feat(linux) - avoid compiling creative tools, update noctalia & utils.nu

Flake lock file updates:

• Updated input 'nixpkgs-patched':
    'github:ryan4yin/nixpkgs/d373b16187b32770d99f6ff54a133d9543e68702?narHash=sha256-75W3YfzkkKvpE3/wtHMihlT9kOnQZxWpLoshw1xu0T8%3D' (2026-03-20)
  → 'github:ryan4yin/nixpkgs/4425024452e93ce3d10e11bcd9b47f1dfa78593b?narHash=sha256-pu3loLm4gvcbh8iibeYDGgPHOVFXb8sAKEzJ9AxX5L4%3D' (2026-06-03)

fix: qq

flake.lock

@@ -588,10 +588,10 @@
     "mysecrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1773927262,
+        "lastModified": 1780453481,
-        "narHash": "sha256-nxx7jAiHGTYU6hXdjHYjdR1SJNgFcVPokiFlR8MZwTc=",
+        "narHash": "sha256-kH3iAbIuRVtB8VOjQrV10HtxO1z22fwUH8oFVfJoFVE=",
         "ref": "refs/heads/main",
-        "rev": "c388ca33beb5c099bf4603e6ab25a2e94af00b80",
+        "rev": "0e2b90e6d57dfa70c0527c3a4d399bde82998f78",
         "shallow": true,
         "type": "git",
         "url": "ssh://git@github.com/ryan4yin/nix-secrets.git"
@@ -804,11 +804,11 @@
     },
     "nixpkgs-patched": {
       "locked": {
-        "lastModified": 1774012337,
+        "lastModified": 1780458942,
-        "narHash": "sha256-75W3YfzkkKvpE3/wtHMihlT9kOnQZxWpLoshw1xu0T8=",
+        "narHash": "sha256-pu3loLm4gvcbh8iibeYDGgPHOVFXb8sAKEzJ9AxX5L4=",
         "owner": "ryan4yin",
         "repo": "nixpkgs",
-        "rev": "d373b16187b32770d99f6ff54a133d9543e68702",
+        "rev": "4425024452e93ce3d10e11bcd9b47f1dfa78593b",
         "type": "github"
       },
       "original": {

hardening/nixpaks/default.nix

@@ -1,6 +1,6 @@
 {
   pkgs,
-  pkgs-master,
+  pkgs-patched,
   nixpak,
   ...
 }:
@@ -22,7 +22,7 @@ in
   nixpkgs.overlays = [
     (_: super: {
       nixpaks = {
-        qq = wrapper super ./qq.nix;
+        qq = wrapper pkgs-patched ./qq.nix;
         telegram-desktop = wrapper super ./telegram-desktop.nix;
         firefox = wrapper super ./firefox.nix;
       };

home/base/core/editors/neovim/default.nix

@@ -1,7 +1,15 @@
-{ config, nixvim, ... }:
+{
+  config,
+  nixpkgs,
+  nixvim,
+  pkgs,
+  ...
+}:
 {
 
   imports = [ nixvim.homeModules.nixvim ];
+
+  programs.nixvim.nixpkgs.source = nixpkgs;
   home.shellAliases = {
 
     vi = "nvim";
@@ -11,7 +19,7 @@
   programs.nixvim = {
     enable = true;
 
-    clipboard.providers.wl-copy.enable = true;
+    clipboard.providers.wl-copy.enable = pkgs.stdenv.isLinux;
 
     opts = {
       number = true;

home/base/gui/terminal/ghostty.nix

@@ -12,9 +12,9 @@
     enable = true;
     package =
       if pkgs.stdenv.isDarwin then
-        pkgs.hello # pkgs.ghostty is currently broken on darwin
+        null # installed via Homebrew cask on darwin
       else
-        pkgs.ghostty; # the stable version
+        pkgs.ghostty;
     enableBashIntegration = false;
     installBatSyntax = false;
     # installVimSyntax = true;

home/base/tui/ssh.nix

@@ -9,42 +9,32 @@
   programs.ssh = {
     enable = true;
 
-    # default config
     enableDefaultConfig = false;
-    matchBlocks."*" = {
+    settings."*" = {
-      forwardAgent = false;
+      ForwardAgent = false;
-      # "a private key that is used during authentication will be added to ssh-agent if it is running"
+      AddKeysToAgent = "yes";
-      addKeysToAgent = "yes";
+      Compression = true;
-      compression = true;
+      ServerAliveInterval = 0;
-      serverAliveInterval = 0;
+      ServerAliveCountMax = 3;
-      serverAliveCountMax = 3;
+      HashKnownHosts = false;
-      hashKnownHosts = false;
+      UserKnownHostsFile = "~/.ssh/known_hosts";
-      userKnownHostsFile = "~/.ssh/known_hosts";
+      ControlMaster = "no";
-      controlMaster = "no";
+      ControlPath = "~/.ssh/master-%r@%n:%p";
-      controlPath = "~/.ssh/master-%r@%n:%p";
+      ControlPersist = "no";
-      controlPersist = "no";
     };
 
-    matchBlocks = {
+    settings = {
       "github.com" = {
-        # "Using SSH over the HTTPS port for GitHub"
+        HostName = "ssh.github.com";
-        # "(port 22 is banned by some proxies / firewalls)"
+        Port = 443;
-        hostname = "ssh.github.com";
+        User = "git";
-        port = 443;
+        IdentitiesOnly = true;
-        user = "git";
-
-        # Specifies that ssh should only use the identity file explicitly configured above
-        # required to prevent sending default identity files first.
-        identitiesOnly = true;
       };
 
       "192.168.*" = {
-        # "allow to securely use local SSH agent to authenticate on the remote machine."
+        ForwardAgent = true;
-        # "It has the same effect as adding cli option `ssh -A user@host`"
+        IdentityFile = "/etc/agenix/ssh-key-romantic";
-        forwardAgent = true;
+        IdentitiesOnly = true;
-        # "romantic holds my homelab~"
-        identityFile = "/etc/agenix/ssh-key-romantic";
-        identitiesOnly = true;
       };
     };
   };

home/hosts/darwin/darwin-fern.nix

@@ -5,6 +5,5 @@ in
 {
   imports = [ ../../darwin ];
 
-  programs.ssh.matchBlocks."github.com".identityFile =
+  programs.ssh.settings."github.com".IdentityFile = "${config.home.homeDirectory}/.ssh/${hostName}";
-    "${config.home.homeDirectory}/.ssh/${hostName}";
 }

home/hosts/darwin/darwin-frieren.nix

@@ -5,6 +5,5 @@ in
 {
   imports = [ ../../darwin ];
 
-  programs.ssh.matchBlocks."github.com".identityFile =
+  programs.ssh.settings."github.com".IdentityFile = "${config.home.homeDirectory}/.ssh/${hostName}";
-    "${config.home.homeDirectory}/.ssh/${hostName}";
 }

home/hosts/linux/12kingdoms-shoukei.nix

@@ -6,8 +6,7 @@ in
 {
   imports = [ ../../linux/gui.nix ];
 
-  programs.ssh.matchBlocks."github.com".identityFile =
+  programs.ssh.settings."github.com".IdentityFile = "${config.home.homeDirectory}/.ssh/${hostName}";
-    "${config.home.homeDirectory}/.ssh/${hostName}";
 
   modules.desktop.gaming.enable = false;
   modules.desktop.niri.enable = true;

home/hosts/linux/idols-ai.nix

@@ -5,7 +5,7 @@ in
 {
   imports = [ ../../linux/gui.nix ];
 
-  programs.ssh.matchBlocks."github.com".identityFile = "${config.home.homeDirectory}/.ssh/idols-ai";
+  programs.ssh.settings."github.com".IdentityFile = "${config.home.homeDirectory}/.ssh/idols-ai";
 
   modules.desktop.gaming.enable = true;
   modules.desktop.niri.enable = true;

home/linux/gui/base/creative.nix

@@ -1,12 +1,13 @@
 {
   lib,
   pkgs,
+  pkgs-stable,
   blender-bin,
   ...
 }:
 {
   home.packages =
-    with pkgs;
+    with pkgs-stable;
     [
       # creative
       # gimp      # image editing, I prefer using figma in browser instead of this one

home/linux/gui/base/noctalia/config/settings.json

@@ -176,8 +176,8 @@
           "unreadBadgeColor": "primary"
         },
         {
-          "deviceNativePath": "",
+          "deviceNativePath": "__default__",
-          "displayMode": "alwaysShow",
+          "displayMode": "icon-always",
           "hideIfIdle": false,
           "hideIfNotDetected": true,
           "id": "Battery",

utils.nu

@@ -14,6 +14,8 @@ export def nixos-switch [
         # show details via nix-output-monitor
         nom build $".#nixosConfigurations.($name).config.system.build.toplevel" --show-trace --verbose
         nixos-rebuild switch --sudo --flake $".#($name)" --show-trace --verbose
+    } else if "boot" == $mode {
+        nixos-rebuild boot --sudo --flake $".#($name)"
     } else {
         nixos-rebuild switch --sudo --flake $".#($name)"
     }