From e4c2548a934bb65339b2fb8a00082609b20d5002 Mon Sep 17 00:00:00 2001 From: Ryan Yin Date: Mon, 2 Nov 2026 00:02:26 +0800 Subject: [PATCH] refactor: replace redundant mkForce with plain values and mkDefault Each of these overrode a value nothing else set at a higher priority: - qemu-guest: btrbk, hardwareTools and cloud-init have no competing definition on the guests. - mdns: nixpkgs' sunshine module sets avahi.publish.* with mkDefault. - computer-use: i18n now sets the time zone with mkDefault. - darwin terminal: the shared ghostty/kitty font sizes are now mkDefault. - shoukei: sunshine is mkDefault false in remote-desktop.nix, zram's memoryPercent is mkDefault 50; supportedFilesystems now merges instead of discarding the fsType entries other modules add. - youko: nothing enables docker. - nixpak: pasta.enable and sockets.pipewire are mkDefault in the shared modules, sockets.pulse already was. Every NixOS host's toplevel drvPath is unchanged; on fern and frieren the terminal font sizes and time zone evaluate to the same values. Assisted-by: Claude Code (claude-opus-5-5) --- hardening/nixpaks/firefox.nix | 2 +- hardening/nixpaks/modules/chromium-browser.nix | 2 +- hardening/nixpaks/modules/desktop-base.nix | 2 +- hardening/nixpaks/modules/file-viewer-policy.nix | 2 +- hardening/nixpaks/modules/musescore-policy.nix | 5 ++--- hardening/nixpaks/modules/network.nix | 3 ++- hardening/nixpaks/modules/slicer-policy.nix | 2 +- home/base/gui/terminal/ghostty.nix | 3 ++- home/base/gui/terminal/kitty.nix | 3 ++- home/darwin/terminal.nix | 6 +++--- hosts/12kingdoms-shoukei/apple-silicon.nix | 3 +-- hosts/12kingdoms-shoukei/default.nix | 2 +- hosts/12kingdoms-shoukei/hardware-configuration.nix | 3 +-- .../homelab-services/oci-containers/default.nix | 2 -- modules/nixos/base/i18n.nix | 5 +++-- modules/nixos/base/networking/mdns.nix | 9 +++++---- modules/nixos/desktop/computer-use.nix | 2 +- modules/nixos/server/qemu-guest.nix | 6 +++--- 18 files changed, 31 insertions(+), 31 deletions(-) diff --git a/hardening/nixpaks/firefox.nix b/hardening/nixpaks/firefox.nix index 8c8261f9..b541f7fd 100644 --- a/hardening/nixpaks/firefox.nix +++ b/hardening/nixpaks/firefox.nix @@ -42,7 +42,7 @@ let # Firefox keeps the host network: local development servers and the # mihomo controller live on 127.0.0.1, and pasta's isolated loopback # would hide them. Chromium uses the same personal-browser policy. - pasta.enable = lib.mkForce false; + pasta.enable = false; bubblewrap = { # To trace all the home files Firefox accesses, you can use the following nushell command: diff --git a/hardening/nixpaks/modules/chromium-browser.nix b/hardening/nixpaks/modules/chromium-browser.nix index b5a7fe42..9b8a893c 100644 --- a/hardening/nixpaks/modules/chromium-browser.nix +++ b/hardening/nixpaks/modules/chromium-browser.nix @@ -56,7 +56,7 @@ let }; flatpak = { inherit appId; }; # Firefox/Chromium need host loopback for local services; Chrome and the rest use pasta. - pasta.enable = lib.mkForce (!hostLoopback); + pasta.enable = !hostLoopback; pasta.mode = "isolate"; browserPermissions = { inherit diff --git a/hardening/nixpaks/modules/desktop-base.nix b/hardening/nixpaks/modules/desktop-base.nix index d9ae4610..b9618bc6 100644 --- a/hardening/nixpaks/modules/desktop-base.nix +++ b/hardening/nixpaks/modules/desktop-base.nix @@ -45,7 +45,7 @@ wayland = true; x11 = lib.mkDefault false; pulse = lib.mkDefault true; - pipewire = false; + pipewire = lib.mkDefault false; }; bind.rw = with sloth; [ [ diff --git a/hardening/nixpaks/modules/file-viewer-policy.nix b/hardening/nixpaks/modules/file-viewer-policy.nix index 904e9e73..3f76768c 100644 --- a/hardening/nixpaks/modules/file-viewer-policy.nix +++ b/hardening/nixpaks/modules/file-viewer-policy.nix @@ -32,7 +32,7 @@ in accessibility = true; }; bubblewrap = { - sockets.pulse = lib.mkForce false; + sockets.pulse = false; bind.ro = lib.mkIf (!cfg.writableUserDirs) userDirs; bind.rw = lib.mkIf cfg.writableUserDirs userDirs; }; diff --git a/hardening/nixpaks/modules/musescore-policy.nix b/hardening/nixpaks/modules/musescore-policy.nix index 04d28315..ee220617 100644 --- a/hardening/nixpaks/modules/musescore-policy.nix +++ b/hardening/nixpaks/modules/musescore-policy.nix @@ -2,7 +2,6 @@ # ALSA via the host PipeWire plugin, MIDI uses the ALSA sequencer, and the UI # runs through XWayland. { - lib, sloth, ... }: @@ -30,8 +29,8 @@ x11 = true; # MuseScore speaks ALSA; the host ALSA configuration forwards its # default PCM to PipeWire, so expose the PipeWire socket for audio. - pulse = lib.mkForce false; - pipewire = lib.mkForce true; + pulse = false; + pipewire = true; }; bind.rw = [ (sloth.mkdir (sloth.concat' sloth.homeDir "/.config/MuseScore")) diff --git a/hardening/nixpaks/modules/network.nix b/hardening/nixpaks/modules/network.nix index 7a1d9e8f..5b2be788 100644 --- a/hardening/nixpaks/modules/network.nix +++ b/hardening/nixpaks/modules/network.nix @@ -1,9 +1,10 @@ # https://github.com/nixpak/pkgs/blob/master/pkgs/modules/network.nix +{ lib, ... }: { etc.sslCertificates.enable = true; bubblewrap.network = true; # pasta's default isolate mode gives the app its own loopback, so host # services on 127.0.0.1 are out of reach. Proxying still works because # mihomo runs in TUN mode, which sees pasta's outbound traffic. - pasta.enable = true; + pasta.enable = lib.mkDefault true; } diff --git a/hardening/nixpaks/modules/slicer-policy.nix b/hardening/nixpaks/modules/slicer-policy.nix index 385544a5..c756856a 100644 --- a/hardening/nixpaks/modules/slicer-policy.nix +++ b/hardening/nixpaks/modules/slicer-policy.nix @@ -20,7 +20,7 @@ in bubblewrap = { sockets = { x11 = true; - pulse = lib.mkForce cfg.enablePulse; + pulse = cfg.enablePulse; }; env = { DISPLAY = sloth.envOr "DISPLAY" ""; diff --git a/home/base/gui/terminal/ghostty.nix b/home/base/gui/terminal/ghostty.nix index 29b68985..7dc0deba 100644 --- a/home/base/gui/terminal/ghostty.nix +++ b/home/base/gui/terminal/ghostty.nix @@ -1,4 +1,5 @@ { + lib, pkgs, ... }: @@ -23,7 +24,7 @@ installBatSyntax = false; settings = { font-family = "Maple Mono NF CN"; - font-size = 13; + font-size = lib.mkDefault 13; # macOS overrides this in home/darwin/terminal.nix # hide title bar/header bar (Linux only; on macOS it would remove the traffic lights too) window-decoration = pkgs.stdenv.hostPlatform.isDarwin; diff --git a/home/base/gui/terminal/kitty.nix b/home/base/gui/terminal/kitty.nix index f5f624dc..5e468ade 100644 --- a/home/base/gui/terminal/kitty.nix +++ b/home/base/gui/terminal/kitty.nix @@ -1,4 +1,5 @@ { + lib, pkgs, ... }: @@ -16,7 +17,7 @@ enable = true; font = { name = "Maple Mono NF CN"; - size = 13; # macOS overrides this in home/darwin/terminal.nix + size = lib.mkDefault 13; # macOS overrides this in home/darwin/terminal.nix }; settings = { diff --git a/home/darwin/terminal.nix b/home/darwin/terminal.nix index 6ccd5b8b..96361448 100644 --- a/home/darwin/terminal.nix +++ b/home/darwin/terminal.nix @@ -1,8 +1,8 @@ -{ lib, ... }: +_: let fontSize = 15; in { - programs.ghostty.settings.font-size = lib.mkForce fontSize; - programs.kitty.font.size = lib.mkForce fontSize; + programs.ghostty.settings.font-size = fontSize; + programs.kitty.font.size = fontSize; } diff --git a/hosts/12kingdoms-shoukei/apple-silicon.nix b/hosts/12kingdoms-shoukei/apple-silicon.nix index e0716d80..0629082c 100644 --- a/hosts/12kingdoms-shoukei/apple-silicon.nix +++ b/hosts/12kingdoms-shoukei/apple-silicon.nix @@ -1,5 +1,4 @@ { - lib, mylib, pkgs, nixos-apple-silicon, @@ -16,7 +15,7 @@ # screen would bypass it entirely). Keep tuigreet from modules/nixos/desktop.nix. # 16G machine: more compressed swap than the 50% default - zramSwap.memoryPercent = lib.mkForce 75; + zramSwap.memoryPercent = 75; nix.settings = { extra-substituters = [ diff --git a/hosts/12kingdoms-shoukei/default.nix b/hosts/12kingdoms-shoukei/default.nix index 98db0c1e..20cafae1 100644 --- a/hosts/12kingdoms-shoukei/default.nix +++ b/hosts/12kingdoms-shoukei/default.nix @@ -24,7 +24,7 @@ in modules.remote-builders.enable = true; # disable sunshine for security - services.sunshine.enable = lib.mkForce false; + services.sunshine.enable = false; # Laptop joins untrusted networks and is never scraped (see youko's # `offlineHosts`); don't expose :9100, and don't keep the smartctl exporter diff --git a/hosts/12kingdoms-shoukei/hardware-configuration.nix b/hosts/12kingdoms-shoukei/hardware-configuration.nix index dbb1de44..e83ff95b 100644 --- a/hosts/12kingdoms-shoukei/hardware-configuration.nix +++ b/hosts/12kingdoms-shoukei/hardware-configuration.nix @@ -48,8 +48,7 @@ in ]; # supported file systems, so we can mount any removable disks with these filesystems. - # mkForce replaces the whole list, so entries added by any other module are lost here. - boot.supportedFilesystems = lib.mkForce [ + boot.supportedFilesystems = [ "ext4" "btrfs" "xfs" diff --git a/hosts/12kingdoms-youko/homelab-services/oci-containers/default.nix b/hosts/12kingdoms-youko/homelab-services/oci-containers/default.nix index a97006a8..2561df3b 100644 --- a/hosts/12kingdoms-youko/homelab-services/oci-containers/default.nix +++ b/hosts/12kingdoms-youko/homelab-services/oci-containers/default.nix @@ -1,5 +1,4 @@ { - lib, mylib, ... }: @@ -7,7 +6,6 @@ imports = mylib.scanPaths ./.; virtualisation = { - docker.enable = lib.mkForce false; podman = { enable = true; # Create a `docker` alias for podman, to use it as a drop-in replacement diff --git a/modules/nixos/base/i18n.nix b/modules/nixos/base/i18n.nix index a420a6d6..287108a1 100644 --- a/modules/nixos/base/i18n.nix +++ b/modules/nixos/base/i18n.nix @@ -1,6 +1,7 @@ +{ lib, ... }: { - # Set your time zone. - time.timeZone = "Asia/Shanghai"; + # Set your time zone. A default: the computer-use VMs match their proxy region. + time.timeZone = lib.mkDefault "Asia/Shanghai"; # English is the default. Chinese overrides only the categories where the # en_US default is factually wrong for China (metric, A4, CNY); everything diff --git a/modules/nixos/base/networking/mdns.nix b/modules/nixos/base/networking/mdns.nix index 2e496520..21e0c3c3 100644 --- a/modules/nixos/base/networking/mdns.nix +++ b/modules/nixos/base/networking/mdns.nix @@ -33,10 +33,11 @@ in publish-addresses = true; publish-domain = true; }; - # The nixpkgs sunshine module still sets these legacy options. Force them - # to null so settings.publish above is the only source of truth. - publish.enable = lib.mkForce null; - publish.userServices = lib.mkForce null; + # The nixpkgs sunshine module still sets these legacy options (with + # mkDefault). Reset them to null so settings.publish above is the only + # source of truth. + publish.enable = null; + publish.userServices = null; }; # avahi and systemd-resolved both run an mDNS responder, which makes mDNS diff --git a/modules/nixos/desktop/computer-use.nix b/modules/nixos/desktop/computer-use.nix index e7e2e6a7..d321eeb7 100644 --- a/modules/nixos/desktop/computer-use.nix +++ b/modules/nixos/desktop/computer-use.nix @@ -40,7 +40,7 @@ in hardware.graphics.enable = true; # Match the proxy's exit region. - time.timeZone = lib.mkForce timeZone; + time.timeZone = timeZone; # Browsers keep their profile/preferences in dconf. programs.dconf.enable = true; diff --git a/modules/nixos/server/qemu-guest.nix b/modules/nixos/server/qemu-guest.nix index 79ce6e61..d4436e2f 100644 --- a/modules/nixos/server/qemu-guest.nix +++ b/modules/nixos/server/qemu-guest.nix @@ -18,10 +18,10 @@ config = { # disable backups in the VM - modules.btrbk.enable = lib.mkForce false; + modules.btrbk.enable = false; # VM guest: no physical hardware to inspect. - modules.hardwareTools.enable = lib.mkForce false; + modules.hardwareTools.enable = false; boot.growPartition = true; boot.kernelParams = [ "console=ttyS0" ]; @@ -30,7 +30,7 @@ services.qemuGuest.enable = true; # qemu-guest-agent services.openssh.enable = true; # we configure the host via nixos itself, so we don't need the cloud-init - services.cloud-init.enable = lib.mkForce false; + services.cloud-init.enable = false; # Default so the NixOS test framework can override it: test-instrumentation # disables this getty to keep ttyS0 free for its backdoor console. systemd.services."serial-getty@ttyS0".enable = lib.mkDefault true;