agenix was pinned to a May 2025 revision, so `just up` could never move
it. Move to the 0.18.0 release tag and collapse its duplicate
nix-darwin/home-manager lock nodes via follows.
Remove a dead .gitattributes rule, bump the mirror workflow's checkout,
document the daemon test settings, drop unused JACK, and align the
installer's disko version.
* fix(ci): fail the eval-test run when the suite does not pass
`nix eval .#evalTests` prints the suite result but exits 0 either way, so
both `just test` and the CI workflow reported success even when a test
failed. Compare the raw boolean and fail instead.
* fix(ci): use --json for the boolean eval result
`nix eval --raw` cannot coerce a Boolean to a string, and Just runs each
recipe line as a separate `nu -c`, so the result variable must stay on one
line.
* feat!: replace zellij with tuios and switch to ghostty + kitty
Terminal environment overhaul:
- add the tuios flake input (upstream 0.8.5; nixpkgs has 0.8.1) and link
the checked-in config out-of-store; auto-start tuios in nushell instead
of zellij
- remove zellij entirely: both modules, config, README and nushell
completions
- remove foot and alacritty, which lack the Kitty graphics protocol;
Reuse the already-extracted, libtiff-patched AppImage from the nixpkgs wechat package (`wechat.src`) instead of keeping our own CDN URLs and hashes, which had to be refreshed whenever Tencent replaced the versionless files. Take the package from nixpkgs-master, which carries the newest builds.
- wechat.nix: repacking is needed because nixpkgs' wechat package does not expose its AppImage wrapper args for `.override`, not because wrapAppImage lacks overriding (it forwards args to buildFHSEnv).
- peripherals.nix: drop a link to an already-closed issue and fix a typo.
nixpkgs-blender tracked the nixpkgs master branch, so every `just up` re-bumped it and started a full Blender/CUDA source rebuild even though Blender stayed at 5.2.2 LTS. Pin it to a fixed rev so bumps are deliberate.
The OIDN cmake override is obsolete: nixpkgs#545542 made setupCudaHook add nvcc to CUDAToolkit_ROOT, fixing the CMake 4.3+ split-root failure (nixpkgs#544701). Dropping it also stops Blender's derivation from depending on nixpkgs-stable.
environment.enableAllTerminfo installs every terminal's terminfo, including rxvt-unicode, which no longer builds with GCC 16 (NixOS/nixpkgs#568896). Install just the terminals we use (alacritty, foot, ghostty, kitty) instead. This also makes the aarch64 jasper workaround unnecessary.
16 inputs moved; nixpkgs -> c59305bab206 (nixos-unstable, 2026-10-01), plus the
master/stable/darwin/blender/patched nixpkgs inputs and the module flakes
(home-manager, microvm, nixos-apple-silicon, nix-gaming, nixpak, llm-agents,
rust-overlay, flake-parts, git-hooks, nu_scripts).
Audited each moved revision through the GitHub compare API: no red flags
(substituters, trusted-users, activationScript, pre-commit hooks) in the inputs
examined. home-manager carries the rl-2611 extraConfig/mkForce change (affects
mbsync/lieer/mujmap/notmuch/astroid/grobi; none used here). The home-manager
compare is large, so the audit is not exhaustive and relies on the build.
Validated with `just test` (true), eval-host on the NixOS hosts, and
`just build-host ai-niri`; deployment passed. The build initially failed on
rxvt-unicode-unwrapped (GCC 16 std::lerp regression, nixpkgs#568896), pulled in
by environment.enableAllTerminfo; terminfo is now scoped to the terminals in use.
* feat(idols-ai): persist /var/tmp and small state dirs, wipe /var/tmp at boot
Move the strata model staging area (~3G) off the root tmpfs onto the
persistent btrfs volume to free RAM, preserve btrbk/cups/logrotate
state, and wipe /var/tmp at boot so it only accumulates between
reboots.
* chore(idols-ai): add nosuid,nodev to root tmpfs and tmp btrfs mounts
Hardens /, /tmp and /snapshots; safe because /dev, /run, /nix and
/run/setuid-programs are separate mounts, so nothing there needs suid
bits or device nodes.
* chore(idols-ai): add noatime to the @tmp btrfs mount
Temp files do not need access times; matches the @nix subvolume style
and saves btrfs metadata writes.
* chore(idols-ai): harden the /var/tmp bind mount with nosuid,nodev
World-writable staging data should not honor suid bits or device
nodes, same as /tmp and /snapshots.
* fix(idols-ai): preserve logrotate state as a file, fix persisted dir ownership
- /var/lib/logrotate.status is a regular file, not a directory: move it from
preservation directories to files. A missing state entry makes logrotate
treat every log as freshly rotated, so it must survive reboots.
- keep /var/lib/btrbk owned by btrbk:btrbk 0750 so preservation does not
override the btrbk module's rule with root:root.
- set /var/tmp mode 1777 explicitly instead of relying on systemd's tmp.conf
ordering.
- rewrite comments to describe the paths generically.
* chore(idols-ai): cap journal, wipe coredumps at boot, persist upower/noctalia
- services.journald.settings.Journal: SystemMaxUse=10G, RuntimeMaxUse=256M,
matching the cap already set on idols-kana/idols-ruby.
- wipe /var/lib/systemd/coredump at boot: it lives in the persisted
/var/lib/systemd and crash dumps can contain secrets copied from memory.
- persist /var/lib/upower (device battery history) and
~/.local/state/noctalia (shell settings, notification/clipboard history).
Running strata with qwen3.8-flash-next keeps ~53G of model weights
resident, leaving little RAM for the desktop side and pushing ~13G of
anonymous pages into the 20G swapfile. With swap that full, a burst
risks OOM-killing processes. Disk space is not a constraint (1.9T
btrfs, ~1.4T free), so grow the swapfile to the classic 1x-RAM size.
Keep zram off and zswap at 10%: zram's compressed pool would steal page
cache that the mmap'd weights rely on.
Prefer the narrowest output of a dependency (for example stdenv.cc.cc.lib
instead of stdenv.cc.cc) and measure the built closure, since a full
toolchain can add hundreds of MiB. Also note how to check what is actually
needed (DT_NEEDED, exec'd tools) before trimming.
Disable the rootful system podman.socket on desktop hosts and drop the module's autoPrune, which prunes the rootful store and pulls in the rootful API service. Add a weekly per-user timer that prunes the rootless store instead.
Manage ~/.config/go-musicfox/config.toml declaratively: the upstream default plus the mpv engine, ~/Music download dir, 2 GiB cache and cover art.
The app rewrites the file with a temp file plus rename, which would replace a plain symlink, so use force = true like fcitx5's profile: the repo copy is restored on every rebuild and runtime edits are ephemeral. Runtime data and state stay on the persistent volume.
* feat(secrets): add work gitconfig secret, symlink it in home-manager
* feat(secrets): add a no-sudo replace recipe for new secrets
* refactor(secrets): move work gitconfig symlink into the desktop layer
* docs(skills): point nix-config-secrets at the private repo under ~/codes
Record where the private nix-secrets checkout lives and that agents should
do the mechanical secret work themselves, handing back only the
interactive/sudo agenix operations and pushes.
* docs(agents): add related repositories to nix-config
* chore(agents): adopt ~/src for source checkouts
Move third-party/source checkouts from ~/codes/src to ~/src so the home
layout reads as three siblings: ~/codes (personal), ~/work (work),
~/src (checkouts). Preserve and back up the new path, and update the
global rule and the two nixpkgs skill references.
* docs(agents): tighten the code layout rule
* docs(agents): fold the work-confidentiality note into the layout line
* docs(agents): base the confidentiality rule on repo visibility
* docs(agents): drop the stale KubeVirt mention
Catppuccin's home-manager module writes extra-substituters/extra-trusted-public-keys
for catppuccin.cachix.org into the user-level ~/.config/nix/nix.conf. Since the
normal user is no longer a trusted-user (modules/base/nix.nix), Nix ignores those
client-specified settings and warns on every command. The ports build locally, so
turn the user-level cache off instead.
nixvim has been disabled for a long time (programs.nixvim.enable = false), so
drop the flake input (and prune flake.lock). Port the settings it carried to
Home Manager's programs.neovim: opts and per-plugin setup become an initLua
block plus a plugin list. The catppuccin module already provides the
colorscheme, vi stays unmapped, and the plain system neovim package is
untouched so sudo/nvim --clean keep using it.
ryan4yin | 二花
Ryan Yin