diff --git a/WORKAROUNDS.md b/WORKAROUNDS.md index 2814d04c..20022d5c 100644 --- a/WORKAROUNDS.md +++ b/WORKAROUNDS.md @@ -19,8 +19,6 @@ A version or revision pinned for a reason that can go away. | ID | What & where | Why | Removal condition | Added | Revisit | Status | | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ---------- | -------------------------- | ------ | | WA-001 | smartctl_exporter pinned to upstream `6274decc`, which carries PR [#329](https://github.com/prometheus-community/smartctl_exporter/pull/329) — `overlays/smartctl-exporter/` | `/metrics` returns HTTP 500 once a device becomes readable after startup ([#305](https://github.com/prometheus-community/smartctl_exporter/issues/305), [#326](https://github.com/prometheus-community/smartctl_exporter/issues/326)) | Drop once nixpkgs provides a version containing the #329 fix | 2026-10-03 | next nixpkgs bump | active | -| WA-002 | `nixpkgs-2505` — `flake.nix`; consumer `home/base/tui/container.nix` | `kubernetes-helm` regressed in newer nixpkgs | Drop the input and its consumer once helm works again in current nixpkgs | 2025-12-03 | when helm is revisited | active | -| WA-003 | `rust-overlay` follow — `flake.nix` | lanzaboote v1.1.0's pinned rust-overlay uses the deprecated `stdenv.isLinux`/`stdenv.isDarwin` | Drop the follow once lanzaboote updates its pin (or we drop the lanzaboote pin) | 2026-09-25 | on lanzaboote bump | active | | WA-004 | `catppuccin` on `main` — `flake.nix` | `main` carries the nodejs→nodejs-slim deprecation fix, which is not in a release | Switch to a release tag once it includes the fix | 2026-09-25 | on catppuccin release | active | | WA-005 | `tuios` input — `flake.nix`; `home/base/tui/tuios/` | nixpkgs lags behind upstream | Use nixpkgs' `tuios` once it is recent enough | 2026-10-03 | on nixpkgs bump | active | | WA-006 | `nixpkgs-blender` — `flake.nix` | Blender 5.2 LTS + CUDA/OptiX pin; keeps `just up` from triggering a full source rebuild | Bump deliberately when needed; drop the pin if the current nixpkgs build is acceptable | 2026-07-24 | deliberate | active | @@ -34,27 +32,27 @@ A version or revision pinned for a reason that can go away. A setting that works around a bug or a hardware quirk. -| ID | What & where | Why | Removal condition | Added | Revisit | Status | -| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | --------------------------------------------------------------------------------------------------- | ------ | -| WA-008 | Relaxed NVMe APST (`nvme_core.default_ps_max_latency_us=100000`) — `hosts/idols-ai/hardware-configuration.nix`, `hosts/idols-aquamarine/hardware-configuration.nix` | the KINGBANK KP260 (DRAM-less QLC) froze on slow APST wake-ups | Drop the override once kernel/firmware fixes or replacement hardware make default APST reliable | 2026-10-03 | watch NVMe timeout/reset/AER in the journal | active | -| WA-009 | USB-SATA bridge mitigations (`usbcore.autosuspend=-1`, `usb-storage.delay_use=10`) — `hosts/12kingdoms-youko/default.nix` | flaky JMicron JMS567 resets with UDMA-CRC and I/O errors | Drop once the bridge/controller is replaced; the signal is smartctl CRC/media errors | 2026-09-21 | on hardware change or CRC errors | active | -| WA-010 | Insta360 Link USB reset on S3 resume — `hosts/idols-ai/default.nix` | the camera stays enumerated with a stalled UVC endpoint after resume | Drop after the Insta360 firmware or the kernel `uvcvideo` fixes it | 2026-08-01 | on kernel or firmware change | active | -| WA-011 | Kernel module blacklist (`esp4`, `esp6`, `rxrpc`) — `hardening/kernel-hardening.nix` | attack surface for the Dirty Frag LPE (CVE-2026-43284 / CVE-2026-43500) | Kept as defence in depth; drop only if something needs those modules | 2026-10-03 | rarely | active | -| WA-017 | keyd right-hand modifier passthrough — `modules/nixos/desktop/peripherals.nix` | keyd folds right Ctrl/Shift/Meta into their left keys | Drop once keyd or fcitx5 keeps right-hand modifiers distinct | 2026-10-05 | on keyd bump | active | -| WA-018 | user-owned `~/.ssh/config` + disabled systemd ssh-proxy include — `home/base/tui/ssh.nix`, `modules/nixos/base/ssh.nix` | bwrap exposes root-owned store files as `nobody` | Drop once sandboxes preserve store ownership | 2026-10-06 | when sandbox layout changes | active | -| WA-019 | programs.steam.extraCompatPackages = [ pkgs.dwproton-bin pkgs.proton-ge-bin ] — modules/nixos/desktop/gaming.nix | ACE games fail on GE/mainline Proton, work with DW-Proton | Drop once mainline or GE-Proton runs these games (GE-Proton#433) | 2026-10-07 | on Proton/GE bump | active | -| WA-024 | Wi-Fi power saving disabled (`networking.networkmanager.wifi.powersave = false`) — `hosts/12kingdoms-shoukei/apple-silicon.nix` | On this BCM4378/brcmfmac laptop, powersave is a common source of intermittent ASSOC-REJECT / authentication-timeout failures; NetworkManager then mistakes the failure for a bad key, re-prompts, and the client (Noctalia, nmtui, nmcli) saves the answer as a duplicate ` 1` profile | Drop once the kernel carries the brcmfmac `port_authorized` fix (WA-025) and no association failures remain | 2026-10-07 | watch `journalctl -u wpa_supplicant` for ASSOC-REJECT / authentication timeout | active | -| WA-026 | guest deploys run `installOnHost` then `systemctl restart microvm@` on the physical host — `Justfile`, `lib/genMicrovmGuestModule.nix` | the sshSwitch step runs `nix-store --load-db` against the guest's read-only virtiofs `/nix/store` and dies on `cannot remount "/nix/store" writable` (nix 2.35) | Drop the manual path once microvm.nix or nix handles a read-only store switch. A host activation re-links `/var/lib/microvms//current` to the runner baked into the host's system, so switch the host after installing a guest from a newer tree | 2026-10-09 | on microvm.nix or nix bump | active | -| WA-028 | GitHub SSH pinned to IPv4 (`AddressFamily = "inet"`) — `home/base/tui/ssh.nix` | a v6 fake AAAA for `ssh.github.com` from the `2001:2::/64` pool (WA-029) is not proven on the 443 SSH tunnel yet | Drop once the v6 fake-ip pool is proven for GitHub SSH | 2026-10-10 | on a mihomo bump or a v6 pool change | active | -| WA-029 | mihomo `fake-ip-range6` is `2001:2::/64`, not the shipped ULA default — `modules/nixos/desktop/networking/mihomo/generate.nu` | the default `fdfe:dcba:9876::/64` sits in `fc00::/7`, which Local Network Access calls local, so a public page loaded over the v4 fake pool and pulling a dual-stack subresource prompts for local-network access (Chrome 154, Firefox). The same range also stalled ssh: a session to a fake AAAA authenticated and then never closed, on both `gvisor` and `mips`. `2001:2::/48` is RFC 5180 benchmarking -- the v6 twin of the `198.18.0.0/15` v4 default, absent from that table -- and both symptoms went with the move | Go back to the upstream default once mihomo ships a pool outside the LNA non-public table; the ULA default brings the ssh stall back | 2026-10-09 | on a browser or mihomo bump -- that table already grew to cover `2001:db8::/32` and `198.18.0.0/15` | active | -| WA-030 | mihomo unit sets `SKIP_SYSTEM_IPV6_CHECK=1` — `modules/nixos/desktop/networking/mihomo/default.nix` | mihomo checks at startup whether another NIC already holds an IPv6 address and, finding none, skips the TUN's v6 half -- but `strict-route` still installs its v6 blackhole (`ip -6 rule add priority 9000 unreachable`). On a cold boot that rule lands before networkd's Router Solicitation is answered, so the host can never send RS/NS, never gets a GUA, and mihomo never re-checks: self-locking until the core restarts. The env var forces the TUN v6 address up, which installs mihomo's normal v6 rules whose `lookup main suppress_prefixlength 0` keeps on-link neighbor discovery and the RA default route off the TUN | Drop once mihomo either re-runs the IPv6 check or skips the v6 strict-route blackhole when the v6 TUN is disabled | 2026-10-10 | on a mihomo bump | active | -| WA-031 | `iommu=pt` kernel parameter — `hosts/idols-aquamarine/hardware-amd-gpu.nix` | ROCm's system requirements warn that multi-GPU systems may need IOMMU passthrough to prevent application hangs, and this host has two Radeon AI PRO R9700 cards. Added before the first inference run; not yet observed on gfx1201. | Drop once a ROCm release states that the default IOMMU mode is safe for multi-GPU gfx1201, or when the host runs a single GPU | 2026-10-13 | on a ROCm bump, or on the first hang report | active | -| WA-032 | `amdgpu.runpm=0` kernel parameter — `hosts/idols-aquamarine/hardware-amd-gpu.nix` | this board's DSDT advertises ATPX power control (`\_SB.PC00.GFX0.ATPX`) but never defines the `PEG0.PEGP._OFF`/`_ON` symbols its body calls, so the first idle resume of the headless R9700 leaves it in `runtime_status = error` (`resume of IP block failed -62`) until reboot, and amdgpu discards the ACPI error. Root cause, kernel-source trail and the measured field comparison: `hosts/idols-aquamarine/ROCM.md`. | Drop once a BIOS update defines those ACPI methods (upstream releases 1023/1066 exist for this board; a flash changes PCR7, so re-enroll TPM2), or a kernel release stops trusting ATPX when its power methods are missing | 2026-10-14 | on a BIOS update or kernel bump | active | -| WA-036 | catppuccin eval-time ports kept in the home closure (`home.extraDependencies`) — `home/base/core/theme.nix` | catppuccin/nix reads some ports at eval time (`lib.importTOML "${sources.starship}/.toml"`) and inlines the result, so the built port, catppuccin's build/install hooks and the fetched port source stay unreachable: every gc deletes them, and the deploy after it rebuilds them (build logs: 2026-10-16). `home.extraDependencies` records the port in the generation, which is a gc root. Also read at eval time upstream: `bottom`, `element` (option `element-desktop`), `firefox`, `rio`, `palette` (options `skim`, `tty`), `spotify-player`. | Drop once catppuccin/nix stops reading port files at eval time, or those ports come from a binary cache | 2026-10-16 | on a catppuccin bump | active | -| WA-039 | niri's NVIDIA free-buffer pool bounded (`GLVidHeapReuseRatio` 0) — `hosts/idols-ai/hardware-nvidia.nix` | the driver does not return freed vidmem buffers to its free pool, so niri's VRAM grows to ~1.1 GiB instead of the ~100 MiB its NVIDIA notes expect (measured 1137 MiB after 24 h uptime; [NVIDIA/egl-wayland#126](https://github.com/NVIDIA/egl-wayland/issues/126)) | Drop once a driver stops growing niri's VRAM without the profile, or niri ships its own default | 2026-10-19 | on an nvidia driver bump | active | -| WA-040 | Root CA blacklist on NixOS and Darwin (Nix CA bundle only, not the macOS Keychain) — `modules/base/security.nix` | eMudhra intermediate keys were compromised; [NixOS/nixpkgs#576390](https://github.com/NixOS/nixpkgs/pull/576390) and [#576401](https://github.com/NixOS/nixpkgs/pull/576401) merged before reaching release channels | Drop once every consumed nixpkgs revision (`nixpkgs` and `nixpkgs-darwin`) includes the upstream root blacklist | 2026-10-20 | on nixpkgs bump | active | -| WA-041 | Monitor OSD "no-signal auto power-off" disabled — no code in this repo (the P32A2V OSD setting) | during a DPMS-off idle the panel drops and re-adds HPD every ~13 s, and after wake niri keeps scanning out while the panel stays dark until the monitor is power cycled; the panel's own auto power-off drives that state, so it is now disabled. Pinning the mode to 120 Hz did not change the symptom | Drop once a driver retrains the DP link after a DPMS wake, the monitor firmware stops cycling HPD, or this monitor is replaced | 2026-10-21 | confirm on the next full idle cycle, then on an nvidia or monitor firmware update | active | -| WA-042 | Colmena nodes set `system.nixos.versionSuffix` and `revision` from the flake's lib — `outputs/default.nix` (`rawColmenaHive`) | Colmena evaluates each node with nixpkgs' `eval-config.nix` and plain lib, which reports `26.11pre-git`, so without the override a Colmena deploy differs from the `nixosConfigurations` toplevel; the `colmena-parity` eval test guards the match | Drop once Colmena evaluates nodes with the flake's lib or accepts `nixosConfigurations` directly, keeping `colmena-parity` green | 2026-10-21 | on a colmena bump | active | +| ID | What & where | Why | Removal condition | Added | Revisit | Status | +| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | ------------------ | +| WA-008 | Relaxed NVMe APST (`nvme_core.default_ps_max_latency_us=100000`) — `hosts/idols-ai/hardware-configuration.nix`, `hosts/idols-aquamarine/hardware-configuration.nix` | the KINGBANK KP260 (DRAM-less QLC) froze on slow APST wake-ups | Drop the override once kernel/firmware fixes or replacement hardware make default APST reliable | 2026-10-03 | watch NVMe timeout/reset/AER in the journal | active | +| WA-009 | USB-SATA bridge mitigations (`usbcore.autosuspend=-1`, `usb-storage.delay_use=10`) — `hosts/12kingdoms-youko/default.nix` | flaky JMicron JMS567 resets with UDMA-CRC and I/O errors | Drop once the bridge/controller is replaced; the signal is smartctl CRC/media errors | 2026-09-21 | on hardware change or CRC errors | active | +| WA-010 | Insta360 Link USB reset on S3 resume — `hosts/idols-ai/default.nix` | the camera stays enumerated with a stalled UVC endpoint after resume | Drop after the Insta360 firmware or the kernel `uvcvideo` fixes it | 2026-08-01 | on kernel or firmware change | active | +| WA-011 | Kernel module blacklist (`esp4`, `esp6`, `rxrpc`) — `hardening/kernel-hardening.nix` | attack surface for the Dirty Frag LPE (CVE-2026-43284 / CVE-2026-43500) | Kept as defence in depth; drop only if something needs those modules | 2026-10-03 | rarely | active | +| WA-017 | keyd right-hand modifier passthrough — `modules/nixos/desktop/peripherals.nix` | keyd folds right Ctrl/Shift/Meta into their left keys | Drop once keyd or fcitx5 keeps right-hand modifiers distinct | 2026-10-05 | on keyd bump | active | +| WA-018 | user-owned `~/.ssh/config` + disabled systemd ssh-proxy include — `home/base/tui/ssh.nix`, `modules/nixos/base/ssh.nix` | bwrap exposes root-owned store files as `nobody` | Drop once sandboxes preserve store ownership | 2026-10-06 | when sandbox layout changes | active | +| WA-019 | programs.steam.extraCompatPackages = [ pkgs.dwproton-bin pkgs.proton-ge-bin ] — modules/nixos/desktop/gaming.nix | ACE games fail on GE/mainline Proton, work with DW-Proton | Drop once mainline or GE-Proton runs these games (GE-Proton#433) | 2026-10-07 | on Proton/GE bump | active | +| WA-024 | Wi-Fi power saving disabled (`networking.networkmanager.wifi.powersave = false`) — `hosts/12kingdoms-shoukei/apple-silicon.nix` | On this BCM4378/brcmfmac laptop, powersave is a common source of intermittent ASSOC-REJECT / authentication-timeout failures; NetworkManager then mistakes the failure for a bad key, re-prompts, and the client (Noctalia, nmtui, nmcli) saves the answer as a duplicate ` 1` profile | Drop once the kernel carries the brcmfmac `port_authorized` fix (WA-025) and no association failures remain | 2026-10-07 | watch `journalctl -u wpa_supplicant` for ASSOC-REJECT / authentication timeout | active | +| WA-026 | guest deploys run `installOnHost` then `systemctl restart microvm@` on the physical host — `Justfile`, `lib/genMicrovmGuestModule.nix` | the sshSwitch step runs `nix-store --load-db` against the guest's read-only virtiofs `/nix/store` and dies on `cannot remount "/nix/store" writable` (nix 2.35) | Drop the manual path once microvm.nix or nix handles a read-only store switch. A host activation re-links `/var/lib/microvms//current` to the runner baked into the host's system, so switch the host after installing a guest from a newer tree | 2026-10-09 | on microvm.nix or nix bump | active | +| WA-028 | GitHub SSH pinned to IPv4 (`AddressFamily = "inet"`) — `home/base/tui/ssh.nix` | a v6 fake AAAA for `ssh.github.com` from the `2001:2::/64` pool (WA-029) is not proven on the 443 SSH tunnel yet | Drop once the v6 fake-ip pool is proven for GitHub SSH | 2026-10-10 | on a mihomo bump or a v6 pool change | active | +| WA-029 | mihomo `fake-ip-range6` is `2001:2::/64`, not the shipped ULA default — `modules/nixos/desktop/networking/mihomo/generate.nu` | the default `fdfe:dcba:9876::/64` sits in `fc00::/7`, which Local Network Access calls local, so a public page loaded over the v4 fake pool and pulling a dual-stack subresource prompts for local-network access (Chrome 154, Firefox). The same range also stalled ssh: a session to a fake AAAA authenticated and then never closed, on both `gvisor` and `mips`. `2001:2::/48` is RFC 5180 benchmarking -- the v6 twin of the `198.18.0.0/15` v4 default, absent from that table -- and both symptoms went with the move | Go back to the upstream default once mihomo ships a pool outside the LNA non-public table; the ULA default brings the ssh stall back | 2026-10-09 | on a browser or mihomo bump -- that table already grew to cover `2001:db8::/32` and `198.18.0.0/15` | active | +| WA-030 | mihomo unit sets `SKIP_SYSTEM_IPV6_CHECK=1` — `modules/nixos/desktop/networking/mihomo/default.nix` | mihomo checks at startup whether another NIC already holds an IPv6 address and, finding none, skips the TUN's v6 half -- but `strict-route` still installs its v6 blackhole (`ip -6 rule add priority 9000 unreachable`). On a cold boot that rule lands before networkd's Router Solicitation is answered, so the host can never send RS/NS, never gets a GUA, and mihomo never re-checks: self-locking until the core restarts. The env var forces the TUN v6 address up, which installs mihomo's normal v6 rules whose `lookup main suppress_prefixlength 0` keeps on-link neighbor discovery and the RA default route off the TUN | Drop once mihomo either re-runs the IPv6 check or skips the v6 strict-route blackhole when the v6 TUN is disabled | 2026-10-10 | on a mihomo bump | active | +| WA-031 | `iommu=pt` kernel parameter — `hosts/idols-aquamarine/hardware-amd-gpu.nix` | ROCm's system requirements warn that multi-GPU systems may need IOMMU passthrough to prevent application hangs, and this host has two Radeon AI PRO R9700 cards. Added before the first inference run; not yet observed on gfx1201. | Drop once a ROCm release states that the default IOMMU mode is safe for multi-GPU gfx1201, or when the host runs a single GPU | 2026-10-13 | on a ROCm bump, or on the first hang report | active | +| WA-032 | `amdgpu.runpm=0` kernel parameter — `hosts/idols-aquamarine/hardware-amd-gpu.nix` | this board's DSDT advertises ATPX power control (`\_SB.PC00.GFX0.ATPX`) but never defines the `PEG0.PEGP._OFF`/`_ON` symbols its body calls, so the first idle resume of the headless R9700 leaves it in `runtime_status = error` (`resume of IP block failed -62`) until reboot, and amdgpu discards the ACPI error. Root cause, kernel-source trail and the measured field comparison: `hosts/idols-aquamarine/ROCM.md`. | Drop once a BIOS update defines those ACPI methods (upstream releases 1023/1066 exist for this board; a flash changes PCR7, so re-enroll TPM2), or a kernel release stops trusting ATPX when its power methods are missing | 2026-10-14 | on a BIOS update or kernel bump | active | +| WA-036 | catppuccin eval-time ports kept in the home closure (`home.extraDependencies`) — `home/base/core/theme.nix` | catppuccin/nix reads some ports at eval time (`lib.importTOML "${sources.starship}/.toml"`) and inlines the result, so the built port, catppuccin's build/install hooks and the fetched port source stay unreachable: every gc deletes them, and the deploy after it rebuilds them (build logs: 2026-10-16). `home.extraDependencies` records the port in the generation, which is a gc root. Also read at eval time upstream: `bottom`, `element` (option `element-desktop`), `firefox`, `rio`, `palette` (options `skim`, `tty`), `spotify-player`. | Drop once catppuccin/nix stops reading port files at eval time, or those ports come from a binary cache | 2026-10-16 | on a catppuccin bump | active | +| WA-039 | niri's NVIDIA free-buffer pool bounded (`GLVidHeapReuseRatio` 0) — `hosts/idols-ai/hardware-nvidia.nix` | the driver does not return freed vidmem buffers to its free pool, so niri's VRAM grows to ~1.1 GiB instead of the ~100 MiB its NVIDIA notes expect (measured 1137 MiB after 24 h uptime; [NVIDIA/egl-wayland#126](https://github.com/NVIDIA/egl-wayland/issues/126)) | Drop once a driver stops growing niri's VRAM without the profile, or niri ships its own default | 2026-10-19 | on an nvidia driver bump | active | +| WA-040 | `workaround` | Comodo AAA Services root blacklist — `modules/base/security.nix` | CVE-2026-111943. NixOS injects the entry itself, but nix-darwin only passes this list through; keep one explicit entry for both. The compromised eMudhra emSign roots are gone from the NSS bundle and were removed from the list. | Drop once nix-darwin carries the upstream default or both inputs handle the blacklist | 2026-10-20 | on nix-darwin bump | active | +| WA-041 | Monitor OSD "no-signal auto power-off" disabled — no code in this repo (the P32A2V OSD setting) | during a DPMS-off idle the panel drops and re-adds HPD every ~13 s, and after wake niri keeps scanning out while the panel stays dark until the monitor is power cycled; the panel's own auto power-off drives that state, so it is now disabled. Pinning the mode to 120 Hz did not change the symptom | Drop once a driver retrains the DP link after a DPMS wake, the monitor firmware stops cycling HPD, or this monitor is replaced | 2026-10-21 | confirm on the next full idle cycle, then on an nvidia or monitor firmware update | active | +| WA-042 | Colmena nodes set `system.nixos.versionSuffix` and `revision` from the flake's lib — `outputs/default.nix` (`rawColmenaHive`) | Colmena evaluates each node with nixpkgs' `eval-config.nix` and plain lib, which reports `26.11pre-git`, so without the override a Colmena deploy differs from the `nixosConfigurations` toplevel; the `colmena-parity` eval test guards the match | Drop once Colmena evaluates nodes with the flake's lib or accepts `nixosConfigurations` directly, keeping `colmena-parity` green | 2026-10-21 | on a colmena bump | active | If WA-008 freezes recur, the fallback is to restore the parameters commented out in `hosts/idols-ai/hardware-configuration.nix` — diff --git a/docs/nixos-modernization-options.md b/docs/nixos-modernization-options.md index 4b3e802d..e64d1660 100644 --- a/docs/nixos-modernization-options.md +++ b/docs/nixos-modernization-options.md @@ -277,14 +277,13 @@ are hard to attribute; no measured problem to solve yet. **Current:** systemd-boot on akane, shoukei and the VM hosts (shoryu, shushou, youko); GRUB on `/dev/vda` on the libvirt guests kana and ruby; no bootloader on the MicroVM guests; on idols-ai and aquamarine, lanzaboote provides Secure Boot with a `/etc/secureboot` (lzpt) bundle. The lanzaboote -flake input must track a rust-overlay follow (WA-003). +flake input is maintained separately for Secure Boot. **Proposed:** `boot.loader.limine` — in nixpkgs, with `secureBoot`, `validateChecksums`, `panicOnChecksumMismatch`, `biosSupport`, `maxGenerations`, graphical menu. **Pros:** one bootloader for UEFI and BIOS (covers the qemu guests' GRUB case); Secure Boot without -the lanzaboote flake input and its rust-overlay pin (WA-003 disappears); checksum validation of -kernel and initrd; nicer menu. +the lanzaboote flake input; checksum validation of kernel and initrd; nicer menu. **Cons:** different trust model — it signs **limine itself** and validates artifacts by checksum, rather than shipping a firmware-verified UKI, so `SECURITY.md` and the threat model must be updated; @@ -532,7 +531,7 @@ header) should then be trimmed to **adopt** items only. `services/system/{userborn,nix-daemon,zram-generator}.nix`, `services/monitoring/prometheus/exporters.nix`. - NixOS 26.05 release notes; Nix manual, Experimental Features. -- Repo context: `SECURITY.md` (trust zones and control limits), `WORKAROUNDS.md` (WA-001, WA-003, - WA-008, WA-009, WA-023), `modules/nixos/base/networking/mdns.nix`, +- Repo context: `SECURITY.md` (trust zones and control limits), `WORKAROUNDS.md` (WA-001, WA-008, + WA-009, WA-023), `modules/nixos/base/networking/mdns.nix`, `hosts/12kingdoms-youko/homelab-services/caddy.nix`, `hosts/12kingdoms-youko/homelab-services/README.md`. diff --git a/flake.lock b/flake.lock index 291d977d..0324e31d 100644 --- a/flake.lock +++ b/flake.lock @@ -68,11 +68,11 @@ ] }, "locked": { - "lastModified": 1789553013, - "narHash": "sha256-W5dvgFOuVs24X3G5tUb8C2IHU7ICXNvyGPiWWFjfbuo=", + "lastModified": 1793189487, + "narHash": "sha256-8objiXPnGhtvbOJGUhTDJkKKqMAcmzulmRnTkHRCykc=", "owner": "catppuccin", "repo": "nix", - "rev": "89b3eacf59d6b5eefbc2d69c3a4eb5aaf66d63bc", + "rev": "ddfe53d3304399d50a89ef6503b6ca1be9349fab", "type": "github" }, "original": { @@ -111,11 +111,11 @@ }, "crane": { "locked": { - "lastModified": 1781825982, - "narHash": "sha256-SlXKwIRIhrOSAcTjCB3ftPLzJWZStQIPS7J1FlZPnKk=", + "lastModified": 1789760033, + "narHash": "sha256-jtT4yxZpR8seYnlCMMWSSPlFN92zO6ICuZ8pJrmi86k=", "owner": "ipetkov", "repo": "crane", - "rev": "469fd08d0bcf6926321fa973c6777fbc87785dd7", + "rev": "73b980519cefc727a5f6cc8e5c0947a2f9be6edd", "type": "github" }, "original": { @@ -174,11 +174,11 @@ "nur-ryan4yin": "nur-ryan4yin" }, "locked": { - "lastModified": 1792600852, - "narHash": "sha256-K95TJliFJrD3ssB9jMEqEQ3R7qJtK5wd6tK9oy5ZZ9E=", + "lastModified": 1793290908, + "narHash": "sha256-EXQpNeSoiLhk3NsfETZxuWbMwZT/01l/uP5maVziiCI=", "owner": "ryan4yin", "repo": "dsh-nu", - "rev": "405e24541f8ea1c99bde545689e3d22819efe4ac", + "rev": "b3a7c6eb7383aea56fe1ebbfbf06e5592952713a", "type": "github" }, "original": { @@ -330,11 +330,11 @@ "nixpkgs-lib": "nixpkgs-lib" }, "locked": { - "lastModified": 1788450739, - "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=", + "lastModified": 1790898470, + "narHash": "sha256-zTwuwezD0w3hpga6a6P8emidzAZFyWqlNeRBlpWOOl8=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993", + "rev": "024633cd702b10285db5cb19b40ad48d2399ba60", "type": "github" }, "original": { @@ -351,11 +351,11 @@ ] }, "locked": { - "lastModified": 1788450739, - "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=", + "lastModified": 1790898470, + "narHash": "sha256-zTwuwezD0w3hpga6a6P8emidzAZFyWqlNeRBlpWOOl8=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993", + "rev": "024633cd702b10285db5cb19b40ad48d2399ba60", "type": "github" }, "original": { @@ -430,11 +430,11 @@ ] }, "locked": { - "lastModified": 1790091288, - "narHash": "sha256-2dUuLTiQrf2gUFVLlayDq/hgluitplAMv6Y9bYwQQ+c=", + "lastModified": 1791909798, + "narHash": "sha256-VAhpCOmrun/KXimYfR8NM88bciKCui7CqHHhThSzgag=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "0d3997c4d3253505f77c9bcea63904bb575da3c5", + "rev": "1ba1dbfe28738c9a71c266be6efa5b89e75491a9", "type": "github" }, "original": { @@ -468,28 +468,6 @@ "type": "github" } }, - "gitignore": { - "inputs": { - "nixpkgs": [ - "lanzaboote", - "pre-commit", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1709087332, - "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", - "owner": "hercules-ci", - "repo": "gitignore.nix", - "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", - "type": "github" - }, - "original": { - "owner": "hercules-ci", - "repo": "gitignore.nix", - "type": "github" - } - }, "haumea": { "inputs": { "nixpkgs": [ @@ -543,11 +521,11 @@ ] }, "locked": { - "lastModified": 1790949926, - "narHash": "sha256-56J++x9pn63GFJY9zP/z/c3DR4ZWg0aiWUP6TcnZB/U=", + "lastModified": 1793193205, + "narHash": "sha256-X6xa6sGA7RnJQuZGbFMC+K+KToWAlBDCCjJXfTwEPsw=", "owner": "nix-community", "repo": "home-manager", - "rev": "8ae04955022d033a24f9dbce7e1f4a04c01b1f31", + "rev": "095fef2f265c3c0da4fe315efba8f8a04495ab34", "type": "github" }, "original": { @@ -577,11 +555,11 @@ "i-have-adhd": { "flake": false, "locked": { - "lastModified": 1791329026, - "narHash": "sha256-5EYLKtrg0RQN0CHR51Sc2qSkgYklu6lqzuH87Dp3gv4=", + "lastModified": 1791734634, + "narHash": "sha256-GTqrnZxQvzo/ogAuUrffkOaMK1BYm/4rAZsnfmDt7DU=", "owner": "ryan4yin", "repo": "i-have-adhd", - "rev": "723af7d9afaf43eb871dbcce6129e2bf80de90d5", + "rev": "1ecea1993b7fce257ffbd686c070948b5e07eda6", "type": "github" }, "original": { @@ -597,21 +575,19 @@ "nixpkgs" ], "pre-commit": "pre-commit", - "rust-overlay": [ - "rust-overlay" - ] + "rust-overlay": "rust-overlay" }, "locked": { - "lastModified": 1782141370, - "narHash": "sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU=", + "lastModified": 1790423250, + "narHash": "sha256-sr4Kfp6yaXUeyKL6n0Y8/ElcR3momIRC20HFc+LF22s=", "owner": "nix-community", "repo": "lanzaboote", - "rev": "7c9a54a7f87b4539ddbd8bda09a8a5f5f9361aa9", + "rev": "c1c5edd31802d181c8aa2c71588995d93425d650", "type": "github" }, "original": { "owner": "nix-community", - "ref": "v1.1.0", + "ref": "v1.2.0", "repo": "lanzaboote", "type": "github" } @@ -625,11 +601,11 @@ "treefmt-nix": "treefmt-nix" }, "locked": { - "lastModified": 1791072324, - "narHash": "sha256-hm+VeaOyLQLe37IvSADW4IKIxTvm9W/nZDd+S7flKzU=", + "lastModified": 1793267696, + "narHash": "sha256-pU0HWLzBuoGIYLMIjoZNqiALCAUl9JwV6ujIyOZO3i4=", "owner": "numtide", "repo": "llm-agents.nix", - "rev": "4e0a04f23b1113a125efb0246f57752674ade3d9", + "rev": "e452052b9efb54fd59f8a06cbc09978fb542a3c2", "type": "github" }, "original": { @@ -662,11 +638,11 @@ "spectrum": "spectrum" }, "locked": { - "lastModified": 1790890970, - "narHash": "sha256-MV/BNWl8docJMxrNtkZ2/iw0FYMesyB69HKkLWk0r5s=", + "lastModified": 1793225170, + "narHash": "sha256-G/iL0mroLP5etLwYs55uyOyffMS4t+gpyXF06haba4w=", "owner": "microvm-nix", "repo": "microvm.nix", - "rev": "3f1540f254fe73ac907281b7de7d396bb3d54850", + "rev": "c37d37a876a3c4bd7ff78fcc716b2e4fac770360", "type": "github" }, "original": { @@ -716,11 +692,11 @@ ] }, "locked": { - "lastModified": 1786845137, - "narHash": "sha256-oQFip+v0luP8NIxJzmiW4Wu8bILsbFWom5l0zonl8hQ=", + "lastModified": 1792737899, + "narHash": "sha256-P0/GhewcEQmAbzq3QunNWY2jLJaYH9F6c/5dEM/jQ4M=", "owner": "lnl7", "repo": "nix-darwin", - "rev": "4cff07de74b50e64bdd68cd4e722ab5b6b35ee48", + "rev": "bb0b90dbd54e207100de72b5dcbe3188c98a4b69", "type": "github" }, "original": { @@ -768,11 +744,11 @@ ] }, "locked": { - "lastModified": 1790831398, - "narHash": "sha256-1auhLnjmGjabpn4CMKSSe+NR+KYWSvtsELn4xIzc6XA=", + "lastModified": 1793250639, + "narHash": "sha256-5ZT7ZVSqM0OFq7D7LtETkrV3TNQ6NoFsptFOI0OFK+Q=", "owner": "fufexan", "repo": "nix-gaming", - "rev": "5094744feadd342f2e9d0eec9de5529ce449aa75", + "rev": "46024210a12bf7203036f6e4d4d9318f96f488e7", "type": "github" }, "original": { @@ -831,11 +807,11 @@ ] }, "locked": { - "lastModified": 1791152654, - "narHash": "sha256-KSS03mAblpolVRQj2TIblaQLZWJxawUtp4YRMfUotGM=", + "lastModified": 1792772387, + "narHash": "sha256-MK6/UsOv1Ii71c+2U28GpmKn+Fm4MZG2TmIscuvUERw=", "owner": "nix-community", "repo": "nixos-apple-silicon", - "rev": "e9be72cb979725110b0ff9ea96e945e512525312", + "rev": "46e80bc641f5aaee6ed7ef90a12314a81492f48f", "type": "github" }, "original": { @@ -853,11 +829,11 @@ ] }, "locked": { - "lastModified": 1790821369, - "narHash": "sha256-z9JfAJQ3yk7C1QTMZMl+G8fo7i5wem5PW0I95epjHlQ=", + "lastModified": 1792779741, + "narHash": "sha256-Bv69px6ayex2DFXZnx398li2wj1TrTV+6AZlPXgSRzQ=", "owner": "nixpak", "repo": "nixpak", - "rev": "a7a1f41e342e5f597ae47581dfc76726d03a8be7", + "rev": "3b061c82f9ccb99973154ffced2391535da7b66b", "type": "github" }, "original": { @@ -868,11 +844,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1790600678, - "narHash": "sha256-6k3n7X2UsZ6tAlWTz99RimiZab+17tMUrw9sRUcELiA=", + "lastModified": 1793225069, + "narHash": "sha256-sx1f99WGrDfJ83KKuQrqGPmot0rnDgmpLJDzpU2oHQQ=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "f45c6f04c2f013f004bf94e284e95d72898d9393", + "rev": "e62746b0b472753ef019baceab6f1e2e52014980", "type": "github" }, "original": { @@ -882,22 +858,6 @@ "type": "github" } }, - "nixpkgs-2505": { - "locked": { - "lastModified": 1767313136, - "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=", - "owner": "nixos", - "repo": "nixpkgs", - "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d", - "type": "github" - }, - "original": { - "owner": "nixos", - "ref": "nixos-25.05", - "repo": "nixpkgs", - "type": "github" - } - }, "nixpkgs-blender": { "locked": { "lastModified": 1790950605, @@ -916,11 +876,11 @@ }, "nixpkgs-darwin": { "locked": { - "lastModified": 1790652569, - "narHash": "sha256-641r7xrlSOHYoktL9/aArPIYNgZJ9eM5URzSEOtPJDY=", + "lastModified": 1793225069, + "narHash": "sha256-sx1f99WGrDfJ83KKuQrqGPmot0rnDgmpLJDzpU2oHQQ=", "owner": "nixos", "repo": "nixpkgs", - "rev": "b6c8664de9b6cc07fe5666a29f91884ba81197c4", + "rev": "e62746b0b472753ef019baceab6f1e2e52014980", "type": "github" }, "original": { @@ -932,11 +892,11 @@ }, "nixpkgs-lib": { "locked": { - "lastModified": 1788057806, - "narHash": "sha256-DTQSMxzDWmT0zhguthvegnVkn7CFqGCv4IHCzk5ZUpM=", + "lastModified": 1790477367, + "narHash": "sha256-oujbxmVKDhci2E4EM3KyAbRUgp5/IsCoiA/LfEF7OOk=", "owner": "nix-community", "repo": "nixpkgs.lib", - "rev": "596e2e3940e09b2abbeb03f75fa1828c57fcd72c", + "rev": "f7cd230690d9fc982d06129f9189b101fddcfa3b", "type": "github" }, "original": { @@ -947,11 +907,11 @@ }, "nixpkgs-master": { "locked": { - "lastModified": 1790950605, - "narHash": "sha256-/q30U6phIKLz7EaV2VAKIJATIOrhmm5wigXz6cS9OnY=", + "lastModified": 1793276362, + "narHash": "sha256-DusxEOidL1xE8vKwiHSeY/CYwjgD+f5tS9QrEN/O4mE=", "owner": "nixos", "repo": "nixpkgs", - "rev": "4b8338e3113dc41bcf7695f56dc372107b7ff4c9", + "rev": "ceb48b970d5e3c98492ae6386187600c43ff2014", "type": "github" }, "original": { @@ -979,11 +939,11 @@ }, "nixpkgs-patched": { "locked": { - "lastModified": 1791119557, - "narHash": "sha256-9JIYNP4TxaQwyPoCQRp65xjeDxkjpxkL6t0ZMw2zXR4=", + "lastModified": 1791048980, + "narHash": "sha256-KgItSKML8Xvte0B7/uGnBDsYzSnnKHcOaiUbgWBXLXw=", "owner": "ryan4yin", "repo": "nixpkgs", - "rev": "78c0fce8e29f1cc8c3c7ef04fde9220c676766c8", + "rev": "a7868a727837f3c09cee2ce0ca671c76b1589fed", "type": "github" }, "original": { @@ -995,11 +955,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1790920529, - "narHash": "sha256-nQyFkMR78WP6PiXKkDW2SjqzLf/spQqjRuxRGSbcV8k=", + "lastModified": 1793183032, + "narHash": "sha256-56mFMf8heLNfYhcgbrh4GpN5x+G9JOfTFXZC3n6w0qM=", "owner": "nixos", "repo": "nixpkgs", - "rev": "774debe7a0d1b496e35677ad955a1011c6ff74f3", + "rev": "08d3a97586f6b6343b3b5e799980773629432610", "type": "github" }, "original": { @@ -1011,11 +971,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1791000213, - "narHash": "sha256-qsAQkushLI1nYI/Uz/OAufjcvg50bZBGBq25pe/jcWk=", + "lastModified": 1793225069, + "narHash": "sha256-sx1f99WGrDfJ83KKuQrqGPmot0rnDgmpLJDzpU2oHQQ=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "f71476e8faba8240824d77877d2da77cc42e6d00", + "rev": "e62746b0b472753ef019baceab6f1e2e52014980", "type": "github" }, "original": { @@ -1049,11 +1009,11 @@ ] }, "locked": { - "lastModified": 1792342725, - "narHash": "sha256-kalmu6yOiD8HiXoo2ipvQ12L4UXe2kk68ObaMHeVslw=", + "lastModified": 1793285532, + "narHash": "sha256-srlNGg3/PBb3DfaC9ROlYl68VjxJfKPJoddFSU89oOQ=", "owner": "ryan4yin", "repo": "nur-packages", - "rev": "a71fc275ec7dbbbb8b3e9ece422a2df7f55269db", + "rev": "4687255272d66973ee4a8c1b025ca9f84371b9a6", "type": "github" }, "original": { @@ -1069,11 +1029,11 @@ ] }, "locked": { - "lastModified": 1792342725, - "narHash": "sha256-kalmu6yOiD8HiXoo2ipvQ12L4UXe2kk68ObaMHeVslw=", + "lastModified": 1793285532, + "narHash": "sha256-srlNGg3/PBb3DfaC9ROlYl68VjxJfKPJoddFSU89oOQ=", "owner": "ryan4yin", "repo": "nur-packages", - "rev": "a71fc275ec7dbbbb8b3e9ece422a2df7f55269db", + "rev": "4687255272d66973ee4a8c1b025ca9f84371b9a6", "type": "github" }, "original": { @@ -1085,16 +1045,16 @@ "ponytail": { "flake": false, "locked": { - "lastModified": 1791476378, - "narHash": "sha256-diYM3gqcEboVi7OQff/SvlE0TKAIPTJDIggX7rZWslY=", + "lastModified": 1793243094, + "narHash": "sha256-CY0EifTY0UVc6/FPGVJjEfYEf/8QLsINQmoYYKZYh98=", "owner": "DietrichGebert", "repo": "ponytail", - "rev": "9cc65d03aa2da1db7121b912d03596409ee340b8", + "rev": "7801d061243d7b753bad0e0b3c057cd250b11755", "type": "github" }, "original": { "owner": "DietrichGebert", - "ref": "v5.1.0", + "ref": "v5.3.3", "repo": "ponytail", "type": "github" } @@ -1102,23 +1062,22 @@ "pre-commit": { "inputs": { "flake-compat": "flake-compat_2", - "gitignore": "gitignore", "nixpkgs": [ "lanzaboote", "nixpkgs" ] }, "locked": { - "lastModified": 1781733627, - "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=", + "lastModified": 1789514889, + "narHash": "sha256-PFD1nxptCXJyJoiYO1gf/5Vv43yqGpHtMC6LUhl9/pQ=", "owner": "cachix", - "repo": "pre-commit-hooks.nix", - "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39", + "repo": "git-hooks.nix", + "rev": "59f4ca0d063a1a3ec722c88b51a33004862e5379", "type": "github" }, "original": { "owner": "cachix", - "repo": "pre-commit-hooks.nix", + "repo": "git-hooks.nix", "type": "github" } }, @@ -1130,11 +1089,11 @@ ] }, "locked": { - "lastModified": 1790500375, - "narHash": "sha256-XN3sDtn8TU9hAc9xqZ+SqRB/HHm2wjxM6aSWYLJU+oo=", + "lastModified": 1791909798, + "narHash": "sha256-VAhpCOmrun/KXimYfR8NM88bciKCui7CqHHhThSzgag=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "a0e4241b51206fbcbf52fd322eb5f0cd80f153c4", + "rev": "1ba1dbfe28738c9a71c266be6efa5b89e75491a9", "type": "github" }, "original": { @@ -1145,11 +1104,11 @@ }, "preservation": { "locked": { - "lastModified": 1757436102, - "narHash": "sha256-mMI9IanU+Xw+pVogD2oT0I2kTmvz2Un/Apc5+CwUpEY=", + "lastModified": 1792953443, + "narHash": "sha256-s/A2rSO2Ndf8Y5yiouesnI/3Zkn9pmVGF2NxFxOUvx8=", "owner": "nix-community", "repo": "preservation", - "rev": "93416f4614ad2dfed5b0dcf12f27e57d27a5ab11", + "rev": "00be7f7dd1a11ae0605386f2272288de7cf33abe", "type": "github" }, "original": { @@ -1165,16 +1124,15 @@ ] }, "locked": { - "lastModified": 1789583109, - "narHash": "sha256-CwZHQHZBfo3furE7M/Qsc6TdU+3JRo7FPYSRtgYESU8=", + "lastModified": 1790136661, + "narHash": "sha256-2R03dOunHhpAIVzJObB4dVl66PwT0E8ilwe+zoPsk7I=", "owner": "ryan4yin", "repo": "pyclipsync", - "rev": "d0b6af8913c69c64fad4d00517e75674daaa9453", + "rev": "0b134383248faff0b2c8d3c9e8841322499ab7f8", "type": "github" }, "original": { "owner": "ryan4yin", - "ref": "v0.1.3", "repo": "pyclipsync", "type": "github" } @@ -1203,7 +1161,6 @@ "nixos-apple-silicon": "nixos-apple-silicon", "nixpak": "nixpak", "nixpkgs": "nixpkgs_2", - "nixpkgs-2505": "nixpkgs-2505", "nixpkgs-blender": "nixpkgs-blender", "nixpkgs-darwin": "nixpkgs-darwin", "nixpkgs-master": "nixpkgs-master", @@ -1216,7 +1173,6 @@ "pre-commit-hooks": "pre-commit-hooks", "preservation": "preservation", "pyclipsync": "pyclipsync", - "rust-overlay": "rust-overlay", "tuios": "tuios", "wallpapers": "wallpapers" } @@ -1224,15 +1180,16 @@ "rust-overlay": { "inputs": { "nixpkgs": [ + "lanzaboote", "nixpkgs" ] }, "locked": { - "lastModified": 1790928989, - "narHash": "sha256-5r3MN/Rx7N9tLapCBmUq6/zCc3C9J7gNif1HybD1fJQ=", + "lastModified": 1793261817, + "narHash": "sha256-fAvtOccUXHVAH5wXK+ABYUUC47W2qTb9T9EefLcS9ME=", "owner": "oxalica", "repo": "rust-overlay", - "rev": "368fee9beaab04ca6fe7af28db63caa9badb22fa", + "rev": "afcefd09c71e63663a46e4ce5e09968584f2c709", "type": "github" }, "original": { @@ -1295,11 +1252,11 @@ }, "systems_2": { "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "lastModified": 1791244623, + "narHash": "sha256-uuanbkFk8a313Zfrxdcz8Us/yQtaxNnKJtX8v0ZPpd8=", "owner": "nix-systems", "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "rev": "d36eeed142f88b5a636f2e3856a53c61654cf29b", "type": "github" }, "original": { @@ -1316,11 +1273,11 @@ ] }, "locked": { - "lastModified": 1786901030, - "narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=", + "lastModified": 1791885023, + "narHash": "sha256-C3alQ2MEt0zVrUSho5NUDo3jmhbff72++bfwoqT9Omo=", "owner": "numtide", "repo": "treefmt-nix", - "rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa", + "rev": "0d6d739a833ba9a9c93034862e4a7b061a062a1c", "type": "github" }, "original": { @@ -1364,16 +1321,16 @@ "treefmt-nix": "treefmt-nix_2" }, "locked": { - "lastModified": 1792258594, - "narHash": "sha256-1p9LCTwVuXQBFjWFpt9uvDorj/UvKh809RZy48prglU=", + "lastModified": 1793015645, + "narHash": "sha256-ifgOqJGihtLQIpdfNJZ27mhqGwKvJ/bxR2/4cmGR1q4=", "owner": "Gaurav-Gosain", "repo": "tuios", - "rev": "f8b7820aa685b28295af46e1f32fb20b0d8461dc", + "rev": "12dedac04d57a60ae02e58ea73c2aadb596c515c", "type": "github" }, "original": { "owner": "Gaurav-Gosain", - "ref": "v0.10.1", + "ref": "v0.11.1", "repo": "tuios", "type": "github" } diff --git a/flake.nix b/flake.nix index 982426c1..b904b352 100644 --- a/flake.nix +++ b/flake.nix @@ -27,10 +27,6 @@ inputs.nixpkgs.follows = "nixpkgs"; }; nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-26.05"; - # Kept for pinning a package that regressed in newer nixpkgs. Currently only - # kubernetes-helm uses it (home/base/tui/container.nix); extend or drop this - # input together with that consumer. - nixpkgs-2505.url = "github:nixos/nixpkgs/nixos-25.05"; # ryan4yin/nixpkgs fork for the `.agents/skills/nixpkgs-patched` workflow. It # currently carries no patches (see WORKAROUNDS.md), but `pkgs-patched` is @@ -76,15 +72,7 @@ }; lanzaboote = { - url = "github:nix-community/lanzaboote/v1.1.0"; - inputs.nixpkgs.follows = "nixpkgs"; - inputs.rust-overlay.follows = "rust-overlay"; - }; - - # lanzaboote's pinned rust-overlay still uses the deprecated - # `stdenv.isLinux`/`stdenv.isDarwin`; follow a newer revision. - rust-overlay = { - url = "github:oxalica/rust-overlay"; + url = "github:nix-community/lanzaboote/v1.2.0"; inputs.nixpkgs.follows = "nixpkgs"; }; @@ -152,7 +140,7 @@ # terminal window manager / multiplexer; nixpkgs lags behind upstream, # so track the upstream flake. tuios = { - url = "github:Gaurav-Gosain/tuios/v0.10.1"; + url = "github:Gaurav-Gosain/tuios/v0.11.1"; inputs.nixpkgs.follows = "nixpkgs"; }; @@ -201,7 +189,7 @@ flake = false; }; ponytail = { - url = "github:DietrichGebert/ponytail/v5.1.0"; + url = "github:DietrichGebert/ponytail/v5.3.3"; flake = false; }; ######################## My own repositories ######################################### @@ -237,9 +225,10 @@ inputs.nixpkgs.follows = "nixpkgs"; }; - # Wayland <-> X11 clipboard sync daemon for xwayland-satellite (niri) + # Wayland <-> X11 clipboard sync daemon for xwayland-satellite (niri). + # Track main while the upstream fix for pkgs.system has no release tag. pyclipsync = { - url = "github:ryan4yin/pyclipsync/v0.1.3"; + url = "github:ryan4yin/pyclipsync"; inputs.nixpkgs.follows = "nixpkgs"; }; }; diff --git a/home/base/core/shells/default.nix b/home/base/core/shells/default.nix index 6626c9d7..d23ac12d 100644 --- a/home/base/core/shells/default.nix +++ b/home/base/core/shells/default.nix @@ -8,6 +8,9 @@ programs.nushell = { enable = true; + # Adopt the 26.11 default: source Home Manager's session environment from + # env.nu instead of relying only on the bash-login wrapper. + loadSessionVariables = true; configFile.source = ./config.nu; }; } diff --git a/home/base/tui/agents/dsh.md b/home/base/tui/agents/dsh.md index a9bc970a..552de4dc 100644 --- a/home/base/tui/agents/dsh.md +++ b/home/base/tui/agents/dsh.md @@ -59,8 +59,9 @@ on, `$DSH_AGENTS_HOME/AGENTS.md` — so no patch row is needed; identical conten spawns. The plugin adds Nushell rules and a syntax guide, and rewrites the shell-tool descriptions, so the model is told what actually runs. `nu` is the Nushell `dsh-nu`'s flake resolves — Nixpkgs', through `inputs.nixpkgs.follows` — substituted into the rendered patch at build time, so it does not -depend on `PATH`. The bundle is tested with Nushell 0.115.1 and warns at evaluation time when the -resolved Nushell differs; drop the `follows` to build against its own pin instead. A command that +depend on `PATH`. The bundle still records Nushell 0.115.1 as its tested release; nix-config follows +the main nixpkgs and rewrites that manifest field to the resolved Nushell in `outputs/default.nix` +until dsh-nu retests, rather than pinning an older nixpkgs for the whole plugin. A command that hands a script file to a shell (`bash scripts/build.sh`) is refused, and the refusal names the direct `./scripts/build.sh` spelling; the guard itself is unchanged. diff --git a/home/base/tui/container.nix b/home/base/tui/container.nix index f8f859d1..4deab982 100644 --- a/home/base/tui/container.nix +++ b/home/base/tui/container.nix @@ -1,6 +1,5 @@ { pkgs, - pkgs-2505, nur-ryan4yin, ... }: @@ -30,7 +29,7 @@ kubectl-cnpg # cloudnative-pg's cli tool istioctl - pkgs-2505.kubernetes-helm + kubernetes-helm fluxcd # argocd ]; diff --git a/hosts/12kingdoms-shoryu/preservation.nix b/hosts/12kingdoms-shoryu/preservation.nix index c94fce40..ef15a87f 100644 --- a/hosts/12kingdoms-shoryu/preservation.nix +++ b/hosts/12kingdoms-shoryu/preservation.nix @@ -14,8 +14,6 @@ in ]; preservation.enable = true; - boot.initrd.systemd.enable = true; - environment.systemPackages = [ # `sudo gdu -x /` pkgs.gdu diff --git a/hosts/12kingdoms-youko/homelab-services/gitea.nix b/hosts/12kingdoms-youko/homelab-services/gitea.nix index c65b424a..10f022f7 100644 --- a/hosts/12kingdoms-youko/homelab-services/gitea.nix +++ b/hosts/12kingdoms-youko/homelab-services/gitea.nix @@ -22,7 +22,6 @@ PROTOCOL = "http"; HTTP_PORT = 3301; HTTP_ADDR = "127.0.0.1"; - DOMAIN = "git.writefor.fun"; ROOT_URL = "https://git.writefor.fun/"; }; # one of "Trace", "Debug", "Info", "Warn", "Error", "Critical" diff --git a/hosts/idols-ai/preservation.nix b/hosts/idols-ai/preservation.nix index 1e3598d1..506378e9 100644 --- a/hosts/idols-ai/preservation.nix +++ b/hosts/idols-ai/preservation.nix @@ -14,9 +14,6 @@ in ]; preservation.enable = true; - # pverservation required initrd using systemd. - boot.initrd.systemd.enable = true; - environment.systemPackages = [ # Whole-filesystem disk usage (`-x` stays on one filesystem): # sudo gdu -n -x / # non-interactive, plain text diff --git a/hosts/idols-aquamarine/preservation.nix b/hosts/idols-aquamarine/preservation.nix index c1b818d7..d99863c1 100644 --- a/hosts/idols-aquamarine/preservation.nix +++ b/hosts/idols-aquamarine/preservation.nix @@ -14,9 +14,6 @@ in ]; preservation.enable = true; - # preservation requires a systemd initrd. - boot.initrd.systemd.enable = true; - environment.systemPackages = [ # Whole-filesystem disk usage (`-x` stays on one filesystem): # sudo gdu -n -x / # non-interactive, plain text diff --git a/modules/base/security.nix b/modules/base/security.nix index 0844765b..027c1e90 100644 --- a/modules/base/security.nix +++ b/modules/base/security.nix @@ -4,13 +4,11 @@ ../../certs/ecc-ca.crt ]; - # Distrust the roots that signed the compromised eMudhra intermediates - # (Mozilla advisory, 2026-10-20). Upstream nixpkgs blacklists them as of - # NixOS/nixpkgs#576390; drop this once every consumed nixpkgs revision has it (WA-040). + # CVE-2026-111943. NixOS adds this entry itself, but nix-darwin only passes + # this list through, so keep it explicit for both platforms. The emSign roots + # are gone from the NSS bundle upstream; listing those names now makes + # buildcatrust fail, so they are intentionally absent. security.pki.caCertificateBlacklist = [ "Comodo AAA Services root" - "emSign ECC Root CA - G3" - "emSign Root CA - C1" - "emSign ECC Root CA - C3" ]; } diff --git a/modules/nixos/base/networking/mdns.nix b/modules/nixos/base/networking/mdns.nix index 287bd6e3..2e496520 100644 --- a/modules/nixos/base/networking/mdns.nix +++ b/modules/nixos/base/networking/mdns.nix @@ -27,11 +27,16 @@ in services.avahi = { enable = true; nssmdns4 = true; - publish = { - enable = true; - domain = true; - userServices = true; + settings.publish = { + disable-publishing = false; + disable-user-service-publishing = false; + publish-addresses = true; + publish-domain = true; }; + # The nixpkgs sunshine module still sets these legacy options. Force them + # to null so settings.publish above is the only source of truth. + publish.enable = lib.mkForce null; + publish.userServices = lib.mkForce null; }; # avahi and systemd-resolved both run an mDNS responder, which makes mDNS diff --git a/outputs/default.nix b/outputs/default.nix index e531c9a3..b390ed0f 100644 --- a/outputs/default.nix +++ b/outputs/default.nix @@ -18,6 +18,7 @@ let inherit system; config.allowUnfree = true; }; + in inputs // { @@ -31,11 +32,6 @@ let pkgs-stable ; - pkgs-2505 = import inputs.nixpkgs-2505 { - inherit system; - # To use chrome, we need to allow the installation of non-free software - config.allowUnfree = true; - }; pkgs-patched = import inputs.nixpkgs-patched { inherit system; # to use chrome, we need to allow the installation of non-free software @@ -60,7 +56,7 @@ let cudaCapabilities = [ "8.9" ]; }; }; - # NUR packages for this system, so modules use `myNurPkgs.dsh` instead of + # NUR packages for this system; modules use `myNurPkgs.dsh` instead of # repeating `nur-ryan4yin.packages.${pkgs.stdenv.hostPlatform.system}`. myNurPkgs = inputs.nur-ryan4yin.packages.${system}; };