ci-runner experiment

.drone.yml

@@ -1,12 +1,11 @@
 ---
 kind: pipeline
-type: exec
+type: docker
 name: Check
-node:
-  hosttype: baremetal
 
 steps:
   - name: "Check"
+    image: docker.nix-community.org/nixpkgs/nix-flakes:latest
     when:
       event:
         - pull_request
@@ -21,8 +20,6 @@ steps:
 kind: pipeline
 type: exec
 name: Tests
-node:
-  hosttype: baremetal
 
 steps:
   - name: "Tests"
@@ -148,6 +145,6 @@ volumes:
 
 ---
 kind: signature
-hmac: 291be33bbf2954d1f5e4bf569679e24a773e7d6f90db4765fb9dacb3686a825e
+hmac: 3e6a89e903e214f21d488eba82863683b130ef6dbc2dc352377d4fd94ab3cd0c
 
 ...

flake.lock

@@ -42,11 +42,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1667419884,
-        "narHash": "sha256-oLNw87ZI5NxTMlNQBv1wG2N27CUzo9admaFlnmavpiY=",
+        "lastModified": 1665392861,
+        "narHash": "sha256-bCd8fYJMAb0LzabsiXl4nxECDoz483bJOCa2hjox7N0=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "cfc0125eafadc9569d3d6a16ee928375b77e3100",
+        "rev": "ef56fd8979b5f4e800c4716f62076e00600b1172",
         "type": "github"
       },
       "original": {
@@ -205,22 +205,6 @@
         "type": "github"
       }
     },
-    "flake-compat_4": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1650374568,
-        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
     "flake-utils": {
       "locked": {
         "lastModified": 1642700792,
@@ -272,11 +256,11 @@
     },
     "flake-utils_3": {
       "locked": {
-        "lastModified": 1667077288,
-        "narHash": "sha256-bdC8sFNDpT0HK74u9fUkpbf1MEzVYJ+ka7NXCdgBoaA=",
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "6ee9ebb6b1ee695d2cacc4faa053a7b9baa76817",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
         "type": "github"
       },
       "original": {
@@ -292,11 +276,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1667677389,
-        "narHash": "sha256-y9Zdq8vtsn0T5TO1iTvWA7JndYIAGjzCjbYVi/hOSmA=",
+        "lastModified": 1665996265,
+        "narHash": "sha256-/k9og6LDBQwT+f/tJ5ClcWiUl8kCX5m6ognhsAxOiCY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "87d55517f6f36aa1afbd7a4a064869d5a1d405b8",
+        "rev": "b81e128fc053ab3159d7b464d9b7dedc9d6a6891",
         "type": "github"
       },
       "original": {
@@ -324,11 +308,11 @@
     },
     "latest_2": {
       "locked": {
-        "lastModified": 1667629849,
-        "narHash": "sha256-P+v+nDOFWicM4wziFK9S/ajF2lc0N2Rg9p6Y35uMoZI=",
+        "lastModified": 1665940183,
+        "narHash": "sha256-cPe3F7CtnxU9YbJpc3Adl4d9kX+turqTv5FxM98i8vg=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "3bacde6273b09a21a8ccfba15586fb165078fb62",
+        "rev": "104e8082de1b20f9d0e1f05b1028795ed0e0e4bc",
         "type": "github"
       },
       "original": {
@@ -375,11 +359,11 @@
     },
     "nixos": {
       "locked": {
-        "lastModified": 1667653703,
-        "narHash": "sha256-Xow4vx52/g5zkhlgZnMEm/TEXsj+13jTPCc2jIhW1xU=",
+        "lastModified": 1666014999,
+        "narHash": "sha256-gvKl8xlPJreezNG1NVTJv/HdGC69MSrM+IpCxS+eFvw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "f09ad462c5a121d0239fde645aacb2221553a217",
+        "rev": "1935dd8fdab8e022a9d958419663162fd840014c",
         "type": "github"
       },
       "original": {
@@ -395,11 +379,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1666812839,
-        "narHash": "sha256-0nBDgjPU+iDsvz89W+cDEyhnFGSwCJmwDl/gMGqYiU0=",
+        "lastModified": 1666016402,
+        "narHash": "sha256-Cm/nrdUMXwXiFQforG1Mv8OA4o8yhuVx6E1eDFH4rew=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "41f3518bc194389df22a3d198215eae75e6b5ab9",
+        "rev": "688db42a1eb34853f050267ff65c975f664312f0",
         "type": "github"
       },
       "original": {
@@ -410,11 +394,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1667768008,
-        "narHash": "sha256-PGbX0s2hhXGnZDFVE6UIhPSOf5YegpWs5dUXpT/14F0=",
+        "lastModified": 1665987993,
+        "narHash": "sha256-MvlaIYTRiqefG4dzI5p6vVCfl+9V8A1cPniUjcn6Ngc=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "f6483e0def85efb9c1e884efbaff45a5e7aabb34",
+        "rev": "0e6593630071440eb89cd97a52921497482b22c6",
         "type": "github"
       },
       "original": {
@@ -469,18 +453,18 @@
     },
     "nvfetcher": {
       "inputs": {
-        "flake-compat": "flake-compat_4",
+        "flake-compat": "flake-compat_3",
         "flake-utils": "flake-utils_3",
         "nixpkgs": [
           "nixos"
         ]
       },
       "locked": {
-        "lastModified": 1667620329,
-        "narHash": "sha256-v1Zk7rtEbAGpevBGPZvZBKpwbmw4I+uVwxvd+pBlp3o=",
+        "lastModified": 1664550666,
+        "narHash": "sha256-eXfMRd9uItEp3PsYI31FSVGPG9dVC6yF++65ZrGwW8A=",
         "owner": "berberman",
         "repo": "nvfetcher",
-        "rev": "294826951113dcd3aa9abbcacfb1aa5b95a19116",
+        "rev": "9763ad40d59a044e90726653d9253efaeeb053b2",
         "type": "github"
       },
       "original": {
@@ -495,7 +479,6 @@
         "darwin": "darwin",
         "deploy": "deploy",
         "digga": "digga",
-        "flake-compat": "flake-compat_3",
         "home": "home",
         "latest": "latest_2",
         "naersk": "naersk",

flake.nix

@@ -11,9 +11,6 @@
       nixos.url = "github:nixos/nixpkgs/nixos-22.05";
       latest.url = "github:nixos/nixpkgs/nixos-unstable";
 
-      flake-compat.url = "github:edolstra/flake-compat";
-      flake-compat.flake = false;
-
       digga.url = "github:pub-solar/digga/fix/bootstrap-iso";
       digga.inputs.nixpkgs.follows = "nixos";
       digga.inputs.nixlib.follows = "nixos";

lib/compat/default.nix

@@ -1,14 +1,14 @@
 let
-  lock = builtins.fromJSON (builtins.readFile builtins.path { path = ../../flake.lock; name = "lockPath"; });
+  rev = "e7e5d481a0e15dcd459396e55327749989e04ce0";
   flake = (import
     (
       fetchTarball {
-        url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
-        sha256 = lock.nodes.flake-compat.locked.narHash;
+        url = "https://github.com/edolstra/flake-compat/archive/${rev}.tar.gz";
+        sha256 = "0zd3x46fswh5n6faq4x2kkpy6p3c6j593xbdlbsl40ppkclwc80x";
       }
     )
     {
-      src = builtins.path { path = ../../.; name = "projectRoot"; };
+      src = ../../.;
     });
 in
 flake

modules/ci-runner/default.nix

@@ -1,41 +1,119 @@
-{ lib, config, pkgs, self, ... }:
+{ lib, config, pkgs, self, dockerTools, ... }:
+
 with lib;
 let
+  runnerImageName = "ci-runner-docker-drone-exec";
+  runnerImage = dockerTools.buildImage {
+    name = runnerImageName;
+    tag = "latest";
+
+    fromImageName = "debian";
+
+    runAsRoot = ''
+      #!/usr/bin/env bash
+
+      set -e
+
+      apt update
+      apt install --yes curl git sudo xz-utils
+
+      adduser --system --uid 9999 build
+      chown build /nix
+
+      sudo -u build curl -L https://nixos.org/nix/install > install
+      sudo -u build sh install
+
+      echo "export PATH=/nix/var/nix/profiles/per-user/build/profile/bin:''$PATH" >> /etc/profile
+
+      mkdir /etc/nix
+      echo 'experimental-features = nix-command flakes' >> /etc/nix/nix.conf
+
+      export nix_user_config_file="/home/build/.local/share/nix/trusted-settings.json"
+      mkdir -p $(dirname \\$nix_user_config_file)
+      echo '{"extra-experimental-features":{"nix-command flakes":true},"extra-substituters":{"https://nix-dram.cachix.org https://dram.cachix.org  https://nrdxp.cachix.org https://nix-community.cachix.org":true},"extra-trusted-public-keys":{"nix-dram.cachix.org-1:CKjZ0L1ZiqH3kzYAZRt8tg8vewAx5yj8Du/+iR8Efpg= dram.cachix.org-1:baoy1SXpwYdKbqdTbfKGTKauDDeDlHhUpC+QuuILEMY= nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=":true}}' > \\$nix_user_config_file
+      chown -R build /home/build/
+
+      curl -L https://github.com/drone-runners/drone-runner-exec/releases/latest/download/drone_runner_exec_linux_amd64.tar.gz | tar xz
+      sudo install -t /usr/local/bin drone-runner-exec
+    '';
+  };
+
+  startup = pkgs.writeScript "startup.sh" ''
+    chown build /nix
+
+    if [ ! -f /run/vars ]; then
+      exit 1
+    fi
+
+    cp -a /run/vars /run/runtime-vars
+    env | grep "DRONE" >> /run/runtime-vars
+
+    su - -s /bin/bash build sh -c "/usr/local/bin/drone-runner-exec daemon /run/runtime-vars"
+  '';
+
   psCfg = config.pub-solar;
   cfg = config.pub-solar.ci-runner;
 in
 {
   options.pub-solar.ci-runner = {
-    enable = mkEnableOption "Enables a systemd service that runs drone-ci-runner";
-  };
+    enable = lib.mkEnableOption "Enables a docker container running a drone exec runner as unprivileged user.";
 
-  config = mkIf cfg.enable {
-    systemd.user.services.ci-runner = {
-      enable = true;
-
-      description = "CI runner for the PubSolarOS repository that can run test VM instances with KVM.";
-
-      serviceConfig = {
-        Type = "simple";
-        Restart = "always";
-      };
-
-      path = [
-        pkgs.git
-        pkgs.nix
-        pkgs.libvirt
-      ];
-
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" "libvirtd.service" ];
-
-      script = ''${pkgs.drone-runner-exec}/bin/drone-runner-exec daemon /run/agenix/drone-runner-exec-config'';
+    enableKvm = lib.mkOption {
+      description = ''
+        Enable kvm support.
+      '';
+      default = true;
+      type = types.bool;
     };
 
-    age.secrets."drone-runner-exec-config" = {
-      file = "${self}/secrets/drone-runner-exec-config";
-      mode = "700";
-      owner = psCfg.user.name;
+    nixCacheLocation = lib.mkOption {
+      description = ''
+        Location of nix cache that is shared between builds
+      '';
+      type = types.path;
+    };
+
+    runnerEnvironment = lib.mkOption {
+      description = ''
+        Additional environment variables added to the vars file on container runtime
+      '';
+      default = {};
+    };
+
+    runnerVarsFile = lib.mkOption {
+      description = ''
+        Location of vars file passed to drone runner
+      '';
+      type = types.path;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation = {
+      docker = {
+        enable = true; # sadly podman is not supported rightnow
+      };
+
+      oci-containers = {
+        backend = "docker";
+        containers."drone-exec-runner" = {
+          image = runnerImageName;
+          imageFile = runnerImage;
+          autoStart = true;
+          entrypoint = "bash";
+          cmd = [ "/startup.sh" ];
+
+          volumes = [
+            "${cfg.runnerVarsFile}:/run/vars"
+            "${cfg.nixCacheLocation}:/nix"
+            "${startup}:/startup.sh"
+          ];
+
+          environment = cfg.runnerEnvironment;
+
+          extraOptions = lib.mkIf cfg.enableKvm [ "--device=/dev/kvm" ];
+        };
+      };
     };
   };
 }

modules/core/hibernation.nix

@@ -27,7 +27,9 @@ in
   config = {
     boot = mkIf cfg.enable {
       resumeDevice = cfg.resumeDevice;
-      kernelParams = mkIf (cfg.resumeOffset != null) [ "resume_offset=${builtins.toString cfg.resumeOffset}" ];
+      kernelParams =
+        if (cfg.resumeOffset == null && cfg.enable) then builtins.abort "config.pub-solar.resumeOffset has to be set if config.pub-solar.enable is true."
+        else [ "resume_offset=${builtins.toString cfg.resumeOffset}" ];
     };
   };
 }

modules/terminal-life/nvim/default.nix

@@ -5,6 +5,66 @@ let
   xdg = config.home-manager.users."${psCfg.user.name}".xdg;
 
   preview-file = pkgs.writeShellScriptBin "preview-file" (import ./preview-file.nix pkgs);
+
+  vimagit-master = pkgs.vimUtils.buildVimPlugin {
+    name = "vimagit-master";
+    src = pkgs.fetchFromGitHub {
+      owner = "jreybert";
+      repo = "vimagit";
+      rev = "308650ddc1e9a94e49fae0ea04bbc1c45f23d4c4";
+      sha256 = "sha256-fhazQQqyFaO0fdoeNI9nBshwTDhKNHH262H/QThtuO0=";
+    };
+  };
+
+  instant-nvim = pkgs.vimUtils.buildVimPlugin {
+    name = "instant";
+    src = pkgs.fetchFromGitHub {
+      owner = "jbyuki";
+      repo = "instant.nvim";
+      rev = "c02d72267b12130609b7ad39b76cf7f4a3bc9554";
+      sha256 = "sha256-7Pr2Au/oGKp5kMXuLsQY4BK5Wny9L1EBdXtyS5EaZPI=";
+    };
+  };
+
+  vim-caddyfile = pkgs.vimUtils.buildVimPlugin {
+    name = "vim-caddyfile";
+    src = pkgs.fetchFromGitHub {
+      owner = "isobit";
+      repo = "vim-caddyfile";
+      rev = "24fe0720551883e407cb70ae1d7c03f162d1d5a0";
+      sha256 = "sha256-rRYv3vnt31g7hNTxttTD6BWdv5JJ+ko3rPNyDUEOZ9o=";
+    };
+  };
+
+  workspace = pkgs.vimUtils.buildVimPlugin {
+    name = "vim-workspace";
+    src = pkgs.fetchFromGitHub {
+      owner = "thaerkh";
+      repo = "vim-workspace";
+      rev = "c26b473f9b073f24bacecd38477f44c5cd1f5a62";
+      sha256 = "sha256-XV7opLyfkHIDO0+JJaO/x0za0gsHuklrzapTGdLHJmI=";
+    };
+  };
+
+  beautify = pkgs.vimUtils.buildVimPlugin {
+    name = "vim-beautify";
+    src = pkgs.fetchFromGitHub {
+      owner = "zeekay";
+      repo = "vim-beautify";
+      rev = "e0691483927dc5a0c051433602397419f9628623";
+      sha256 = "QPTCl6KaGcAjTS5yVDov9yxmv0fDaFoPLMsrtVIG6GQ=";
+    };
+  };
+
+  apprentice = pkgs.vimUtils.buildVimPlugin {
+    name = "vim-apprentice";
+    src = pkgs.fetchFromGitHub {
+      owner = "romainl";
+      repo = "Apprentice";
+      rev = "ecd41698037f15a58125b349be76dbd2595bfb6d";
+      sha256 = "sha256-9s7Yzn3IEJBjcyUq9NBIQ9wb45Xr7jOkEIoWf0lAYYg=";
+    };
+  };
 in
 {
   enable = true;
@@ -48,7 +108,7 @@ in
     lsp_extensions-nvim
     nvim-lspconfig
 
-    instant-nvim-nvfetcher
+    instant-nvim
 
     ack-vim
     vim-airline
@@ -59,23 +119,23 @@ in
     syntastic
     vim-gutentags
     vim-vinegar
-    vim-workspace-nvfetcher
+    workspace
 
     sonokai
     vim-hybrid-material
     vim-airline-themes
-    vim-apprentice-nvfetcher
+    apprentice
 
     fugitive
     vim-gitgutter
     vim-rhubarb
-    vimagit-nvfetcher
+    vimagit-master
 
     fzf-vim
     fzfWrapper
     vim-highlightedyank
 
-    vim-beautify-nvfetcher
+    beautify
     vim-surround
 
     vim-bufkill
@@ -84,7 +144,7 @@ in
     ansible-vim
     emmet-vim
     rust-vim
-    vim-caddyfile-nvfetcher
+    vim-caddyfile
     vim-go
     vim-javascript
     vim-json

modules/terminal-life/zsh/default.nix

@@ -40,27 +40,46 @@ in
     myip = "dig +short myip.opendns.com @208.67.222.222 2>&1";
   };
   plugins = [
-    # src gets fetched by nvfetcher, see: ./pkgs/sources.toml
     {
       # will source ohmyzsh/plugins/z/
       name = "zsh-plugins-z";
-      file = "plugins/z/z.plugin.zsh";
-      src = pkgs.sources.ohmyzsh.src;
+      file = "plugins/z/z.sh";
+      src = pkgs.fetchFromGitHub {
+        owner = "ohmyzsh";
+        repo = "ohmyzsh";
+        rev = "249c708ed3a4a7a63d16a6e911a46b6fb9623cbd";
+        sha256 = "sha256-NAVotL5RxpS/zKnO+ngMIjv787lqc1dj/c4blQrQcvU=";
+      };
     }
     {
       name = "zsh-powerlevel10k";
       file = "powerlevel10k.zsh-theme";
-      src = pkgs.sources.powerlevel10k.src;
+      src = pkgs.fetchFromGitHub {
+        owner = "romkatv";
+        repo = "powerlevel10k";
+        rev = "2dd6a29e4d7a33bfef10973d6550e087be37ddee";
+        sha256 = "sha256-9vc4cMBCNOmPOyzGwnPeMrXXyQUq4pC9Du3AWl9+Rys=";
+      };
     }
     {
       name = "zsh-fast-syntax-highlighting";
       file = "F-Sy-H.plugin.zsh";
-      src = pkgs.sources.F-Sy-H.src;
+      src = pkgs.fetchFromGitHub {
+        owner = "z-shell";
+        repo = "F-Sy-H";
+        rev = "c4bdc485b67b58351a24f21fcac92c9e0232b939";
+        sha256 = "sha256-uXBGIdJwubuueNhQRdGxPUi0eJN17cflYAuHTjeQ8FQ=";
+      };
     }
     {
       name = "zsh-nix-shell";
       file = "nix-shell.plugin.zsh";
-      src = pkgs.sources.zsh-nix-shell.src;
+      src = pkgs.fetchFromGitHub {
+        owner = "chisui";
+        repo = "zsh-nix-shell";
+        rev = "af6f8a266ea1875b9a3e86e14796cadbe1cfbf08";
+        sha256 = "sha256-BjgMhILEL/qdgfno4LR64LSB8n9pC9R+gG7IQWwgyfQ=";
+      };
     }
   ];
 

overlays/neovim-plugins.nix

@@ -1,22 +0,0 @@
-final: prev: {
-  vimPlugins = prev.vimPlugins // {
-    instant-nvim-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
-      inherit (prev.sources.instant-nvim-nvfetcher) pname version src;
-    };
-    vimagit-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
-      inherit (prev.sources.vimagit-nvfetcher) pname version src;
-    };
-    vim-caddyfile-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
-      inherit (prev.sources.vim-caddyfile-nvfetcher) pname version src;
-    };
-    vim-workspace-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
-      inherit (prev.sources.vim-workspace-nvfetcher) pname version src;
-    };
-    vim-beautify-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
-      inherit (prev.sources.vim-beautify-nvfetcher) pname version src;
-    };
-    vim-apprentice-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
-      inherit (prev.sources.vim-apprentice-nvfetcher) pname version src;
-    };
-  };
-}

overlays/rnix-lsp.nix

@@ -1,6 +1,13 @@
 final: prev: {
   rnix-lsp = prev.rnix-lsp.overrideAttrs (oldAttrs: rec {
-    inherit (prev.sources.rnix-lsp-nvfetcher) pname version src;
+    version = "unstable-2022-07-28";
+
+    src = prev.fetchFromGitHub {
+      owner = "nix-community";
+      repo = "rnix-lsp";
+      rev = "ff18e04551a39ccdab0ff9c83926db3807b23478";
+      sha256 = "sha256-4OIpATLdPQvryyhRQPELeqNYC0n6PCyjD6LCPdwOztc=";
+    };
 
     cargoDeps = oldAttrs.cargoDeps.overrideAttrs (prev.lib.const {
       name = "rnix-lsp-vendor.tar.gz";

pkgs/_sources/generated.nix

@@ -1,136 +1,16 @@
 # This file was generated by nvfetcher, please do not modify it manually.
-{ fetchgit, fetchurl, fetchFromGitHub }:
+{ fetchgit, fetchurl }:
 {
-  F-Sy-H = {
-    pname = "F-Sy-H";
-    version = "b935a87a75560f8173dd78deee6717c59d464e06";
-    src = fetchFromGitHub ({
-      owner = "z-shell";
-      repo = "F-Sy-H";
-      rev = "b935a87a75560f8173dd78deee6717c59d464e06";
-      fetchSubmodules = false;
-      sha256 = "sha256-448OlDnrDkUjvaSLDhXsa9bkgYXzj1Ju8CTpJVjH8LM=";
-    });
-  };
-  instant-nvim-nvfetcher = {
-    pname = "instant-nvim-nvfetcher";
-    version = "294b6d08143b3db8f9db7f606829270149e1a786";
-    src = fetchFromGitHub ({
-      owner = "jbyuki";
-      repo = "instant.nvim";
-      rev = "294b6d08143b3db8f9db7f606829270149e1a786";
-      fetchSubmodules = false;
-      sha256 = "sha256-DXJWji/NR8ZCxe014rD51v3EHJHMhRQeOoI3SsY8mR4=";
-    });
-  };
   manix = {
     pname = "manix";
     version = "d08e7ca185445b929f097f8bfb1243a8ef3e10e4";
-    src = fetchFromGitHub ({
-      owner = "mlvzk";
-      repo = "manix";
+    src = fetchgit {
+      url = "https://github.com/mlvzk/manix";
       rev = "d08e7ca185445b929f097f8bfb1243a8ef3e10e4";
       fetchSubmodules = false;
-      sha256 = "sha256-GqPuYscLhkR5E2HnSFV4R48hCWvtM3C++3zlJhiK/aw=";
-    });
-  };
-  ohmyzsh = {
-    pname = "ohmyzsh";
-    version = "65a1e4edbe678cdac37ad96ca4bc4f6d77e27adf";
-    src = fetchFromGitHub ({
-      owner = "ohmyzsh";
-      repo = "ohmyzsh";
-      rev = "65a1e4edbe678cdac37ad96ca4bc4f6d77e27adf";
-      fetchSubmodules = false;
-      sha256 = "sha256-qyI7CU0vKhhADZfQtD73GsyAbqdMPhDQ1uA03h4erpw=";
-    });
-  };
-  powerlevel10k = {
-    pname = "powerlevel10k";
-    version = "8091c8a3a8a845c70046684235a01cd500075def";
-    src = fetchFromGitHub ({
-      owner = "romkatv";
-      repo = "powerlevel10k";
-      rev = "8091c8a3a8a845c70046684235a01cd500075def";
-      fetchSubmodules = false;
-      sha256 = "sha256-I0/tktXCbZ3hMYTNvPoWfOEYWRgmHoXsar/jcUB6bpo=";
-    });
-  };
-  rnix-lsp-nvfetcher = {
-    pname = "rnix-lsp-nvfetcher";
-    version = "6925256babec4307479a4080b44f2be38056f210";
-    src = fetchFromGitHub ({
-      owner = "nix-community";
-      repo = "rnix-lsp";
-      rev = "6925256babec4307479a4080b44f2be38056f210";
-      fetchSubmodules = false;
-      sha256 = "sha256-OKLyIXIXhUnRB3Xw+7zI3u6XkwF7Mrbfz1XaasV6i7Q=";
-    });
-  };
-  vim-apprentice-nvfetcher = {
-    pname = "vim-apprentice-nvfetcher";
-    version = "9942d0bb0a5d82f7a24450b00051c1f2cc008659";
-    src = fetchFromGitHub ({
-      owner = "romainl";
-      repo = "Apprentice";
-      rev = "9942d0bb0a5d82f7a24450b00051c1f2cc008659";
-      fetchSubmodules = false;
-      sha256 = "sha256-Xs+vTdnihNbBFPOKsW+NB40pqN9eaadqzc0DIeNoOFo=";
-    });
-  };
-  vim-beautify-nvfetcher = {
-    pname = "vim-beautify-nvfetcher";
-    version = "e0691483927dc5a0c051433602397419f9628623";
-    src = fetchFromGitHub ({
-      owner = "zeekay";
-      repo = "vim-beautify";
-      rev = "e0691483927dc5a0c051433602397419f9628623";
-      fetchSubmodules = false;
-      sha256 = "sha256-QPTCl6KaGcAjTS5yVDov9yxmv0fDaFoPLMsrtVIG6GQ=";
-    });
-  };
-  vim-caddyfile-nvfetcher = {
-    pname = "vim-caddyfile-nvfetcher";
-    version = "24fe0720551883e407cb70ae1d7c03f162d1d5a0";
-    src = fetchFromGitHub ({
-      owner = "isobit";
-      repo = "vim-caddyfile";
-      rev = "24fe0720551883e407cb70ae1d7c03f162d1d5a0";
-      fetchSubmodules = false;
-      sha256 = "sha256-rRYv3vnt31g7hNTxttTD6BWdv5JJ+ko3rPNyDUEOZ9o=";
-    });
-  };
-  vim-workspace-nvfetcher = {
-    pname = "vim-workspace-nvfetcher";
-    version = "c26b473f9b073f24bacecd38477f44c5cd1f5a62";
-    src = fetchFromGitHub ({
-      owner = "thaerkh";
-      repo = "vim-workspace";
-      rev = "c26b473f9b073f24bacecd38477f44c5cd1f5a62";
-      fetchSubmodules = false;
-      sha256 = "sha256-XV7opLyfkHIDO0+JJaO/x0za0gsHuklrzapTGdLHJmI=";
-    });
-  };
-  vimagit-nvfetcher = {
-    pname = "vimagit-nvfetcher";
-    version = "308650ddc1e9a94e49fae0ea04bbc1c45f23d4c4";
-    src = fetchFromGitHub ({
-      owner = "jreybert";
-      repo = "vimagit";
-      rev = "308650ddc1e9a94e49fae0ea04bbc1c45f23d4c4";
-      fetchSubmodules = false;
-      sha256 = "sha256-fhazQQqyFaO0fdoeNI9nBshwTDhKNHH262H/QThtuO0=";
-    });
-  };
-  zsh-nix-shell = {
-    pname = "zsh-nix-shell";
-    version = "af6f8a266ea1875b9a3e86e14796cadbe1cfbf08";
-    src = fetchFromGitHub ({
-      owner = "chisui";
-      repo = "zsh-nix-shell";
-      rev = "af6f8a266ea1875b9a3e86e14796cadbe1cfbf08";
-      fetchSubmodules = false;
-      sha256 = "sha256-BjgMhILEL/qdgfno4LR64LSB8n9pC9R+gG7IQWwgyfQ=";
-    });
+      deepClone = false;
+      leaveDotGit = false;
+      sha256 = "1b7xi8c2drbwzfz70czddc4j33s7g1alirv12dwl91hbqxifx8qs";
+    };
   };
 }

pkgs/sources.toml

@@ -2,47 +2,3 @@
 [manix]
 src.git = "https://github.com/mlvzk/manix"
 fetch.github = "mlvzk/manix"
-
-[ohmyzsh]
-src.git = "https://github.com/ohmyzsh/ohmyzsh"
-fetch.github = "ohmyzsh/ohmyzsh"
-
-[powerlevel10k]
-src.git = "https://github.com/romkatv/powerlevel10k"
-fetch.github = "romkatv/powerlevel10k"
-
-[F-Sy-H]
-src.git = "https://github.com/z-shell/F-Sy-H"
-fetch.github = "z-shell/F-Sy-H"
-
-[zsh-nix-shell]
-src.git = "https://github.com/chisui/zsh-nix-shell"
-fetch.github = "chisui/zsh-nix-shell"
-
-[rnix-lsp-nvfetcher]
-src.git = "https://github.com/nix-community/rnix-lsp"
-fetch.github = "nix-community/rnix-lsp"
-
-[vimagit-nvfetcher]
-src.git = "https://github.com/jreybert/vimagit"
-fetch.github = "jreybert/vimagit"
-
-[instant-nvim-nvfetcher]
-src.git = "https://github.com/jbyuki/instant.nvim"
-fetch.github = "jbyuki/instant.nvim"
-
-[vim-caddyfile-nvfetcher]
-src.git = "https://github.com/isobit/vim-caddyfile"
-fetch.github = "isobit/vim-caddyfile"
-
-[vim-workspace-nvfetcher]
-src.git = "https://github.com/thaerkh/vim-workspace"
-fetch.github = "thaerkh/vim-workspace"
-
-[vim-beautify-nvfetcher]
-src.git = "https://github.com/zeekay/vim-beautify"
-fetch.github = "zeekay/vim-beautify"
-
-[vim-apprentice-nvfetcher]
-src.git = "https://github.com/romainl/Apprentice"
-fetch.github = "romainl/Apprentice"

shell/devos.nix

@@ -28,6 +28,21 @@ in
   # override for our own welcome
   devshell.name = pkgs.lib.mkForce "PubSolarOS";
 
+  # tempfix: remove when merged https://github.com/numtide/devshell/pull/123
+  devshell.startup.load_profiles = pkgs.lib.mkForce (pkgs.lib.noDepEntry ''
+    # PATH is devshell's exorbitant privilige:
+    # fence against its pollution
+    _PATH=''${PATH}
+    # Load installed profiles
+    for file in "$DEVSHELL_DIR/etc/profile.d/"*.sh; do
+      # If that folder doesn't exist, bash loves to return the whole glob
+      [[ -f "$file" ]] && source "$file"
+    done
+    # Exert exorbitant privilige and leave no trace
+    export PATH=''${_PATH}
+    unset _PATH
+  '');
+
   commands = with pkgs; [
     (devos nix)
     (devos agenix)