starred/nix-config
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-08-31 15:27:13 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity
2,266 Commits 5 Branches 35 Tags
be6e2b411043d8a2f758a65dbeda67677c92caaf
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ryan Yin be6e2b4110 security: bind aquamarine metrics exporters to loopback 2026-08-26 18:14:43 +08:00
Ryan Yin 36c29a8371 security: enable AppArmor (complain) on all Linux hosts 2026-08-26 18:14:43 +08:00
Ryan Yin b46bb471d8 test: fix security-firewall eval test to scalar per-host values 2026-08-26 18:14:43 +08:00
Ryan Yin 72a6e95cab security: make firewall secure-by-default, disable explicitly on servers 
Flip the base firewall default to ON so new hosts are protected by default. Servers keep the firewall off (trusted internal LAN, WAN protected at the router) via explicit overrides in modules/nixos/server/{server,server-aarch64}.nix. Behavior-preserving for all 18 current hosts; adds a security-firewall eval test guarding the per-host state.
 2026-08-26 18:14:43 +08:00
Ryan Yin 7364d5aa1b feat(home): add pyclipsync clipboard sync service for niri 
xwayland-satellite has no compositor-level clipboard bridging, so X11
clients (WeChat/QQ) and Wayland clients cannot see each other's clipboard.
Add the pyclipsync flake input and enable its home-manager module, which
installs the daemon as a systemd user service bound to the graphical session.
 2026-08-25 17:31:03 +08:00
Ryan Yin 166376676b docs(agents): clarify command waiting and environment rules 2026-08-25 17:17:31 +08:00
Ryan Yin d91b861cd6 feat(bwraps): update wechat to 4.1.1.8 2026-08-25 13:41:34 +08:00
Ryan Yin cd539925f0 fix(flake): update rust-overlay to silence stdenv.is* deprecation warnings 
Lanzaboote's nested rust-overlay input (2026-06-21) used the now-deprecated
stdenv.isLinux/stdenv.isDarwin aliases in mk-aggregated.nix, triggering two
evaluation warnings on nixpkgs 26.11 (where these aliases gained lib.warn).

rust-overlay fixed this treewide in 892c035d (2026-08-13); update the nested
input to master (f60c1b57, 2026-08-23).
 2026-08-24 10:01:15 +08:00
Ryan Yin 6e32a3ef27 fix(Justfile): fmt via external find to not follow result symlink 2026-08-24 00:33:36 +08:00
Ryan Yin c33b68c7bb fix(home): let atuin own Ctrl-R, disable fzf history widget 2026-08-24 00:33:30 +08:00
Ryan Yin b2e19840d0 fix(home): disable catppuccin theme for removed gemini-cli 2026-08-24 00:33:24 +08:00
Ryan Yin 7cba098b07 fix(home): replace deprecated stdenv.is* with hostPlatform.is* 2026-08-24 00:33:22 +08:00
Ryan Yin 3c361f316f fix(home): explicitly enable home.pointerCursor 2026-08-24 00:33:02 +08:00
Ryan Yin 9df14d8c39 chore(obs): comment out unused plugins 
Keep only the plugins actually in use (screen capture, gstreamer,
input-overlay, multi-rtmp, source-clone, pipewire audio, vaapi);
disable the rest (teleport, droidcam, vkcapture, shaderfilter,
record, livesplit, looking-glass, vintage-filter, command-source,
move-transition, backgroundremoval, 3d-effect).
 2026-08-23 20:06:33 +08:00
Ryan Yin 598bb470db fix(nushell): import argx & lg with prefix to avoid shadowing builtins 
`use modules/argx *` glob-imports argx's `parse` command into the global
scope, shadowing nushell's builtin `parse`. Any script sourced afterwards
that relies on the builtin (e.g. fzf's nushell integration, which uses
`parse --regex`) then fails to parse with `unknown flag`.

Use prefixed imports for `argx` and `lg` instead of `*`: both modules are
still registered for the kubernetes module's submodules (which call
`argx parse` / `lg level`), there are no bare `parse`/`main`/`level` call
sites, and the builtin `parse` stays available.
 2026-08-23 20:06:33 +08:00
Ryan Yin 5498988ef9 flake.lock: Update 
Flake lock file updates:

• Updated input 'home-manager':
    'github:nix-community/home-manager/7d8127d308c3fb9664f7e643eec944be74ebb37d?narHash=sha256-efIPwVGtIWIjWcznhaop6XN6HxnOL8800hF6CBNvlqQ%3D' (2026-05-30)
  → 'github:nix-community/home-manager/ec1a8fdf74ed3f276148ee106299a2ba0e65d51f?narHash=sha256-XL2qfqmocfsvuEGyomZg4nOZfkuSe8vZtrOX99I%2Bb6I%3D' (2026-08-22)
• Updated input 'llm-agents':
    'github:numtide/llm-agents.nix/76f2e1f07e0435873d08e7f8a07dbe18f237ec5c?narHash=sha256-IiNvo9rlL9ncnLOp70Mo1toobC2t9xHzsZIZayEv7dg%3D' (2026-08-10)
  → 'github:numtide/llm-agents.nix/5fae6955fa522382e640b65876fb2f456059f4c2?narHash=sha256-JzRwvboh8r37Coj6UhtnDiL0LIdPyz3%2B0zknDqS1zi0%3D' (2026-08-23)
• Updated input 'llm-agents/nixpkgs':
    'github:NixOS/nixpkgs/70ce234312134a463ba7728e94da2486a1d237ac?narHash=sha256-X44cn5rzytELc3NNoQsh0aLkjWA/QzPfc6HPQmsG3sU%3D' (2026-08-06)
  → 'github:NixOS/nixpkgs/391b592eb44808b3bd0cb80bb71b63a5a118b8bb?narHash=sha256-WvvHR4kSQLAbtouMC/ruZ5UpLwlUcY3K4FAllMN%2ByGk%3D' (2026-08-20)
• Updated input 'llm-agents/treefmt-nix':
    'github:numtide/treefmt-nix/ae7910970dddc408fe6ab1c8e4b277bb21d72dc0?narHash=sha256-NLSyTCW4K4ofhNBllt3omPasm6QpralXH1DBZOc91Dw%3D' (2026-08-05)
  → 'github:numtide/treefmt-nix/27b3b12a8e6375f28ebe122f07d230ca5459bbfa?narHash=sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE%3D' (2026-08-16)
• Updated input 'nix-darwin':
    'github:lnl7/nix-darwin/56c666e108467d87d13508936aade6d567f2a501?narHash=sha256-zXcwYQGCT6pzinK%2B1dBB2ekTVtfxGZAapb3Evdcu4fY%3D' (2026-05-17)
  → 'github:lnl7/nix-darwin/4cff07de74b50e64bdd68cd4e722ab5b6b35ee48?narHash=sha256-oQFip%2Bv0luP8NIxJzmiW4Wu8bILsbFWom5l0zonl8hQ%3D' (2026-08-16)
• Updated input 'nix-gaming':
    'github:fufexan/nix-gaming/ec11c77819f9736dc9f5fd17b979df24f9bd3e94?narHash=sha256-YdfiXMkJki1hghjaPmK2epJQYUjsbvDFiecaqTUx09U%3D' (2026-05-31)
  → 'github:fufexan/nix-gaming/daa997a8979f01a0defcc2065ba824c65bb461f6?narHash=sha256-BXGiZoNdYzfs5ZqsSlSvNvMgcL4%2Bje67BRUoyXY%2Bfjw%3D' (2026-08-23)
• Added input 'nix-gaming/flake-compat':
    'github:NixOS/flake-compat/5edf11c44bc78a0d334f6334cdaf7d60d732daab?narHash=sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns%3D' (2025-12-29)
• Updated input 'nix-gaming/flake-parts':
    'github:hercules-ci/flake-parts/f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb?narHash=sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4%3D' (2026-05-13)
  → 'github:hercules-ci/flake-parts/427bf4bd9435fdf21321c8cc628c24efc14c0f7a?narHash=sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw%3D' (2026-08-01)
• Updated input 'nix-gaming/flake-parts/nixpkgs-lib':
    'github:nix-community/nixpkgs.lib/f5901329dade4a6ea039af1433fb087bd9c1fe14?narHash=sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ%3D' (2026-04-26)
  → 'github:nix-community/nixpkgs.lib/0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c?narHash=sha256-OmshNvn2vupOFpYinLUu%2B1Dnpu4n7Q5N3ggGVNHpkUI%3D' (2026-07-26)
• Updated input 'nix-gaming/git-hooks':
    'github:cachix/git-hooks.nix/61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a?narHash=sha256-kTwur1wV%2B01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs%3D' (2026-05-11)
  → 'github:cachix/git-hooks.nix/809414f0cdadf82cf11b06c2b29ba9b3168b3297?narHash=sha256-O2tBn84NNuHrnqNVxx/XqsXwfYvS1YwBh%2B7CBnbCYsk%3D' (2026-08-22)
• Updated input 'nix-gaming/git-hooks/flake-compat':
    'github:NixOS/flake-compat/5edf11c44bc78a0d334f6334cdaf7d60d732daab?narHash=sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns%3D' (2025-12-29)
  → follows 'nix-gaming/flake-compat'
• Removed input 'nix-gaming/git-hooks/gitignore'
• Removed input 'nix-gaming/git-hooks/gitignore/nixpkgs'
• Updated input 'nixos-apple-silicon':
    'github:nix-community/nixos-apple-silicon/5723dd7b3d7132144287513a398442ae5b57397b?narHash=sha256-Qrgy2wSZ%2BOJ/qf7CKV5wfwFrgSXqBT5MR%2BBFQpyxCLM%3D' (2026-05-30)
  → 'github:nix-community/nixos-apple-silicon/53798a0eb0fa4c8cfaeca7bdc5b4ad22ed210c95?narHash=sha256-zRPYCn5RJWxr9uyUwNIQjPsTFcIFRwuRnI91dqvGA0k%3D' (2026-08-16)
• Updated input 'nixpak':
    'github:nixpak/nixpak/fea2dec31d7405cccbd6b4ce35bb30348108bd04?narHash=sha256-xY%2Bv%2BEnRMvROziet7d/qIC6rd/y219HsSoUZrRHhF%2B0%3D' (2026-05-31)
  → 'github:nixpak/nixpak/333bd8c7ca0c014e61be1933b3c131c9dfa20218?narHash=sha256-eh6isB4Gt3Wry1fPqRI1qKWySjDbalvaBwToG82jcR4%3D' (2026-07-26)
• Updated input 'nixpak/flake-parts':
    'github:hercules-ci/flake-parts/f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb?narHash=sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4%3D' (2026-05-13)
  → 'github:hercules-ci/flake-parts/17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e?narHash=sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w%2B6NWK9yA%3D' (2026-07-01)
• Updated input 'nixpak/hercules-ci-effects':
    'github:hercules-ci/hercules-ci-effects/af4331c44f13977b6964745454eadcfee2d244d1?narHash=sha256-OOEWyt8ma7QAysDbiP65J7li7KIdtZfnbA11gFnwyEI%3D' (2026-05-16)
  → 'github:hercules-ci/hercules-ci-effects/86c7c78a840b44b1a0a5cbc7e9baa0154c0d0f3f?narHash=sha256-vy0EiuiLRKWbXYOqdEKoy5ImlbHcdMC52x9BcC/MwQ8%3D' (2026-06-15)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/8e2eeb9477c9d40009a5bd51cd3eef2f5abb26f1?narHash=sha256-JTbODJPDcd3d8U7lO4MVUU3Yo0jz2KQSAHXka%2BIWBEo%3D' (2026-08-11)
  → 'github:nixos/nixpkgs/2c423e03bbafcff28bfadc6781a4a8257f205cb5?narHash=sha256-dt4WdcvsA8/RCe%2BVZZwqU0X%2BXMM3wBbGCWA0/sFWzGo%3D' (2026-08-22)
• Updated input 'nixpkgs-blender':
    'github:nixos/nixpkgs/596a0d7dc02bb847b5f4cb44a20a15ff12275bb3?narHash=sha256-bf8Gay/Vopie4kGiw1qg1PQBKL4MNU7Li9ThI80JE1c%3D' (2026-07-24)
  → 'github:nixos/nixpkgs/c2c93465e2871183025a30c52d19b6804311526f?narHash=sha256-8cgQR83UlOCuSkmKvOQcHTiRrSknUqTUbnRM7ai4obI%3D' (2026-08-23)
• Updated input 'nixpkgs-darwin':
    'github:nixos/nixpkgs/e9a7635a57597d9754eccebdfc7045e6c8600e6b?narHash=sha256-u6WU/yd/o8iYQrHX3RAwO1hYa3LkoSL%2BWNQD0rJfJZQ%3D' (2026-05-29)
  → 'github:nixos/nixpkgs/a831408e6378bc02ebf8cc09b52c96ca86f6bab4?narHash=sha256-NcYt9QJfpJiF1lAyN8BDPB4EeScbPU%2BEwQqPiBElrpU%3D' (2026-08-22)
• Updated input 'nixpkgs-master':
    'github:nixos/nixpkgs/38feebd13bb995c67c97133f7303924e3242dd8c?narHash=sha256-N6ZarU/L7Jk%2BOZvo%2Bs%2B8TfcW1ToxGhsZ3AW9pB/XISI%3D' (2026-08-18)
  → 'github:nixos/nixpkgs/c2c93465e2871183025a30c52d19b6804311526f?narHash=sha256-8cgQR83UlOCuSkmKvOQcHTiRrSknUqTUbnRM7ai4obI%3D' (2026-08-23)
• Updated input 'nixpkgs-stable':
    'github:nixos/nixpkgs/b51242d7d43689db2f3be91bd05d5b24fbb469c4?narHash=sha256-K5sT4jTpGs15ADhviMKNBH38REpPf5Q6mM1%2BN6cArVE%3D' (2026-05-31)
  → 'github:nixos/nixpkgs/5880666fd9eb563038431edb35c2d0aa595884e6?narHash=sha256-OURZPknrTjQrlNyxPdqzyqmU/81Wes1CUP/Ft1Rv/YI%3D' (2026-08-20)
• Updated input 'nixvim':
    'github:nix-community/nixvim/167da56c3ab1e51751a6ae4a997ed66587f9edae?narHash=sha256-Bfq9y0X6Vs4UPb67u7hN3jt7fJKHtl3%2Bg0lBSDebRNg%3D' (2026-05-31)
  → 'github:nix-community/nixvim/b397fb9f6950d57355d62bb92457d223464e0115?narHash=sha256-Hj/nkhKDv0aJly1PAUstrhrgEYn1mVSkLIYMh90r/Pc%3D' (2026-08-16)
• Updated input 'nixvim/flake-parts':
    'github:hercules-ci/flake-parts/f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb?narHash=sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4%3D' (2026-05-13)
  → 'github:hercules-ci/flake-parts/427bf4bd9435fdf21321c8cc628c24efc14c0f7a?narHash=sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw%3D' (2026-08-01)
• Updated input 'nur-ryan4yin':
    'github:ryan4yin/nur-packages/ab573501bbbe38f38818afb5b2d0e1f58ba61f29?narHash=sha256-PKkRUkMgpvqAPmGBCSNL1R0MfoaaoQpvH1ffiNwJkQ8%3D' (2026-04-08)
  → 'github:ryan4yin/nur-packages/c3207ff6d6bed0a35511b0fb7133d07d4b00e118?narHash=sha256-1gIhdoBDzKv0T%2BNsqYFkjEDiwAeI%2BdDab1Dfg4bavO0%3D' (2026-06-23)
• Updated input 'pre-commit-hooks':
    'github:cachix/git-hooks.nix/61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a?narHash=sha256-kTwur1wV%2B01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs%3D' (2026-05-11)
  → 'github:cachix/git-hooks.nix/809414f0cdadf82cf11b06c2b29ba9b3168b3297?narHash=sha256-O2tBn84NNuHrnqNVxx/XqsXwfYvS1YwBh%2B7CBnbCYsk%3D' (2026-08-22)
• Removed input 'pre-commit-hooks/gitignore'
• Removed input 'pre-commit-hooks/gitignore/nixpkgs'
 2026-08-23 17:54:25 +08:00
Ryan Yin 95088c4ff8 fix(nixpaks): route qq via pkgs-master for 3.2.32-2026-08-12 2026-08-18 09:59:45 +08:00
Ryan Yin 9670cb065e flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs-master':
    'github:nixos/nixpkgs/a3d21f34e0fd3284dc9a7484c53d6b9ffc4cb41b?narHash=sha256-7RfqWnitmg%2BII4IxlFteaJijrlGmYNVyXtxouavxuX0%3D' (2026-08-15)
  → 'github:nixos/nixpkgs/38feebd13bb995c67c97133f7303924e3242dd8c?narHash=sha256-N6ZarU/L7Jk%2BOZvo%2Bs%2B8TfcW1ToxGhsZ3AW9pB/XISI%3D' (2026-08-18)
 2026-08-18 09:51:16 +08:00
Ryan Yin 334e53a187 flake.lock: Update 
Flake lock file updates:

• Updated input 'nu_scripts':
    'github:ryan4yin/nu_scripts/ff8092707054ad091d67bd408374a39977e33c1b?narHash=sha256-oxnXzxQkNccCs36j%2BaMzg4QGHDcX7niJruqxCkeg0LM%3D' (2025-11-11)
  → 'github:ryan4yin/nu_scripts/381eb7577705b00bea437da7c0439c39ff05f06b?narHash=sha256-b4/JOcpUa2BittwZz/w3IPUik4QPlpqcgc2dgDDbb1E%3D' (2026-07-19)
 2026-08-16 16:26:45 +08:00
Ryan Yin 78fc64e136 fix(neovim): disable nixvim manpage on broken nixpkgs pin 2026-08-16 15:40:12 +08:00
Ryan Yin bb13a43ff9 fix(nixpaks): route qq via pkgs-patched for 3.2.32-2026-07-30 2026-08-16 15:40:11 +08:00
Ryan Yin fd4f61f710 flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs-patched':
    'github:ryan4yin/nixpkgs/4425024452e93ce3d10e11bcd9b47f1dfa78593b?narHash=sha256-pu3loLm4gvcbh8iibeYDGgPHOVFXb8sAKEzJ9AxX5L4%3D' (2026-06-03)
  → 'github:ryan4yin/nixpkgs/5d9f7ea174a0cb08dcc36eba9b8f67615962ece9?narHash=sha256-zd5dQC9Y6Q8FtfqAbNJTFmbwpyqaeFuZ9Ww5YjpIsaQ%3D' (2026-08-16)
 2026-08-16 14:41:58 +08:00
Ryan Yin 663df05ce7 flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/d407951447dcd00442e97087bf374aad70c04cea?narHash=sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU%2BK27sk%3D' (2026-07-05)
  → 'github:NixOS/nixpkgs/8e2eeb9477c9d40009a5bd51cd3eef2f5abb26f1?narHash=sha256-JTbODJPDcd3d8U7lO4MVUU3Yo0jz2KQSAHXka%2BIWBEo%3D' (2026-08-11)
 2026-08-16 14:36:17 +08:00
Ryan Yin 21c76cf9cc fix(nixpaks): route qq via nixpkgs-master for 3.2.32-2026-07-30 2026-08-15 20:53:50 +08:00
Ryan Yin 5537790829 flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs-master':
    'github:nixos/nixpkgs/a3eff1e98209f4c27139b231521a886df64fcaab?narHash=sha256-3ZsD71dKOmllzulAwsWXUgnzQzUZt8n91kDPTKxKebY%3D' (2026-07-22)
  → 'github:nixos/nixpkgs/a3d21f34e0fd3284dc9a7484c53d6b9ffc4cb41b?narHash=sha256-7RfqWnitmg%2BII4IxlFteaJijrlGmYNVyXtxouavxuX0%3D' (2026-08-15)
 2026-08-15 20:47:05 +08:00
Ryan Yin 9842a8a17f feat(nushell): add lsa & dus wrappers to prevent column truncation 
`lsa` (ls -al) and `dus` (du) render the table at a fixed width of 350 so
columns like size/apparent/physical are never dropped to "..." when the
natural table is wider than the terminal.
 2026-08-15 20:35:15 +08:00
Ryan Yin 495c366938 fix(xdg): order autostart apps after xdg-desktop-portal 
At login the xdg-autostart-generator starts apps at
graphical-session.target, racing the portal user services. Sandboxed
apps (nixpak firefox/telegram) end up with broken FileChooser/OpenURI
until manually restarted.

Add a template drop-in on app-@autostart.service that makes every
autostart app wait for the portal stack.
 2026-08-15 00:47:59 +08:00
Ryan Yin 88e916b63e flake.lock: Update 
Flake lock file updates:

• Updated input 'llm-agents':
    'github:numtide/llm-agents.nix/6c650f7597e3f212395e4fdba754bf6537cc2298?narHash=sha256-cS5Rv01brbs95/a5NrNCxKLqMZWkFnRRZXdmz2NZnQs%3D' (2026-07-22)
  → 'github:numtide/llm-agents.nix/76f2e1f07e0435873d08e7f8a07dbe18f237ec5c?narHash=sha256-IiNvo9rlL9ncnLOp70Mo1toobC2t9xHzsZIZayEv7dg%3D' (2026-08-10)
• Updated input 'llm-agents/bun2nix':
    'github:nix-community/bun2nix/5a39d717029e94163ac223aee8d5c9946cafed1c?narHash=sha256-s9BuFv0mRuZx9C1MF8qPHRdcAK14ONi0A5m6E2wqOoM%3D' (2026-06-29)
  → 'github:nix-community/bun2nix/0f2a1f0b6f42cebe3b149bf62d38754c5e0e9729?narHash=sha256-9BMxlTxCCDAeoNLtb1a/st7udtTIJep%2BwpUzquA29VU%3D' (2026-07-21)
• Updated input 'llm-agents/flake-parts':
    'github:hercules-ci/flake-parts/17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e?narHash=sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w%2B6NWK9yA%3D' (2026-07-01)
  → 'github:hercules-ci/flake-parts/427bf4bd9435fdf21321c8cc628c24efc14c0f7a?narHash=sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw%3D' (2026-08-01)
• Updated input 'llm-agents/nixpkgs':
    'github:NixOS/nixpkgs/421eebfd0ec7bccd4abe826ce62d7e6e83129493?narHash=sha256-/FCliTPgiuV1owejZFNx3Ch9irdvkOfOFl%2BHHZ%2BDrtM%3D' (2026-07-20)
  → 'github:NixOS/nixpkgs/70ce234312134a463ba7728e94da2486a1d237ac?narHash=sha256-X44cn5rzytELc3NNoQsh0aLkjWA/QzPfc6HPQmsG3sU%3D' (2026-08-06)
• Updated input 'llm-agents/treefmt-nix':
    'github:numtide/treefmt-nix/df3c0640565d04a0261253cdd89fce78ec50168a?narHash=sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0%3D' (2026-07-18)
  → 'github:numtide/treefmt-nix/ae7910970dddc408fe6ab1c8e4b277bb21d72dc0?narHash=sha256-NLSyTCW4K4ofhNBllt3omPasm6QpralXH1DBZOc91Dw%3D' (2026-08-05)
 2026-08-10 09:58:22 +08:00
Ryan Yin a804c56263 chore: add qrtool & herdr 2026-08-07 14:15:26 +08:00
Ryan Yin 58e056486d docs(agents): allow scoped secret authentication 2026-08-05 10:13:16 +08:00
Ryan Yin 6f837b8718 docs(agents): clarify cleanup safety boundaries 2026-08-05 10:06:04 +08:00
Ryan Yin c0f50a7d4a fix(bambu-studio): adjust HiDPI text scaling 2026-08-05 09:14:33 +08:00
Ryan Yin 6f100d94a9 feat(gh): persist user-managed configuration 2026-08-04 17:45:24 +08:00
Ryan Yin cce15300d6 feat(niri): reorganize workspaces 2026-08-03 22:42:37 +08:00
Ryan Yin 20dac3bb84 docs(zoom-us): screen capture mode 2026-08-01 10:28:01 +08:00
Ryan Yin 6264190c49 fix(idols-ai): reset camera after resume 2026-08-01 10:04:22 +08:00
Ryan Yin 7826934b23 fix(nixpak): allow document portal saves 2026-08-01 09:37:43 +08:00
Ryan Yin 3aadd65a36 fix(telegram): preserve Wayland app ID in nixpak 2026-07-31 17:35:31 +08:00
Ryan Yin 41512097e5 feat(grafana): add kubernetes service and storage dashboards 2026-07-31 17:34:52 +08:00
Ryan Yin 071212e40f feat(niri): reorganize workspace layout 2026-07-31 12:06:27 +08:00
Ryan Yin ac96c62cbe fix(niri): position Zoom toolbar at bottom 2026-07-31 11:07:07 +08:00
Ryan Yin e43ae1625c fix(niri): handle Zoom auxiliary windows 2026-07-31 11:01:38 +08:00
Ryan Yin 5c5bbe3210 docs: agents - add secres access policy 2026-07-28 18:28:12 +08:00
Ryan Yin 64ecc1cf66 fix(grafana): scope hwmon joins to selected node 2026-07-27 20:57:10 +08:00
Ryan Yin 095dc5dee8 feat(desktop): enable the firewall on desktop machines 
Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-26 22:26:01 +08:00
Ryan Yin 74598b6f6b chore(monitoring): stop scraping offline hosts, mute noisy alert levels 
- Add an offlineHosts list to VictoriaMetrics scrape generation: SBCs
  and the whole k3s-prod-1 cluster are powered off, shoukei's exporter
  is disabled on the machine; also comment out the dnsmasq-exporter
  job (runs on suzi).
- Disable node-exporter on shoukei: a laptop on untrusted networks
  should not expose :9100 (the firewall is off repo-wide).
- Route severity none|info alerts to the null receiver; meta alerts
  and info noise should never page.

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-26 22:19:56 +08:00
Ryan Yin ec208ab4d1 fix(monitoring): exclude shm from HostFilesystemDeviceError 
node-exporter always reports device_error=1 for containerd sandbox shm
bind mounts (tmpfs), producing ~50 bogus critical alerts on the
kubevirt hosts. Verified against live metrics that no non-shm device
errors exist, so nothing real is filtered out.

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-26 15:28:41 +08:00
Ryan Yin 21c6d9b7bc fix(monitoring): drop $vars from telegram template to survive envsubst 
The NixOS alertmanager module pipes the generated config through
envsubst to inject secrets, which silently replaced the template's
$i/$a variables with empty strings, so every telegram notification
failed with a template parse error since Friday's deploy.

Rewrite the template without variables: range + dot, define/template
for the per-alert block, and an if/else split to cap a group at 5
alerts (slice errors when fewer than 5). Verified with amtool template
render against post-envsubst content for both branches.

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-26 15:16:46 +08:00
Ryan Yin 8bb2adc436 feat(home): enable easyeffects for loudness normalization 
Fix inconsistent volume across bilibili videos at the PipeWire level:
the easyeffects daemon auto-starts at login; an autogain + limiter
chain can be applied per-app (e.g. only to the browser).

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-26 11:29:09 +08:00
Ryan Yin b6a7a8f49b feat(monitoring): restructure telegram alert template for readability 
- Show group-level labels (alertgroup/cluster/env/namespace) once in
  the header instead of repeating them per alert.
- Use each rule's summary annotation as the per-alert headline (it
  already carries the distinguishing resource name), falling back to
  the instance label; show nodename on its own line when present.
- Drop the noisy per-alert label dump and the always-N/A value line.

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-24 22:57:13 +08:00
Ryan Yin 35d41a4391 fix(monitoring): bound telegram message length and mute meta alerts 
- Trim the telegram template: drop the full label dump, render at
  most 5 alerts per group, and note how many were omitted, so
  messages stay within Telegram's 4096-char limit.
- Route severity=none meta alerts (Watchdog, InfoInhibitor) to a new
  null receiver so they no longer notify.

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-24 20:57:54 +08:00
Ryan Yin 149d8bc137 feat(monitoring): add UPS reference lines and alerts 
fix(grafana): clarify UPS voltage references

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-07-24 20:13:11 +08:00
Ryan Yin 8a0e1a648f feat(grafana): add UPS monitoring dashboard 2026-07-24 16:25:25 +08:00
Ryan Yin 83d919815b feat(deployment): add configurable NixOS deployment modes 2026-07-24 15:44:40 +08:00
Ryan Yin bae7e05a9a fix(aquamarine): remove insecure MinIO service 2026-07-24 15:07:49 +08:00
Ryan Yin f80580772a feat(blender): build 5.2 LTS with CUDA and OptiX 2026-07-24 14:34:25 +08:00
Ryan Yin 3550c6af2a feat(monitoring): collect homelab UPS metrics 2026-07-24 12:44:17 +08:00
Ryan Yin 45f15ec1a0 feat(darwin): add codex & claude desktop app 2026-07-24 10:28:18 +08:00
Ryan Yin 9ee947dc0a fix: clash-verge-rev ui by upgrade 2026-07-23 11:22:06 +08:00
Ryan Yin 56e0e4f0c6 flake.lock: Update 
Flake lock file updates:

• Updated input 'llm-agents':
    'github:numtide/llm-agents.nix/b384352cb2f0bfd8ec2ce984f87ec2ad0a293e2c?narHash=sha256-U02S4TzJ0OUyAF60dtzWaCtfKsjj0Vjywqt1aj9Fegc%3D' (2026-07-16)
  → 'github:numtide/llm-agents.nix/6c650f7597e3f212395e4fdba754bf6537cc2298?narHash=sha256-cS5Rv01brbs95/a5NrNCxKLqMZWkFnRRZXdmz2NZnQs%3D' (2026-07-22)
• Updated input 'llm-agents/nixpkgs':
    'github:NixOS/nixpkgs/35d3407a3816f3b341d8cf1d60abaf2b7b8166ac?narHash=sha256-BoYPdqk6jlKXy%2BDyUzyGV/CtRGfAhk2MmIgBhsemTGI%3D' (2026-07-15)
  → 'github:NixOS/nixpkgs/421eebfd0ec7bccd4abe826ce62d7e6e83129493?narHash=sha256-/FCliTPgiuV1owejZFNx3Ch9irdvkOfOFl%2BHHZ%2BDrtM%3D' (2026-07-20)
• Updated input 'llm-agents/treefmt-nix':
    'github:numtide/treefmt-nix/db947814a175b7ca6ded66e21383d938df01c227?narHash=sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM%3D' (2026-05-31)
  → 'github:numtide/treefmt-nix/df3c0640565d04a0261253cdd89fce78ec50168a?narHash=sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0%3D' (2026-07-18)
 2026-07-22 22:00:00 +08:00
Ryan Yin 2506b88080 flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs-master':
    'github:nixos/nixpkgs/a55048a53c27e59309d0c641d8acd72b5651920e?narHash=sha256-cw4ccmTWfdhNd6ATsgXgXsJEDhAY615qJCYgomchX60%3D' (2026-07-10)
  → 'github:nixos/nixpkgs/a3eff1e98209f4c27139b231521a886df64fcaab?narHash=sha256-3ZsD71dKOmllzulAwsWXUgnzQzUZt8n91kDPTKxKebY%3D' (2026-07-22)
 2026-07-22 09:38:12 +08:00
Ryan Yin b1e2bb7e09 docs: agents - add kimi-code 2026-07-17 11:15:09 +08:00
Ryan Yin dda800f65d chore: preserve kimi-code data 2026-07-17 10:45:55 +08:00
Ryan Yin c2ce266511 flake.lock: Update 
Flake lock file updates:

• Updated input 'llm-agents':
    'github:numtide/llm-agents.nix/d17493b6a6d08cc1846a17175df67cd603c80c7d?narHash=sha256-M30foxi%2B2JXQ8KEIeWIKpB2uVpDYOw0XGI/gOaTb38I%3D' (2026-07-10)
  → 'github:numtide/llm-agents.nix/b384352cb2f0bfd8ec2ce984f87ec2ad0a293e2c?narHash=sha256-U02S4TzJ0OUyAF60dtzWaCtfKsjj0Vjywqt1aj9Fegc%3D' (2026-07-16)
• Removed input 'llm-agents/blueprint'
• Removed input 'llm-agents/blueprint/nixpkgs'
• Removed input 'llm-agents/blueprint/systems'
• Updated input 'llm-agents/nixpkgs':
    'github:NixOS/nixpkgs/f205b5574fd0cb7da5b702a2da51507b7f4fdd1b?narHash=sha256-/NAkDSsve%2BGNM0Bt6tleJdCGfsTlK89nPjkVOzZMo0s%3D' (2026-07-05)
  → 'github:NixOS/nixpkgs/35d3407a3816f3b341d8cf1d60abaf2b7b8166ac?narHash=sha256-BoYPdqk6jlKXy%2BDyUzyGV/CtRGfAhk2MmIgBhsemTGI%3D' (2026-07-15)
 2026-07-17 10:40:13 +08:00
Ryan Yin ac7755e5ee chore: add kimi-code 2026-07-17 10:39:53 +08:00
Ryan Yin c44aa91e96 chore: preserve bambu studio's data 2026-07-10 13:07:05 +08:00
Ryan Yin 2868b72019 fix(home): move nix.package fallback to darwin module 2026-07-10 12:54:25 +08:00
Ryan Yin 0bba489dbc flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs-master':
    'github:nixos/nixpkgs/173d0ad7a974f8543a9ab01d2271b2e290341b33?narHash=sha256-ORvqDbb/LYxiJljGIejapjkc/kJbVote2N1WSb9W45I%3D' (2026-06-12)
  → 'github:nixos/nixpkgs/a55048a53c27e59309d0c641d8acd72b5651920e?narHash=sha256-cw4ccmTWfdhNd6ATsgXgXsJEDhAY615qJCYgomchX60%3D' (2026-07-10)
 2026-07-10 12:48:54 +08:00
Ryan Yin e22af008bf chore: upgrade slicer app 2026-07-10 12:40:12 +08:00
Ryan Yin 831c64407b flake.lock: Update 
Flake lock file updates:

• Updated input 'llm-agents':
    'github:numtide/llm-agents.nix/76948750034d89409ac9224173f52ffc05afe946?narHash=sha256-X1xqgUNcYI/UWxDW8W1DC7OEMOjOhTtwWc8v%2BMGMasY%3D' (2026-06-29)
  → 'github:numtide/llm-agents.nix/d17493b6a6d08cc1846a17175df67cd603c80c7d?narHash=sha256-M30foxi%2B2JXQ8KEIeWIKpB2uVpDYOw0XGI/gOaTb38I%3D' (2026-07-10)
• Updated input 'llm-agents/bun2nix':
    'github:nix-community/bun2nix/f2bc12af1a6369648aac41041ceeaa0b866599c6?narHash=sha256-oQvcadh2BCkrog%2BSGrG6YffKJrveYpjj3TdQJWaKhaM%3D' (2026-05-10)
  → 'github:nix-community/bun2nix/5a39d717029e94163ac223aee8d5c9946cafed1c?narHash=sha256-s9BuFv0mRuZx9C1MF8qPHRdcAK14ONi0A5m6E2wqOoM%3D' (2026-06-29)
• Updated input 'llm-agents/flake-parts':
    'github:hercules-ci/flake-parts/f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb?narHash=sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4%3D' (2026-05-13)
  → 'github:hercules-ci/flake-parts/17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e?narHash=sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w%2B6NWK9yA%3D' (2026-07-01)
• Updated input 'llm-agents/nixpkgs':
    'github:NixOS/nixpkgs/89570f24e97e614aa34aa9ab1c927b6578a43775?narHash=sha256-EMzXKmnOtBQ2MnvpiNOm7E%2BkOMvdPrIKaeg52Tip2Uk%3D' (2026-06-23)
  → 'github:NixOS/nixpkgs/f205b5574fd0cb7da5b702a2da51507b7f4fdd1b?narHash=sha256-/NAkDSsve%2BGNM0Bt6tleJdCGfsTlK89nPjkVOzZMo0s%3D' (2026-07-05)
 2026-07-10 12:40:12 +08:00
Ryan Yin ab7136e58e flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs-master':
    'github:nixos/nixpkgs/173d0ad7a974f8543a9ab01d2271b2e290341b33?narHash=sha256-ORvqDbb/LYxiJljGIejapjkc/kJbVote2N1WSb9W45I%3D' (2026-06-12)
  → 'github:nixos/nixpkgs/a55048a53c27e59309d0c641d8acd72b5651920e?narHash=sha256-cw4ccmTWfdhNd6ATsgXgXsJEDhAY615qJCYgomchX60%3D' (2026-07-10)
 2026-07-10 12:40:12 +08:00
Ryan Yin 9315055bac fix(darwin): unblock home-manager activation 2026-07-10 12:28:47 +08:00
Ryan Yin 6c84c9e85b feat: add bambu studio 2026-07-10 10:04:18 +08:00
Ryan Yin ca6d584684 fix(nixos): accept flake config during switch 2026-07-09 17:02:28 +08:00
Ryan Yin d5822550b4 fix(catppuccin): use cache for themed ports 2026-07-09 17:02:28 +08:00
Ryan Yin 8d8cdab300 chore: symlink CLAUDE.md 2026-07-08 10:51:45 +08:00
Ryan Yin 410b3c5312 chore: remove useless comments 2026-07-06 23:04:16 +08:00
Ryan Yin f0126c69d0 flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/3d46470bb3030020f7e1361f33514854f5bfa86d?narHash=sha256-PkBPmP5ofNtunCU7/tfn6wi9OLlzFGcHAqqmY%2B/mwUI%3D' (2026-06-27)
  → 'github:NixOS/nixpkgs/d407951447dcd00442e97087bf374aad70c04cea?narHash=sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU%2BK27sk%3D' (2026-07-05)
 2026-07-06 23:04:16 +08:00
Ryan Yin 0fe12bef5a fix(nix): preserve default sandbox shell 
Setting nix.settings.sandbox-paths replaces Nix compiled sandbox defaults. Keeping only /dev/net made local builds lose the sandbox shell that normally provides /bin/sh, which broke upstream scripts with /bin/sh shebangs in packages such as X11-fonts and openldap.

Use extra-sandbox-paths for /dev/net instead. This keeps Nix daemon defaults intact, including the configured sandbox shell, while still allowing builds that need /dev/net.

Add eval coverage for both Linux output sets so future changes keep /dev/net in extra-sandbox-paths and do not reintroduce an explicit sandbox-paths override.
 2026-07-06 23:04:16 +08:00
Ryan Yin 049390581e fix(flake): update lanzaboote after bootspec removal 
The pinned lanzaboote module still defined boot.bootspec.enable, but nixpkgs now always generates bootspec data and rejects attempts to set that removed option.

Update the lanzaboote input to a revision compatible with the new nixpkgs module behavior.
 2026-07-06 22:01:23 +08:00
Ryan Yin 46398fc688 fix(nixos): migrate kmscon to config attrset 
Nixpkgs removed services.kmscon.fonts and services.kmscon.extraConfig, so the old font module failed evaluation on current nixos-unstable.

Move the selected font, font size, and hardware acceleration settings into services.kmscon.config while keeping the existing terminal type option.
 2026-07-06 22:01:18 +08:00
Ryan Yin c7b82b9e3e flake.lock: Update 
Flake lock file updates:

• Updated input 'llm-agents':
    'github:numtide/llm-agents.nix/129d65240d8c27ab2875f415e0c0b1da8ca28552?narHash=sha256-7%2BuI3P7u%2Btgl0ZfCusw3g9yoG74yogO/l/QLwNmNDEU%3D' (2026-06-21)
  → 'github:numtide/llm-agents.nix/76948750034d89409ac9224173f52ffc05afe946?narHash=sha256-X1xqgUNcYI/UWxDW8W1DC7OEMOjOhTtwWc8v%2BMGMasY%3D' (2026-06-29)
• Updated input 'llm-agents/nixpkgs':
    'github:NixOS/nixpkgs/3e41b24abd260e8f71dbe2f5737d24122f972158?narHash=sha256-rxO%2Buc/KFbSJp%2BpgyXRuAX6QlG9hJdnt0BXpEQRXY%2BU%3D' (2026-06-16)
  → 'github:NixOS/nixpkgs/89570f24e97e614aa34aa9ab1c927b6578a43775?narHash=sha256-EMzXKmnOtBQ2MnvpiNOm7E%2BkOMvdPrIKaeg52Tip2Uk%3D' (2026-06-23)
 2026-06-29 10:37:26 +08:00
Ryan Yin c02459fabc flake.lock: Update 
Flake lock file updates:

• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/e9a7635a57597d9754eccebdfc7045e6c8600e6b?narHash=sha256-u6WU/yd/o8iYQrHX3RAwO1hYa3LkoSL%2BWNQD0rJfJZQ%3D' (2026-05-29)
  → 'github:NixOS/nixpkgs/3d46470bb3030020f7e1361f33514854f5bfa86d?narHash=sha256-PkBPmP5ofNtunCU7/tfn6wi9OLlzFGcHAqqmY%2B/mwUI%3D' (2026-06-27)
 2026-06-29 10:30:01 +08:00
Ryan Yin 30a6ad89ef chore(nixos): dns servers 2026-06-27 22:11:17 +08:00
Ryan Yin a5110c3aa7 feat(darwin): add orca slicer 2026-06-25 22:41:17 +08:00
Ryan Yin 0e5f1801cf feat(nixos): add orca-slicer 
Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-06-25 22:19:14 +08:00
Ryan Yin 6279ac663f docs: AGENTS.md - script languages 2026-06-23 20:46:35 +08:00
Ryan Yin 92b92969b3 docs: AGENTS.md - script languages 2026-06-23 20:43:11 +08:00
Ryan Yin ef1c02f3cf docs: AGENTS.md 
Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2026-06-23 20:34:58 +08:00
Ryan Yin b493cbae45 flake.lock: Update 
Flake lock file updates:

• Updated input 'llm-agents':
    'github:numtide/llm-agents.nix/27d586e930f255a425ec2f9f238f078880333d09?narHash=sha256-gYIQvLpoGLH34tw3lZp11IrK82mkttLcw5sPErGe3%2Bk%3D' (2026-06-12)
  → 'github:numtide/llm-agents.nix/129d65240d8c27ab2875f415e0c0b1da8ca28552?narHash=sha256-7%2BuI3P7u%2Btgl0ZfCusw3g9yoG74yogO/l/QLwNmNDEU%3D' (2026-06-21)
• Updated input 'llm-agents/nixpkgs':
    'github:NixOS/nixpkgs/8c3cede7ddc26bd659d2d383b5610efbd2c7a16e?narHash=sha256-rppURzHviaQN131F%2BnLiLdGfcb0uCd9gGP0E5%2Biw9MI%3D' (2026-06-08)
  → 'github:NixOS/nixpkgs/3e41b24abd260e8f71dbe2f5737d24122f972158?narHash=sha256-rxO%2Buc/KFbSJp%2BpgyXRuAX6QlG9hJdnt0BXpEQRXY%2BU%3D' (2026-06-16)
 2026-06-22 09:07:06 +08:00
Ryan Yin 8462d34ade feat: NixOS tests using systemd-nspawn containers 2026-06-22 09:02:06 +08:00
Ryan Yin be429dea2e docs: remove comment 2026-06-14 14:25:33 +08:00
Ryan Yin 691af4ae54 chore: use nixfmt pre-commit hook 2026-06-14 14:15:37 +08:00
Ryan Yin 400725b36c chore: replace nixos-generators image outputs 2026-06-14 14:10:08 +08:00
Ryan Yin 2ed03e23e3 chore: remove nuenv input 2026-06-14 14:09:40 +08:00
Ryan Yin eaacb0f9e7 chore: update zed-editor settings, remove unused packages(java,zig,etc) 2026-06-12 22:30:04 +08:00
Ryan Yin 86f316cfdb fix: shoukei - noctalia - adjust brightness 2026-06-12 15:55:51 +08:00
Ryan Yin e18f94dca1 chore: claude-code: use work credentials 2026-06-12 14:10:20 +08:00
Ryan Yin b142f1acb7 flake.lock: Update 
Flake lock file updates:

• Updated input 'mysecrets':
    'git+ssh://git@github.com/ryan4yin/nix-secrets.git?ref=refs/heads/main&rev=0e2b90e6d57dfa70c0527c3a4d399bde82998f78&shallow=1' (2026-06-03)
  → 'git+ssh://git@github.com/ryan4yin/nix-secrets.git?ref=refs/heads/main&rev=490e3aca901fa703083822ee64a65f0a1f4529af&shallow=1' (2026-06-12)
 2026-06-12 14:07:37 +08:00
Ryan Yin e6245cad17 chore(darwin): install some packages via nix instead of brew 2026-06-12 14:04:13 +08:00