feat: update nixpkgs-patched & nixpaks-common

Justfile

@@ -100,7 +100,7 @@ repair-store *paths:
 # Update all Nixpkgs inputs
 [group('nix')]
 up-nix:
-  nix flake update nixpkgs nixpkgs-stable nixpkgs-unstable nixpkgs-darwin nixpkgs-ollama
+  nix flake update nixpkgs nixpkgs-stable nixpkgs-unstable nixpkgs-darwin nixpkgs-patched
 
 ############################################################################
 #

flake.nix

@@ -39,8 +39,6 @@
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
     nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.05";
 
-    nixpkgs-ollama.url = "github:nixos/nixpkgs/nixos-unstable";
-
     nixpkgs-patched.url = "github:ryan4yin/nixpkgs/nixos-unstable-patched";
 
     # for macos

hardening/nixpaks/modules/common.nix

@@ -1,32 +1,31 @@
 # https://github.com/mnixry/nixos-config/blob/74913c2b90d06e31170bbbaa0074f915721da224/desktop/packages/nixpaks-common.nix
+# https://github.com/Kraftland/portable/blob/09c4a4227538a3f42de208a6ecbdc938ac9c00dd/portable.sh
 {
   lib,
-  pkgs,
   sloth,
   config,
   ...
 }:
+let
+  inherit (config.flatpak) appId;
+in
 {
   config = {
-    dbus =
+    dbus = {
-      let
+      # `--see`: The bus name can be enumerated by the application.
-        inherit (config.flatpak) appId;
+      # `--talk`: The application can send messages to, and receive replies and signals from, the bus name.
-      in
+      # `--own`: The application can own the bus name
-      {
-        # same usage as --see, --talk, --own
       policies = {
         "${appId}" = "own";
         "${appId}.*" = "own";
         "org.freedesktop.DBus" = "talk";
         "ca.desrt.dconf" = "talk";
-          "org.gtk.vfs" = "talk";
-          "org.gtk.vfs.*" = "talk";
         "org.freedesktop.appearance" = "talk";
         "org.freedesktop.appearance.*" = "talk";
       }
       // (builtins.listToAttrs (
         map (id: lib.nameValuePair "org.kde.StatusNotifierItem-${toString id}-1" "own") (
-            lib.lists.range 2 11
+          lib.lists.range 2 29
         )
       ))
       // {
@@ -36,16 +35,14 @@
         "org.mpris.MediaPlayer2.${appId}.*" = "own";
         "org.mpris.MediaPlayer2.${lib.lists.last (lib.strings.splitString "." appId)}" = "own";
         "org.mpris.MediaPlayer2.${lib.lists.last (lib.strings.splitString "." appId)}.*" = "own";
-          # Conditionally allows a custom, friendlier MPRIS name if 'mprisName' is set.
-          #       "org.mpris.MediaPlayer2.${mprisName}" = "own";
-          #       "org.mpris.MediaPlayer2.${mprisName}.*" = "own";
 
         # --- General Desktop Integration ---
         "com.canonical.AppMenu.Registrar" = "talk"; # For Ubuntu AppMenu
         "org.freedesktop.FileManager1" = "talk";
         "org.freedesktop.Notifications" = "talk";
+        "org.kde.StatusNotifierWatcher" = "talk";
 
-          # --- Accessibility (a11y) ---
+        # --- Accessibility (a11y) 无障碍服务 ---
         "org.a11y.Bus" = "see";
 
         # --- Portal Access ---
@@ -66,10 +63,9 @@
         "org.freedesktop.portal.IBus" = "talk";
         "org.freedesktop.portal.IBus.*" = "talk";
       };
-        rules = {
+      # '--call' rules permit specific method calls on D-Bus interfaces.
-          # 'call' rules permit specific method calls on D-Bus interfaces.
+      rules.call = {
-          call = {
+        # --- Accessibility (a11y) 无障碍服务 ---
-            # --- Accessibility ---
         "org.a11y.Bus" = [
           "org.a11y.Bus.GetAddress@/org/a11y/bus"
           "org.freedesktop.DBus.Properties.Get@/org/a11y/bus"
@@ -95,13 +91,37 @@
         # --- Main Desktop Portal Interface ---
         # A comprehensive list of permissions for interacting with the desktop environment.
         "org.freedesktop.portal.Desktop" = [
-              # Device Access
+          # Properties & Settings
+          "org.freedesktop.DBus.Properties.GetAll"
+          "org.freedesktop.DBus.Properties.Get@/org/freedesktop/portal/desktop"
+          "org.freedesktop.portal.Session.Close"
+          "org.freedesktop.portal.Settings.ReadAll"
+          "org.freedesktop.portal.Settings.Read"
+          "org.freedesktop.portal.Account.GetUserInformation"
+
+          # Network & Proxy
+          "org.freedesktop.portal.NetworkMonitor"
+          "org.freedesktop.portal.NetworkMonitor.*"
+          "org.freedesktop.portal.ProxyResolver.Lookup"
+          "org.freedesktop.portal.ProxyResolver.Lookup.*"
+
+          # Screenshot / Screen Capture & Sharing
+          "org.freedesktop.portal.ScreenCast"
+          "org.freedesktop.portal.ScreenCast.*"
+          "org.freedesktop.portal.Screenshot"
+          "org.freedesktop.portal.Screenshot.Screenshot"
+
+          # Device Access(Camera / USB)
           "org.freedesktop.portal.Camera"
           "org.freedesktop.portal.Camera.*"
           "org.freedesktop.portal.Usb"
           "org.freedesktop.portal.Usb.*"
 
-              # File Chooser & Documents
+          # Remote Desktop
+          "org.freedesktop.portal.RemoteDesktop"
+          "org.freedesktop.portal.RemoteDesktop.*"
+
+          # File Operations
           "org.freedesktop.portal.Documents"
           "org.freedesktop.portal.Documents.*"
           "org.freedesktop.portal.FileChooser"
@@ -109,12 +129,6 @@
           "org.freedesktop.portal.FileTransfer"
           "org.freedesktop.portal.FileTransfer.*"
 
-              # Input Methods
-              "org.freedesktop.portal.Fcitx"
-              "org.freedesktop.portal.Fcitx.*"
-              "org.freedesktop.portal.IBus"
-              "org.freedesktop.portal.IBus.*"
-
           # Notifications & Printing
           "org.freedesktop.portal.Notification"
           "org.freedesktop.portal.Notification.*"
@@ -122,63 +136,41 @@
           "org.freedesktop.portal.Print.*"
 
           # Open/Launch Handlers
-              "org.freedesktop.portal.Email.ComposeEmail"
           "org.freedesktop.portal.OpenURI"
           "org.freedesktop.portal.OpenURI.*"
+          "org.freedesktop.portal.Email.ComposeEmail"
 
-              # Properties & Session Management
+          # Input Methods
-              "org.freedesktop.DBus.Properties.GetAll"
+          "org.freedesktop.portal.Fcitx"
-              "org.freedesktop.DBus.Properties.Get@/org/freedesktop/portal/desktop"
+          "org.freedesktop.portal.Fcitx.*"
-              "org.freedesktop.portal.Session.Close"
+          "org.freedesktop.portal.IBus"
-
+          "org.freedesktop.portal.IBus.*"
-              # Screen Capture & Sharing
-              "org.freedesktop.portal.RemoteDesktop"
-              "org.freedesktop.portal.RemoteDesktop.*"
-              "org.freedesktop.portal.ScreenCast"
-              "org.freedesktop.portal.ScreenCast.*"
-              "org.freedesktop.portal.Screenshot"
-              "org.freedesktop.portal.Screenshot.Screenshot"
 
           # Secrets (Keyring)
           "org.freedesktop.portal.Secret"
           "org.freedesktop.portal.Secret.RetrieveSecret"
 
-              # Settings
+          # Get/Update GlobalShortcuts
-              "org.freedesktop.portal.Settings.Read"
+          # "org.freedesktop.portal.GlobalShortcuts"
-              "org.freedesktop.portal.Settings.ReadAll"
+          # "org.freedesktop.portal.GlobalShortcuts.*"
 
-              # System Information
+          # -- get the user's location
-              "org.freedesktop.portal.Account.GetUserInformation"
+          # "org.freedesktop.portal.Location"
-              "org.freedesktop.portal.NetworkMonitor"
+          # "org.freedesktop.portal.Location.*"
-              "org.freedesktop.portal.NetworkMonitor.*"
-              "org.freedesktop.portal.ProxyResolver.Lookup"
-              "org.freedesktop.portal.ProxyResolver.Lookup.*"
 
-              # Generic Request Fallback
+          # -- inhibit the user session from ending, suspending, idling or getting switched away.
-              "org.freedesktop.portal.Request"
-
-              # --- Conditional Portal Rules ---
-              # These would be enabled based on config flags in a real implementation.
-
-              # Enabled if 'allowGlobalShortcuts = true'
-              "org.freedesktop.portal.GlobalShortcuts"
-              "org.freedesktop.portal.GlobalShortcuts.*"
-
-              # Enabled if 'allowInhibit = true'
           "org.freedesktop.portal.Inhibit"
           "org.freedesktop.portal.Inhibit.*"
 
-              # Enabled if 'XDG_CURRENT_DESKTOP = "GNOME"'
+          # Generic Request Fallback
-              "org.freedesktop.portal.Location"
+          "org.freedesktop.portal.Request"
-              "org.freedesktop.portal.Location.*"
         ];
       };
 
       # 'broadcast' rules permit receiving signals from D-Bus names.
-          broadcast = {
+      rules.broadcast = {
         "org.freedesktop.portal.*" = [ "@/org/freedesktop/portal/*" ];
       };
-        };
       args = [
         "--filter"
         "--sloppy-names"

hosts/idols-ai/ai/ollama.nix

@@ -1,19 +1,14 @@
 {
-  pkgs,
+  pkgs-patched,
-  nixpkgs-ollama,
   ...
 }:
 let
-  pkgs-ollama = import nixpkgs-ollama {
+
-    inherit (pkgs) system;
-    # To use cuda, we need to allow the installation of non-free software
-    config.allowUnfree = true;
-  };
 in
 {
   services.ollama = rec {
     enable = true;
-    package = pkgs-ollama.ollama;
+    package = pkgs-patched.ollama;
     acceleration = "cuda";
     host = "0.0.0.0";
     port = 11434;