From e8e9691f2d55c10e14261e10bc38814999ac8a55 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?ryan4yin=20=7C=20=E4=BA=8C=E8=8A=B1?= Date: Fri, 30 Oct 2026 00:39:01 +0800 Subject: [PATCH] chore(nix): update nixpkgs to e62746b and refresh flake inputs (#488) * chore(nix): update nixpkgs to e62746b and fix 26.11 breakage Bump nixpkgs to e62746b and preservation to 00be7f7, then adapt to the removals and renamed options in the new revision: drop the removed boot.initrd.systemd.enable settings, trim the stale emSign CA blacklist on Linux while keeping it for the older Darwin input, and migrate Avahi publishing to settings.publish. Work around sunshine still setting the legacy Avahi options and keep dsh-nu on its tested Nushell 0.115.1. Patch NUR dsh's pnpm call to pass nodejs = null, and update pyclipsync for the stdenv.hostPlatform.system rename. * chore(nix): refresh flake inputs for 26.11 - update nixpkgs-darwin to the same e62746b revision as nixpkgs - make dsh-nu follow main nixpkgs and patch its testedWith manifest for the resolved Nushell - refresh floating inputs; update lanzaboote, tuios, and ponytail - drop the nixpkgs-2505 and rust-overlay workarounds - keep pyclipsync on main and simplify the cross-platform CA blacklist - adopt home-manager's Nushell loadSessionVariables default * fix(gitea): use ROOT_URL for nixpkgs 26.11 nixpkgs removed the legacy settings.server.DOMAIN option; the existing ROOT_URL already carries the public URL. * chore(nix): update dsh-nu to 0.7.0 Assisted-by: DeepSeek Harness (deepseek-flash) --- WORKAROUNDS.md | 44 ++- docs/nixos-modernization-options.md | 9 +- flake.lock | 255 ++++++++---------- flake.nix | 23 +- home/base/core/shells/default.nix | 3 + home/base/tui/agents/dsh.md | 5 +- home/base/tui/container.nix | 3 +- hosts/12kingdoms-shoryu/preservation.nix | 2 - .../homelab-services/gitea.nix | 1 - hosts/idols-ai/preservation.nix | 3 - hosts/idols-aquamarine/preservation.nix | 3 - modules/base/security.nix | 10 +- modules/nixos/base/networking/mdns.nix | 13 +- outputs/default.nix | 8 +- 14 files changed, 159 insertions(+), 223 deletions(-) diff --git a/WORKAROUNDS.md b/WORKAROUNDS.md index 2814d04c..20022d5c 100644 --- a/WORKAROUNDS.md +++ b/WORKAROUNDS.md @@ -19,8 +19,6 @@ A version or revision pinned for a reason that can go away. | ID | What & where | Why | Removal condition | Added | Revisit | Status | | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ---------- | -------------------------- | ------ | | WA-001 | smartctl_exporter pinned to upstream `6274decc`, which carries PR [#329](https://github.com/prometheus-community/smartctl_exporter/pull/329) — `overlays/smartctl-exporter/` | `/metrics` returns HTTP 500 once a device becomes readable after startup ([#305](https://github.com/prometheus-community/smartctl_exporter/issues/305), [#326](https://github.com/prometheus-community/smartctl_exporter/issues/326)) | Drop once nixpkgs provides a version containing the #329 fix | 2026-10-03 | next nixpkgs bump | active | -| WA-002 | `nixpkgs-2505` — `flake.nix`; consumer `home/base/tui/container.nix` | `kubernetes-helm` regressed in newer nixpkgs | Drop the input and its consumer once helm works again in current nixpkgs | 2025-12-03 | when helm is revisited | active | -| WA-003 | `rust-overlay` follow — `flake.nix` | lanzaboote v1.1.0's pinned rust-overlay uses the deprecated `stdenv.isLinux`/`stdenv.isDarwin` | Drop the follow once lanzaboote updates its pin (or we drop the lanzaboote pin) | 2026-09-25 | on lanzaboote bump | active | | WA-004 | `catppuccin` on `main` — `flake.nix` | `main` carries the nodejs→nodejs-slim deprecation fix, which is not in a release | Switch to a release tag once it includes the fix | 2026-09-25 | on catppuccin release | active | | WA-005 | `tuios` input — `flake.nix`; `home/base/tui/tuios/` | nixpkgs lags behind upstream | Use nixpkgs' `tuios` once it is recent enough | 2026-10-03 | on nixpkgs bump | active | | WA-006 | `nixpkgs-blender` — `flake.nix` | Blender 5.2 LTS + CUDA/OptiX pin; keeps `just up` from triggering a full source rebuild | Bump deliberately when needed; drop the pin if the current nixpkgs build is acceptable | 2026-07-24 | deliberate | active | @@ -34,27 +32,27 @@ A version or revision pinned for a reason that can go away. A setting that works around a bug or a hardware quirk. -| ID | What & where | Why | Removal condition | Added | Revisit | Status | -| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | --------------------------------------------------------------------------------------------------- | ------ | -| WA-008 | Relaxed NVMe APST (`nvme_core.default_ps_max_latency_us=100000`) — `hosts/idols-ai/hardware-configuration.nix`, `hosts/idols-aquamarine/hardware-configuration.nix` | the KINGBANK KP260 (DRAM-less QLC) froze on slow APST wake-ups | Drop the override once kernel/firmware fixes or replacement hardware make default APST reliable | 2026-10-03 | watch NVMe timeout/reset/AER in the journal | active | -| WA-009 | USB-SATA bridge mitigations (`usbcore.autosuspend=-1`, `usb-storage.delay_use=10`) — `hosts/12kingdoms-youko/default.nix` | flaky JMicron JMS567 resets with UDMA-CRC and I/O errors | Drop once the bridge/controller is replaced; the signal is smartctl CRC/media errors | 2026-09-21 | on hardware change or CRC errors | active | -| WA-010 | Insta360 Link USB reset on S3 resume — `hosts/idols-ai/default.nix` | the camera stays enumerated with a stalled UVC endpoint after resume | Drop after the Insta360 firmware or the kernel `uvcvideo` fixes it | 2026-08-01 | on kernel or firmware change | active | -| WA-011 | Kernel module blacklist (`esp4`, `esp6`, `rxrpc`) — `hardening/kernel-hardening.nix` | attack surface for the Dirty Frag LPE (CVE-2026-43284 / CVE-2026-43500) | Kept as defence in depth; drop only if something needs those modules | 2026-10-03 | rarely | active | -| WA-017 | keyd right-hand modifier passthrough — `modules/nixos/desktop/peripherals.nix` | keyd folds right Ctrl/Shift/Meta into their left keys | Drop once keyd or fcitx5 keeps right-hand modifiers distinct | 2026-10-05 | on keyd bump | active | -| WA-018 | user-owned `~/.ssh/config` + disabled systemd ssh-proxy include — `home/base/tui/ssh.nix`, `modules/nixos/base/ssh.nix` | bwrap exposes root-owned store files as `nobody` | Drop once sandboxes preserve store ownership | 2026-10-06 | when sandbox layout changes | active | -| WA-019 | programs.steam.extraCompatPackages = [ pkgs.dwproton-bin pkgs.proton-ge-bin ] — modules/nixos/desktop/gaming.nix | ACE games fail on GE/mainline Proton, work with DW-Proton | Drop once mainline or GE-Proton runs these games (GE-Proton#433) | 2026-10-07 | on Proton/GE bump | active | -| WA-024 | Wi-Fi power saving disabled (`networking.networkmanager.wifi.powersave = false`) — `hosts/12kingdoms-shoukei/apple-silicon.nix` | On this BCM4378/brcmfmac laptop, powersave is a common source of intermittent ASSOC-REJECT / authentication-timeout failures; NetworkManager then mistakes the failure for a bad key, re-prompts, and the client (Noctalia, nmtui, nmcli) saves the answer as a duplicate ` 1` profile | Drop once the kernel carries the brcmfmac `port_authorized` fix (WA-025) and no association failures remain | 2026-10-07 | watch `journalctl -u wpa_supplicant` for ASSOC-REJECT / authentication timeout | active | -| WA-026 | guest deploys run `installOnHost` then `systemctl restart microvm@` on the physical host — `Justfile`, `lib/genMicrovmGuestModule.nix` | the sshSwitch step runs `nix-store --load-db` against the guest's read-only virtiofs `/nix/store` and dies on `cannot remount "/nix/store" writable` (nix 2.35) | Drop the manual path once microvm.nix or nix handles a read-only store switch. A host activation re-links `/var/lib/microvms//current` to the runner baked into the host's system, so switch the host after installing a guest from a newer tree | 2026-10-09 | on microvm.nix or nix bump | active | -| WA-028 | GitHub SSH pinned to IPv4 (`AddressFamily = "inet"`) — `home/base/tui/ssh.nix` | a v6 fake AAAA for `ssh.github.com` from the `2001:2::/64` pool (WA-029) is not proven on the 443 SSH tunnel yet | Drop once the v6 fake-ip pool is proven for GitHub SSH | 2026-10-10 | on a mihomo bump or a v6 pool change | active | -| WA-029 | mihomo `fake-ip-range6` is `2001:2::/64`, not the shipped ULA default — `modules/nixos/desktop/networking/mihomo/generate.nu` | the default `fdfe:dcba:9876::/64` sits in `fc00::/7`, which Local Network Access calls local, so a public page loaded over the v4 fake pool and pulling a dual-stack subresource prompts for local-network access (Chrome 154, Firefox). The same range also stalled ssh: a session to a fake AAAA authenticated and then never closed, on both `gvisor` and `mips`. `2001:2::/48` is RFC 5180 benchmarking -- the v6 twin of the `198.18.0.0/15` v4 default, absent from that table -- and both symptoms went with the move | Go back to the upstream default once mihomo ships a pool outside the LNA non-public table; the ULA default brings the ssh stall back | 2026-10-09 | on a browser or mihomo bump -- that table already grew to cover `2001:db8::/32` and `198.18.0.0/15` | active | -| WA-030 | mihomo unit sets `SKIP_SYSTEM_IPV6_CHECK=1` — `modules/nixos/desktop/networking/mihomo/default.nix` | mihomo checks at startup whether another NIC already holds an IPv6 address and, finding none, skips the TUN's v6 half -- but `strict-route` still installs its v6 blackhole (`ip -6 rule add priority 9000 unreachable`). On a cold boot that rule lands before networkd's Router Solicitation is answered, so the host can never send RS/NS, never gets a GUA, and mihomo never re-checks: self-locking until the core restarts. The env var forces the TUN v6 address up, which installs mihomo's normal v6 rules whose `lookup main suppress_prefixlength 0` keeps on-link neighbor discovery and the RA default route off the TUN | Drop once mihomo either re-runs the IPv6 check or skips the v6 strict-route blackhole when the v6 TUN is disabled | 2026-10-10 | on a mihomo bump | active | -| WA-031 | `iommu=pt` kernel parameter — `hosts/idols-aquamarine/hardware-amd-gpu.nix` | ROCm's system requirements warn that multi-GPU systems may need IOMMU passthrough to prevent application hangs, and this host has two Radeon AI PRO R9700 cards. Added before the first inference run; not yet observed on gfx1201. | Drop once a ROCm release states that the default IOMMU mode is safe for multi-GPU gfx1201, or when the host runs a single GPU | 2026-10-13 | on a ROCm bump, or on the first hang report | active | -| WA-032 | `amdgpu.runpm=0` kernel parameter — `hosts/idols-aquamarine/hardware-amd-gpu.nix` | this board's DSDT advertises ATPX power control (`\_SB.PC00.GFX0.ATPX`) but never defines the `PEG0.PEGP._OFF`/`_ON` symbols its body calls, so the first idle resume of the headless R9700 leaves it in `runtime_status = error` (`resume of IP block failed -62`) until reboot, and amdgpu discards the ACPI error. Root cause, kernel-source trail and the measured field comparison: `hosts/idols-aquamarine/ROCM.md`. | Drop once a BIOS update defines those ACPI methods (upstream releases 1023/1066 exist for this board; a flash changes PCR7, so re-enroll TPM2), or a kernel release stops trusting ATPX when its power methods are missing | 2026-10-14 | on a BIOS update or kernel bump | active | -| WA-036 | catppuccin eval-time ports kept in the home closure (`home.extraDependencies`) — `home/base/core/theme.nix` | catppuccin/nix reads some ports at eval time (`lib.importTOML "${sources.starship}/.toml"`) and inlines the result, so the built port, catppuccin's build/install hooks and the fetched port source stay unreachable: every gc deletes them, and the deploy after it rebuilds them (build logs: 2026-10-16). `home.extraDependencies` records the port in the generation, which is a gc root. Also read at eval time upstream: `bottom`, `element` (option `element-desktop`), `firefox`, `rio`, `palette` (options `skim`, `tty`), `spotify-player`. | Drop once catppuccin/nix stops reading port files at eval time, or those ports come from a binary cache | 2026-10-16 | on a catppuccin bump | active | -| WA-039 | niri's NVIDIA free-buffer pool bounded (`GLVidHeapReuseRatio` 0) — `hosts/idols-ai/hardware-nvidia.nix` | the driver does not return freed vidmem buffers to its free pool, so niri's VRAM grows to ~1.1 GiB instead of the ~100 MiB its NVIDIA notes expect (measured 1137 MiB after 24 h uptime; [NVIDIA/egl-wayland#126](https://github.com/NVIDIA/egl-wayland/issues/126)) | Drop once a driver stops growing niri's VRAM without the profile, or niri ships its own default | 2026-10-19 | on an nvidia driver bump | active | -| WA-040 | Root CA blacklist on NixOS and Darwin (Nix CA bundle only, not the macOS Keychain) — `modules/base/security.nix` | eMudhra intermediate keys were compromised; [NixOS/nixpkgs#576390](https://github.com/NixOS/nixpkgs/pull/576390) and [#576401](https://github.com/NixOS/nixpkgs/pull/576401) merged before reaching release channels | Drop once every consumed nixpkgs revision (`nixpkgs` and `nixpkgs-darwin`) includes the upstream root blacklist | 2026-10-20 | on nixpkgs bump | active | -| WA-041 | Monitor OSD "no-signal auto power-off" disabled — no code in this repo (the P32A2V OSD setting) | during a DPMS-off idle the panel drops and re-adds HPD every ~13 s, and after wake niri keeps scanning out while the panel stays dark until the monitor is power cycled; the panel's own auto power-off drives that state, so it is now disabled. Pinning the mode to 120 Hz did not change the symptom | Drop once a driver retrains the DP link after a DPMS wake, the monitor firmware stops cycling HPD, or this monitor is replaced | 2026-10-21 | confirm on the next full idle cycle, then on an nvidia or monitor firmware update | active | -| WA-042 | Colmena nodes set `system.nixos.versionSuffix` and `revision` from the flake's lib — `outputs/default.nix` (`rawColmenaHive`) | Colmena evaluates each node with nixpkgs' `eval-config.nix` and plain lib, which reports `26.11pre-git`, so without the override a Colmena deploy differs from the `nixosConfigurations` toplevel; the `colmena-parity` eval test guards the match | Drop once Colmena evaluates nodes with the flake's lib or accepts `nixosConfigurations` directly, keeping `colmena-parity` green | 2026-10-21 | on a colmena bump | active | +| ID | What & where | Why | Removal condition | Added | Revisit | Status | +| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | ------------------ | +| WA-008 | Relaxed NVMe APST (`nvme_core.default_ps_max_latency_us=100000`) — `hosts/idols-ai/hardware-configuration.nix`, `hosts/idols-aquamarine/hardware-configuration.nix` | the KINGBANK KP260 (DRAM-less QLC) froze on slow APST wake-ups | Drop the override once kernel/firmware fixes or replacement hardware make default APST reliable | 2026-10-03 | watch NVMe timeout/reset/AER in the journal | active | +| WA-009 | USB-SATA bridge mitigations (`usbcore.autosuspend=-1`, `usb-storage.delay_use=10`) — `hosts/12kingdoms-youko/default.nix` | flaky JMicron JMS567 resets with UDMA-CRC and I/O errors | Drop once the bridge/controller is replaced; the signal is smartctl CRC/media errors | 2026-09-21 | on hardware change or CRC errors | active | +| WA-010 | Insta360 Link USB reset on S3 resume — `hosts/idols-ai/default.nix` | the camera stays enumerated with a stalled UVC endpoint after resume | Drop after the Insta360 firmware or the kernel `uvcvideo` fixes it | 2026-08-01 | on kernel or firmware change | active | +| WA-011 | Kernel module blacklist (`esp4`, `esp6`, `rxrpc`) — `hardening/kernel-hardening.nix` | attack surface for the Dirty Frag LPE (CVE-2026-43284 / CVE-2026-43500) | Kept as defence in depth; drop only if something needs those modules | 2026-10-03 | rarely | active | +| WA-017 | keyd right-hand modifier passthrough — `modules/nixos/desktop/peripherals.nix` | keyd folds right Ctrl/Shift/Meta into their left keys | Drop once keyd or fcitx5 keeps right-hand modifiers distinct | 2026-10-05 | on keyd bump | active | +| WA-018 | user-owned `~/.ssh/config` + disabled systemd ssh-proxy include — `home/base/tui/ssh.nix`, `modules/nixos/base/ssh.nix` | bwrap exposes root-owned store files as `nobody` | Drop once sandboxes preserve store ownership | 2026-10-06 | when sandbox layout changes | active | +| WA-019 | programs.steam.extraCompatPackages = [ pkgs.dwproton-bin pkgs.proton-ge-bin ] — modules/nixos/desktop/gaming.nix | ACE games fail on GE/mainline Proton, work with DW-Proton | Drop once mainline or GE-Proton runs these games (GE-Proton#433) | 2026-10-07 | on Proton/GE bump | active | +| WA-024 | Wi-Fi power saving disabled (`networking.networkmanager.wifi.powersave = false`) — `hosts/12kingdoms-shoukei/apple-silicon.nix` | On this BCM4378/brcmfmac laptop, powersave is a common source of intermittent ASSOC-REJECT / authentication-timeout failures; NetworkManager then mistakes the failure for a bad key, re-prompts, and the client (Noctalia, nmtui, nmcli) saves the answer as a duplicate ` 1` profile | Drop once the kernel carries the brcmfmac `port_authorized` fix (WA-025) and no association failures remain | 2026-10-07 | watch `journalctl -u wpa_supplicant` for ASSOC-REJECT / authentication timeout | active | +| WA-026 | guest deploys run `installOnHost` then `systemctl restart microvm@` on the physical host — `Justfile`, `lib/genMicrovmGuestModule.nix` | the sshSwitch step runs `nix-store --load-db` against the guest's read-only virtiofs `/nix/store` and dies on `cannot remount "/nix/store" writable` (nix 2.35) | Drop the manual path once microvm.nix or nix handles a read-only store switch. A host activation re-links `/var/lib/microvms//current` to the runner baked into the host's system, so switch the host after installing a guest from a newer tree | 2026-10-09 | on microvm.nix or nix bump | active | +| WA-028 | GitHub SSH pinned to IPv4 (`AddressFamily = "inet"`) — `home/base/tui/ssh.nix` | a v6 fake AAAA for `ssh.github.com` from the `2001:2::/64` pool (WA-029) is not proven on the 443 SSH tunnel yet | Drop once the v6 fake-ip pool is proven for GitHub SSH | 2026-10-10 | on a mihomo bump or a v6 pool change | active | +| WA-029 | mihomo `fake-ip-range6` is `2001:2::/64`, not the shipped ULA default — `modules/nixos/desktop/networking/mihomo/generate.nu` | the default `fdfe:dcba:9876::/64` sits in `fc00::/7`, which Local Network Access calls local, so a public page loaded over the v4 fake pool and pulling a dual-stack subresource prompts for local-network access (Chrome 154, Firefox). The same range also stalled ssh: a session to a fake AAAA authenticated and then never closed, on both `gvisor` and `mips`. `2001:2::/48` is RFC 5180 benchmarking -- the v6 twin of the `198.18.0.0/15` v4 default, absent from that table -- and both symptoms went with the move | Go back to the upstream default once mihomo ships a pool outside the LNA non-public table; the ULA default brings the ssh stall back | 2026-10-09 | on a browser or mihomo bump -- that table already grew to cover `2001:db8::/32` and `198.18.0.0/15` | active | +| WA-030 | mihomo unit sets `SKIP_SYSTEM_IPV6_CHECK=1` — `modules/nixos/desktop/networking/mihomo/default.nix` | mihomo checks at startup whether another NIC already holds an IPv6 address and, finding none, skips the TUN's v6 half -- but `strict-route` still installs its v6 blackhole (`ip -6 rule add priority 9000 unreachable`). On a cold boot that rule lands before networkd's Router Solicitation is answered, so the host can never send RS/NS, never gets a GUA, and mihomo never re-checks: self-locking until the core restarts. The env var forces the TUN v6 address up, which installs mihomo's normal v6 rules whose `lookup main suppress_prefixlength 0` keeps on-link neighbor discovery and the RA default route off the TUN | Drop once mihomo either re-runs the IPv6 check or skips the v6 strict-route blackhole when the v6 TUN is disabled | 2026-10-10 | on a mihomo bump | active | +| WA-031 | `iommu=pt` kernel parameter — `hosts/idols-aquamarine/hardware-amd-gpu.nix` | ROCm's system requirements warn that multi-GPU systems may need IOMMU passthrough to prevent application hangs, and this host has two Radeon AI PRO R9700 cards. Added before the first inference run; not yet observed on gfx1201. | Drop once a ROCm release states that the default IOMMU mode is safe for multi-GPU gfx1201, or when the host runs a single GPU | 2026-10-13 | on a ROCm bump, or on the first hang report | active | +| WA-032 | `amdgpu.runpm=0` kernel parameter — `hosts/idols-aquamarine/hardware-amd-gpu.nix` | this board's DSDT advertises ATPX power control (`\_SB.PC00.GFX0.ATPX`) but never defines the `PEG0.PEGP._OFF`/`_ON` symbols its body calls, so the first idle resume of the headless R9700 leaves it in `runtime_status = error` (`resume of IP block failed -62`) until reboot, and amdgpu discards the ACPI error. Root cause, kernel-source trail and the measured field comparison: `hosts/idols-aquamarine/ROCM.md`. | Drop once a BIOS update defines those ACPI methods (upstream releases 1023/1066 exist for this board; a flash changes PCR7, so re-enroll TPM2), or a kernel release stops trusting ATPX when its power methods are missing | 2026-10-14 | on a BIOS update or kernel bump | active | +| WA-036 | catppuccin eval-time ports kept in the home closure (`home.extraDependencies`) — `home/base/core/theme.nix` | catppuccin/nix reads some ports at eval time (`lib.importTOML "${sources.starship}/.toml"`) and inlines the result, so the built port, catppuccin's build/install hooks and the fetched port source stay unreachable: every gc deletes them, and the deploy after it rebuilds them (build logs: 2026-10-16). `home.extraDependencies` records the port in the generation, which is a gc root. Also read at eval time upstream: `bottom`, `element` (option `element-desktop`), `firefox`, `rio`, `palette` (options `skim`, `tty`), `spotify-player`. | Drop once catppuccin/nix stops reading port files at eval time, or those ports come from a binary cache | 2026-10-16 | on a catppuccin bump | active | +| WA-039 | niri's NVIDIA free-buffer pool bounded (`GLVidHeapReuseRatio` 0) — `hosts/idols-ai/hardware-nvidia.nix` | the driver does not return freed vidmem buffers to its free pool, so niri's VRAM grows to ~1.1 GiB instead of the ~100 MiB its NVIDIA notes expect (measured 1137 MiB after 24 h uptime; [NVIDIA/egl-wayland#126](https://github.com/NVIDIA/egl-wayland/issues/126)) | Drop once a driver stops growing niri's VRAM without the profile, or niri ships its own default | 2026-10-19 | on an nvidia driver bump | active | +| WA-040 | `workaround` | Comodo AAA Services root blacklist — `modules/base/security.nix` | CVE-2026-111943. NixOS injects the entry itself, but nix-darwin only passes this list through; keep one explicit entry for both. The compromised eMudhra emSign roots are gone from the NSS bundle and were removed from the list. | Drop once nix-darwin carries the upstream default or both inputs handle the blacklist | 2026-10-20 | on nix-darwin bump | active | +| WA-041 | Monitor OSD "no-signal auto power-off" disabled — no code in this repo (the P32A2V OSD setting) | during a DPMS-off idle the panel drops and re-adds HPD every ~13 s, and after wake niri keeps scanning out while the panel stays dark until the monitor is power cycled; the panel's own auto power-off drives that state, so it is now disabled. Pinning the mode to 120 Hz did not change the symptom | Drop once a driver retrains the DP link after a DPMS wake, the monitor firmware stops cycling HPD, or this monitor is replaced | 2026-10-21 | confirm on the next full idle cycle, then on an nvidia or monitor firmware update | active | +| WA-042 | Colmena nodes set `system.nixos.versionSuffix` and `revision` from the flake's lib — `outputs/default.nix` (`rawColmenaHive`) | Colmena evaluates each node with nixpkgs' `eval-config.nix` and plain lib, which reports `26.11pre-git`, so without the override a Colmena deploy differs from the `nixosConfigurations` toplevel; the `colmena-parity` eval test guards the match | Drop once Colmena evaluates nodes with the flake's lib or accepts `nixosConfigurations` directly, keeping `colmena-parity` green | 2026-10-21 | on a colmena bump | active | If WA-008 freezes recur, the fallback is to restore the parameters commented out in `hosts/idols-ai/hardware-configuration.nix` — diff --git a/docs/nixos-modernization-options.md b/docs/nixos-modernization-options.md index 4b3e802d..e64d1660 100644 --- a/docs/nixos-modernization-options.md +++ b/docs/nixos-modernization-options.md @@ -277,14 +277,13 @@ are hard to attribute; no measured problem to solve yet. **Current:** systemd-boot on akane, shoukei and the VM hosts (shoryu, shushou, youko); GRUB on `/dev/vda` on the libvirt guests kana and ruby; no bootloader on the MicroVM guests; on idols-ai and aquamarine, lanzaboote provides Secure Boot with a `/etc/secureboot` (lzpt) bundle. The lanzaboote -flake input must track a rust-overlay follow (WA-003). +flake input is maintained separately for Secure Boot. **Proposed:** `boot.loader.limine` — in nixpkgs, with `secureBoot`, `validateChecksums`, `panicOnChecksumMismatch`, `biosSupport`, `maxGenerations`, graphical menu. **Pros:** one bootloader for UEFI and BIOS (covers the qemu guests' GRUB case); Secure Boot without -the lanzaboote flake input and its rust-overlay pin (WA-003 disappears); checksum validation of -kernel and initrd; nicer menu. +the lanzaboote flake input; checksum validation of kernel and initrd; nicer menu. **Cons:** different trust model — it signs **limine itself** and validates artifacts by checksum, rather than shipping a firmware-verified UKI, so `SECURITY.md` and the threat model must be updated; @@ -532,7 +531,7 @@ header) should then be trimmed to **adopt** items only. `services/system/{userborn,nix-daemon,zram-generator}.nix`, `services/monitoring/prometheus/exporters.nix`. - NixOS 26.05 release notes; Nix manual, Experimental Features. -- Repo context: `SECURITY.md` (trust zones and control limits), `WORKAROUNDS.md` (WA-001, WA-003, - WA-008, WA-009, WA-023), `modules/nixos/base/networking/mdns.nix`, +- Repo context: `SECURITY.md` (trust zones and control limits), `WORKAROUNDS.md` (WA-001, WA-008, + WA-009, WA-023), `modules/nixos/base/networking/mdns.nix`, `hosts/12kingdoms-youko/homelab-services/caddy.nix`, `hosts/12kingdoms-youko/homelab-services/README.md`. diff --git a/flake.lock b/flake.lock index 291d977d..0324e31d 100644 --- a/flake.lock +++ b/flake.lock @@ -68,11 +68,11 @@ ] }, "locked": { - "lastModified": 1789553013, - "narHash": "sha256-W5dvgFOuVs24X3G5tUb8C2IHU7ICXNvyGPiWWFjfbuo=", + "lastModified": 1793189487, + "narHash": "sha256-8objiXPnGhtvbOJGUhTDJkKKqMAcmzulmRnTkHRCykc=", "owner": "catppuccin", "repo": "nix", - "rev": "89b3eacf59d6b5eefbc2d69c3a4eb5aaf66d63bc", + "rev": "ddfe53d3304399d50a89ef6503b6ca1be9349fab", "type": "github" }, "original": { @@ -111,11 +111,11 @@ }, "crane": { "locked": { - "lastModified": 1781825982, - "narHash": "sha256-SlXKwIRIhrOSAcTjCB3ftPLzJWZStQIPS7J1FlZPnKk=", + "lastModified": 1789760033, + "narHash": "sha256-jtT4yxZpR8seYnlCMMWSSPlFN92zO6ICuZ8pJrmi86k=", "owner": "ipetkov", "repo": "crane", - "rev": "469fd08d0bcf6926321fa973c6777fbc87785dd7", + "rev": "73b980519cefc727a5f6cc8e5c0947a2f9be6edd", "type": "github" }, "original": { @@ -174,11 +174,11 @@ "nur-ryan4yin": "nur-ryan4yin" }, "locked": { - "lastModified": 1792600852, - "narHash": "sha256-K95TJliFJrD3ssB9jMEqEQ3R7qJtK5wd6tK9oy5ZZ9E=", + "lastModified": 1793290908, + "narHash": "sha256-EXQpNeSoiLhk3NsfETZxuWbMwZT/01l/uP5maVziiCI=", "owner": "ryan4yin", "repo": "dsh-nu", - "rev": "405e24541f8ea1c99bde545689e3d22819efe4ac", + "rev": "b3a7c6eb7383aea56fe1ebbfbf06e5592952713a", "type": "github" }, "original": { @@ -330,11 +330,11 @@ "nixpkgs-lib": "nixpkgs-lib" }, "locked": { - "lastModified": 1788450739, - "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=", + "lastModified": 1790898470, + "narHash": "sha256-zTwuwezD0w3hpga6a6P8emidzAZFyWqlNeRBlpWOOl8=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993", + "rev": "024633cd702b10285db5cb19b40ad48d2399ba60", "type": "github" }, "original": { @@ -351,11 +351,11 @@ ] }, "locked": { - "lastModified": 1788450739, - "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=", + "lastModified": 1790898470, + "narHash": "sha256-zTwuwezD0w3hpga6a6P8emidzAZFyWqlNeRBlpWOOl8=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993", + "rev": "024633cd702b10285db5cb19b40ad48d2399ba60", "type": "github" }, "original": { @@ -430,11 +430,11 @@ ] }, "locked": { - "lastModified": 1790091288, - "narHash": "sha256-2dUuLTiQrf2gUFVLlayDq/hgluitplAMv6Y9bYwQQ+c=", + "lastModified": 1791909798, + "narHash": "sha256-VAhpCOmrun/KXimYfR8NM88bciKCui7CqHHhThSzgag=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "0d3997c4d3253505f77c9bcea63904bb575da3c5", + "rev": "1ba1dbfe28738c9a71c266be6efa5b89e75491a9", "type": "github" }, "original": { @@ -468,28 +468,6 @@ "type": "github" } }, - "gitignore": { - "inputs": { - "nixpkgs": [ - "lanzaboote", - "pre-commit", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1709087332, - "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", - "owner": "hercules-ci", - "repo": "gitignore.nix", - "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", - "type": "github" - }, - "original": { - "owner": "hercules-ci", - "repo": "gitignore.nix", - "type": "github" - } - }, "haumea": { "inputs": { "nixpkgs": [ @@ -543,11 +521,11 @@ ] }, "locked": { - "lastModified": 1790949926, - "narHash": "sha256-56J++x9pn63GFJY9zP/z/c3DR4ZWg0aiWUP6TcnZB/U=", + "lastModified": 1793193205, + "narHash": "sha256-X6xa6sGA7RnJQuZGbFMC+K+KToWAlBDCCjJXfTwEPsw=", "owner": "nix-community", "repo": "home-manager", - "rev": "8ae04955022d033a24f9dbce7e1f4a04c01b1f31", + "rev": "095fef2f265c3c0da4fe315efba8f8a04495ab34", "type": "github" }, "original": { @@ -577,11 +555,11 @@ "i-have-adhd": { "flake": false, "locked": { - "lastModified": 1791329026, - "narHash": "sha256-5EYLKtrg0RQN0CHR51Sc2qSkgYklu6lqzuH87Dp3gv4=", + "lastModified": 1791734634, + "narHash": "sha256-GTqrnZxQvzo/ogAuUrffkOaMK1BYm/4rAZsnfmDt7DU=", "owner": "ryan4yin", "repo": "i-have-adhd", - "rev": "723af7d9afaf43eb871dbcce6129e2bf80de90d5", + "rev": "1ecea1993b7fce257ffbd686c070948b5e07eda6", "type": "github" }, "original": { @@ -597,21 +575,19 @@ "nixpkgs" ], "pre-commit": "pre-commit", - "rust-overlay": [ - "rust-overlay" - ] + "rust-overlay": "rust-overlay" }, "locked": { - "lastModified": 1782141370, - "narHash": "sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU=", + "lastModified": 1790423250, + "narHash": "sha256-sr4Kfp6yaXUeyKL6n0Y8/ElcR3momIRC20HFc+LF22s=", "owner": "nix-community", "repo": "lanzaboote", - "rev": "7c9a54a7f87b4539ddbd8bda09a8a5f5f9361aa9", + "rev": "c1c5edd31802d181c8aa2c71588995d93425d650", "type": "github" }, "original": { "owner": "nix-community", - "ref": "v1.1.0", + "ref": "v1.2.0", "repo": "lanzaboote", "type": "github" } @@ -625,11 +601,11 @@ "treefmt-nix": "treefmt-nix" }, "locked": { - "lastModified": 1791072324, - "narHash": "sha256-hm+VeaOyLQLe37IvSADW4IKIxTvm9W/nZDd+S7flKzU=", + "lastModified": 1793267696, + "narHash": "sha256-pU0HWLzBuoGIYLMIjoZNqiALCAUl9JwV6ujIyOZO3i4=", "owner": "numtide", "repo": "llm-agents.nix", - "rev": "4e0a04f23b1113a125efb0246f57752674ade3d9", + "rev": "e452052b9efb54fd59f8a06cbc09978fb542a3c2", "type": "github" }, "original": { @@ -662,11 +638,11 @@ "spectrum": "spectrum" }, "locked": { - "lastModified": 1790890970, - "narHash": "sha256-MV/BNWl8docJMxrNtkZ2/iw0FYMesyB69HKkLWk0r5s=", + "lastModified": 1793225170, + "narHash": "sha256-G/iL0mroLP5etLwYs55uyOyffMS4t+gpyXF06haba4w=", "owner": "microvm-nix", "repo": "microvm.nix", - "rev": "3f1540f254fe73ac907281b7de7d396bb3d54850", + "rev": "c37d37a876a3c4bd7ff78fcc716b2e4fac770360", "type": "github" }, "original": { @@ -716,11 +692,11 @@ ] }, "locked": { - "lastModified": 1786845137, - "narHash": "sha256-oQFip+v0luP8NIxJzmiW4Wu8bILsbFWom5l0zonl8hQ=", + "lastModified": 1792737899, + "narHash": "sha256-P0/GhewcEQmAbzq3QunNWY2jLJaYH9F6c/5dEM/jQ4M=", "owner": "lnl7", "repo": "nix-darwin", - "rev": "4cff07de74b50e64bdd68cd4e722ab5b6b35ee48", + "rev": "bb0b90dbd54e207100de72b5dcbe3188c98a4b69", "type": "github" }, "original": { @@ -768,11 +744,11 @@ ] }, "locked": { - "lastModified": 1790831398, - "narHash": "sha256-1auhLnjmGjabpn4CMKSSe+NR+KYWSvtsELn4xIzc6XA=", + "lastModified": 1793250639, + "narHash": "sha256-5ZT7ZVSqM0OFq7D7LtETkrV3TNQ6NoFsptFOI0OFK+Q=", "owner": "fufexan", "repo": "nix-gaming", - "rev": "5094744feadd342f2e9d0eec9de5529ce449aa75", + "rev": "46024210a12bf7203036f6e4d4d9318f96f488e7", "type": "github" }, "original": { @@ -831,11 +807,11 @@ ] }, "locked": { - "lastModified": 1791152654, - "narHash": "sha256-KSS03mAblpolVRQj2TIblaQLZWJxawUtp4YRMfUotGM=", + "lastModified": 1792772387, + "narHash": "sha256-MK6/UsOv1Ii71c+2U28GpmKn+Fm4MZG2TmIscuvUERw=", "owner": "nix-community", "repo": "nixos-apple-silicon", - "rev": "e9be72cb979725110b0ff9ea96e945e512525312", + "rev": "46e80bc641f5aaee6ed7ef90a12314a81492f48f", "type": "github" }, "original": { @@ -853,11 +829,11 @@ ] }, "locked": { - "lastModified": 1790821369, - "narHash": "sha256-z9JfAJQ3yk7C1QTMZMl+G8fo7i5wem5PW0I95epjHlQ=", + "lastModified": 1792779741, + "narHash": "sha256-Bv69px6ayex2DFXZnx398li2wj1TrTV+6AZlPXgSRzQ=", "owner": "nixpak", "repo": "nixpak", - "rev": "a7a1f41e342e5f597ae47581dfc76726d03a8be7", + "rev": "3b061c82f9ccb99973154ffced2391535da7b66b", "type": "github" }, "original": { @@ -868,11 +844,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1790600678, - "narHash": "sha256-6k3n7X2UsZ6tAlWTz99RimiZab+17tMUrw9sRUcELiA=", + "lastModified": 1793225069, + "narHash": "sha256-sx1f99WGrDfJ83KKuQrqGPmot0rnDgmpLJDzpU2oHQQ=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "f45c6f04c2f013f004bf94e284e95d72898d9393", + "rev": "e62746b0b472753ef019baceab6f1e2e52014980", "type": "github" }, "original": { @@ -882,22 +858,6 @@ "type": "github" } }, - "nixpkgs-2505": { - "locked": { - "lastModified": 1767313136, - "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=", - "owner": "nixos", - "repo": "nixpkgs", - "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d", - "type": "github" - }, - "original": { - "owner": "nixos", - "ref": "nixos-25.05", - "repo": "nixpkgs", - "type": "github" - } - }, "nixpkgs-blender": { "locked": { "lastModified": 1790950605, @@ -916,11 +876,11 @@ }, "nixpkgs-darwin": { "locked": { - "lastModified": 1790652569, - "narHash": "sha256-641r7xrlSOHYoktL9/aArPIYNgZJ9eM5URzSEOtPJDY=", + "lastModified": 1793225069, + "narHash": "sha256-sx1f99WGrDfJ83KKuQrqGPmot0rnDgmpLJDzpU2oHQQ=", "owner": "nixos", "repo": "nixpkgs", - "rev": "b6c8664de9b6cc07fe5666a29f91884ba81197c4", + "rev": "e62746b0b472753ef019baceab6f1e2e52014980", "type": "github" }, "original": { @@ -932,11 +892,11 @@ }, "nixpkgs-lib": { "locked": { - "lastModified": 1788057806, - "narHash": "sha256-DTQSMxzDWmT0zhguthvegnVkn7CFqGCv4IHCzk5ZUpM=", + "lastModified": 1790477367, + "narHash": "sha256-oujbxmVKDhci2E4EM3KyAbRUgp5/IsCoiA/LfEF7OOk=", "owner": "nix-community", "repo": "nixpkgs.lib", - "rev": "596e2e3940e09b2abbeb03f75fa1828c57fcd72c", + "rev": "f7cd230690d9fc982d06129f9189b101fddcfa3b", "type": "github" }, "original": { @@ -947,11 +907,11 @@ }, "nixpkgs-master": { "locked": { - "lastModified": 1790950605, - "narHash": "sha256-/q30U6phIKLz7EaV2VAKIJATIOrhmm5wigXz6cS9OnY=", + "lastModified": 1793276362, + "narHash": "sha256-DusxEOidL1xE8vKwiHSeY/CYwjgD+f5tS9QrEN/O4mE=", "owner": "nixos", "repo": "nixpkgs", - "rev": "4b8338e3113dc41bcf7695f56dc372107b7ff4c9", + "rev": "ceb48b970d5e3c98492ae6386187600c43ff2014", "type": "github" }, "original": { @@ -979,11 +939,11 @@ }, "nixpkgs-patched": { "locked": { - "lastModified": 1791119557, - "narHash": "sha256-9JIYNP4TxaQwyPoCQRp65xjeDxkjpxkL6t0ZMw2zXR4=", + "lastModified": 1791048980, + "narHash": "sha256-KgItSKML8Xvte0B7/uGnBDsYzSnnKHcOaiUbgWBXLXw=", "owner": "ryan4yin", "repo": "nixpkgs", - "rev": "78c0fce8e29f1cc8c3c7ef04fde9220c676766c8", + "rev": "a7868a727837f3c09cee2ce0ca671c76b1589fed", "type": "github" }, "original": { @@ -995,11 +955,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1790920529, - "narHash": "sha256-nQyFkMR78WP6PiXKkDW2SjqzLf/spQqjRuxRGSbcV8k=", + "lastModified": 1793183032, + "narHash": "sha256-56mFMf8heLNfYhcgbrh4GpN5x+G9JOfTFXZC3n6w0qM=", "owner": "nixos", "repo": "nixpkgs", - "rev": "774debe7a0d1b496e35677ad955a1011c6ff74f3", + "rev": "08d3a97586f6b6343b3b5e799980773629432610", "type": "github" }, "original": { @@ -1011,11 +971,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1791000213, - "narHash": "sha256-qsAQkushLI1nYI/Uz/OAufjcvg50bZBGBq25pe/jcWk=", + "lastModified": 1793225069, + "narHash": "sha256-sx1f99WGrDfJ83KKuQrqGPmot0rnDgmpLJDzpU2oHQQ=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "f71476e8faba8240824d77877d2da77cc42e6d00", + "rev": "e62746b0b472753ef019baceab6f1e2e52014980", "type": "github" }, "original": { @@ -1049,11 +1009,11 @@ ] }, "locked": { - "lastModified": 1792342725, - "narHash": "sha256-kalmu6yOiD8HiXoo2ipvQ12L4UXe2kk68ObaMHeVslw=", + "lastModified": 1793285532, + "narHash": "sha256-srlNGg3/PBb3DfaC9ROlYl68VjxJfKPJoddFSU89oOQ=", "owner": "ryan4yin", "repo": "nur-packages", - "rev": "a71fc275ec7dbbbb8b3e9ece422a2df7f55269db", + "rev": "4687255272d66973ee4a8c1b025ca9f84371b9a6", "type": "github" }, "original": { @@ -1069,11 +1029,11 @@ ] }, "locked": { - "lastModified": 1792342725, - "narHash": "sha256-kalmu6yOiD8HiXoo2ipvQ12L4UXe2kk68ObaMHeVslw=", + "lastModified": 1793285532, + "narHash": "sha256-srlNGg3/PBb3DfaC9ROlYl68VjxJfKPJoddFSU89oOQ=", "owner": "ryan4yin", "repo": "nur-packages", - "rev": "a71fc275ec7dbbbb8b3e9ece422a2df7f55269db", + "rev": "4687255272d66973ee4a8c1b025ca9f84371b9a6", "type": "github" }, "original": { @@ -1085,16 +1045,16 @@ "ponytail": { "flake": false, "locked": { - "lastModified": 1791476378, - "narHash": "sha256-diYM3gqcEboVi7OQff/SvlE0TKAIPTJDIggX7rZWslY=", + "lastModified": 1793243094, + "narHash": "sha256-CY0EifTY0UVc6/FPGVJjEfYEf/8QLsINQmoYYKZYh98=", "owner": "DietrichGebert", "repo": "ponytail", - "rev": "9cc65d03aa2da1db7121b912d03596409ee340b8", + "rev": "7801d061243d7b753bad0e0b3c057cd250b11755", "type": "github" }, "original": { "owner": "DietrichGebert", - "ref": "v5.1.0", + "ref": "v5.3.3", "repo": "ponytail", "type": "github" } @@ -1102,23 +1062,22 @@ "pre-commit": { "inputs": { "flake-compat": "flake-compat_2", - "gitignore": "gitignore", "nixpkgs": [ "lanzaboote", "nixpkgs" ] }, "locked": { - "lastModified": 1781733627, - "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=", + "lastModified": 1789514889, + "narHash": "sha256-PFD1nxptCXJyJoiYO1gf/5Vv43yqGpHtMC6LUhl9/pQ=", "owner": "cachix", - "repo": "pre-commit-hooks.nix", - "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39", + "repo": "git-hooks.nix", + "rev": "59f4ca0d063a1a3ec722c88b51a33004862e5379", "type": "github" }, "original": { "owner": "cachix", - "repo": "pre-commit-hooks.nix", + "repo": "git-hooks.nix", "type": "github" } }, @@ -1130,11 +1089,11 @@ ] }, "locked": { - "lastModified": 1790500375, - "narHash": "sha256-XN3sDtn8TU9hAc9xqZ+SqRB/HHm2wjxM6aSWYLJU+oo=", + "lastModified": 1791909798, + "narHash": "sha256-VAhpCOmrun/KXimYfR8NM88bciKCui7CqHHhThSzgag=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "a0e4241b51206fbcbf52fd322eb5f0cd80f153c4", + "rev": "1ba1dbfe28738c9a71c266be6efa5b89e75491a9", "type": "github" }, "original": { @@ -1145,11 +1104,11 @@ }, "preservation": { "locked": { - "lastModified": 1757436102, - "narHash": "sha256-mMI9IanU+Xw+pVogD2oT0I2kTmvz2Un/Apc5+CwUpEY=", + "lastModified": 1792953443, + "narHash": "sha256-s/A2rSO2Ndf8Y5yiouesnI/3Zkn9pmVGF2NxFxOUvx8=", "owner": "nix-community", "repo": "preservation", - "rev": "93416f4614ad2dfed5b0dcf12f27e57d27a5ab11", + "rev": "00be7f7dd1a11ae0605386f2272288de7cf33abe", "type": "github" }, "original": { @@ -1165,16 +1124,15 @@ ] }, "locked": { - "lastModified": 1789583109, - "narHash": "sha256-CwZHQHZBfo3furE7M/Qsc6TdU+3JRo7FPYSRtgYESU8=", + "lastModified": 1790136661, + "narHash": "sha256-2R03dOunHhpAIVzJObB4dVl66PwT0E8ilwe+zoPsk7I=", "owner": "ryan4yin", "repo": "pyclipsync", - "rev": "d0b6af8913c69c64fad4d00517e75674daaa9453", + "rev": "0b134383248faff0b2c8d3c9e8841322499ab7f8", "type": "github" }, "original": { "owner": "ryan4yin", - "ref": "v0.1.3", "repo": "pyclipsync", "type": "github" } @@ -1203,7 +1161,6 @@ "nixos-apple-silicon": "nixos-apple-silicon", "nixpak": "nixpak", "nixpkgs": "nixpkgs_2", - "nixpkgs-2505": "nixpkgs-2505", "nixpkgs-blender": "nixpkgs-blender", "nixpkgs-darwin": "nixpkgs-darwin", "nixpkgs-master": "nixpkgs-master", @@ -1216,7 +1173,6 @@ "pre-commit-hooks": "pre-commit-hooks", "preservation": "preservation", "pyclipsync": "pyclipsync", - "rust-overlay": "rust-overlay", "tuios": "tuios", "wallpapers": "wallpapers" } @@ -1224,15 +1180,16 @@ "rust-overlay": { "inputs": { "nixpkgs": [ + "lanzaboote", "nixpkgs" ] }, "locked": { - "lastModified": 1790928989, - "narHash": "sha256-5r3MN/Rx7N9tLapCBmUq6/zCc3C9J7gNif1HybD1fJQ=", + "lastModified": 1793261817, + "narHash": "sha256-fAvtOccUXHVAH5wXK+ABYUUC47W2qTb9T9EefLcS9ME=", "owner": "oxalica", "repo": "rust-overlay", - "rev": "368fee9beaab04ca6fe7af28db63caa9badb22fa", + "rev": "afcefd09c71e63663a46e4ce5e09968584f2c709", "type": "github" }, "original": { @@ -1295,11 +1252,11 @@ }, "systems_2": { "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "lastModified": 1791244623, + "narHash": "sha256-uuanbkFk8a313Zfrxdcz8Us/yQtaxNnKJtX8v0ZPpd8=", "owner": "nix-systems", "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "rev": "d36eeed142f88b5a636f2e3856a53c61654cf29b", "type": "github" }, "original": { @@ -1316,11 +1273,11 @@ ] }, "locked": { - "lastModified": 1786901030, - "narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=", + "lastModified": 1791885023, + "narHash": "sha256-C3alQ2MEt0zVrUSho5NUDo3jmhbff72++bfwoqT9Omo=", "owner": "numtide", "repo": "treefmt-nix", - "rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa", + "rev": "0d6d739a833ba9a9c93034862e4a7b061a062a1c", "type": "github" }, "original": { @@ -1364,16 +1321,16 @@ "treefmt-nix": "treefmt-nix_2" }, "locked": { - "lastModified": 1792258594, - "narHash": "sha256-1p9LCTwVuXQBFjWFpt9uvDorj/UvKh809RZy48prglU=", + "lastModified": 1793015645, + "narHash": "sha256-ifgOqJGihtLQIpdfNJZ27mhqGwKvJ/bxR2/4cmGR1q4=", "owner": "Gaurav-Gosain", "repo": "tuios", - "rev": "f8b7820aa685b28295af46e1f32fb20b0d8461dc", + "rev": "12dedac04d57a60ae02e58ea73c2aadb596c515c", "type": "github" }, "original": { "owner": "Gaurav-Gosain", - "ref": "v0.10.1", + "ref": "v0.11.1", "repo": "tuios", "type": "github" } diff --git a/flake.nix b/flake.nix index 982426c1..b904b352 100644 --- a/flake.nix +++ b/flake.nix @@ -27,10 +27,6 @@ inputs.nixpkgs.follows = "nixpkgs"; }; nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-26.05"; - # Kept for pinning a package that regressed in newer nixpkgs. Currently only - # kubernetes-helm uses it (home/base/tui/container.nix); extend or drop this - # input together with that consumer. - nixpkgs-2505.url = "github:nixos/nixpkgs/nixos-25.05"; # ryan4yin/nixpkgs fork for the `.agents/skills/nixpkgs-patched` workflow. It # currently carries no patches (see WORKAROUNDS.md), but `pkgs-patched` is @@ -76,15 +72,7 @@ }; lanzaboote = { - url = "github:nix-community/lanzaboote/v1.1.0"; - inputs.nixpkgs.follows = "nixpkgs"; - inputs.rust-overlay.follows = "rust-overlay"; - }; - - # lanzaboote's pinned rust-overlay still uses the deprecated - # `stdenv.isLinux`/`stdenv.isDarwin`; follow a newer revision. - rust-overlay = { - url = "github:oxalica/rust-overlay"; + url = "github:nix-community/lanzaboote/v1.2.0"; inputs.nixpkgs.follows = "nixpkgs"; }; @@ -152,7 +140,7 @@ # terminal window manager / multiplexer; nixpkgs lags behind upstream, # so track the upstream flake. tuios = { - url = "github:Gaurav-Gosain/tuios/v0.10.1"; + url = "github:Gaurav-Gosain/tuios/v0.11.1"; inputs.nixpkgs.follows = "nixpkgs"; }; @@ -201,7 +189,7 @@ flake = false; }; ponytail = { - url = "github:DietrichGebert/ponytail/v5.1.0"; + url = "github:DietrichGebert/ponytail/v5.3.3"; flake = false; }; ######################## My own repositories ######################################### @@ -237,9 +225,10 @@ inputs.nixpkgs.follows = "nixpkgs"; }; - # Wayland <-> X11 clipboard sync daemon for xwayland-satellite (niri) + # Wayland <-> X11 clipboard sync daemon for xwayland-satellite (niri). + # Track main while the upstream fix for pkgs.system has no release tag. pyclipsync = { - url = "github:ryan4yin/pyclipsync/v0.1.3"; + url = "github:ryan4yin/pyclipsync"; inputs.nixpkgs.follows = "nixpkgs"; }; }; diff --git a/home/base/core/shells/default.nix b/home/base/core/shells/default.nix index 6626c9d7..d23ac12d 100644 --- a/home/base/core/shells/default.nix +++ b/home/base/core/shells/default.nix @@ -8,6 +8,9 @@ programs.nushell = { enable = true; + # Adopt the 26.11 default: source Home Manager's session environment from + # env.nu instead of relying only on the bash-login wrapper. + loadSessionVariables = true; configFile.source = ./config.nu; }; } diff --git a/home/base/tui/agents/dsh.md b/home/base/tui/agents/dsh.md index a9bc970a..552de4dc 100644 --- a/home/base/tui/agents/dsh.md +++ b/home/base/tui/agents/dsh.md @@ -59,8 +59,9 @@ on, `$DSH_AGENTS_HOME/AGENTS.md` — so no patch row is needed; identical conten spawns. The plugin adds Nushell rules and a syntax guide, and rewrites the shell-tool descriptions, so the model is told what actually runs. `nu` is the Nushell `dsh-nu`'s flake resolves — Nixpkgs', through `inputs.nixpkgs.follows` — substituted into the rendered patch at build time, so it does not -depend on `PATH`. The bundle is tested with Nushell 0.115.1 and warns at evaluation time when the -resolved Nushell differs; drop the `follows` to build against its own pin instead. A command that +depend on `PATH`. The bundle still records Nushell 0.115.1 as its tested release; nix-config follows +the main nixpkgs and rewrites that manifest field to the resolved Nushell in `outputs/default.nix` +until dsh-nu retests, rather than pinning an older nixpkgs for the whole plugin. A command that hands a script file to a shell (`bash scripts/build.sh`) is refused, and the refusal names the direct `./scripts/build.sh` spelling; the guard itself is unchanged. diff --git a/home/base/tui/container.nix b/home/base/tui/container.nix index f8f859d1..4deab982 100644 --- a/home/base/tui/container.nix +++ b/home/base/tui/container.nix @@ -1,6 +1,5 @@ { pkgs, - pkgs-2505, nur-ryan4yin, ... }: @@ -30,7 +29,7 @@ kubectl-cnpg # cloudnative-pg's cli tool istioctl - pkgs-2505.kubernetes-helm + kubernetes-helm fluxcd # argocd ]; diff --git a/hosts/12kingdoms-shoryu/preservation.nix b/hosts/12kingdoms-shoryu/preservation.nix index c94fce40..ef15a87f 100644 --- a/hosts/12kingdoms-shoryu/preservation.nix +++ b/hosts/12kingdoms-shoryu/preservation.nix @@ -14,8 +14,6 @@ in ]; preservation.enable = true; - boot.initrd.systemd.enable = true; - environment.systemPackages = [ # `sudo gdu -x /` pkgs.gdu diff --git a/hosts/12kingdoms-youko/homelab-services/gitea.nix b/hosts/12kingdoms-youko/homelab-services/gitea.nix index c65b424a..10f022f7 100644 --- a/hosts/12kingdoms-youko/homelab-services/gitea.nix +++ b/hosts/12kingdoms-youko/homelab-services/gitea.nix @@ -22,7 +22,6 @@ PROTOCOL = "http"; HTTP_PORT = 3301; HTTP_ADDR = "127.0.0.1"; - DOMAIN = "git.writefor.fun"; ROOT_URL = "https://git.writefor.fun/"; }; # one of "Trace", "Debug", "Info", "Warn", "Error", "Critical" diff --git a/hosts/idols-ai/preservation.nix b/hosts/idols-ai/preservation.nix index 1e3598d1..506378e9 100644 --- a/hosts/idols-ai/preservation.nix +++ b/hosts/idols-ai/preservation.nix @@ -14,9 +14,6 @@ in ]; preservation.enable = true; - # pverservation required initrd using systemd. - boot.initrd.systemd.enable = true; - environment.systemPackages = [ # Whole-filesystem disk usage (`-x` stays on one filesystem): # sudo gdu -n -x / # non-interactive, plain text diff --git a/hosts/idols-aquamarine/preservation.nix b/hosts/idols-aquamarine/preservation.nix index c1b818d7..d99863c1 100644 --- a/hosts/idols-aquamarine/preservation.nix +++ b/hosts/idols-aquamarine/preservation.nix @@ -14,9 +14,6 @@ in ]; preservation.enable = true; - # preservation requires a systemd initrd. - boot.initrd.systemd.enable = true; - environment.systemPackages = [ # Whole-filesystem disk usage (`-x` stays on one filesystem): # sudo gdu -n -x / # non-interactive, plain text diff --git a/modules/base/security.nix b/modules/base/security.nix index 0844765b..027c1e90 100644 --- a/modules/base/security.nix +++ b/modules/base/security.nix @@ -4,13 +4,11 @@ ../../certs/ecc-ca.crt ]; - # Distrust the roots that signed the compromised eMudhra intermediates - # (Mozilla advisory, 2026-10-20). Upstream nixpkgs blacklists them as of - # NixOS/nixpkgs#576390; drop this once every consumed nixpkgs revision has it (WA-040). + # CVE-2026-111943. NixOS adds this entry itself, but nix-darwin only passes + # this list through, so keep it explicit for both platforms. The emSign roots + # are gone from the NSS bundle upstream; listing those names now makes + # buildcatrust fail, so they are intentionally absent. security.pki.caCertificateBlacklist = [ "Comodo AAA Services root" - "emSign ECC Root CA - G3" - "emSign Root CA - C1" - "emSign ECC Root CA - C3" ]; } diff --git a/modules/nixos/base/networking/mdns.nix b/modules/nixos/base/networking/mdns.nix index 287bd6e3..2e496520 100644 --- a/modules/nixos/base/networking/mdns.nix +++ b/modules/nixos/base/networking/mdns.nix @@ -27,11 +27,16 @@ in services.avahi = { enable = true; nssmdns4 = true; - publish = { - enable = true; - domain = true; - userServices = true; + settings.publish = { + disable-publishing = false; + disable-user-service-publishing = false; + publish-addresses = true; + publish-domain = true; }; + # The nixpkgs sunshine module still sets these legacy options. Force them + # to null so settings.publish above is the only source of truth. + publish.enable = lib.mkForce null; + publish.userServices = lib.mkForce null; }; # avahi and systemd-resolved both run an mDNS responder, which makes mDNS diff --git a/outputs/default.nix b/outputs/default.nix index e531c9a3..b390ed0f 100644 --- a/outputs/default.nix +++ b/outputs/default.nix @@ -18,6 +18,7 @@ let inherit system; config.allowUnfree = true; }; + in inputs // { @@ -31,11 +32,6 @@ let pkgs-stable ; - pkgs-2505 = import inputs.nixpkgs-2505 { - inherit system; - # To use chrome, we need to allow the installation of non-free software - config.allowUnfree = true; - }; pkgs-patched = import inputs.nixpkgs-patched { inherit system; # to use chrome, we need to allow the installation of non-free software @@ -60,7 +56,7 @@ let cudaCapabilities = [ "8.9" ]; }; }; - # NUR packages for this system, so modules use `myNurPkgs.dsh` instead of + # NUR packages for this system; modules use `myNurPkgs.dsh` instead of # repeating `nur-ryan4yin.packages.${pkgs.stdenv.hostPlatform.system}`. myNurPkgs = inputs.nur-ryan4yin.packages.${system}; };