemd.after=wireguard-wgupload.service" "x-systemd.mount-timeout=10s" ];
+  };
+}

hosts/TITAN/hardware-configuration.nix

@@ -0,0 +1,52 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "ahci"
+    "usbhid"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "tmprootfs";
+    fsType = "tmpfs";
+    options = [ "defaults" "size=2G" "mode=755" ];
+  };
+
+  fileSystems."/persist" = {
+    device = "/dev/disk/by-partlabel/persist";
+    fsType = "xfs";
+    neededForBoot = true;
+  };
+
+  fileSystems."/srv/data" = {
+    device = "/dev/disk/by-label/butter";
+    fsType = "btrfs";
+  };
+
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-partlabel/nixstore";
+    fsType = "xfs";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-partlabel/ESP";
+    fsType = "vfat";
+  };
+
+  fileSystems."/home" = {
+    device = "/dev/disk/by-partlabel/home";
+    fsType = "xfs";
+  };
+}

hosts/TITAN/system.nix

@@ -0,0 +1,54 @@
+{ config, pkgs, aspect, inputs, hosts, ... }:
+
+{
+
+  imports = [
+    ./hardware-configuration.nix
+    ./extras/cachix-upload-daemon.nix
+    ./extras/ddcci-backlight.nix
+    ./extras/fbi-downloader.nix
+    (import ../../users "desktop").users.max
+    inputs.agenix.nixosModules.age
+  ]
+  ++ ( with inputs.nixos-hardware.nixosModules; [
+    common-cpu-amd
+  ])
+  ++ aspect.sets.desktop
+  ++ (with aspect.modules; [
+    persistence
+    nix-builder
+    games
+    lidarr
+    prowlarr
+  ]);
+
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "TITAN";
+
+  time.timeZone = "Europe/Vienna";
+
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "";
+    keyMap = "de";
+  };
+
+  services.xserver.layout = "de";
+
+  services.xserver.libinput.enable = true;
+
+  services.openssh.enable = true;
+
+  system.stateVersion = "20.09";
+
+  services.fstrim.enable = true;
+
+  users.mutableUsers = false;
+
+  virtualisation.podman.enable = true;
+}
+

hosts/default.nix

@@ -0,0 +1,43 @@
+let
+  tools = import ./tools.nix;
+in with tools.dns; {
+
+  # NixOS machines
+  jericho = import ./jericho tools;
+  TITAN = import ./TITAN tools;
+
+  # Unmanaged machine metadata
+  VEGAS = {
+    ssh.id = {
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICz2nGA+Y4OxhMKsV6vKIns3hOoBkK557712h7FfWXcE";
+      extraHostNames = subResolve "vegas" "backbone";
+    };
+    hypr = {
+      id = "QmYs4xNBby2fTs8RnzfXEk161KD4mftBfCiR8yXtgGPj4J";
+      addr = "10.100.3.5";
+    };
+  };
+  prophet = {
+    ssh.id = {
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJZ4FyGi69MksEn+UJZ87vw1APqiZmPNlEYIr0CbEoGv";
+      extraHostNames = subResolve "prophet" "node";
+    };
+    hypr = {    
+      id = "QmbrAHuh4RYcyN9fWePCZMVmQjbaNXtyvrDCWz4VrchbXh";    
+      addr = "10.100.3.9";     
+    };     
+  };
+  styx = {
+    ssh.id = {
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOYLrmiuPK77cw71QNzG2zaWs6gsxmYuLyqsUrWMYLnk";
+      extraHostNames = subResolve "styx" "services";
+    };
+  };
+  AnimusAlpha = let extraHostNames = [ "alpha.animus.com" "animus.com" ]; in {
+    ssh.id = {
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGpFR47Ev+W+bdng6IrDVpl8rlKBBHSr1v5lwJmZcEFH";
+      extraHostNames = portMap 69 extraHostNames;
+    };
+    ssh.extraConfig = tools.ssh.extraConfig extraHostNames [ "Port 69" ];
+  };
+}

hosts/jericho/default.nix

@@ -0,0 +1,13 @@
+tools: {
+  ssh.id = with tools.dns; {
+    publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGHMvKAtawuD2mrUOLo8ueb+A7q87xmZvXSCX60QO1r7";
+    extraHostNames = clientResolve "jericho";
+  };
+
+  hypr = {
+    id = "QmccBLgGP3HR36tTkwSYZX3KDv2EXb1MvYwGVs6PbpbHv9";
+    addr = "10.100.3.13";
+  };
+
+  nixos = import ./system.nix;
+}

hosts/jericho/extras/i915-dp-hdmi-always-full-color-patch.nix

@@ -0,0 +1,6 @@
+{
+  boot.kernelPatches = [{
+    patch = ./i915-dp-hdmi-always-full-color.patch;
+    name = "i915-always-full-color";
+  }];
+}

hosts/jericho/extras/i915-dp-hdmi-always-full-color.patch

@@ -0,0 +1,12 @@
+diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
+index a552f05a6..6546b0b6d 100644
+--- a/drivers/gpu/drm/i915/display/intel_dp.c
++++ b/drivers/gpu/drm/i915/display/intel_dp.c
+@@ -1567,6 +1567,7 @@ bool intel_dp_limited_color_range(const struct intel_crtc_state *crtc_state,
+ 		 * VESA DisplayPort Ver.1.2a - 5.1.1.1 Video Colorimetry
+ 		 */
+ 		return crtc_state->pipe_bpp != 18 &&
++			(crtc_state->pipe_bpp != 18 && crtc_state->pipe_bpp != 24) &&
+ 			drm_default_rgb_quant_range(adjusted_mode) ==
+ 			HDMI_QUANTIZATION_RANGE_LIMITED;
+ 	} else {

hosts/jericho/extras/kernel-clr.nix

@@ -0,0 +1,27 @@
+{ pkgs, inputs, ... }:
+
+{
+  boot.kernelPatches = let
+    pickPatch = x: "${inputs.kernel-clr}/${x}";
+    patchFiles = map pickPatch [
+      "0104-pci-pme-wakeups.patch"
+      "0108-smpboot-reuse-timer-calibration.patch"
+      "0110-give-rdrand-some-credit.patch"
+      "0111-ipv4-tcp-allow-the-memory-tuning-for-tcp-to-go-a-lit.patch"
+      "0118-add-scheduler-turbo3-patch.patch"
+      "0119-use-lfence-instead-of-rep-and-nop.patch"
+      "0120-do-accept-in-LIFO-order-for-cache-efficiency.patch"
+      "0121-locking-rwsem-spin-faster.patch"
+      "itmt_epb.patch"
+      "mm-wakeups.patch"
+      "percpu-minsize.patch"
+      "socket.patch"
+    ];
+    patches = map builtins.readFile patchFiles;
+    patchSet = builtins.concatStringsSep "\n" patches;
+    patch = pkgs.writeText "kernel-clr-combined.patch" patchSet;
+  in [{
+    inherit patch;
+    name = "Clear Linux* patchset";
+  }];
+}

hosts/jericho/extras/thermal-conf.xml

@@ -0,0 +1,120 @@
+<?xml version="1.0"?> 
+ <!-- BEGIN --> 
+ <ThermalConfiguration> 
+ <Platform>
+	<Name> Auto generated </Name>
+	<ProductName>XPS 13 7390 2-in-1</ProductName>
+	<Preference>QUIET</Preference>
+	<PPCC>
+		<PowerLimitIndex>0</PowerLimitIndex>
+		<PowerLimitMinimum>6000</PowerLimitMinimum>
+		<PowerLimitMaximum>25000</PowerLimitMaximum>
+		<TimeWindowMinimum>28000</TimeWindowMinimum>
+		<TimeWindowMaximum>28000</TimeWindowMaximum>
+		<StepSize>250</StepSize>
+	</PPCC>
+	<ThermalZones>
+		<ThermalZone>
+			<Type>auto_zone_0</Type>
+			<TripPoints>
+				<TripPoint>
+					<SensorType>TMEM</SensorType>
+					<Temperature>75000</Temperature>
+					<Type>Passive</Type>
+					<CoolingDevice>
+						<Type>B0D4</Type>
+						<SamplingPeriod>5</SamplingPeriod>
+					</CoolingDevice>
+				</TripPoint>
+			</TripPoints>
+		</ThermalZone>
+		<ThermalZone>
+			<Type>auto_zone_1</Type>
+			<TripPoints>
+				<TripPoint>
+					<SensorType>TSKN</SensorType>
+					<Temperature>60000</Temperature>
+					<Type>Passive</Type>
+					<CoolingDevice>
+						<Type>B0D4</Type>
+						<SamplingPeriod>0</SamplingPeriod>
+						<TargetState>2147483647</TargetState>
+					</CoolingDevice>
+				</TripPoint>
+				<TripPoint>
+					<SensorType>TSKN</SensorType>
+					<Temperature>63000</Temperature>
+					<Type>Passive</Type>
+					<CoolingDevice>
+						<Type>B0D4</Type>
+						<SamplingPeriod>5</SamplingPeriod>
+						<TargetState>13000000</TargetState>
+					</CoolingDevice>
+				</TripPoint>
+				<TripPoint>
+					<SensorType>TSKN</SensorType>
+					<Temperature>65000</Temperature>
+					<Type>Passive</Type>
+					<CoolingDevice>
+						<Type>B0D4</Type>
+						<SamplingPeriod>5</SamplingPeriod>
+						<TargetState>13000000</TargetState>
+					</CoolingDevice>
+				</TripPoint>
+				<TripPoint>
+					<SensorType>TSKN</SensorType>
+					<Temperature>68000</Temperature>
+					<Type>Passive</Type>
+					<CoolingDevice>
+						<Type>B0D4</Type>
+						<SamplingPeriod>5</SamplingPeriod>
+					</CoolingDevice>
+				</TripPoint>
+			</TripPoints>
+		</ThermalZone>
+		<ThermalZone>
+			<Type>auto_zone_2</Type>
+			<TripPoints>
+				<TripPoint>
+					<SensorType>NGFF</SensorType>
+					<Temperature>75000</Temperature>
+					<Type>Passive</Type>
+					<CoolingDevice>
+						<Type>B0D4</Type>
+						<SamplingPeriod>5</SamplingPeriod>
+					</CoolingDevice>
+				</TripPoint>
+			</TripPoints>
+		</ThermalZone>
+		<ThermalZone>
+			<Type>auto_zone_3</Type>
+			<TripPoints>
+				<TripPoint>
+					<SensorType>CHRG</SensorType>
+					<Temperature>75000</Temperature>
+					<Type>Passive</Type>
+					<CoolingDevice>
+						<Type>B0D4</Type>
+						<SamplingPeriod>2</SamplingPeriod>
+					</CoolingDevice>
+				</TripPoint>
+			</TripPoints>
+		</ThermalZone>
+		<ThermalZone>
+			<Type>auto_zone_4</Type>
+			<TripPoints>
+				<TripPoint>
+					<SensorType>WRLS</SensorType>
+					<Temperature>75000</Temperature>
+					<Type>Passive</Type>
+					<CoolingDevice>
+						<Type>B0D4</Type>
+						<SamplingPeriod>5</SamplingPeriod>
+					</CoolingDevice>
+				</TripPoint>
+			</TripPoints>
+		</ThermalZone>
+	</ThermalZones>
+</Platform>
+</ThermalConfiguration>
+<!-- END -->

hosts/jericho/extras/thermal.nix

@@ -0,0 +1,9 @@
+{
+  services.thermald.configFile = ./thermal-conf.xml;
+  services.undervolt = {
+    enable = true;
+    coreOffset = -50;
+    gpuOffset = -50;
+    analogioOffset = -50;
+  };
+}

hosts/jericho/hardware-configuration.nix

@@ -0,0 +1,33 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "rtsx_pci_sdmmc" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-partlabel/rootfs";
+    fsType = "xfs";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-partlabel/ESP";
+    fsType = "vfat";
+  };
+
+  fileSystems."/home" = {
+    device = "/dev/disk/by-partlabel/home";
+    fsType = "xfs";
+  };
+
+  fileSystems."/srv/data" = {
+    device = "/dev/disk/by-partlabel/data";
+    fsType = "xfs";
+  };
+
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+  hardware.sensor.iio.enable = true;
+}

hosts/jericho/system.nix

@@ -0,0 +1,43 @@
+{ config, pkgs, aspect, inputs, hosts, ... }:
+
+{
+  imports = [ 
+    ./hardware-configuration.nix
+    ./extras/i915-dp-hdmi-always-full-color-patch.nix
+    ./extras/kernel-clr.nix
+    ./extras/thermal.nix
+    (import ../../users "desktop").users.max
+    inputs.nixos-hardware.nixosModules.dell-xps-13-7390
+    inputs.agenix.nixosModules.age
+  ]
+  ++ aspect.sets.laptop
+  ++ (with aspect.modules; [ games ]);
+
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "jericho";
+
+  time.timeZone = "Europe/Vienna";
+
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "";
+    keyMap = "us";
+  };
+
+  services.xserver.layout = "us";
+
+  services.xserver.libinput.enable = true;
+
+  services.openssh.enable = true;
+
+  system.stateVersion = "20.09";
+
+  services.fstrim.enable = true;
+
+  services.ipfs.dataDir = "/srv/data/ipfs";
+}
+

hosts/tools.nix

@@ -0,0 +1,32 @@
+{
+  dns = rec {
+    findSvc = name: [
+      "any.${name}"
+      "local.${name}"
+      "tunnel.${name}"
+      "wired.${name}"
+      "wireless.${name}"
+      "*.if.${name}"
+    ];
+    findResolve = list: dnameResolve (append "find" list) ++ append "f.void" list;
+    dnameResolve = list: append "private.void" list ++ append "privatevoid.net" list;
+    vpnResolve = list: dnameResolve (append "vpn" list) ++ (append "hypr" list);
+    llmnrResolve = append "local";
+    append = part: map (x: "${x}.${part}");
+    portMap = port: map (x: "[${x}]:${builtins.toString port}");
+    as = x: [x];
+
+    clientResolve = x: [x] ++
+      findResolve (findSvc x) ++
+      vpnResolve [x] ++
+      llmnrResolve [x];
+
+    subResolve = name: sub: [name] ++ dnameResolve ["${name}.${sub}"];
+  };
+  ssh = {
+    extraConfig = patterns: config: with builtins; let
+      match = "Host ${concatStringsSep " " patterns}";
+      indent = map (x: "    " + x) config;
+    in concatStringsSep "\n" ([match] ++ indent);
+  };
+}

modules/autopatch/default.nix

@@ -0,0 +1,50 @@
+{ pkgs, lib, config, ... }:
+{
+  nixpkgs.overlays = [
+    (self: super:
+      (let
+        patched = import ../../packages/patched-derivations.nix super;
+      in {
+
+        inherit (patched)
+          ddcci-driver-with-global-control
+          kooha
+          nerdfonts-terminus
+          oni2
+          terminus_font_fancy
+          webkitgtk
+        ;
+
+        doas = patched.doas-interactive;
+
+        ipfs = patched.lain-ipfs;
+
+        hydra-unstable = patched.hydra;
+
+        nix-direnv = super.nix-direnv.override {
+          nix = config.nix.package;
+        };
+
+      } // lib.optionalAttrs config.krb5.enable {
+
+        bind = patched.kerberized-bind;
+        dnsutils = patched.kerberized-dnsutils;
+        dig = patched.kerberized-dig;
+
+      } // lib.optionalAttrs config.services.xserver.desktopManager.gnome.enable {
+
+        ungoogled-chromium = super.ungoogled-chromium.override {
+          commandLineArgs = "--enable-features=OverlayScrollbar,OverlayScrollbarFlashAfterAnyScrollUpdate,OverlayScrollbarFlashWhenMouseEnter --auth-server-whitelist=*privatevoid.net";
+        };
+
+        gnome = super.gnome.overrideScope' (self': super': {
+          inherit (patched) nautilus;
+          gnome-control-center = patched.gnome-control-center.override { inherit (self') gnome-user-share; };
+        });
+
+        tilix = patched.tilix-high-refresh-rate;
+
+
+      }))
+  ];
+}

modules/default.nix

@@ -0,0 +1,54 @@
+inputs: 
+with builtins;
+let
+  aspects = [
+    ./autopatch
+    ./desktop
+    ./enterprise
+    ./firewall
+    ./games
+    ./hardened
+    ./hyprspace
+    ./ipfs-lain
+    ./jackett
+    ./laptop-config
+    ./lidarr
+    ./networking-client
+    ./nextcloud-client
+    ./nix-builder
+    ./nix-config
+    ./nix-register-flakes
+    ./nm-vdns-auto
+    ./persistence
+    ./prowlarr
+    ./shell-config
+    ./sound
+    ./ssh
+  ];
+  mappedAspects = map (x: { name = baseNameOf x; value = import x; }) aspects;
+in rec {
+  modules = listToAttrs mappedAspects;
+  sets = with modules; rec {
+    base = [ 
+      autopatch
+      enterprise
+      hardened
+    ];
+
+    networking = [ firewall ssh ];
+
+    client-networking = networking ++ [ networking-client nm-vdns-auto ipfs-lain hyprspace ];
+
+    desktop = [
+      modules.desktop
+      inputs.home-manager.nixosModules.home-manager
+      nextcloud-client
+      nix-register-flakes
+      nix-config
+      shell-config
+      sound
+    ] ++ base ++ client-networking;
+
+    laptop = desktop ++ [ laptop-config ];
+  };
+}

modules/desktop/appbar.conf

@@ -0,0 +1,2 @@
+[org.gnome.shell]
+favorite-apps=[ 'chromium-browser.desktop', 'org.gnome.Epiphany.desktop', 'org.gnome.Calendar.desktop', 'org.gnome.Lollypop.desktop', 'org.gnome.Nautilus.desktop' ]

modules/desktop/default.nix

@@ -0,0 +1,81 @@
+{ pkgs, config, inputs, lib, ... }: let
+  portRanges = [
+    # GSConnect
+    { from = 1716; to = 1764; }
+  ];
+in {
+  imports = [
+    ./package-sets.nix
+  ];
+
+  services.xserver = {
+    enable = true;
+    displayManager.gdm.enable = true;
+    desktopManager.gnome = {
+      enable = true;
+      extraGSettingsOverrides = builtins.readFile ./gsettings.conf;
+      favoriteAppsOverride = builtins.readFile ./appbar.conf;
+    };
+  };
+
+  programs.adb.enable = true;
+
+  environment.gnome.excludePackages = with pkgs.gnome; [
+    cheese
+    gnome-logs
+    gnome-music
+    totem
+    pkgs.gnome-photos
+  ];
+
+  environment.variables = {
+    EDITOR = "nvim";
+    SSH_ASKPASS = lib.mkForce "";
+  };
+
+  fonts.fonts = with pkgs; [
+    terminus_font_fancy
+    nerdfonts-terminus
+    noto-fonts
+  ];
+
+  security = {
+    sudo.enable = false;
+    doas.enable = true;
+    doas.extraRules = [{
+      groups = [ "wheel" ];
+      noPass = true;
+    }];
+  };
+
+  services.printing.enable = true;
+
+  networking.firewall.allowedTCPPortRanges = portRanges;
+  networking.firewall.allowedUDPPortRanges = portRanges;
+
+  services.avahi.enable = false;
+
+  services.fwupd.enable = true;
+
+  boot = {
+    loader.timeout = 0;
+    initrd.verbose = false;
+    consoleLogLevel = 0;
+    kernelParams = [ "quiet" "udev.log_priority=3" ];
+    plymouth.enable = true;
+  };
+
+  zramSwap.enable = true;
+  zramSwap.algorithm = "zstd";
+
+  services.packagekit.enable = lib.mkForce false;
+  programs.gnome-terminal.enable = false;
+
+  qt5 = {
+    enable = true;
+    platformTheme = "gtk2";
+    style = "gtk2";
+  };
+
+  virtualisation.libvirtd.enable = true;
+}

modules/desktop/gsettings.conf

@@ -0,0 +1,62 @@
+[org.gnome.desktop.interface]
+font-name='Arimo 11'
+gtk-im-module='gtk-im-context-simple'
+gtk-theme='Adwaita'
+monospace-font-name='Terminus Bold 10'
+toolkit-accessibility=false
+
+[org.gnome.desktop.wm.keybindings]
+close=['<Super>q']
+cycle-windows=@as []
+cycle-windows-backward=@as []
+minimize=@as []
+panel-main-menu=@as []
+panel-run-dialog=['<Shift><Alt>space']
+raise-or-lower=['<Super>h']
+switch-group=['<Alt>Escape']
+switch-group-backward=['<Shift><Alt>Escape']
+switch-panels=@as []
+switch-panels-backward=@as []
+switch-windows=['<Primary><Alt>Tab']
+switch-windows-backward=['<Primary><Shift><Alt>Tab']
+toggle-fullscreen=['<Alt><Super>f']
+
+[org.gnome.settings-daemon.plugins.media-keys]
+control-center=['<Alt><Super>Return']
+custom-keybindings=['/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/launchtilix/', '/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/launchsysmon/']
+eject=['<Alt>Return']
+email=['<Super>m']
+home=['<Super>f']
+magnifier=['<Shift><Super>x']
+magnifier-zoom-in=['<Super>c']
+magnifier-zoom-out=['<Super>x']
+media=['<Super>AudioPlay']
+mic-mute=['<Super>AudioMute']
+on-screen-keyboard=['<Alt><Super>k']
+volume-down=['<Primary><Alt><Super>Tab']
+volume-up=['<Primary><Alt>Tab']
+window-screenshot-clip=['<Super>Print']
+www=['<Super>w']
+
+[org.gnome.settings-daemon.plugins.media-keys.launchtilix]
+binding='<Super>Return'
+command='gapplication launch com.gexperts.Tilix'
+name='Launch Tilix'
+
+[org.gnome.settings-daemon.plugins.media-keys.launchsysmon]
+binding='<Super>y'
+command='gtk-launch gnome-system-monitor'
+name='Launch System Monitor'
+
+[org.gnome.desktop.peripherals.keyboard]
+delay=uint32 319
+numlock-state=true
+repeat=true
+repeat-interval=uint32 15
+
+[org.gnome.desktop.peripherals.touchpad]
+edge-scrolling-enabled=false
+natural-scroll=false
+speed=0.375
+tap-to-click=true
+two-finger-scrolling-enabled=true

modules/desktop/package-sets.nix

@@ -0,0 +1,64 @@
+{ pkgs, config, inputs, lib, ... }: let
+  sets = with pkgs; rec {
+    editor = [
+      inputs.modular-nvim.defaultPackage.x86_64-linux
+    ];
+    writing = [
+      apostrophe
+      libreoffice
+    ];
+    drawing = [
+      pkgs.drawing
+      gimp
+      inkscape
+      krita
+      xournalpp
+    ];
+    cli-utils = [
+      bat
+      dua
+      duf
+      fzf
+      git
+      hyperfine
+      lsd
+      ripgrep
+      wget
+      xh
+    ];
+    www = [
+      ungoogled-chromium
+    ];
+    gui-apps = with inputs.self.packages.x86_64-linux; [
+      identity
+      obfuscate
+    ] ++ [
+      celluloid
+      gnome-firmware-updater
+      gnome-podcasts
+      gnome.dconf-editor
+      gnome.gnome-boxes
+      gnome.gnome-todo
+      gnome.gnome-tweaks
+      gnome.nautilus-python
+      kooha
+      lollypop
+      pavucontrol
+      scrcpy
+      tilix
+      virt-manager
+    ];
+    dev-tools = [
+      bustle
+      gnome-builder
+      inputs.self.packages.x86_64-linux.neovim-gtk
+    ];
+    system = with pkgs.gnomeExtensions; [
+      appindicator
+      caffeine
+      gsconnect 
+    ];
+  };
+in {
+  environment.systemPackages = lib.flatten (builtins.attrValues sets);
+}

modules/enterprise/default.nix

@@ -0,0 +1,30 @@
+{ pkgs, config, inputs, ... }:
+let
+  orgDomain = "privatevoid.net";
+  orgRealm = "PRIVATEVOID.NET";
+in {
+  krb5 = {
+    enable = true;
+    domain_realm = {
+      ${orgDomain} = orgRealm;
+      ".${orgDomain}" = orgRealm;
+    };
+    libdefaults = {
+      default_realm = orgRealm;
+      dns_lookup_kdc = true;
+      rdns = false;
+      forwardable = true;
+      default_ccache_name = "KEYRING:persistent:%{uid}";
+      pkinit_anchors = "FILE:${inputs.self.packages.x86_64-linux.privatevoid-smart-card-ca-bundle}";
+    };
+    realms = {
+      "${orgRealm}" = rec {
+        kdc = "authsys.virtual-machines.privatevoid.net";
+        admin_server = kdc;
+        kpasswd_server = kdc;
+        default_domain = orgDomain;
+      };
+    };
+  };
+  services.pcscd.enable = true;
+}

modules/firewall/default.nix

@@ -0,0 +1,5 @@
+{ pkgs, lib, ... }:
+{
+  networking.firewall.package = pkgs.iptables-nftables-compat;
+  environment.systemPackages = [ pkgs.nftables ];
+}

modules/games/default.nix

@@ -0,0 +1,6 @@
+{ pkgs, config, ... }:
+{
+  nixpkgs.config.allowUnfree = true;
+  hardware.opengl.driSupport32Bit = true;
+  programs.steam.enable = true;
+}

modules/hardened/default.nix

@@ -0,0 +1,15 @@
+{ pkgs, config, ... }:
+{
+  boot.kernel.sysctl = {
+    "kernel.yama.ptrace_scope" = 1;
+    "kernel.kptr_restrict" = 2;
+
+    "net.ipv4.conf.all.rp_filter" = 1;
+    "net.ipv4.conf.default.rp_filter" = 1;
+
+    "net.ipv4.conf.all.send_redirects" = false;
+    "net.ipv4.conf.default.send_redirects" = false;
+
+    "net.ipv4.icmp_echo_ignore_broadcasts" = true;
+  };
+}

modules/hyprspace/default.nix

@@ -0,0 +1,79 @@
+{ inputs, pkgs, lib, hosts, config, ... }:
+let
+  inherit (config.networking) hostName;
+  inherit (inputs.self.packages.${pkgs.system}) hyprspace;
+  hyprspaceCapableNodes = lib.filterAttrs (_: host: host ? hypr) hosts;
+  peersFormatted = builtins.mapAttrs (_: x: { "${x.hypr.addr}".id = x.hypr.id; }) hyprspaceCapableNodes;
+  peersFiltered = lib.filterAttrs (name: _: name != hostName) peersFormatted;
+  buildHyprspacePeerList = peers: pkgs.writeText "hyprspace-peers.yml" (builtins.toJSON peers);
+  peers = lib.foldAttrs (n: _: n) null (builtins.attrValues peersFiltered);
+  peerList = buildHyprspacePeerList peers;
+  myNode = hosts.${hostName};
+  listenPort = myNode.hypr.listenPort or 8001;
+
+  precedingConfig = pkgs.writeText "hyprspace-interface.yml" ''
+    interface:
+      name: hyprspace
+      listen_port: ${builtins.toString listenPort}
+      id: ${myNode.hypr.id}
+      address: ${myNode.hypr.addr}/24
+      private_key: !!binary |
+  '';
+
+  privateKeyFile = config.age.secrets.hyprspace-key.path;
+  runConfig = "/run/hyprspace.yml";
+in {
+  networking.hosts = lib.mapAttrs' (k: v: lib.nameValuePair (v.hypr.addr) ([k "${k}.hypr"])) hyprspaceCapableNodes;
+  age.secrets.hyprspace-key = {
+    file = ../../secrets/hyprspace-key- + "${hostName}.age";
+    mode = "0400";
+  };
+  age.secrets.ipfs-swarm-key = {
+    file = ../../secrets/ipfs-swarm-key.age;
+    mode = "0400";
+  };
+  systemd.services.hyprspace = {
+    enable = true;
+    wantedBy = [ "multi-user.target" ];
+    wants = [ "network-online.target" ];
+    after = [ "network-online.target" ];
+    preStart = ''
+      test -e ${runConfig} && rm ${runConfig}
+      touch ${runConfig}
+      chmod 0600 ${runConfig}
+
+      cat ${precedingConfig} >> ${runConfig}
+      sed 's/^/    /g' ${privateKeyFile} >> ${runConfig}
+      echo -n 'peers: ' >> ${runConfig}
+      cat ${peerList} >> ${runConfig}
+
+      chmod 0400 ${runConfig}
+    '';
+    environment.HYPRSPACE_SWARM_KEY = config.age.secrets.ipfs-swarm-key.path;
+    serviceConfig = {
+      ExecStart = "${hyprspace}/bin/hyprspace up hyprspace -f -c ${runConfig}";
+      ExecStop = "${hyprspace}/bin/hyprspace down hyprspace";
+    };
+  };
+  networking.firewall = {
+    allowedTCPPorts = [ listenPort ];
+    allowedUDPPorts = [ listenPort ];
+    trustedInterfaces = [ "hyprspace" ];
+  };
+  networking.networkmanager.dispatcherScripts = [{
+    source = pkgs.writeShellScript "hyprspace-reconnect.sh" ''
+      [[ "$2" != "up" ]] && exit 0
+      PATH=${pkgs.systemd}/bin:$PATH
+      case $1 in
+        wl*|en*)
+          if systemctl is-active hyprspace.service; then
+      ${builtins.concatStringsSep "\n" (map (peer: "/run/wrappers/bin/ping -qnA -c3 -W1 ${peer} && exit") (builtins.attrNames peers))}
+          fi
+          systemctl restart --no-block hyprspace.service;;
+      esac
+      exit 0
+    '';
+    type = "basic";
+  }];
+}
+

modules/ipfs-lain/default.nix

@@ -0,0 +1,60 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.ipfs;
+  ipfsApi = pkgs.writeTextDir "api" "/ip4/127.0.0.1/tcp/5001";
+in {
+  services.ipfs = {
+    enable = true;
+    localDiscovery = true;
+    autoMount = true;
+    startWhenNeeded = false;
+    enableGC = true;
+    extraFlags = [ "--enable-pubsub-experiment" "--enable-namesys-pubsub" ];
+    extraConfig = {
+      Bootstrap = [
+        "/ip4/95.216.8.12/tcp/4001/p2p/Qmd7QHZU8UjfYdwmjmq1SBh9pvER9AwHpfwQvnvNo3HBBo"
+        "/ip4/51.38.87.150/tcp/4001/p2p/12D3KooWDUgNsoLVauCDpRAo54mc4whoBudgeXQnZZK2iVYhBLCN"
+      ];
+    };
+  };
+
+  systemd.services.ipfs.environment.LIBP2P_FORCE_PNET = "1";
+  systemd.sockets = {
+    ipfs-api.enable = false;
+    ipfs-gateway.enable = false;
+  };
+
+  environment = {
+    variables.IPFS_PATH = lib.mkForce "${ipfsApi}";
+    shellAliases = {
+      ipfs-admin = "doas -u ${cfg.user} env IPFS_PATH=${cfg.dataDir} ipfs";
+      f = "ipfs files";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 4001 ];
+
+  environment.systemPackages = lib.singleton (pkgs.writeShellScriptBin "share" ''
+      PATH=${cfg.package}/bin:$PATH
+      set -e
+      cid=$(ipfs add -Qrp --pin=false "$@")
+      test -n $cid || exit 0
+      echo -e "\n\n IPFS path: /ipfs/$cid"
+      echo -e " Web link: https://$(ipfs cid base32 $cid).ipfs.privatevoid.net\n"
+    '');
+  networking.networkmanager.dispatcherScripts = [{
+    source = pkgs.writeShellScript "nm-ipfs-reconnect.sh" ''
+      [[ "$2" != "up" ]] && exit 0
+      PATH=${pkgs.systemd}/bin:${pkgs.findutils}/bin:${cfg.package}/bin:$PATH
+      export IPFS_PATH=${ipfsApi}
+      systemctl is-active ipfs.service || exit 0
+      case $1 in
+              wl*|en*)
+                ipfs swarm peers | xargs -P4 -n1 timeout 3 ipfs swarm disconnect
+                ipfs bootstrap | xargs -P4 -n1 timeout 10 ipfs swarm connect
+      esac
+      exit 0
+    '';
+    type = "basic";
+  }];
+}

modules/jackett/default.nix

@@ -0,0 +1,5 @@
+{ pkgs, config, ... }:
+{
+  services.jackett.enable = true;
+  services.jackett.openFirewall = true;
+}

modules/laptop-config/default.nix

@@ -0,0 +1,11 @@
+{ pkgs, config, lib, inputs, ... }:
+{
+  nix.distributedBuilds = true;
+  nix.settings.system-features = [ "nixos-test" "benchmark" "kvm" ];
+  imports = [ ./gdm-touchpad-config.nix ];
+  services.tlp.enable = false;
+  services.thermald.enable = true;
+
+  powerManagement.powertop.enable = true;
+  powerManagement.scsiLinkPolicy = "med_power_with_dipm";
+}

modules/laptop-config/gdm-touchpad-config.nix

@@ -0,0 +1,36 @@
+{ pkgs, lib, ... }:
+
+{
+  programs.dconf.profiles.gdm = lib.mkForce (let
+    customDconf = pkgs.writeTextFile {
+      name = "gdm-dconf-touchpad";
+      destination = "/dconf/gdm-custom";
+      text = ''
+        [org/gnome/desktop/peripherals/touchpad]
+        edge-scrolling-enabled=false
+        natural-scroll=false
+        speed=0.375
+        tap-to-click=true
+        two-finger-scrolling-enabled=true
+      '';
+    };
+
+    customDconfDb = pkgs.stdenv.mkDerivation {
+      name = "gdm-dconf-db";
+      buildCommand = ''
+        ${pkgs.dconf}/bin/dconf compile $out ${customDconf}/dconf
+      '';
+    };
+  in pkgs.stdenv.mkDerivation {
+    name = "dconf-gdm-profile";
+    buildCommand = with { gdm = pkgs.gnome.gdm; }; ''
+      # Check that the GDM profile starts with what we expect.
+      if [ $(head -n 1 ${gdm}/share/dconf/profile/gdm) != "user-db:user" ]; then
+        echo "GDM dconf profile changed, please update gdm.nix"
+        exit 1
+      fi
+      # Insert our custom DB behind it.
+      sed '2ifile-db:${customDconfDb}' ${gdm}/share/dconf/profile/gdm > $out
+    '';
+  });
+}

modules/lidarr/default.nix

@@ -0,0 +1,5 @@
+{ pkgs, config, ... }:
+{
+  services.lidarr.enable = true;
+  services.lidarr.openFirewall = true;
+}

modules/networking-client/default.nix

@@ -0,0 +1,21 @@
+{
+  networking.useDHCP = false;
+
+  networking.networkmanager.dns = "systemd-resolved";
+  networking.networkmanager.enableStrongSwan = false;
+  services.resolved = {
+    enable = true;
+    fallbackDns = [ "10.1.0.1" ];
+    llmnr = "true";
+    dnssec = "false";
+    extraConfig = "Cache=no-negative";
+  };
+  networking.firewall = let
+    ports = [
+      5355 # llmnr
+    ];
+  in {
+    allowedTCPPorts = ports;
+    allowedUDPPorts = ports;
+  };
+}

modules/nextcloud-client/default.nix

@@ -0,0 +1,15 @@
+{ pkgs, config, ... }:
+{
+  # expose nextcloud client into the environment
+  environment.systemPackages = [ pkgs.nextcloud-client ];
+
+  systemd.user.services.nextcloud = {
+    description = "Nextcloud Client Service";
+    wantedBy = [ "gnome-session.target" ];
+    serviceConfig = {
+      ExecStart = "${pkgs.nextcloud-client}/bin/nextcloud --background";
+      Restart = "always";
+      Slice = "background.slice";
+    };
+  };
+}

modules/nix-builder/default.nix

@@ -0,0 +1,16 @@
+{ pkgs, config, ... }:
+{
+  nix.settings.trusted-users = [ "nix" ];
+  users.users.nix = {
+    isSystemUser = true;
+    description = "Nix Remote Build";
+    home = "/var/tmp/nix-remote-builder";
+    createHome = true;
+    useDefaultShell = true;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBa9gDXWdp7Kqzbjz9Zchu91ZoYcBD6AbjvuktYA//yg"
+    ];
+    group = "nix";
+  };
+  users.groups.nix = {};
+}

modules/nix-config/default.nix

@@ -0,0 +1,76 @@
+{ pkgs, lib, config, inputs, ... }@args:
+let
+  builder = {
+    systems = [ "x86_64-linux" "i686-linux" ];
+    speedFactor = 4;
+    supportedFeatures = [ "benchmark" "nixos-test" ];
+    sshKey = config.age.secrets.nixBuilderKey.path;
+  };
+  bigBuilder = builder // {
+    speedFactor = 16;
+    supportedFeatures = builder.supportedFeatures ++ [ "kvm" "big-parallel" ];
+  };
+in {
+  age.secrets.nixBuilderKey = {
+    file = ../../secrets/builder_key.age;
+    mode = "0400";
+  };
+  nixpkgs.overlays = [
+    (self: super: {
+      nixSuper = inputs.nix-super.defaultPackage.x86_64-linux;
+    })
+  ];
+  nix = {
+    package = pkgs.nixSuper;
+
+    settings = {
+      trusted-users = [ "root" "@wheel" ];
+      auto-optimise-store = true;
+
+      substituters = [
+        "https://cache.privatevoid.net"
+        "https://max.cachix.org"
+        "https://reflex.privatevoid.net?priority=10"
+      ];
+
+      trusted-public-keys = [
+        "cache.privatevoid.net:SErQ8bvNWANeAvtsOESUwVYr2VJynfuc9JRwlzTTkVg="
+        "max.cachix.org-1:oSMQ1zYLR8H4L17hfe6ETlI/d+VeiBykB8PbBdPtDJw="
+      ];
+
+    };
+
+    extraOptions = ''
+      experimental-features = nix-command flakes
+      warn-dirty = false
+      builders-use-substitutes = true
+      flake-registry = ${
+        pkgs.writeText "null-registry.json" ''{"flakes":[],"version":2}''
+      }
+    '';
+
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+
+    distributedBuilds = true;
+
+    buildMachines = [
+      (bigBuilder // {
+        sshUser = "nixbuilder";
+        hostName = "animus.com";
+        maxJobs = 4;
+      })
+    ] ++
+    (lib.optional (config.networking.hostName != "TITAN") (bigBuilder // {
+        sshUser = "nix";
+        hostName = "titan.hypr";
+        speedFactor = 12;
+        maxJobs = 12;
+    }));
+  };
+
+  environment.systemPackages = [ pkgs.cachix ];
+}

modules/nix-register-flakes/default.nix

@@ -0,0 +1,41 @@
+{ config, inputs, lib, pkgs, ... }:
+
+with inputs;
+{
+  nix.nixPath = [
+    "repl=/etc/nix/flake-channels/system/repl.nix"
+    "nixpkgs=/etc/nix/flake-channels/nixpkgs"
+    "home-manager=/etc/nix/flake-channels/home-manager"
+  ];
+
+  nix.registry = {
+    system.flake = self;
+    nixpkgs.flake = nixpkgs;
+    default.flake = nixpkgs;
+    home-manager.flake = home-manager;
+    vim.flake = let
+      nixpkgsSelfLock = lib.importJSON "${self}/flake.lock";
+      vimLock = lib.importJSON "${modular-nvim}/flake.lock";
+      patchedLock = lib.recursiveUpdate vimLock { nodes.nixpkgs.locked = (nixpkgsSelfLock.nodes.nixpkgs.locked); };
+      patchedLockFile = pkgs.writeText "patched-flake.lock" (builtins.toJSON patchedLock);
+    in pkgs.runCommand "vim-flake" {} ''
+      cp -vr ${modular-nvim} $out
+      chmod +w $out
+      rm $out/flake.lock
+      cp -v ${patchedLockFile} $out/flake.lock
+    '';
+    templates.to = {
+      owner = "max";
+      repo = "flake-templates";
+      ref = "master";
+      host = "git.privatevoid.net";
+      type = "gitlab";
+    };
+  };
+
+  environment.etc = {
+    "nix/flake-channels/system".source = inputs.self;
+    "nix/flake-channels/nixpkgs".source = nixpkgs;
+    "nix/flake-channels/home-manager".source = home-manager;
+  };
+}

modules/nm-vdns-auto/default.nix

@@ -0,0 +1,16 @@
+{ pkgs, config, ... }:
+
+{
+  networking.networkmanager.dispatcherScripts = [{
+    source = pkgs.writeShellScript "vdns.sh" ''
+      [[ "$2" != "up" ]] && exit 0
+      case $1 in
+              wl*|en*)
+                      sleep 0.5;
+                      ${pkgs.networkmanager}/bin/nmcli c up vDNS;;
+      esac
+      exit 0
+    '';
+    type = "basic";
+  }];
+}

modules/persistence/default.nix

@@ -0,0 +1,23 @@
+{ pkgs, config, ... }:
+
+{
+  services.openssh.hostKeys = [
+    {
+      bits = 4096;
+      path = "/persist/keys/ssh/ssh_host_rsa_key";
+      type = "rsa";
+    }
+    {
+      path = "/persist/keys/ssh/ssh_host_ed25519_key";
+      type = "ed25519";
+    }
+  ];
+
+  services.ipfs.dataDir = "/persist/ipfs";
+  services.lidarr.dataDir = "/persist/db/lidarr";
+  services.jackett.dataDir = "/persist/db/jackett";
+
+  environment.etc = {
+    "NetworkManager/system-connections".source = "/persist/config/NetworkManager/system-connections";  
+  };
+}

modules/prowlarr/default.nix

@@ -0,0 +1,5 @@
+{ pkgs, config, ... }:
+{
+  services.prowlarr.enable = true;
+  services.prowlarr.openFirewall = true;
+}

modules/shell-config/default.nix

@@ -0,0 +1,81 @@
+{ pkgs, config, ... }:
+let
+  component = name: builtins.readFile (builtins.toString ../../config/zsh/components + "/${name}.zsh");
+
+  snippets = map component [
+    "console-256color"
+    "fuzzy-tab"
+    "magic-space"
+    "navigation"
+  ] ++ [
+    "source ${pkgs.fzf}/share/fzf/key-bindings.zsh"
+    "ZSH_HIGHLIGHT_DIRS_BLACKLIST=(/* /ipfs /ipns)"
+  ];
+in {
+  environment.shellAliases = {
+    cat = "bat";
+    df = "duf";
+    doas = "doas ";
+    du = "dua";
+    ip = "ip -c";
+    ls = "lsd";
+    sudo = "sudo ";
+    tree = "lsd --tree";
+    uctl = "systemctl --user";
+    vim = "nvim";
+    nvr = "nvr --servername /tmp/nvim-remote-$USER --remote-tab";
+    nix-repl = "nix repl '<repl>'";
+    # thanks gytis
+    manix-view = ''manix "" | grep '^# ' | sed 's/^# \(.*\) (.*/\1/;s/ (.*//;s/^# //' | fzf --ansi --preview="manix '{}' | sed 's/type: /> type: /g' | bat -l Markdown --color=always --plain"'';
+  };
+  programs = {
+    zsh = {
+      enable = true;
+      histFile = "$HOME/.cache/zsh_history";
+      histSize = 15000;
+      setOptions = [
+        "autocd"
+        "autopushd"
+        "globcomplete"
+        "globstarshort"
+        "histexpiredupsfirst"
+        "histfcntllock"
+        "histignoredups"
+        "histnofunctions"
+        "histnostore"
+        "histreduceblanks"
+        "histverify"
+        "interactivecomments"
+        "monitor"
+        "nobadpattern"
+        "promptsubst"
+        "sharehistory"
+        "zle"
+      ];
+
+      vteIntegration = true;
+
+      promptInit = builtins.readFile ../../config/zsh/prompt.zsh;
+      interactiveShellInit = builtins.concatStringsSep "\n" snippets;
+      enableCompletion = true;
+      autosuggestions.enable = true;
+      syntaxHighlighting = {
+        enable = true;
+        highlighters = [ "main" "pattern" ];
+        styles = {
+          "precommand" = "fg=33";
+          "arg0" = "fg=39";
+          "single-hyphen-option" = "fg=229";
+          "double-hyphen-option" = "fg=228";
+          "path" = "none";
+        };
+
+        # these are aliases, highlight them properly regardless
+        patterns = {
+          "doas" = "fg=33";
+          "sudo" = "fg=33";
+        };
+      };
+    };
+  };
+}

modules/sound/default.nix

@@ -0,0 +1,57 @@
+{ pkgs, ... }:
+{
+  sound.enable = true;
+  hardware.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    pulse.enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    jack.enable = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+
+    # KXStudio stuff
+    cadence
+    carla
+    
+    jack_oscrolloscope
+    jack_rack
+    jackmeter
+    qjackctl
+
+    # Audio plugins
+    AMB-plugins
+    aether-lv2
+    artyFX
+    calf
+    distrho
+    guitarix
+    helm
+    infamousPlugins
+    ingen
+    kapitonov-plugins-pack
+    ladspaPlugins
+    lv2
+    metersLv2
+    noise-repellent
+    rakarrack
+    rkrlv2
+    sorcer
+    swh_lv2
+    x42-plugins
+    zam-plugins
+  ];
+
+  environment.variables = {
+    LADSPA_PATH = "/run/current-system/sw/lib/ladspa";
+    LV2_PATH = "/run/current-system/sw/lib/lv2";
+    LXVST_PATH = "/run/current-system/sw/lib/lxvst";
+    VST3_PATH = "/run/current-system/sw/lib/vst3";
+    VST_PATH = "/run/current-system/sw/lib/vst";
+  };
+
+
+}

modules/ssh/default.nix

@@ -0,0 +1,14 @@
+{ hosts, config, lib, ... }:
+let
+  filtered = lib.filterAttrs (_: host: host ? ssh) hosts;
+  idCapable = lib.filterAttrs (_: host: host.ssh ? id) filtered;
+  configCapable = lib.filterAttrs (_: host: host.ssh ? extraConfig) filtered;
+
+  sshHosts = lib.mapAttrs (_: host: host.ssh.id) idCapable;
+  sshExtras = lib.mapAttrsToList (_: host: host.ssh.extraConfig) configCapable;
+in {
+  programs.ssh = {
+    knownHosts = sshHosts;
+    extraConfig = builtins.concatStringsSep "\n" sshExtras;
+  };
+}

packages/apps/identity/default.nix

@@ -0,0 +1,79 @@
+{ lib, stdenv
+, desktop-file-utils
+, fetchFromGitLab
+, nix-update-script
+, meson
+, ninja
+, gettext
+, python3
+, rustPlatform
+, pkg-config
+, glib
+, libhandy
+, gtk3
+, dbus
+, gst_all_1
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "identity";
+  version = "0.1.3";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "YaLTeR";
+    repo = "identity";
+    rev = "v${version}";
+    sha256 = "sha256-LvBDzI8x42npiRSR3uNTYGuz7H7ClaUR9zp9rchpMyk=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-2xURbda1fIQr+nWPL5yilDBT7ji3uTHwhYKgL77vYek=";
+  };
+
+  nativeBuildInputs = [
+    desktop-file-utils
+    gettext
+    meson
+    ninja
+    pkg-config
+    python3
+    rustPlatform.rust.cargo
+    rustPlatform.cargoSetupHook
+    rustPlatform.rust.rustc
+    wrapGAppsHook
+    glib
+  ];
+
+  buildInputs = [
+    dbus
+    glib
+    gst_all_1.gst-editing-services
+    gst_all_1.gst-plugins-bad
+    gst_all_1.gst-plugins-base
+    (gst_all_1.gst-plugins-good.override {
+      gtkSupport = true;
+    })
+    gst_all_1.gstreamer
+    gst_all_1.gst-devtools
+    gtk3
+    libhandy
+  ];
+
+  postPatch = ''
+    patchShebangs build-aux/meson_post_install.py
+  '';
+
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+  };
+
+  postFixup = ''
+    substituteInPlace $out/share/applications/org.gnome.gitlab.YaLTeR.Identity.desktop --replace Icon=org.gnome.gitlab.YaLTeR.Identity Icon=$out/share/icons/hicolor/symbolic/apps/org.gnome.gitlab.YaLTeR.Identity-symbolic.svg
+  '';
+}

packages/apps/neovim-gtk/build-noforce.patch

@@ -0,0 +1,17 @@
+diff --git a/Makefile b/Makefile
+index 73d0f2c..d27f387 100644
+--- a/Makefile
++++ b/Makefile
+@@ -7,10 +7,10 @@ run:
+ 	RUST_LOG=warn RUST_BACKTRACE=1 cargo run -- --no-fork
+ 
+ install: install-resources
+-	cargo install --path . --force --root $(DESTDIR)$(PREFIX)
++	cargo install --path . --root $(DESTDIR)$(PREFIX)
+ 
+ install-debug: install-resources
+-	cargo install --debug --path . --force --root $(DESTDIR)$(PREFIX)
++	cargo install --debug --path . --root $(DESTDIR)$(PREFIX)
+ 
+ install-resources:
+ 	mkdir -p $(DESTDIR)$(PREFIX)/share/nvim-gtk/

packages/apps/neovim-gtk/default.nix

@@ -0,0 +1,29 @@
+{ rustPackages, fetchFromGitHub,
+  pkg-config, gnused,
+  gtk3, glib, cairo, pango
+}:
+rustPackages.rustPlatform.buildRustPackage {
+  name = "neovim-gtk-nightly";
+  src = fetchFromGitHub {
+    owner = "daa84";
+    repo = "neovim-gtk";
+    rev = "c03649276ee47caa9bc7beb68f6c800b8c97651a";
+    sha256 = "sha256-dqJACgCXHWaRwvGxnYDSTvhbyrUarw2o9yRxjj41Auw=";
+  };
+  cargoSha256 = "sha256-hcD+kWmtIQXXm1LisHwj24ttmxJxQ9GmJNezAztZR4c=";
+  nativeBuildInputs = [ pkg-config gnused ];
+  buildInputs = [
+    gtk3
+    glib
+    cairo
+    pango
+  ];
+  patches = [
+    ./build-noforce.patch
+    ./popup-huge-padding.patch
+  ];
+  buildPhase = "make install PREFIX=$out";
+  installPhase = ''
+    sed -i 's/Name=NeovimGtk/Name=Neovim GTK/g' $out/share/applications/*.desktop
+  '';
+}

packages/apps/neovim-gtk/double-width-popups.patch

@@ -0,0 +1,13 @@
+diff --git a/src/shell.rs b/src/shell.rs
+index c631762..7319c1d 100644
+--- a/src/shell.rs
++++ b/src/shell.rs
+@@ -1577,7 +1577,7 @@ impl State {
+                 level_idx: level,
+                 x,
+                 y,
+-                width,
++                width: width*8,
+                 height,
+                 max_width: self.max_popup_width(),
+             };

packages/apps/neovim-gtk/popup-huge-padding.patch

@@ -0,0 +1,13 @@
+diff --git a/src/popup_menu.rs b/src/popup_menu.rs
+index 0abb937..9adb7e6 100644
+--- a/src/popup_menu.rs
++++ b/src/popup_menu.rs
+@@ -100,7 +100,7 @@ impl State {
+     }
+ 
+     fn limit_column_widths(&self, ctx: &PopupMenuContext) {
+-        const DEFAULT_PADDING: i32 = 5;
++        const DEFAULT_PADDING: i32 = 30;
+ 
+         let layout = ctx.font_ctx.create_layout();
+         let kind_exists = ctx.menu_items.iter().any(|i| !i.kind.is_empty());

packages/apps/obfuscate/default.nix

@@ -0,0 +1,77 @@
+{ lib, stdenv
+, desktop-file-utils
+, fetchFromGitLab
+, nix-update-script
+, meson
+, ninja
+, gettext
+, python3
+, rustPlatform
+, pkg-config
+, glib
+, libadwaita
+, gtk4
+, dbus
+, gst_all_1
+, gdk-pixbuf
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "obfuscate";
+  version = "0.0.4";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "World";
+    repo = "obfuscate";
+    rev = version;
+    sha256 = "sha256-P8Y2Eizn1BMZXuFjGMXF/3oAUzI8ZNTrnbLyU+V6uk4=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-eKXVN3PHgeLeG4qxh30VhyMX0FMOO/ZlZ8trUGIs2sc=";
+  };
+
+  nativeBuildInputs = [
+    desktop-file-utils
+    gettext
+    meson
+    ninja
+    pkg-config
+    python3
+    rustPlatform.rust.cargo
+    rustPlatform.cargoSetupHook
+    rustPlatform.rust.rustc
+    wrapGAppsHook
+    glib
+  ];
+
+  buildInputs = [
+    dbus
+    gdk-pixbuf
+    glib
+    gst_all_1.gst-editing-services
+    gst_all_1.gst-plugins-bad
+    gst_all_1.gst-plugins-base
+    (gst_all_1.gst-plugins-good.override {
+      gtkSupport = true;
+    })
+    gst_all_1.gstreamer
+    gst_all_1.gst-devtools
+    gtk4
+    libadwaita
+  ];
+
+  postPatch = ''
+    patchShebangs build-aux/meson_post_install.py
+  '';
+
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+  };
+}

packages/data/misc/steam-metro-skin/default.nix

@@ -0,0 +1,8 @@
+{ fetchzip }:
+
+fetchzip {
+  name = "metro-for-steam-4.4";
+  url =
+    "https://github.com/minischetti/metro-for-steam/archive/v4.4.zip";
+  sha256 = "sha256-E/hmOODf/aBAcc/RYueqMjQ+7SuvftfjYCVKD6CTX+U=";
+}

packages/data/privatevoid-smart-card-certificate-authority-bundle.nix

@@ -0,0 +1,7 @@
+{ fetchurl }:
+
+fetchurl {
+  url =
+    "https://export.privatevoid.net/Certificates/PRIVATEVOID.NET__Private_Void_Smart_Card_Authority-bundle-s12.pem";
+  sha256 = "3939eb6512e5675bb27028f9bf9892dbb1d1a60b014f4537f8d2b6180deece68";
+}

packages/default.nix

@@ -0,0 +1,8 @@
+{ nixpkgs, inputs }:
+let
+  patched-derivations = import ./patched-derivations.nix nixpkgs;
+  patched-inputs = import ./patched-inputs.nix inputs;
+  packages = import ./packages.nix nixpkgs;
+in patched-derivations
+// patched-inputs
+// packages

packages/development/langservers/jdtls.nix

@@ -0,0 +1,95 @@
+{ lib
+, stdenv
+, fetchurl
+, makeWrapper
+, jdk
+}:
+
+stdenv.mkDerivation rec {
+  pname = "jdt-language-server";
+  version = "0.67.0";
+  timestamp = "202012170459";
+
+  src = fetchurl {
+    url = "https://download.eclipse.org/jdtls/milestones/${version}/jdt-language-server-${version}-${timestamp}.tar.gz";
+    sha256 = "11qzwf2l737hdv1g7bfcrmdxcrl7g9z2k9nhy9lknlabmhq4mcdl";
+  };
+
+  sourceRoot = ".";
+
+  buildInputs = [
+    jdk
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  installPhase =
+    let
+      # The application ships with config directories for linux and mac
+      configDir = if stdenv.isDarwin then "config_mac" else "config_linux";
+      # The application will store it's data here. Note especially the escaping so
+      # that the env vars are interpreted at runtime and not during installPhase.
+      runtimePath = "\\\${XDG_CACHE_HOME:-\\$HOME/.cache}/jdt-language-server";
+    in
+    ''
+      # Copy jars
+      install -D -t $out/share/java/plugins/ plugins/*.jar
+      # Copy config directories for linux and mac
+      install -Dm 444 -t $out/share/config ${configDir}/*
+      # Get latest version of launcher jar
+      # e.g. org.eclipse.equinox.launcher_1.5.800.v20200727-1323.jar
+      launcher="$(ls $out/share/java/plugins/org.eclipse.equinox.launcher_* | sort -V | tail -n1)"
+      # The wrapper script will create a directory in the user's cache, copy in the config
+      # files since this dir can't be read-only, and by default use this as the runtime dir.
+      #
+      # The following options are required as per the upstream documentation:
+      #
+      #   -Declipse.application=org.eclipse.jdt.ls.core.id1
+      #   -Dosgi.bundles.defaultStartLevel=4
+      #   -Declipse.product=org.eclipse.jdt.ls.core.product
+      #   -noverify
+      #   --add-modules=ALL-SYSTEM
+      #   --add-opens java.base/java.util=ALL-UNNAMED
+      #   --add-opens java.base/java.lang=ALL-UNNAMED
+      #
+      # Other options which the user may change:
+      #
+      #   -Dlog.level:
+      #     Log level.
+      #     This can be overidden by setting JAVA_OPTS.
+      #   -configuration:
+      #     The application will read the configuration from this directory but also needs
+      #     to be able to write here (hence mode 17777).
+      #     This can be overidden by specifying -configuration to the wrapper.
+      #   -data:
+      #     The application stores runtime data here. We set this to <cache-dir>/$PWD
+      #     so that projects don't collide with each other.
+      #     This can be overidden by specifying -configuration to the wrapper.
+      #
+      # Java options, such as -Xms and Xmx can be specified by setting JAVA_OPTS.
+      makeWrapper ${jdk}/bin/java $out/bin/jdt-language-server \
+        --run "mkdir -p ${runtimePath}" \
+        --run "install -Dm 1777 -t ${runtimePath}/config $out/share/config/*" \
+        --add-flags "-Declipse.application=org.eclipse.jdt.ls.core.id1" \
+        --add-flags "-Dosgi.bundles.defaultStartLevel=4" \
+        --add-flags "-Declipse.product=org.eclipse.jdt.ls.core.product" \
+        --add-flags "-Dlog.level=ALL" \
+        --add-flags "-noverify" \
+        --add-flags "\$JAVA_OPTS" \
+        --add-flags "-jar $launcher" \
+        --add-flags "--add-modules=ALL-SYSTEM" \
+        --add-flags "--add-opens java.base/java.util=ALL-UNNAMED" \
+        --add-flags "--add-opens java.base/java.lang=ALL-UNNAMED" \
+        --add-flags "-configuration \"${runtimePath}/config\"" \
+        --add-flags "-data \"${runtimePath}/data\$PWD\""
+    '';
+
+  meta = with lib; {
+    homepage = "https://github.com/eclipse/eclipse.jdt.ls";
+    description = "Java language server";
+    license = licenses.epl20;
+    maintainers = with maintainers; [ matt-snider ];
+  };
+}

packages/lib/tools.nix

@@ -0,0 +1,27 @@
+rec {
+  dirfilter = type: path:
+    (let root = builtins.readDir path;
+    in builtins.filter (x: builtins.getAttr x root == type)
+    (builtins.attrNames root));
+
+  absolutify = path: ../../. + ("/" + path);
+  mkpatchlist = pkg:
+    map (patch: absolutify (builtins.concatStringsSep "/" [ pkg patch ]))
+    (dirfilter "regular" (absolutify pkg));
+
+  patch = super: patchdir:
+    super.overrideAttrs
+    (attrs: { patches = (attrs.patches or [ ]) ++ (mkpatchlist patchdir); });
+
+  patch-rename = super: pname: patchdir:
+    super.overrideAttrs (attrs: {
+      patches = (attrs.patches or [ ]) ++ (mkpatchlist patchdir);
+      inherit pname;
+    });
+
+  patch-rename-direct = super: renameWith: patchdir:
+    super.overrideAttrs (attrs: {
+      patches = (attrs.patches or [ ]) ++ (mkpatchlist patchdir);
+      name = renameWith attrs;
+    });
+}

packages/networking/hyprspace/0001-Lain-ipfs-bootstrap-nodes.patch

@@ -0,0 +1,72 @@
+From 06370f8afc1a00da62757137f2f739c531ccfdfc Mon Sep 17 00:00:00 2001
+From: Tiago Carvalho <sugoiuguu@tfwno.gf>
+Date: Sat, 5 Feb 2022 15:15:24 +0000
+Subject: [PATCH 1/3] Lain ipfs bootstrap nodes
+
+---
+ p2p/node.go | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/p2p/node.go b/p2p/node.go
+index 65d13c8..736101a 100644
+--- a/p2p/node.go
++++ b/p2p/node.go
+@@ -4,6 +4,7 @@ import (
+ 	"context"
+ 	"errors"
+ 	"fmt"
++	"os"
+ 	"sync"
+ 
+ 	"github.com/ipfs/go-datastore"
+@@ -12,6 +13,7 @@ import (
+ 	"github.com/libp2p/go-libp2p-core/host"
+ 	"github.com/libp2p/go-libp2p-core/network"
+ 	"github.com/libp2p/go-libp2p-core/peer"
++	"github.com/libp2p/go-libp2p-core/pnet"
+ 	dht "github.com/libp2p/go-libp2p-kad-dht"
+ 	libp2pquic "github.com/libp2p/go-libp2p-quic-transport"
+ 	"github.com/libp2p/go-tcp-transport"
+@@ -29,14 +31,22 @@ func CreateNode(ctx context.Context, inputKey string, port int, handler network.
+ 		return
+ 	}
+ 
++	swarmKey, err := os.Open(os.Getenv("HYPRSPACE_SWARM_KEY"))
++	if err != nil {
++		return
++	}
++
+ 	ip6quic := fmt.Sprintf("/ip6/::/udp/%d/quic", port)
+ 	ip4quic := fmt.Sprintf("/ip4/0.0.0.0/udp/%d/quic", port)
+ 
+ 	ip6tcp := fmt.Sprintf("/ip6/::/tcp/%d", port)
+ 	ip4tcp := fmt.Sprintf("/ip4/0.0.0.0/tcp/%d", port)
+ 
++	key, _ := pnet.DecodeV1PSK(swarmKey)
++
+ 	// Create libp2p node
+ 	node, err = libp2p.New(
++		libp2p.PrivateNetwork(key),
+ 		libp2p.ListenAddrStrings(ip6quic, ip4quic, ip6tcp, ip4tcp),
+ 		libp2p.Identity(privateKey),
+ 		libp2p.DefaultSecurity,
+@@ -58,12 +68,10 @@ func CreateNode(ctx context.Context, inputKey string, port int, handler network.
+ 
+ 	// Define Bootstrap Nodes.
+ 	peers := []string{
+-		"/dnsaddr/bootstrap.libp2p.io/p2p/QmcZf59bWwK5XFi76CZX8cbJ4BhTzzA3gU1ZjYZcYW3dwt",
+-		"/ip4/104.131.131.82/tcp/4001/p2p/QmaCpDMGvV2BGHeYERUEnRQAwe3N8SzbUtfsmvsqQLuvuJ",
+-		"/ip4/104.131.131.82/udp/4001/quic/p2p/QmaCpDMGvV2BGHeYERUEnRQAwe3N8SzbUtfsmvsqQLuvuJ",
+-		"/dnsaddr/bootstrap.libp2p.io/p2p/QmNnooDu7bfjPFoTZYxMNLWUQJyrVwtbZg5gBMjTezGAJN",
+-		"/dnsaddr/bootstrap.libp2p.io/p2p/QmQCU2EcMqAqQPR2i9bChDtGNJchTbq5TbXJJ16u19uLTa",
+-		"/dnsaddr/bootstrap.libp2p.io/p2p/QmbLHAnMoJPWSCR5Zhtx6BHJX9KiKNN6tpvbUcqanj75Nb",
++		"/ip4/168.235.67.108/tcp/4001/p2p/QmRMA5pWXtfuW1y5w2t9gYxrDDD6bPRLKdWAYnHTeCxZMm",
++		"/ip4/95.216.8.12/tcp/4001/p2p/Qmd7QHZU8UjfYdwmjmq1SBh9pvER9AwHpfwQvnvNo3HBBo",
++		"/ip6/2001:41d0:800:1402::3f16:3fb5/tcp/4001/p2p/12D3KooWDUgNsoLVauCDpRAo54mc4whoBudgeXQnZZK2iVYhBLCN",
++		"/ip6/2001:818:da65:e400:a553:fbc1:f0b1:5743/tcp/4001/p2p/12D3KooWC1RZxLvAeEFNTZWk1FWc1sZZ3yemF4FNNRYa3X854KJ8",
+ 	}
+ 
+ 	// Convert Bootstap Nodes into usable addresses.
+-- 
+2.34.1
+

packages/networking/hyprspace/0002-Remove-quic-transport-for-Lain-ipfs.patch

@@ -0,0 +1,48 @@
+From 743c2cc62daa48bbdcce038ad21805b906e8ddaf Mon Sep 17 00:00:00 2001
+From: Tiago Carvalho <sugoiuguu@tfwno.gf>
+Date: Sat, 5 Feb 2022 15:16:33 +0000
+Subject: [PATCH 2/3] Remove quic transport for Lain ipfs
+
+---
+ p2p/node.go | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/p2p/node.go b/p2p/node.go
+index 736101a..2f86317 100644
+--- a/p2p/node.go
++++ b/p2p/node.go
+@@ -15,7 +15,6 @@ import (
+ 	"github.com/libp2p/go-libp2p-core/peer"
+ 	"github.com/libp2p/go-libp2p-core/pnet"
+ 	dht "github.com/libp2p/go-libp2p-kad-dht"
+-	libp2pquic "github.com/libp2p/go-libp2p-quic-transport"
+ 	"github.com/libp2p/go-tcp-transport"
+ 	ma "github.com/multiformats/go-multiaddr"
+ )
+@@ -36,9 +35,6 @@ func CreateNode(ctx context.Context, inputKey string, port int, handler network.
+ 		return
+ 	}
+ 
+-	ip6quic := fmt.Sprintf("/ip6/::/udp/%d/quic", port)
+-	ip4quic := fmt.Sprintf("/ip4/0.0.0.0/udp/%d/quic", port)
+-
+ 	ip6tcp := fmt.Sprintf("/ip6/::/tcp/%d", port)
+ 	ip4tcp := fmt.Sprintf("/ip4/0.0.0.0/tcp/%d", port)
+ 
+@@ -47,12 +43,11 @@ func CreateNode(ctx context.Context, inputKey string, port int, handler network.
+ 	// Create libp2p node
+ 	node, err = libp2p.New(
+ 		libp2p.PrivateNetwork(key),
+-		libp2p.ListenAddrStrings(ip6quic, ip4quic, ip6tcp, ip4tcp),
++		libp2p.ListenAddrStrings(ip6tcp, ip4tcp),
+ 		libp2p.Identity(privateKey),
+ 		libp2p.DefaultSecurity,
+ 		libp2p.NATPortMap(),
+ 		libp2p.DefaultMuxers,
+-		libp2p.Transport(libp2pquic.NewTransport),
+ 		libp2p.Transport(tcp.NewTCPTransport),
+ 		libp2p.FallbackDefaults,
+ 	)
+-- 
+2.34.1
+

packages/networking/hyprspace/0003-Remove-dep-from-go.mod.patch

@@ -0,0 +1,24 @@
+From 377b0a8f56b04e693a4d4c7a0b9bb674c63c5bba Mon Sep 17 00:00:00 2001
+From: Tiago Carvalho <sugoiuguu@tfwno.gf>
+Date: Sat, 5 Feb 2022 15:16:45 +0000
+Subject: [PATCH 3/3] Remove dep from go.mod
+
+---
+ go.mod | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/go.mod b/go.mod
+index 672c2fc..1092553 100644
+--- a/go.mod
++++ b/go.mod
+@@ -11,7 +11,6 @@ require (
+ 	github.com/libp2p/go-libp2p v0.17.0
+ 	github.com/libp2p/go-libp2p-core v0.13.0
+ 	github.com/libp2p/go-libp2p-kad-dht v0.15.0
+-	github.com/libp2p/go-libp2p-quic-transport v0.15.2
+ 	github.com/libp2p/go-tcp-transport v0.4.0
+ 	github.com/multiformats/go-multiaddr v0.4.1
+ 	github.com/nxadm/tail v1.4.8
+-- 
+2.34.1
+

packages/networking/hyprspace/default.nix

@@ -0,0 +1,31 @@
+{ lib, stdenv, buildGoModule, fetchFromGitHub, iproute2mac }:
+
+buildGoModule rec {
+  pname = "hyprspace";
+  version = "0.2.2";
+
+  propagatedBuildInputs = lib.optional stdenv.isDarwin iproute2mac;
+
+  patches = [
+    ./0001-Lain-ipfs-bootstrap-nodes.patch
+    ./0002-Remove-quic-transport-for-Lain-ipfs.patch
+    ./0003-Remove-dep-from-go.mod.patch
+  ];
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-UlIQCy4moW58tQ1dqxrPsU5LN1Bs/Jy5X+2CEmXdYIk=";
+  };
+
+  vendorSha256 = "sha256-8j9M8LrcqiPShCCNOmmJoY6wclHRiX2xOJH/wvlwvwY=";
+
+  meta = with lib; {
+    description = "A Lightweight VPN Built on top of Libp2p for Truly Distributed Networks.";
+    homepage = "https://github.com/hyprspace/hyprspace";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ yusdacra ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}

packages/packages.nix

@@ -0,0 +1,17 @@
+pkgs: {
+  privatevoid-smart-card-ca-bundle = pkgs.callPackage ./data/privatevoid-smart-card-certificate-authority-bundle.nix { };
+
+  jdtls = pkgs.callPackage ./development/langservers/jdtls.nix { };
+  
+  doom-one-vim = pkgs.callPackage ./vim-plugins/doom-one-vim.nix { };
+
+  hyprspace = pkgs.callPackage ./networking/hyprspace { iproute2mac = null; };
+
+  identity = pkgs.callPackage ./apps/identity { };
+
+  obfuscate = pkgs.callPackage ./apps/obfuscate { };
+  
+  neovim-gtk = pkgs.callPackage ./apps/neovim-gtk { };
+
+  steam-metro-skin = import ./data/misc/steam-metro-skin { inherit (pkgs) fetchzip; };
+}

packages/patched-derivations.nix

@@ -0,0 +1,63 @@
+let
+  tools = import ./lib/tools.nix;
+  patch' = super: tools.patch super "patches/base/${super.pname}";
+in with tools;
+super: rec {
+  kerberized-bind = super.bind.overrideAttrs (attrs: {
+    configureFlags = attrs.configureFlags ++ [ "--with-gssapi=${super.krb5.dev}" ];
+    buildInputs = attrs.buildInputs ++ [ super.krb5 ];
+  });
+  kerberized-dnsutils = kerberized-bind.dnsutils;
+  kerberized-dig = kerberized-bind.dnsutils;
+
+  ddcci-driver-with-global-control = patch super.linuxPackages.ddcci-driver "patches/kmods/ddcci-driver";
+
+  doas-interactive = patch-rename super.doas "doas-interactive" "patches/base/doas";
+
+  lain-ipfs = patch-rename super.ipfs "lain-ipfs" "patches/base/ipfs";
+
+  glib = patch' super.glib;
+
+  gnome-control-center = ((patch' super.gnome.gnome-control-center).override {
+    cheese = null;
+  }).overrideAttrs (_: {
+    mesonFlags = [ "-Dcheese=false" ];
+  });
+
+  kooha = super.kooha.overrideAttrs (_: {
+    postInstall = ''
+        substituteInPlace $out/share/applications/io.github.seadve.Kooha.desktop \
+          --replace "=Kooha" "=Screen Recorder"
+      '';
+  });
+
+  nautilus = (patch' super.gnome.nautilus).overrideAttrs (attrs: {
+    preFixup = with super;
+      let py = (python3.withPackages (ps: with ps; [ ps.pygobject3 ]));
+      in attrs.preFixup + ''
+        gappsWrapperArgs+=(
+          --prefix PYTHONPATH : ${py}/${py.sitePackages}
+          )
+      '';
+  });
+
+  oni2 = super.oni2.overrideAttrs (attrs: {
+    nativeBuildInputs = attrs.nativeBuildInputs ++ [
+      super.python3
+    ];
+  });
+
+  terminus_font_fancy = super.terminus_font.overrideAttrs (attrs: {
+    patches = (attrs.patches or [ ]) ++ [ "alt/td1.diff" "alt/ll2.diff" ];
+  });
+
+  nerdfonts-terminus = super.nerdfonts.override { fonts = [ "Terminus" ]; };
+
+  vte-high-refresh-rate = patch' super.vte;
+
+  tilix-high-refresh-rate = super.tilix.override { gtkd = super.gtkd.override { vte = vte-high-refresh-rate; }; };
+
+  webkitgtk = patch' super.webkitgtk;
+
+  webkitgtk_4_1 = patch' super.webkitgtk_4_1;
+}

packages/patched-inputs.nix

@@ -0,0 +1,9 @@
+let tools = import ./lib/tools.nix;
+in with tools;
+inputs: rec {
+  nix-super = inputs.nix-super.defaultPackage.x86_64-linux;
+
+  deploy-rs = inputs.deploy-rs.packages.x86_64-linux.deploy-rs;
+
+  agenix = inputs.agenix.packages.x86_64-linux.agenix.override { nix = nix-super; };
+}

packages/vim-plugins/doom-one-vim.nix

@@ -0,0 +1,14 @@
+{ vimUtils, fetchFromGitHub }:
+
+vimUtils.buildVimPlugin {
+  pname = "doom-one-vim";
+  version = "2021-04-23";
+  src = fetchFromGitHub {
+    owner = "romgrk";
+    repo = "doom-one.vim";
+    rev = "051cd6db324cd38e3b2f96230454ebe947fe12dd";
+    sha256 = "sha256-hdeVcvtnG7ATgly870DVb/bgf6bYmFkW0IHrPe0ts6E=";
+  };
+  patches = [ ./pango-bg.patch ];
+  meta.homepage = "https://github.com/romgrk/doom-one.vim/";
+}

packages/vim-plugins/pango-bg.patch

@@ -0,0 +1,38 @@
+diff --git a/colors/doom-one.vim b/colors/doom-one.vim
+index 6ef4e69..2a65a6f 100644
+--- a/colors/doom-one.vim
++++ b/colors/doom-one.vim
+@@ -47,7 +47,7 @@ endfunc
+ " Colors                                                                     {{{
+ 
+ let s:base0      = '#1B2229'
+-let s:base1      = '#1c1f24'
++let s:base1      = '#181818'
+ let s:base2      = '#202328'
+ let s:base3      = '#23272e'
+ let s:base4      = '#3f444a'
+@@ -73,15 +73,15 @@ let s:white      = '#efefef'
+ 
+ let s:green_alt  = '#799033'
+ 
+-let s:bg             = '#282c34'
+-let s:bg_alt         = '#21242b'
+-let s:bg_highlight   = '#2E323C'
+-let s:bg_popup       = '#3E4556'
+-let s:bg_widget      = s:bg
+-let s:bg_statusline  = s:bg_popup
+-let s:bg_visual      = color#Lighten(s:base4, 0.3)
+-let s:bg_selection   = s:dark_blue
+-let s:bg_highlighted = '#4A4A45'
++let s:bg             = '#1a1a1a'
++let s:bg_alt         = '#202020'
++let s:bg_highlight   = '#303030'
++let s:bg_popup       = '#1a1a1a'
++let s:bg_widget      = '#1a1a1a'
++let s:bg_statusline  = '#1a1a1a'
++let s:bg_visual      = '#404040'
++let s:bg_selection   = '#404040'
++let s:bg_highlighted = '#404040'
+ 
+ let s:fg           = '#bbc2cf'
+ let s:fg_alt       = '#5B6268'

patches/base/doas/doas-interactive.patch

@@ -0,0 +1,99 @@
+diff --git a/doas.1 b/doas.1
+index 7360be3..009ba1d 100644
+--- a/doas.1
++++ b/doas.1
+@@ -97,6 +97,10 @@ Execute the shell from
+ .Ev SHELL
+ or
+ .Pa /etc/passwd .
++.It Fl i
++Execute the shell from the target's
++.Pa /etc/passwd
++entry.
+ .It Fl u Ar user
+ Execute the command as
+ .Ar user .
+diff --git a/doas.c b/doas.c
+index e253905..e9a6cfb 100644
+--- a/doas.c
++++ b/doas.c
+@@ -37,7 +37,7 @@
+ static void __dead
+ usage(void)
+ {
+-	fprintf(stderr, "usage: doas [-Lns] [-C config] [-u user]"
++	fprintf(stderr, "usage: doas [-Lnsi] [-C config] [-u user]"
+ 	    " command [args]\n");
+ 	exit(1);
+ }
+@@ -250,6 +250,7 @@ main(int argc, char **argv)
+ 	int ngroups;
+ 	int i, ch, rv;
+ 	int sflag = 0;
++	int iflag = 0;
+ 	int nflag = 0;
+ 	char cwdpath[PATH_MAX];
+ 	const char *cwd;
+@@ -261,7 +262,7 @@ main(int argc, char **argv)
+ 
+ 	uid = getuid();
+ 
+-	while ((ch = getopt(argc, argv, "+C:Lnsu:")) != -1) {
++	while ((ch = getopt(argc, argv, "+C:Lnsiu:")) != -1) {
+ 		switch (ch) {
+ 		case 'C':
+ 			confpath = optarg;
+@@ -282,6 +283,9 @@ main(int argc, char **argv)
+ 		case 's':
+ 			sflag = 1;
+ 			break;
++		case 'i':
++			iflag = 1;
++			break;
+ 		default:
+ 			usage();
+ 			break;
+@@ -291,9 +295,9 @@ main(int argc, char **argv)
+ 	argc -= optind;
+ 
+ 	if (confpath) {
+-		if (sflag)
++		if (sflag || iflag)
+ 			usage();
+-	} else if ((!sflag && !argc) || (sflag && argc))
++	} else if ((!sflag && !iflag && !argc) || (sflag && argc) || (sflag && iflag) || (iflag && argc))
+ 		usage();
+ 
+ 	rv = mygetpwuid_r(uid, &mypwstore, &mypw);
+@@ -306,7 +310,17 @@ main(int argc, char **argv)
+ 		err(1, "can't get groups");
+ 	groups[ngroups++] = getgid();
+ 
+-	if (sflag) {
++	rv = mygetpwuid_r(target, &targpwstore, &targpw);
++	if (rv != 0)
++		err(1, "getpwuid_r failed");
++	if (targpw == NULL)
++		errx(1, "no passwd entry for target");
++
++	if (iflag) {
++		shargv[0] = targpw->pw_shell;
++		argv = shargv;
++		argc = 1;
++	} else if (sflag) {
+ 		sh = getenv("SHELL");
+ 		if (sh == NULL || *sh == '\0') {
+ 			shargv[0] = mypw->pw_shell;
+@@ -368,12 +382,6 @@ main(int argc, char **argv)
+ 			err(1, "failed to set PATH '%s'", safepath);
+ 	}
+ 
+-	rv = mygetpwuid_r(target, &targpwstore, &targpw);
+-	if (rv != 0)
+-		err(1, "getpwuid_r failed");
+-	if (targpw == NULL)
+-		errx(1, "no passwd entry for target");
+-
+ #if defined(USE_PAM)
+ 	pamauth(targpw->pw_name, mypw->pw_name, !nflag, rule->options & NOPASS,
+ 	    rule->options & PERSIST);

patches/base/glib/glib-appinfo-watch.patch

@@ -0,0 +1,102 @@
+This patch lets GLib's GDesktopAppInfo API watch and notice changes
+to the Nix user and system profiles.  That way, the list of available
+applications shown by the desktop environment is immediately updated
+when the user installs or removes any
+(see <https://issues.guix.gnu.org/35594>).
+
+It does so by monitoring /nix/var/nix/profiles (for changes to the system
+profile) and /nix/var/nix/profiles/per-user/USER (for changes to the user
+profile) as well as /etc/profiles/per-user (for chanes to the user
+environment profile) and crawling their share/applications sub-directory when
+changes happen.
+
+diff --git a/gio/gdesktopappinfo.c b/gio/gdesktopappinfo.c
+index f1e2fdd..095c110 100644
+--- a/gio/gdesktopappinfo.c
++++ b/gio/gdesktopappinfo.c
+@@ -148,6 +148,7 @@ typedef struct
+   gchar                      *alternatively_watching;
+   gboolean                    is_config;
+   gboolean                    is_setup;
++  gchar                      *nix_profile_watch_dir;
+   GFileMonitor               *monitor;
+   GHashTable                 *app_names;
+   GHashTable                 *mime_tweaks;
+@@ -180,6 +181,7 @@ desktop_file_dir_unref (DesktopFileDir *dir)
+     {
+       desktop_file_dir_reset (dir);
+       g_free (dir->path);
++      g_free (dir->nix_profile_watch_dir);
+       g_free (dir);
+     }
+ }
+@@ -204,6 +206,14 @@ desktop_file_dir_get_alternative_dir (DesktopFileDir *dir)
+ {
+   gchar *parent;
+ 
++  /* If DIR is a profile, watch the specified directory--e.g.,
++   * /nix/var/nix/profiles/per-user/$USER/ for the user profile.  Do not watch
++   * ~/.nix-profile or /run/current-system/sw because GFileMonitor does
++   * not pass IN_DONT_FOLLOW and thus cannot notice any change.
++   * /etc/profiles/per-user is monitored directly for the same reason. */
++  if (dir->nix_profile_watch_dir != NULL)
++    return g_strdup (dir->nix_profile_watch_dir);
++
+   /* If the directory itself exists then we need no alternative. */
+   if (g_access (dir->path, R_OK | X_OK) == 0)
+     return NULL;
+@@ -249,11 +258,11 @@ desktop_file_dir_changed (GFileMonitor      *monitor,
+    *
+    * If this is a notification for a parent directory (because the
+    * desktop directory didn't exist) then we shouldn't fire the signal
+-   * unless something actually changed.
++   * unless something actually changed or it's part of a Nix profile.
+    */
+   g_mutex_lock (&desktop_file_dir_lock);
+ 
+-  if (dir->alternatively_watching)
++  if (dir->alternatively_watching && dir->nix_profile_watch_dir == NULL)
+     {
+       gchar *alternative_dir;
+ 
+@@ -1555,6 +1564,40 @@ desktop_file_dirs_lock (void)
+       for (i = 0; dirs[i]; i++)
+         g_ptr_array_add (desktop_file_dirs, desktop_file_dir_new (dirs[i]));
+ 
++      {
++        /* Monitor the system and user profile under /nix/var/nix/profiles and
++         * treat modifications to them as if they were modifications to their
++         * /share sub-directory.  */
++        const gchar *user;
++        DesktopFileDir *system_profile_dir, *user_profile_dir, *user_env_dir;
++
++        system_profile_dir =
++          desktop_file_dir_new ("/nix/var/nix/profiles/system/sw/share");
++        system_profile_dir->nix_profile_watch_dir = g_strdup ("/nix/var/nix/profiles");
++        g_ptr_array_add (desktop_file_dirs, desktop_file_dir_ref (system_profile_dir));
++
++        user = g_get_user_name ();
++        if (user != NULL)
++          {
++            gchar *profile_dir, *user_data_dir, *env_dir, *env_data_dir;
++
++            profile_dir = g_build_filename ("/nix/var/nix/profiles/per-user", user, NULL);
++            user_data_dir = g_build_filename (profile_dir, "profile", "share", NULL);
++            user_profile_dir = desktop_file_dir_new (user_data_dir);
++            user_profile_dir->nix_profile_watch_dir = profile_dir;
++            
++            env_dir = g_build_filename ("/etc/profiles/per-user", NULL);
++            env_data_dir = g_build_filename (env_dir, user, "share", NULL);
++            user_env_dir = desktop_file_dir_new (env_data_dir);
++            user_env_dir->nix_profile_watch_dir = env_dir;
++
++            g_ptr_array_add (desktop_file_dirs, desktop_file_dir_ref (user_profile_dir));
++            g_ptr_array_add (desktop_file_dirs, desktop_file_dir_ref (user_env_dir));
++            g_free (user_data_dir);
++            g_free (env_data_dir);
++          }
++      }
++
+       /* The list of directories will never change after this, unless
+        * g_get_user_config_dir() changes due to %G_TEST_OPTION_ISOLATE_DIRS. */
+       desktop_file_dirs_config_dir = user_config_dir;

patches/base/gnome-control-center/no-alert-chooser.patch

@@ -0,0 +1,442 @@
+diff --git a/panels/sound/cc-alert-chooser.c b/panels/sound/cc-alert-chooser.c
+deleted file mode 100644
+index 8e60659..0000000
+--- a/panels/sound/cc-alert-chooser.c
++++ /dev/null
+@@ -1,278 +0,0 @@
+-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 8 -*-
+- *
+- * Copyright (C) 2018 Canonical Ltd.
+- *
+- * This program is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU General Public License as
+- * published by the Free Software Foundation; either version 2 of the
+- * License, or (at your option) any later version.
+- *
+- * This program is distributed in the hope that it will be useful, but
+- * WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+- * Lesser General Public License for more details.
+- *
+- * You should have received a copy of the GNU General Public License
+- * along with this program; if not, see <http://www.gnu.org/licenses/>.
+- */
+-
+-#include <glib/gi18n.h>
+-#include <gsound.h>
+-
+-#include "config.h"
+-#include "cc-alert-chooser.h"
+-#include "cc-sound-button.h"
+-#include "cc-sound-resources.h"
+-
+-#define KEY_SOUNDS_SCHEMA "org.gnome.desktop.sound"
+-
+-struct _CcAlertChooser
+-{
+-  GtkBox         parent_instance;
+-
+-  CcSoundButton *bark_button;
+-  CcSoundButton *drip_button;
+-  CcSoundButton *glass_button;
+-  CcSoundButton *sonar_button;
+-
+-  GSoundContext *context;
+-  GSettings     *sound_settings;
+-};
+-
+-static void clicked_cb (CcAlertChooser *self,
+-                        CcSoundButton  *button);
+-
+-G_DEFINE_TYPE (CcAlertChooser, cc_alert_chooser, GTK_TYPE_BOX)
+-
+-#define CUSTOM_THEME_NAME "__custom"
+-
+-static gchar *
+-get_theme_dir (void)
+-{
+-  return g_build_filename (g_get_user_data_dir (), "sounds", CUSTOM_THEME_NAME, NULL);
+-}
+-
+-static gchar *
+-get_sound_path (const gchar *name)
+-{
+-  g_autofree gchar *filename = NULL;
+-
+-  filename = g_strdup_printf ("%s.ogg", name);
+-  return g_build_filename (SOUND_DATA_DIR, "gnome", "default", "alerts", filename, NULL);
+-}
+-
+-static gchar *
+-get_alert_name (void)
+-{
+-  g_autofree gchar *dir = NULL;
+-  g_autofree gchar *path = NULL;
+-  g_autoptr(GFile) file = NULL;
+-  g_autoptr(GFileInfo) info = NULL;
+-  const gchar *target;
+-  g_autofree gchar *basename = NULL;
+-  g_autoptr(GError) error = NULL;
+-
+-  dir = get_theme_dir ();
+-  path = g_build_filename (dir, "bell-terminal.ogg", NULL);
+-  file = g_file_new_for_path (path);
+-
+-  info = g_file_query_info (file,
+-                            G_FILE_ATTRIBUTE_STANDARD_SYMLINK_TARGET,
+-                            G_FILE_QUERY_INFO_NONE,
+-                            NULL,
+-                            &error);
+-  if (info == NULL)
+-    {
+-      if (!g_error_matches (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND))
+-        g_warning ("Failed to get sound theme symlink %s: %s", path, error->message);
+-      return NULL;
+-    }
+-  target = g_file_info_get_attribute_byte_string (info, G_FILE_ATTRIBUTE_STANDARD_SYMLINK_TARGET);
+-  if (target == NULL)
+-    return NULL;
+-
+-  basename = g_path_get_basename (target);
+-  if (g_str_has_suffix (basename, ".ogg"))
+-    basename[strlen (basename) - 4] = '\0';
+-
+-  return g_steal_pointer (&basename);
+-}
+-
+-static void
+-set_sound_symlink (const gchar *alert_name,
+-                   const gchar *name)
+-{
+-  g_autofree gchar *dir = NULL;
+-  g_autofree gchar *source_filename = NULL;
+-  g_autofree gchar *source_path = NULL;
+-  g_autofree gchar *target_path = NULL;
+-  g_autoptr(GFile) file = NULL;
+-  g_autoptr(GError) error = NULL;
+-
+-  dir = get_theme_dir ();
+-  source_filename = g_strdup_printf ("%s.ogg", alert_name);
+-  source_path = g_build_filename (dir, source_filename, NULL);
+-  target_path = get_sound_path (name);
+-
+-  file = g_file_new_for_path (source_path);
+-  if (!g_file_delete (file, NULL, &error))
+-    {
+-      if (!g_error_matches (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND))
+-        g_warning ("Failed to remove existing sound symbolic link %s: %s", source_path, error->message);
+-    }
+-  if (!g_file_make_symbolic_link (file, target_path, NULL, &error))
+-    g_warning ("Failed to make sound theme symbolic link %s->%s: %s", source_path, target_path, error->message);
+-}
+-
+-static void
+-set_custom_theme (CcAlertChooser *self,
+-                  const gchar    *name)
+-{
+-  g_autofree gchar *dir = NULL;
+-  g_autofree gchar *theme_path = NULL;
+-  g_autoptr(GKeyFile) theme_file = NULL;
+-  g_autoptr(GVariant) default_theme = NULL;
+-  g_autoptr(GError) load_error = NULL;
+-  g_autoptr(GError) save_error = NULL;
+-
+-  dir = get_theme_dir ();
+-  g_mkdir_with_parents (dir, USER_DIR_MODE);
+-
+-  theme_path = g_build_filename (dir, "index.theme", NULL);
+-
+-  default_theme = g_settings_get_default_value (self->sound_settings, "theme-name");
+-
+-  theme_file = g_key_file_new ();
+-  if (!g_key_file_load_from_file (theme_file, theme_path, G_KEY_FILE_KEEP_COMMENTS, &load_error))
+-    {
+-      if (!g_error_matches (load_error, G_FILE_ERROR, G_FILE_ERROR_NOENT))
+-        g_printerr ("Failed to load theme file %s: %s", theme_path, load_error->message);
+-    }
+-  g_key_file_set_string (theme_file, "Sound Theme", "Name", _("Custom"));
+-  if (default_theme != NULL)
+-    g_key_file_set_string (theme_file, "Sound Theme", "Inherits", g_variant_get_string (default_theme, NULL));
+-  g_key_file_set_string (theme_file, "Sound Theme", "Directories", ".");
+-
+-  if (!g_key_file_save_to_file (theme_file, theme_path, &save_error))
+-    {
+-      g_warning ("Failed to save theme file %s: %s", theme_path, save_error->message);
+-    }
+-
+-  set_sound_symlink ("bell-terminal", name);
+-  set_sound_symlink ("bell-window-system", name);
+-
+-  g_settings_set_boolean (self->sound_settings, "event-sounds", TRUE);
+-  g_settings_set_string (self->sound_settings, "theme-name", CUSTOM_THEME_NAME);
+-}
+-
+-static void
+-select_sound (CcAlertChooser *self,
+-              const gchar    *name)
+-{
+-  g_autofree gchar *path = NULL;
+-  g_autoptr(GError) error = NULL;
+-
+-  path = get_sound_path (name);
+-  if (!gsound_context_play_simple (self->context, NULL, &error,
+-                                   GSOUND_ATTR_MEDIA_FILENAME, path,
+-                                   NULL))
+-    {
+-      g_warning ("Failed to play alert sound %s: %s", path, error->message);
+-    }
+-
+-  set_custom_theme (self, name);
+-}
+-
+-static void
+-set_button (CcAlertChooser *self,
+-            CcSoundButton  *button,
+-            gboolean        active)
+-{
+-  g_signal_handlers_block_by_func (button, clicked_cb, self);
+-  gtk_toggle_button_set_active (GTK_TOGGLE_BUTTON (button), active);
+-  g_signal_handlers_unblock_by_func (button, clicked_cb, self);
+-}
+-
+-static void
+-clicked_cb (CcAlertChooser *self,
+-            CcSoundButton  *button)
+-{
+-  if (button == self->bark_button)
+-    select_sound (self, "bark");
+-  else if (button == self->drip_button)
+-    select_sound (self, "drip");
+-  else if (button == self->glass_button)
+-    select_sound (self, "glass");
+-  else if (button == self->sonar_button)
+-    select_sound (self, "sonar");
+-
+-  set_button (self, button, TRUE);
+-  if (button != self->bark_button)
+-    set_button (self, self->bark_button, FALSE);
+-  if (button != self->drip_button)
+-    set_button (self, self->drip_button, FALSE);
+-  if (button != self->glass_button)
+-    set_button (self, self->glass_button, FALSE);
+-  if (button != self->sonar_button)
+-    set_button (self, self->sonar_button, FALSE);
+-}
+-
+-static void
+-cc_alert_chooser_dispose (GObject *object)
+-{
+-  CcAlertChooser *self = CC_ALERT_CHOOSER (object);
+-
+-  g_clear_object (&self->context);
+-  g_clear_object (&self->sound_settings);
+-
+-  G_OBJECT_CLASS (cc_alert_chooser_parent_class)->dispose (object);
+-}
+-
+-void
+-cc_alert_chooser_class_init (CcAlertChooserClass *klass)
+-{
+-  GObjectClass   *object_class = G_OBJECT_CLASS (klass);
+-  GtkWidgetClass *widget_class = GTK_WIDGET_CLASS (klass);
+-
+-  object_class->dispose = cc_alert_chooser_dispose;
+-
+-  gtk_widget_class_set_template_from_resource (widget_class, "/org/gnome/control-center/sound/cc-alert-chooser.ui");
+-
+-  gtk_widget_class_bind_template_child (widget_class, CcAlertChooser, bark_button);
+-  gtk_widget_class_bind_template_child (widget_class, CcAlertChooser, drip_button);
+-  gtk_widget_class_bind_template_child (widget_class, CcAlertChooser, glass_button);
+-  gtk_widget_class_bind_template_child (widget_class, CcAlertChooser, sonar_button);
+-
+-  gtk_widget_class_bind_template_callback (widget_class, clicked_cb);
+-
+-  g_type_ensure (CC_TYPE_SOUND_BUTTON);
+-}
+-
+-void
+-cc_alert_chooser_init (CcAlertChooser *self)
+-{
+-  g_autofree gchar *alert_name = NULL;
+-  g_autoptr(GError) error = NULL;
+-
+-  g_resources_register (cc_sound_get_resource ());
+-
+-  gtk_widget_init_template (GTK_WIDGET (self));
+-
+-  self->context = gsound_context_new (NULL, &error);
+-  if (self->context == NULL)
+-    g_error ("Failed to make sound context: %s", error->message);
+-
+-  self->sound_settings = g_settings_new (KEY_SOUNDS_SCHEMA);
+-
+-  alert_name = get_alert_name ();
+-  if (g_strcmp0 (alert_name, "bark") == 0)
+-    set_button (self, self->bark_button, TRUE);
+-  else if (g_strcmp0 (alert_name, "drip") == 0)
+-    set_button (self, self->drip_button, TRUE);
+-  else if (g_strcmp0 (alert_name, "glass") == 0)
+-    set_button (self, self->glass_button, TRUE);
+-  else if (g_strcmp0 (alert_name, "sonar") == 0)
+-    set_button (self, self->sonar_button, TRUE);
+-  else if (alert_name != NULL)
+-    g_warning ("Current alert sound has unknown name %s", alert_name);
+-}
+diff --git a/panels/sound/cc-alert-chooser.h b/panels/sound/cc-alert-chooser.h
+deleted file mode 100644
+index c6f4b87..0000000
+--- a/panels/sound/cc-alert-chooser.h
++++ /dev/null
+@@ -1,28 +0,0 @@
+-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 8 -*-
+- *
+- * Copyright (C) 2018 Canonical Ltd.
+- *
+- * This program is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU General Public License as
+- * published by the Free Software Foundation; either version 2 of the
+- * License, or (at your option) any later version.
+- *
+- * This program is distributed in the hope that it will be useful, but
+- * WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+- * Lesser General Public License for more details.
+- *
+- * You should have received a copy of the GNU General Public License
+- * along with this program; if not, see <http://www.gnu.org/licenses/>.
+- */
+-
+-#pragma once
+-
+-#include <gtk/gtk.h>
+-
+-G_BEGIN_DECLS
+-
+-#define CC_TYPE_ALERT_CHOOSER (cc_alert_chooser_get_type ())
+-G_DECLARE_FINAL_TYPE (CcAlertChooser, cc_alert_chooser, CC, ALERT_CHOOSER, GtkBox)
+-
+-G_END_DECLS
+diff --git a/panels/sound/cc-alert-chooser.ui b/panels/sound/cc-alert-chooser.ui
+deleted file mode 100644
+index c673711..0000000
+--- a/panels/sound/cc-alert-chooser.ui
++++ /dev/null
+@@ -1,38 +0,0 @@
+-<?xml version="1.0" encoding="UTF-8"?>
+-<interface>
+-  <!-- interface-requires gtk+ 3.0 -->
+-  <template class="CcAlertChooser" parent="GtkBox">
+-    <property name="homogeneous">True</property>
+-    <style>
+-      <class name="linked"/>
+-    </style>
+-    <child>
+-      <object class="CcSoundButton" id="bark_button">
+-        <property name="visible">True</property>
+-        <property name="label" translatable="yes">Bark</property>
+-        <signal name="clicked" handler="clicked_cb" object="CcAlertChooser" swapped="yes"/>
+-      </object>
+-    </child>
+-    <child>
+-      <object class="CcSoundButton" id="drip_button">
+-        <property name="visible">True</property>
+-        <property name="label" translatable="yes">Drip</property>
+-        <signal name="clicked" handler="clicked_cb" object="CcAlertChooser" swapped="yes"/>
+-      </object>
+-    </child>
+-    <child>
+-      <object class="CcSoundButton" id="glass_button">
+-        <property name="visible">True</property>
+-        <property name="label" translatable="yes">Glass</property>
+-        <signal name="clicked" handler="clicked_cb" object="CcAlertChooser" swapped="yes"/>
+-      </object>
+-    </child>
+-    <child>
+-      <object class="CcSoundButton" id="sonar_button">
+-        <property name="visible">True</property>
+-        <property name="label" translatable="yes">Sonar</property>
+-        <signal name="clicked" handler="clicked_cb" object="CcAlertChooser" swapped="yes"/>
+-      </object>
+-    </child>
+-  </template>
+-</interface>
+diff --git a/panels/sound/cc-sound-panel.c b/panels/sound/cc-sound-panel.c
+index 5e6e03d..611d2b9 100644
+--- a/panels/sound/cc-sound-panel.c
++++ b/panels/sound/cc-sound-panel.c
+@@ -31,7 +31,6 @@
+ #include <gvc-mixer-control.h>
+ 
+ #include "list-box-helper.h"
+-#include "cc-alert-chooser.h"
+ #include "cc-balance-slider.h"
+ #include "cc-device-combo-box.h"
+ #include "cc-fade-slider.h"
+@@ -267,7 +266,6 @@ cc_sound_panel_class_init (CcSoundPanelClass *klass)
+   gtk_widget_class_bind_template_callback (widget_class, output_device_changed_cb);
+   gtk_widget_class_bind_template_callback (widget_class, test_output_configuration_button_clicked_cb);
+ 
+-  g_type_ensure (CC_TYPE_ALERT_CHOOSER);
+   g_type_ensure (CC_TYPE_BALANCE_SLIDER);
+   g_type_ensure (CC_TYPE_DEVICE_COMBO_BOX);
+   g_type_ensure (CC_TYPE_FADE_SLIDER);
+diff --git a/panels/sound/cc-sound-panel.ui b/panels/sound/cc-sound-panel.ui
+index b5706e2..ab4380a 100644
+--- a/panels/sound/cc-sound-panel.ui
++++ b/panels/sound/cc-sound-panel.ui
+@@ -364,23 +364,6 @@
+                     </child>
+                   </object>
+                 </child>
+-                <child>
+-                  <object class="GtkLabel">
+-                    <property name="visible">True</property>
+-                    <property name="xalign">0</property>
+-                    <property name="margin-top">18</property>
+-                    <property name="label" translatable="yes">Alert Sound</property>
+-                    <attributes>
+-                      <attribute name="weight" value="bold"/>
+-                    </attributes>
+-                  </object>
+-                </child>
+-                <child>
+-                  <object class="CcAlertChooser">
+-                    <property name="visible">True</property>
+-                    <property name="hexpand">True</property>
+-                  </object>
+-                </child>
+               </object>
+             </child>
+           </object>
+diff --git a/panels/sound/meson.build b/panels/sound/meson.build
+index fa0f128..f47e7f6 100644
+--- a/panels/sound/meson.build
++++ b/panels/sound/meson.build
+@@ -31,7 +31,6 @@ cflags += [
+ ]
+ 
+ sources = files(
+-  'cc-alert-chooser.c',
+   'cc-balance-slider.c',
+   'cc-device-combo-box.c',
+   'cc-fade-slider.c',
+@@ -67,7 +66,6 @@ resource_data = files(
+   'icons/audio-speaker-right.svg',
+   'icons/audio-speaker-right-testing.svg',
+   'icons/audio-speaker-testing.svg',
+-  'cc-alert-chooser.ui',
+   'cc-balance-slider.ui',
+   'cc-device-combo-box.ui',
+   'cc-fade-slider.ui',
+diff --git a/panels/sound/sound.gresource.xml b/panels/sound/sound.gresource.xml
+index a7b662d..0f6b20f 100644
+--- a/panels/sound/sound.gresource.xml
++++ b/panels/sound/sound.gresource.xml
+@@ -1,7 +1,6 @@
+ <?xml version="1.0" encoding="UTF-8"?>
+ <gresources>
+   <gresource prefix="/org/gnome/control-center/sound">
+-    <file preprocess="xml-stripblanks">cc-alert-chooser.ui</file>
+     <file preprocess="xml-stripblanks">cc-balance-slider.ui</file>
+     <file preprocess="xml-stripblanks">cc-device-combo-box.ui</file>
+     <file preprocess="xml-stripblanks">cc-fade-slider.ui</file>

patches/base/ipfs/ipfs-allow-publish-with-ipns-mounted.patch

@@ -0,0 +1,14 @@
+diff --git a/core/coreapi/coreapi.go b/core/coreapi/coreapi.go
+index 5b638826b..32747fe53 100644
+--- a/core/coreapi/coreapi.go
++++ b/core/coreapi/coreapi.go
+@@ -191,9 +191,6 @@ func (api *CoreAPI) WithOptions(opts ...options.ApiOption) (coreiface.CoreAPI, e
+ 	}
+ 
+ 	subApi.checkPublishAllowed = func() error {
+-		if n.Mounts.Ipns != nil && n.Mounts.Ipns.IsActive() {
+-			return errors.New("cannot manually publish while IPNS is mounted")
+-		}
+ 		return nil
+ 	}
+ 

patches/base/ipfs/ipfs-fuse-nuke-getxattr.patch

@@ -0,0 +1,25 @@
+diff --git a/fuse/readonly/readonly_unix.go b/fuse/readonly/readonly_unix.go
+index 3a2269393..8bff88f28 100644
+--- a/fuse/readonly/readonly_unix.go
++++ b/fuse/readonly/readonly_unix.go
+@@ -228,12 +228,6 @@ func (s *Node) ReadDirAll(ctx context.Context) ([]fuse.Dirent, error) {
+ 	return nil, fuse.ENOENT
+ }
+ 
+-func (s *Node) Getxattr(ctx context.Context, req *fuse.GetxattrRequest, resp *fuse.GetxattrResponse) error {
+-	// TODO: is nil the right response for 'bug off, we ain't got none' ?
+-	resp.Xattr = nil
+-	return nil
+-}
+-
+ func (s *Node) Readlink(ctx context.Context, req *fuse.ReadlinkRequest) (string, error) {
+ 	if s.cached == nil || s.cached.Type() != ft.TSymlink {
+ 		return "", fuse.Errno(syscall.EINVAL)
+@@ -278,7 +272,6 @@ type roNode interface {
+ 	fs.Node
+ 	fs.NodeStringLookuper
+ 	fs.NodeReadlinker
+-	fs.NodeGetxattrer
+ }
+ 
+ var _ roNode = (*Node)(nil)

patches/base/ipfs/ipfs-unsafe-allow-all-paths-for-filestore.patch

@@ -0,0 +1,14 @@
+diff --git a/vendor/github.com/ipfs/go-filestore/fsrefstore.go b/vendor/github.com/ipfs/go-filestore/fsrefstore.go
+index 19927e0..7ff13aa 100644
+--- a/vendor/github.com/ipfs/go-filestore/fsrefstore.go
++++ b/vendor/github.com/ipfs/go-filestore/fsrefstore.go
+@@ -281,9 +281,6 @@ func (f *FileManager) putTo(b *posinfo.FilestoreNode, to putter) error {
+ 		if !f.AllowFiles {
+ 			return ErrFilestoreNotEnabled
+ 		}
+-		if !filepath.HasPrefix(b.PosInfo.FullPath, f.root) { //nolint:staticcheck
+-			return fmt.Errorf("cannot add filestore references outside ipfs root (%s)", f.root)
+-		}
+ 
+ 		p, err := filepath.Rel(f.root, b.PosInfo.FullPath)
+ 		if err != nil {

patches/base/ipfs/lain-webui-0.10.0.patch

@@ -0,0 +1,11 @@
+--- a/core/corehttp/webui.go	2020-05-09 04:58:18.000000000 +0200
++++ b/core/corehttp/webui.go	2020-07-15 00:22:00.439862559 +0200
+@@ -1,7 +1,7 @@
+ package corehttp
+ 
+ // TODO: move to IPNS
+-const WebUIPath = "/ipfs/bafybeihcyruaeza7uyjd6ugicbcrqumejf6uf353e5etdkhotqffwtguva" // v2.13.0
++const WebUIPath = "/ipns/webui.ipfs.privatevoid.net"
+ 
+ // this is a list of all past webUI paths.
+ var WebUIPaths = []string{

patches/base/nautilus/nautilus-extra-paths.patch

@@ -0,0 +1,150 @@
+diff --git a/src/nautilus-file-utilities.c b/src/nautilus-file-utilities.c
+index 3b161f5..e597e50 100644
+--- a/src/nautilus-file-utilities.c
++++ b/src/nautilus-file-utilities.c
+@@ -459,6 +459,45 @@ nautilus_is_home_directory (GFile *dir)
+     return g_file_equal (dir, home_dir);
+ }
+ 
++gboolean
++nautilus_is_ipfs_directory (GFile *dir)
++{
++    static GFile *ipfs_dir = NULL;
++
++    if (ipfs_dir == NULL)
++    {
++        ipfs_dir = g_file_new_for_path ("/ipfs");
++    }
++
++    return g_file_equal (dir, ipfs_dir);
++}
++
++gboolean
++nautilus_is_ipns_directory (GFile *dir)
++{
++    static GFile *ipns_dir = NULL;
++
++    if (ipns_dir == NULL)
++    {
++        ipns_dir = g_file_new_for_path ("/ipns");
++    }
++
++    return g_file_equal (dir, ipns_dir);
++}
++
++gboolean
++nautilus_is_nix_store_directory (GFile *dir)
++{
++    static GFile *nix_store_dir = NULL;
++
++    if (nix_store_dir == NULL)
++    {
++        nix_store_dir = g_file_new_for_path ("/nix/store");
++    }
++
++    return g_file_equal (dir, nix_store_dir);
++}
++
+ gboolean
+ nautilus_is_root_directory (GFile *dir)
+ {
+diff --git a/src/nautilus-file-utilities.h b/src/nautilus-file-utilities.h
+index 67df0e4..64eda25 100644
+--- a/src/nautilus-file-utilities.h
++++ b/src/nautilus-file-utilities.h
+@@ -36,6 +36,9 @@
+  */
+ char *   nautilus_get_user_directory                 (void);
+ char *   nautilus_get_home_directory_uri             (void);
++gboolean nautilus_is_ipfs_directory                  (GFile *dir);
++gboolean nautilus_is_ipns_directory                  (GFile *dir);
++gboolean nautilus_is_nix_store_directory             (GFile *dir);
+ gboolean nautilus_is_root_directory                  (GFile *dir);
+ gboolean nautilus_is_home_directory                  (GFile *dir);
+ gboolean nautilus_is_home_directory_file             (GFile *dir,
+diff --git a/src/nautilus-pathbar.c b/src/nautilus-pathbar.c
+index 622686b..67ca14c 100644
+--- a/src/nautilus-pathbar.c
++++ b/src/nautilus-pathbar.c
+@@ -52,6 +52,9 @@ typedef enum
+     RECENT_BUTTON,
+     MOUNT_BUTTON,
+     TRASH_BUTTON,
++    IPFS_BUTTON,
++    IPNS_BUTTON,
++    NIX_STORE_BUTTON,
+ } ButtonType;
+ 
+ #define BUTTON_DATA(x) ((ButtonData *) (x))
+@@ -327,6 +330,21 @@ get_dir_name (ButtonData *button_data)
+             return _("Home");
+         }
+ 
++        case IPFS_BUTTON:
++        {
++            return _("IPFS");
++        }
++
++        case IPNS_BUTTON:
++        {
++            return _("IPNS");
++        }
++
++        case NIX_STORE_BUTTON:
++        {
++            return _("Nix Store");
++        }
++
+         case OTHER_LOCATIONS_BUTTON:
+         {
+             return _("Other Locations");
+@@ -1251,6 +1269,17 @@ get_gicon (ButtonData *button_data)
+             return g_themed_icon_new (NAUTILUS_ICON_FILESYSTEM);
+         }
+ 
++        case NIX_STORE_BUTTON:
++        {
++            return g_themed_icon_new ("weather-snow-symbolic");
++        }
++
++        case IPFS_BUTTON:
++        case IPNS_BUTTON:
++        {
++            return g_themed_icon_new (NAUTILUS_ICON_FOLDER_PUBLIC_SHARE);
++        }
++
+         case HOME_BUTTON:
+         {
+             return g_themed_icon_new (NAUTILUS_ICON_HOME);
+@@ -1347,6 +1376,21 @@ setup_button_type (ButtonData      *button_data,
+     {
+         button_data->type = ROOT_BUTTON;
+     }
++    else if (nautilus_is_ipfs_directory (location))
++    {
++        button_data->type = IPFS_BUTTON;
++        button_data->is_root = TRUE;
++    }
++    else if (nautilus_is_ipns_directory (location))
++    {
++        button_data->type = IPNS_BUTTON;
++        button_data->is_root = TRUE;
++    }
++    else if (nautilus_is_nix_store_directory (location))
++    {
++        button_data->type = NIX_STORE_BUTTON;
++        button_data->is_root = TRUE;
++    }
+     else if (nautilus_is_home_directory (location))
+     {
+         button_data->type = HOME_BUTTON;
+@@ -1559,6 +1603,9 @@ make_button_data (NautilusPathBar *self,
+         case RECENT_BUTTON:
+         case STARRED_BUTTON:
+         case OTHER_LOCATIONS_BUTTON:
++        case IPFS_BUTTON:
++        case IPNS_BUTTON:
++        case NIX_STORE_BUTTON:
+         {
+             button_data->label = gtk_label_new (NULL);
+             button_data->disclosure_arrow = gtk_image_new_from_icon_name ("pan-down-symbolic",

patches/base/ungoogled-chromium/Improve-screen-sharing-with-PipeWire-on-Linux-Wayland-session.patch

@@ -0,0 +1,125 @@
+From 870df28bda2ae8022ce2df17886bc253c2a92cb1 Mon Sep 17 00:00:00 2001
+From: Jan Grulich <grulja@gmail.com>
+Date: Mon, 14 Dec 2020 22:36:48 +0000
+Subject: [PATCH] Improve screen sharing with PipeWire on Linux Wayland session
+
+Current scenario when PipeWire desktop capturer is used:
+Chromium picker dialog is created with screen and window capturer. Each
+capturer makes an xdg-desktop-portal call, showing another picker
+dialog. Once user confirms both pickers on xdg-desktop-portal side, yet
+another picker is shown as a new capturer is created for the web page
+itself.
+
+With this change:
+Chromium picker dialog is created, but only screen capturer will be
+created as with xdg-desktop-portal the picker will handle both screens
+and windows. Also in the chromium picker, the "window" tab creating
+window capturer expects a list of windows and doesn't show previews,
+but we need actually to behave exactly like the "screen" tab and show
+preview of selected window. Then again, yet another picker from
+xdg-desktop-portal is shown as a new capturer is created for the web
+page itself.
+
+Bug: chromium:1157006
+Change-Id: I39eafc72eb46da7868d1114b5c106030c22787a4
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2578840
+Commit-Queue: mark a. foltz <mfoltz@chromium.org>
+Reviewed-by: mark a. foltz <mfoltz@chromium.org>
+Reviewed-by: Wez <wez@chromium.org>
+Reviewed-by: Guido Urdaneta <guidou@chromium.org>
+Reviewed-by: Avi Drissman <avi@chromium.org>
+Cr-Commit-Position: refs/heads/master@{#836814}
+---
+ AUTHORS                                                  | 1 +
+ .../api/desktop_capture/desktop_capture_base.cc          | 8 ++++++++
+ .../browser/media/webrtc/display_media_access_handler.cc | 8 ++++++++
+ content/public/browser/desktop_capture.cc                | 9 +++++++++
+ content/public/browser/desktop_capture.h                 | 6 ++++++
+ 5 files changed, 32 insertions(+)
+
+diff --git a/AUTHORS b/AUTHORS
+index c0b2771655df5..a4f042fa7bc32 100644
+--- a/AUTHORS
++++ b/AUTHORS
+@@ -441,6 +441,7 @@ James Stanley <james@apphaus.co.uk>
+ James Vega <vega.james@gmail.com>
+ James Wei <james.wei@intel.com>
+ James Willcox <jwillcox@litl.com>
++Jan Grulich <grulja@gmail.com>
+ Jan Rucka <ruckajan10@gmail.com>
+ Jan Sauer <jan@jansauer.de>
+ Janusz Majnert <jmajnert@gmail.com>
+diff --git a/chrome/browser/extensions/api/desktop_capture/desktop_capture_base.cc b/chrome/browser/extensions/api/desktop_capture/desktop_capture_base.cc
+index fa790782b3ee0..a9708300d2c32 100644
+--- a/chrome/browser/extensions/api/desktop_capture/desktop_capture_base.cc
++++ b/chrome/browser/extensions/api/desktop_capture/desktop_capture_base.cc
+@@ -120,6 +120,14 @@ DesktopCaptureChooseDesktopMediaFunctionBase::Execute(
+     }
+   }
+ 
++  // Avoid offering window-capture as a separate source, since PipeWire's
++  // content-picker will offer both screen and window sources.
++  // See crbug.com/1157006.
++  if (content::desktop_capture::CanUsePipeWire() &&
++      base::Contains(media_types, content::DesktopMediaID::TYPE_SCREEN)) {
++    base::Erase(media_types, content::DesktopMediaID::TYPE_WINDOW);
++  }
++
+   DesktopMediaPickerController::DoneCallback callback = base::BindOnce(
+       &DesktopCaptureChooseDesktopMediaFunctionBase::OnPickerDialogResults,
+       this, origin, web_contents);
+diff --git a/chrome/browser/media/webrtc/display_media_access_handler.cc b/chrome/browser/media/webrtc/display_media_access_handler.cc
+index 3026674525bf5..e837e5ca1ed06 100644
+--- a/chrome/browser/media/webrtc/display_media_access_handler.cc
++++ b/chrome/browser/media/webrtc/display_media_access_handler.cc
+@@ -216,6 +216,14 @@ void DisplayMediaAccessHandler::ProcessQueuedAccessRequest(
+       content::DesktopMediaID::TYPE_SCREEN,
+       content::DesktopMediaID::TYPE_WINDOW,
+       content::DesktopMediaID::TYPE_WEB_CONTENTS};
++
++  // Avoid offering window-capture as a separate source, since PipeWire's
++  // content-picker will offer both screen and window sources.
++  // See crbug.com/1157006.
++  if (content::desktop_capture::CanUsePipeWire()) {
++    base::Erase(media_types, content::DesktopMediaID::TYPE_WINDOW);
++  }
++
+   auto source_lists = picker_factory_->CreateMediaList(media_types);
+ 
+   DesktopMediaPicker::DoneCallback done_callback =
+diff --git a/content/public/browser/desktop_capture.cc b/content/public/browser/desktop_capture.cc
+index 60065d125ff5d..c3b8f474cfb77 100644
+--- a/content/public/browser/desktop_capture.cc
++++ b/content/public/browser/desktop_capture.cc
+@@ -65,5 +65,14 @@ std::unique_ptr<webrtc::DesktopCapturer> CreateWindowCapturer() {
+ #endif
+ }
+ 
++bool CanUsePipeWire() {
++#if defined(WEBRTC_USE_PIPEWIRE)
++  return webrtc::DesktopCapturer::IsRunningUnderWayland() &&
++         base::FeatureList::IsEnabled(features::kWebRtcPipeWireCapturer);
++#else
++  return false;
++#endif
++}
++
+ }  // namespace desktop_capture
+ }  // namespace content
+diff --git a/content/public/browser/desktop_capture.h b/content/public/browser/desktop_capture.h
+index c90997a8762a5..700d5c46aed5c 100644
+--- a/content/public/browser/desktop_capture.h
++++ b/content/public/browser/desktop_capture.h
+@@ -19,6 +19,12 @@ CONTENT_EXPORT webrtc::DesktopCaptureOptions CreateDesktopCaptureOptions();
+ CONTENT_EXPORT std::unique_ptr<webrtc::DesktopCapturer> CreateScreenCapturer();
+ CONTENT_EXPORT std::unique_ptr<webrtc::DesktopCapturer> CreateWindowCapturer();
+ 
++// Returns whether we can use PipeWire capturer based on:
++// 1) We run Linux Wayland session
++// 2) WebRTC is built with PipeWire enabled
++// 3) Chromium has features::kWebRtcPipeWireCapturer enabled
++CONTENT_EXPORT bool CanUsePipeWire();
++
+ }  // namespace desktop_capture
+ }  // namespace content
+ 

patches/base/ungoogled-chromium/chromium-privatevoiddotnet-new-tld-void.patch

@@ -0,0 +1,27 @@
+diff --git a/net/base/registry_controlled_domains/effective_tld_names.dat b/net/base/registry_controlled_domains/effective_tld_names.dat
+index 76e7bf2..b4083f1 100644
+--- a/net/base/registry_controlled_domains/effective_tld_names.dat
++++ b/net/base/registry_controlled_domains/effective_tld_names.dat
+@@ -13,6 +13,9 @@
+ 
+ // ===BEGIN ICANN DOMAINS===
+ 
++// Private Void Enterprises quicklink TLD
++void
++
+ // ac : https://en.wikipedia.org/wiki/.ac
+ ac
+ com.ac
+diff --git a/net/base/registry_controlled_domains/effective_tld_names.gperf b/net/base/registry_controlled_domains/effective_tld_names.gperf
+index eb9076e..1720c96 100644
+--- a/net/base/registry_controlled_domains/effective_tld_names.gperf
++++ b/net/base/registry_controlled_domains/effective_tld_names.gperf
+@@ -8043,6 +8043,7 @@ vn.ua, 0
+ voagat.no, 0
+ vodka, 0
+ volda.no, 0
++void, 0
+ volkenkunde.museum, 0
+ volkswagen, 0
+ vologda.su, 4
+

patches/base/vte/vte-high-refresh-rate.patch

@@ -0,0 +1,16 @@
+diff --git a/src/vtedefines.hh b/src/vtedefines.hh
+index c8ecb1a..eb46f52 100644
+--- a/src/vtedefines.hh
++++ b/src/vtedefines.hh
+@@ -82,8 +82,8 @@
+ #define VTE_CHILD_OUTPUT_PRIORITY	G_PRIORITY_HIGH
+ #define VTE_MAX_INPUT_READ		0x1000
+-#define VTE_DISPLAY_TIMEOUT		10
++#define VTE_DISPLAY_TIMEOUT		10
+-#define VTE_UPDATE_TIMEOUT		15
+-#define VTE_UPDATE_REPEAT_TIMEOUT	30
++#define VTE_UPDATE_TIMEOUT		5
++#define VTE_UPDATE_REPEAT_TIMEOUT	10
+ #define VTE_MAX_PROCESS_TIME		100
+ #define VTE_CELL_BBOX_SLACK		1
+ #define VTE_DEFAULT_UTF8_AMBIGUOUS_WIDTH 1

patches/base/webkitgtk/PasteboardGtk-fix-paste-images.patch

@@ -0,0 +1,50 @@
+diff --git b/Source/WebCore/platform/gtk/PasteboardGtk.cpp a/Source/WebCore/platform/gtk/PasteboardGtk.cpp
+index fbe7198..6693af0 100644
+--- b/Source/WebCore/platform/gtk/PasteboardGtk.cpp
++++ a/Source/WebCore/platform/gtk/PasteboardGtk.cpp
+@@ -315,15 +315,43 @@ void Pasteboard::read(PasteboardWebContentReader& reader, WebContentReadingPolic
+ 
+ void Pasteboard::read(PasteboardFileReader& reader, Optional<size_t>)
+ {
++    WTFLogAlways("xxoo Pasteboard::read PasteboardFileReader");
+     if (m_selectionData) {
+-        for (const auto& filePath : m_selectionData->filenames())
++        WTFLogAlways("xxoo Pasteboard::read m_selectionData");
++        for (const auto& filePath : m_selectionData->filenames()) {
++            WTFLogAlways("xxoo Pasteboard::read m_selectionData reader.readFilename filePath=%s", filePath.utf8().data());
+             reader.readFilename(filePath);
++        }
+         return;
+     }
+ 
++    
++    WTFLogAlways("xxoo Pasteboard::read readFilePathsFromClipboard pasteboardName=%s", m_name.utf8().data());
+     auto filePaths = platformStrategies()->pasteboardStrategy()->readFilePathsFromClipboard(m_name);
+-    for (const auto& filePath : filePaths)
++    for (const auto& filePath : filePaths) {
++        WTFLogAlways("xxoo Pasteboard::read readFilePathsFromClipboard reader.readFilename filePath=%s", filePath.utf8().data());
+         reader.readFilename(filePath);
++    }
++
++    if (filePaths.isEmpty()) {
++        WTFLogAlways("xxoo Pasteboard::read readFilePathsFromClipboard got no filePaths, try readBufferFromClipboard pasteboardName=%s", m_name.utf8().data());
++
++        auto types = platformStrategies()->pasteboardStrategy()->types(m_name);
++        static const ASCIILiteral imageTypes[] = { "image/png"_s, "image/jpeg"_s, "image/gif"_s, "image/bmp"_s, "image/vnd.microsoft.icon"_s, "image/x-icon"_s };
++        for (const auto& imageType : imageTypes) {
++            if (types.contains(imageType)) {
++                WTFLogAlways("xxoo Pasteboard::read readBufferFromClipboard types contains imageType");
++                auto buffer = platformStrategies()->pasteboardStrategy()->readBufferFromClipboard(m_name, imageType);
++                // readBuffer(const String&, const String& type, Ref<SharedBuffer>&&)
++                // readImage(Ref<SharedBuffer>&&, const String&, PresentationSize = { }) 
++                if (!buffer->isEmpty()) {
++                    reader.readBuffer(imageType, imageType, buffer.releaseNonNull());
++                    WTFLogAlways("xxoo Pasteboard::read reader.readBuffer success");
++                    return;
++                }
++            }
++        }
++    }
+ }
+ 
+ bool Pasteboard::hasData()

patches/kmods/ddcci-driver/global-control-device.patch

@@ -0,0 +1,119 @@
+diff --git a/ddcci-backlight/ddcci-backlight.c b/ddcci-backlight/ddcci-backlight.c
+index 7a98522..e518bfc 100644
+--- a/ddcci-backlight/ddcci-backlight.c
++++ b/ddcci-backlight/ddcci-backlight.c
+@@ -29,6 +29,12 @@
+ #define DDCCI_MONITOR_BACKLIGHT	0x13
+ #define DDCCI_MONITOR_BL_WHITE		0x6B
+ 
++#define DDCCI_BL_MUX_MAX_DEVICES 8
++
++static struct backlight_device *ddcci_bl_global_control = NULL;
++static struct backlight_device *ddcci_bl_mux_devices[DDCCI_BL_MUX_MAX_DEVICES] = {NULL};
++static int ddcci_bl_mux_device_count = 0;
++
+ static bool convenience_symlink = true;
+ 
+ struct ddcci_monitor_drv_data {
+@@ -101,13 +107,21 @@ static int ddcci_backlight_update_status(struct backlight_device *bl)
+ 	struct ddcci_monitor_drv_data *drv_data = bl_get_data(bl);
+ 	int brightness = bl->props.brightness;
+ 	int ret;
++  int i;
+ 
+-	if (bl->props.power != FB_BLANK_UNBLANK ||
+-	    bl->props.state & BL_CORE_FBBLANK)
+-		brightness = 0;
++	if (drv_data == NULL) {
++		for (i = 0; i < ddcci_bl_mux_device_count; ++i) {
++			ddcci_bl_mux_devices[i]->props.brightness = bl->props.brightness;
++			ddcci_backlight_update_status(ddcci_bl_mux_devices[i]);
++		}
++	} else {
++		if (bl->props.power != FB_BLANK_UNBLANK ||
++				bl->props.state & BL_CORE_FBBLANK)
++			brightness = 0;
+ 
+-	ret = ddcci_monitor_writectrl(drv_data->device, drv_data->used_vcp,
+-				      brightness);
++		ret = ddcci_monitor_writectrl(drv_data->device, drv_data->used_vcp,
++								brightness);
++	}
+ 	if (ret > 0)
+ 		ret = 0;
+ 	return ret;
+@@ -119,6 +133,10 @@ static int ddcci_backlight_get_brightness(struct backlight_device *bl)
+ 	int ret;
+ 	struct ddcci_monitor_drv_data *drv_data = bl_get_data(bl);
+ 
++	if (drv_data == NULL) {
++		return bl->props.brightness;
++	}
++
+ 	ret = ddcci_monitor_readctrl(drv_data->device, drv_data->used_vcp,
+ 				     &value, &maxval);
+ 	if (ret < 0)
+@@ -277,6 +295,7 @@ static int ddcci_monitor_probe(struct ddcci_device *dev,
+ {
+ 	struct ddcci_monitor_drv_data *drv_data;
+ 	struct backlight_properties props;
++	struct backlight_properties cprops;
+ 	struct backlight_device *bl = NULL;
+ 	int ret = 0;
+ 	bool support_luminance, support_bl_white;
+@@ -369,6 +388,27 @@ static int ddcci_monitor_probe(struct ddcci_device *dev,
+ 		ddcci_backlight_create_symlink(dev);
+ 	}
+ 
++	if (ddcci_bl_global_control == NULL) {
++		printk(KERN_INFO "ddcci-backlight: registering global controller with brightness=%d, max_brightness=%d\n",
++				brightness, max_brightness);
++		cprops.type = BACKLIGHT_RAW;
++		cprops.max_brightness = max_brightness;
++		cprops.brightness = brightness;
++		ddcci_bl_global_control = devm_backlight_device_register(&dev->dev, "0000-ddcci_backlight_global_control",
++							&dev->dev, NULL,
++							&ddcci_backlight_ops, &cprops);
++	};
++
++	if(ddcci_bl_mux_device_count < DDCCI_BL_MUX_MAX_DEVICES) {
++		dev_info(&dev->dev, "registering backlight device %s as mux slave #%d",
++				dev_name(&dev->dev), ddcci_bl_mux_device_count);
++		ddcci_bl_mux_devices[ddcci_bl_mux_device_count] = bl;
++		dev_info(&dev->dev, "registered mux slave #%d successfully", ddcci_bl_mux_device_count);
++		++ddcci_bl_mux_device_count;
++	} else {
++		dev_info(&dev->dev, "new backlight device added, but mux slave array is at max capacity. global control will not work for this device.");
++	}
++
+ 	goto end;
+ err_free:
+ 	devm_kfree(&dev->dev, drv_data);
+@@ -378,8 +418,27 @@ end:
+ 
+ static int ddcci_monitor_remove(struct ddcci_device *dev)
+ {
++	int i,j;
++
+ 	dev_dbg(&dev->dev, "removing device\n");
+ 	ddcci_backlight_remove_symlink(dev);
++
++	for (i = 0; i < ddcci_bl_mux_device_count; ++i) {                                                 
++		struct backlight_device *bl = ddcci_bl_mux_devices[i];                                          
++		printk(KERN_INFO "ddcci-backlight: scan for remove global device %d from control array\n", i);     
++		if (dev == (struct ddcci_device*) bl_get_data(bl)) {                                       
++			printk(KERN_INFO "ddcci-backlight: removing global device %d from control array\n", i);          
++			ddcci_bl_mux_devices[i] = NULL;                                                               
++			for (j = i+1; j < ddcci_bl_mux_device_count; ++j) {                                           
++				if(ddcci_bl_mux_devices[j] != NULL) {                                                       
++					printk(KERN_INFO "ddcci-backlight: adjusting global devices %d -> %d\n", j, j-1);            
++					ddcci_bl_mux_devices[j-1] = ddcci_bl_mux_devices[j];                                          
++				}                                                                                       
++			}                                                                                         
++			--ddcci_bl_mux_device_count;                                                                  
++		}                                                                                           
++	}                                                                                             
++	
+ 	return 0;
+ }
+ 

repl.nix

@@ -0,0 +1,8 @@
+let
+  flake = builtins.getFlake (toString ./.);
+  nixpkgs = import <nixpkgs> { };
+in {
+  inherit flake;
+  inherit nixpkgs;
+  nixos = flake.nixosConfigurations;
+}

secrets/cachix-upload-key.age

@@ -0,0 +1,13 @@
+age-encryption.org/v1
+-> ssh-ed25519 NO562A wdYUFvxvT7qtZ2GjKvH5LMqwst83kiWb4wLfx7T6QSs
+4Bpe9C3B11Hmqv8bk7khao+AeG+qrDBe4io477y+mCg
+-> ssh-ed25519 5/zT0w r7KSc3LLqCQiGXBNgnav0StNfnVg5F9VIw2Pzw8UQhI
+pMkSqshAwDLsy2IhP00E8xYTZOMDPUNRJiisH9ArUoU
+-> ssh-ed25519 OxDh5w mb6tt+K0i73aGmPUzwR7+d+vjOQGfJcxHx2udZ6Q9nw
+1icXi5j9nOI5zkwVzu/1K22CxBpbp6ioU9j3uNZgpBo
+-> 9s8B-grease %Dt pw[YavZ RY((bY>
+WL92Bw95H0c3dM+H0iUhYtoefQbM0guP69x1vCX8zxT+NTdKtAeK/Nu1RVaR4qdL
+/yj5
+--- psVhYZPeJN0cgQi882QC7JSj6IejJUTAkdnCHw5cRQQ
+\¦Ýe˜ÑR¦
lËÚYÄÑ*^9ÍYÔJÍË%¿©‘«Í¢—Jߊí¾ÎATWE:MEÁQñ:ÃIx	ÿø}î<´vß)p¬,®0Ñ`Ø$
¿‚,§ñw´e°aúNÑéŸ80öÑo‰‹éךÁ6ܸ¼£aÃ+B¼"¬
¾tþz~Ì{æé jƒç<Ê
Ȳë\„
+_"õ‚+8‰2\ò)<û	ßeFd2sKèS…£þ€Œ“Y—Z,	5U×ÙníZµW>»'

secrets/ipfs-swarm-key.age

@@ -0,0 +1,14 @@
+age-encryption.org/v1
+-> ssh-ed25519 NO562A OAH7JcYyaB+KVOtZFXX7r1F8wDW+Y5BMBdhAou0kSBk
+NmvNTDtaTORPSNp3pUEBtUTuOR2H4ayZPu4Z9tzPDoU
+-> ssh-ed25519 5/zT0w BccoidtcwnqgbNyFylxlSe7G45whhOK+HTvLbz0nkBc
+72VYuHZ/d5BQRJfJSX2nBvzK8p4wjvQqwMbLiPpDa/k
+-> ssh-ed25519 OxDh5w sI9ecpbZ0U/kC8AR17X/KmzCXwXa9Bf6Hk6AqXw5pHM
+83zeCBsHQPtjq4IJ2jaTqZlqL3r0ACF1eqOmFxuELEk
+-> ssh-ed25519 RLSb/g t1vpmXGHm4DggmYwqov1ZrgtiwceaNfk9fZLwbkE0GM
+t/yfwCIH71BAXUc05dLjc3rYfvSvjZBi0a/JB+p/Now
+-> fL?\;;2-grease (s kw+w DNwK 0<gqZ
+fLVDBrnwjU+6+mVwweQ6zZYOVLYHLd1QGxckJaS2wL9kIWEyXCkIy+U6DfEFz+kc
+TtuvyGolurlZ+IYfMo7vorHpBw4r9CxP3IcnqTlBwQ
+--- GQMKSU2Zm8Ac1pxu89zi/Mh+wzdU0dUPMrQp6GONJ+4
+ñ‹=°ËVmP>§‰탪“ƒš¢©¶áæ{„4 õW<”ÀïE4?^Ï<>‚ý@N/ýƒô.ÛäCñóºNÈv¶«Ï¸åš;XSh¤šâGi¢í<C2A2>ëßþJI¶ù@v<>‹_yÂ
ø<>éÖžs²œ‹uع·‘€L˜{{[d:¬ÿ2ÿ

secrets/secrets.nix

@@ -0,0 +1,15 @@
+let
+  max = (import ../users/max/userinfo.nix null).sshKeys;
+  hosts = import ../hosts;
+  systemKeys = x: x.ssh.id.publicKey or null;
+in with hosts;
+{
+  "builder_key.age".publicKeys = max ++ map systemKeys [ TITAN jericho ];
+  "cachix-upload-key.age".publicKeys = max ++ map systemKeys [ TITAN ];
+  "hyprspace-key-TITAN.age".publicKeys = max ++ map systemKeys [ TITAN ];
+  "hyprspace-key-jericho.age".publicKeys = max ++ map systemKeys [ jericho ];
+  "ipfs-swarm-key.age".publicKeys = max ++ map systemKeys [ TITAN jericho ];
+  "transmission-rpc-password.age".publicKeys = max ++ map systemKeys [ TITAN ];
+  "wireguard-key-upload.age".publicKeys = max ++ map systemKeys [ TITAN ];
+  "shadow-max.age".publicKeys = max ++ map systemKeys [ TITAN jericho ];
+}

secrets/shadow-max.age

@@ -0,0 +1,15 @@
+age-encryption.org/v1
+-> ssh-ed25519 NO562A Y73DqIRov+MWeXzgES1YHSRLn3C66IKeLp/V/pIL32U
+Ms1E6/CHgMX5cLSnO1aRnY6OBAL98XtHL1Hvf0KQdL4
+-> ssh-ed25519 5/zT0w g28b5BF0FdtiALo2HlqxQ0s72XIs9EyJd3gc5MB76Fw
+Iz18IvwM3aDAdiPabbRoJHkk2F6PZDTb5vy8APrnQRY
+-> ssh-ed25519 OxDh5w WcZ+UJ5eWb6jArWAW/TE2Np69jWqF3MtgQ3GwhW/tiA
+SIS6KC6NL4Funn6uLq30ePRGTVOaYD7zg5rZ68fwiCs
+-> ssh-ed25519 RLSb/g FnP/tvE4pAn55vAiSO3mFzZscEJuH1xi6AY9FB/8CyY
+q5aVu+yIIpoW3UOZtowzHSbiWgr0W3XUfLrKd79Wr2o
+-> :-grease FPymBk tj?}O {@Wd 4Z9!L+
+gyOW8CULRJiRXisjGrX4TTt4zeN18eGfZMGUbh4Njhiuu1naN/Nn
+--- l/FkE/1S1CxRRw3FYEqDSoKeBJLvdhfN2lYryELRabk
+P°/÷
+4æ‹•0l',çÙWNèì¯3ýâ7êU¨*’<ôDpWFf% áy$u± 3”¥~’—…T8äbwŽuø·OôâÝÀV€ÿ…õ
+p›'Æy@ñŠµ¶#ƒ}r’*ÚYŽnË„ 0ê<30>:È„É··¹Â±Æw\܈œîiIo=ŒG<C592>Á’Œ<>Ø

secrets/transmission-rpc-password.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 NO562A RvwoHSrUYObiumlpczjWPzRyowLSckQ/WtNrVnJkvjc
+NNw6Jxq4ydAdka1M3bke7ZNN85zagltduO7Q189Gp7Y
+-> ssh-ed25519 5/zT0w VRmTc6SLcyhX2SBLQ96Un8ZqkfomWfFZUkSlmjceqzQ
+NlhhrCXYcV9+F1U56eWStq1Yvx+5nrFylOKawKijqFM
+-> ssh-ed25519 OxDh5w I3BpVIe/tyzCaWaHFGbmvSyBnwbvotKmscreC9VuFwA
+rEG3BjTngh8C+4fk1TMVOybjBBnslzxgUAPwRhmdYlQ
+-> 2l-grease |y;2B\
+cERUX8x8PtS+yfv5Fqye0S/iNNHIayaMtl2eu32sAOQaxFs
+--- 8+ewYWTKGNaCMEOA8/pbAu62IX9gz/zPW/etK1nq6dU
+Mç
ÂÝ…ý<
A¾¸Ú«´>Îå†"jÿ˜¦nJ8F‚ÉôRL‘ö-æ)yûhÏ'«yŽÌ†Î‡Z‹Ov
cBŸRµ0í_‡Ìvʵ"4ÍX>H´’¹?<3F>6Ï”8†÷0¯«