From 0b229a771e846893e759cd4102172e60a541d439 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Benjamin=20B=C3=A4dorf?= <hello@benjaminbaedorf.eu>
Date: Sat, 13 Aug 2022 20:38:41 +0200
Subject: [PATCH 01/39] Barebones ci-runner module

This adds a barebones CI-runner module with the following option:

`pub-solar.ci-runner.enable`

If enabled, this will start a systemd service on boot that runs
`drone-runner-exec`. The configuration expects you to have a file called
`secrets/drone-runner-exec-config` handled by agenix that gets put into
`/run/agenix/drone-runner-exec-config` and is owned by root.

This file should contain a configuration similar to the following:

```
CLIENT_DRONE_RPC_PROTO=https
CLIENT_DRONE_RPC_HOST=drone.company.com
CLIENT_DRONE_RPC_SECRET=super-duper-secret
```
---
 modules/ci-runner/default.nix | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 modules/ci-runner/default.nix

diff --git a/modules/ci-runner/default.nix b/modules/ci-runner/default.nix
new file mode 100644
index 00000000..28325b14
--- /dev/null
+++ b/modules/ci-runner/default.nix
@@ -0,0 +1,35 @@
+{ lib, config, pkgs, self, ... }:
+with lib;
+let
+  psCfg = config.pub-solar;
+  cfg = config.pub-solar.ci-runner;
+in
+{
+  options.pub-solar.ci-runner = {
+    enable = mkEnableOption "Enables a systemd service that runs drone-ci-runner";
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.ci-runner = {
+      enable = true;
+
+      description = "CI runner for the PubSolarOS repository that can run test VM instances with KVM.";
+
+      serviceConfig = {
+        Type = "simple";
+        Restart = "always";
+      };
+
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" "libvirtd.service" ];
+
+      script = ''${pkgs.drone-runner-exec}/bin/drone-runner-exec daemon /run/agenix/drone-runner-exec-config'';
+    };
+
+    age.secrets."drone-runner-exec-config" = {
+      file = "${self}/secrets/drone-runner-exec-config";
+      mode = "700";
+      owner = "root";
+    };
+  };
+}
-- 
2.44.2


From e3d76f1999d0512cc4f8f4e8032858000665c3a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Benjamin=20B=C3=A4dorf?= <hello@benjaminbaedorf.eu>
Date: Sat, 13 Aug 2022 22:31:30 +0200
Subject: [PATCH 02/39] Move ci-runner to user and add git, virsh and nix to
 path

---
 modules/ci-runner/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/modules/ci-runner/default.nix b/modules/ci-runner/default.nix
index 28325b14..4db42286 100644
--- a/modules/ci-runner/default.nix
+++ b/modules/ci-runner/default.nix
@@ -10,7 +10,7 @@ in
   };
 
   config = mkIf cfg.enable {
-    systemd.services.ci-runner = {
+    systemd.user.services.ci-runner = {
       enable = true;
 
       description = "CI runner for the PubSolarOS repository that can run test VM instances with KVM.";
@@ -20,6 +20,8 @@ in
         Restart = "always";
       };
 
+      path = "${pkgs.git}/bin:${pkgs.nix}/bin:${pkgs.libvirt}/bin";
+
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" "libvirtd.service" ];
 
@@ -29,7 +31,7 @@ in
     age.secrets."drone-runner-exec-config" = {
       file = "${self}/secrets/drone-runner-exec-config";
       mode = "700";
-      owner = "root";
+      owner = psCfg.user.name;
     };
   };
 }
-- 
2.44.2


From c5362c045313d983bd571ef4dd6fd5d48d53f31c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Benjamin=20B=C3=A4dorf?= <hello@benjaminbaedorf.eu>
Date: Sun, 14 Aug 2022 20:24:50 +0200
Subject: [PATCH 03/39] Fix path in drone runner exec

---
 modules/ci-runner/default.nix | 6 +++++-
 pkgs/drone-docker-runner.nix  | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/modules/ci-runner/default.nix b/modules/ci-runner/default.nix
index 4db42286..1460ab16 100644
--- a/modules/ci-runner/default.nix
+++ b/modules/ci-runner/default.nix
@@ -20,7 +20,11 @@ in
         Restart = "always";
       };
 
-      path = "${pkgs.git}/bin:${pkgs.nix}/bin:${pkgs.libvirt}/bin";
+      path = [
+        pkgs.git
+        pkgs.nix
+        pkgs.libvirt
+      ];
 
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" "libvirtd.service" ];
diff --git a/pkgs/drone-docker-runner.nix b/pkgs/drone-docker-runner.nix
index 7d098536..e1773d5a 100644
--- a/pkgs/drone-docker-runner.nix
+++ b/pkgs/drone-docker-runner.nix
@@ -6,7 +6,7 @@ self: with self; ''
         --env=DRONE_RPC_PROTO=$DRONE_RPC_PROTO \
         --env=DRONE_RPC_HOST=$DRONE_RPC_HOST \
         --env=DRONE_RPC_SECRET=$(${self.libsecret}/bin/secret-tool lookup drone rpc-secret) \
-        --env=DRONE_RUNNER_CAPACITY=4 \
+        --env=DRONE_RUNNER_CAPACITY=8 \
         --env=DRONE_RUNNER_NAME=$(${self.inetutils}/bin/hostname) \
         --publish=3000:3000 \
         --restart=always \
-- 
2.44.2


From 14ba7010615ddd723474bb5844ff686f42bfaabb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Benjamin=20B=C3=A4dorf?= <hello@benjaminbaedorf.eu>
Date: Sun, 14 Aug 2022 20:28:18 +0200
Subject: [PATCH 04/39] Don't use libvirt in ci-runner

---
 modules/ci-runner/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/modules/ci-runner/default.nix b/modules/ci-runner/default.nix
index 1460ab16..0e78e55e 100644
--- a/modules/ci-runner/default.nix
+++ b/modules/ci-runner/default.nix
@@ -23,11 +23,10 @@ in
       path = [
         pkgs.git
         pkgs.nix
-        pkgs.libvirt
       ];
 
       wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" "libvirtd.service" ];
+      after = [ "network.target" ];
 
       script = ''${pkgs.drone-runner-exec}/bin/drone-runner-exec daemon /run/agenix/drone-runner-exec-config'';
     };
-- 
2.44.2


From 8fc8ac2d586735b6a697c950b6536746ac1e73e2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Benjamin=20B=C3=A4dorf?= <hello@benjaminbaedorf.eu>
Date: Thu, 25 Aug 2022 15:25:34 +0200
Subject: [PATCH 05/39] Fix service startup for ci-runner

---
 modules/ci-runner/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/ci-runner/default.nix b/modules/ci-runner/default.nix
index 0e78e55e..1460ab16 100644
--- a/modules/ci-runner/default.nix
+++ b/modules/ci-runner/default.nix
@@ -23,10 +23,11 @@ in
       path = [
         pkgs.git
         pkgs.nix
+        pkgs.libvirt
       ];
 
       wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+      after = [ "network.target" "libvirtd.service" ];
 
       script = ''${pkgs.drone-runner-exec}/bin/drone-runner-exec daemon /run/agenix/drone-runner-exec-config'';
     };
-- 
2.44.2


From 8be1bd53d3c471b641d3e8ef24811f5305760860 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Sat, 4 Jun 2022 23:45:06 +0200
Subject: [PATCH 06/39] wip: first PubSolarOS iso test using the NixOS

test suite:

https://nixos.org/manual/nixos/stable/index.html#sec-nixos-tests
---
 .drone.yml            | 21 ++++++++++-
 flake.nix             |  6 ++-
 tests/first-test.nix  | 87 +++++++++++++++++++++++++++++++++++++++++++
 tests/second-test.nix | 14 +++++++
 4 files changed, 126 insertions(+), 2 deletions(-)
 create mode 100644 tests/first-test.nix
 create mode 100644 tests/second-test.nix

diff --git a/.drone.yml b/.drone.yml
index f54bd8f9..57a0aa1c 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -103,10 +103,29 @@ steps:
       NIX_FLAGS: "--print-build-logs --verbose"
     commands:
       - 'echo DEBUG: Using NIX_FLAGS: $NIX_FLAGS'
-      - nix $$NIX_FLAGS flake check
       - nix $$NIX_FLAGS build ".#nixosConfigurations.PubSolarOS.config.system.build.toplevel"
       - nix $$NIX_FLAGS develop --command echo OK
 
+---
+kind: pipeline
+type: exec
+name: Tests
+
+steps:
+  - name: "Tests"
+    when:
+      event:
+        - pull_request
+        - tag
+    environment:
+      NIX_FLAGS: "--print-build-logs --verbose"
+    commands:
+      - 'echo DEBUG: Using NIX_FLAGS: $NIX_FLAGS'
+      - nix $$NIX_FLAGS build ".#checks.x86_64-linux.customTestFor-PubSolarOS-firstTest"
+      #- nix $$NIX_FLAGS flake check
+      #- nix $$NIX_FLAGS develop --command echo OK
+      #- nix $$NIX_FLAGS develop --command bud --help
+
 ---
 kind: pipeline
 type: docker
diff --git a/flake.nix b/flake.nix
index bf050b2e..b4335a8d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -102,7 +102,11 @@
           imports = [ (digga.lib.importHosts ./hosts) ];
           hosts = {
             /* set host specific properties here */
-            PubSolarOS = { };
+            PubSolarOS = {
+              tests = [
+                (import ./tests/first-test.nix { pkgs = nixos.legacyPackages.x86_64-linux; lib = nixos.lib; })
+              ];
+            };
           };
           importables = rec {
             profiles = digga.lib.rakeLeaves ./profiles // {
diff --git a/tests/first-test.nix b/tests/first-test.nix
new file mode 100644
index 00000000..251779a1
--- /dev/null
+++ b/tests/first-test.nix
@@ -0,0 +1,87 @@
+{ pkgs, lib, ... }:
+{
+  name = "firstTest";
+
+  nodes.test-machine = { suites ? null, ... }: {
+    imports = suites.iso;
+
+    home-manager.users.pub-solar.programs.zsh.shellAliases = {
+      test-x11 = "glinfo | tee /tmp/test-x11.out && touch /tmp/test-x11-exit-ok";
+      test-wayland = "wayland-info | tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok";
+    };
+
+    # source: https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/tests/sway.nix
+    environment = {
+      # For glinfo and wayland-info:
+      systemPackages = with pkgs; [ mesa-demos wayland-utils alacritty ];
+      # Use a fixed SWAYSOCK path (for swaymsg):
+      variables = {
+        "SWAYSOCK" = "/tmp/sway-ipc.sock";
+        # TODO: Investigate if we can get hardware acceleration to work (via
+        # virtio-gpu and Virgil). We currently have to use the Pixman software
+        # renderer since the GLES2 renderer doesn't work inside the VM (even
+        # with WLR_RENDERER_ALLOW_SOFTWARE):
+        # "WLR_RENDERER_ALLOW_SOFTWARE" = "1";
+        "WLR_RENDERER" = "pixman";
+      };
+
+      # To help with OCR:
+      etc."xdg/foot/foot.ini".text = lib.generators.toINI { } {
+        main = {
+          font = "inconsolata:size=14";
+        };
+        colors = rec {
+          foreground = "000000";
+          background = "ffffff";
+          regular2 = foreground;
+        };
+      };
+    };
+
+    fonts.fonts = [ pkgs.inconsolata ];
+
+    # Need to switch to a different GPU driver than the default one (-vga std) so that Sway can launch:
+    virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
+    virtualisation.cores = 4;
+    virtualisation.memorySize = 2048;
+  };
+
+  enableOCR = true;
+
+  testScript = ''
+    import shlex
+    def swaymsg(command: str, succeed=True):
+        with machine.nested(f"sending swaymsg {command!r}" + " (allowed to fail)" * (not succeed)):
+          (machine.succeed if succeed else machine.execute)(
+            f"su - pub-solar -c {shlex.quote('swaymsg -- ' + command)}"
+          )
+
+
+    machine.wait_for_unit("multi-user.target")
+
+    # To check the version:
+    print(machine.succeed("sway --version"))
+
+    # Wait for Sway to complete startup:
+    machine.wait_for_file("/run/user/1000/wayland-1")
+    machine.wait_for_file("/tmp/sway-ipc.sock")
+
+    # Start a terminal (foot) on workspace 3:
+    machine.wait_for_text("1")
+    machine.send_key("meta_l-3")
+    machine.sleep(3)
+    machine.send_key("meta_l-ret")
+    machine.sleep(10)
+    machine.send_chars("whoami\n")
+    machine.sleep(3)
+    machine.wait_for_text("pub-solar")
+    machine.send_chars("test-wayland\n")
+    machine.wait_for_file("/tmp/test-wayland-exit-ok")
+    print(machine.succeed("cat /tmp/test-wayland.out"))
+    machine.copy_from_vm("/tmp/test-wayland.out")
+    machine.sleep(3)
+    machine.screenshot("foot_wayland_info")
+    machine.send_key("meta_l-shift-q")
+    machine.wait_until_fails("pgrep foot")
+  '';
+}
diff --git a/tests/second-test.nix b/tests/second-test.nix
new file mode 100644
index 00000000..d6409820
--- /dev/null
+++ b/tests/second-test.nix
@@ -0,0 +1,14 @@
+{ }:
+{
+  name = "secondTest";
+
+  nodes.test-machine2 = { suites ? null, ... }: {
+    imports = [
+      suites.iso
+    ];
+  };
+
+  testScript = ''
+    machines[0].systemctl("is-system-running --wait")
+  '';
+}
-- 
2.44.2


From 472560e1c1507a664e3b8ef479f28228712464ef Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Sun, 14 Aug 2022 20:51:56 +0200
Subject: [PATCH 07/39] Restructure CI:

build ISO on each push to main branch

tags with v* and t* names trigger a test VM

pull requests trigger a basic check building host PubSolarOS
---
 .drone.yml | 119 ++++++++---------------------------------------------
 1 file changed, 17 insertions(+), 102 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 57a0aa1c..986eee5c 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -1,92 +1,3 @@
----
-kind: pipeline
-type: docker
-name: Upstreaming
-
-steps:
-  - name: "Sync 'devos' branch with upstream"
-    image: alpine/git
-    when:
-      event:
-        - cron
-      cron:
-        - sync-main-with-upstream
-    environment:
-      GITEA_SSH_KEY:
-        from_secret: gitea_ssh_key
-    commands:
-      - ./.drone/setup_ssh.sh
-      - git remote add devos git@git.b12f.io:pub-solar/devos
-      - git remote set-url origin git@git.b12f.io:pub-solar/os
-      - git fetch --all
-      - git checkout -b devos --track origin/devos
-      - git merge -X theirs devos/main
-      - git push origin devos
-      - git remote set-url origin https://git.b12f.io/pub-solar/os.git
-
-  - name: "Sync $BRANCH with upstream"
-    image: alpine/git
-    when:
-      event:
-        - cron
-      cron:
-        - sync-main-with-upstream
-        - sync-b12f-with-main
-        - sync-teutat3s-with-main
-    environment:
-      GITEA_SSH_KEY:
-        from_secret: gitea_ssh_key
-    commands:
-      - git fetch origin
-      - git checkout origin/main
-      - ./.drone/setup_ssh.sh
-      - git remote set-url origin git@git.b12f.io:pub-solar/os
-      - git fetch --all
-      - ./.drone/upstream-branch.sh
-
-  - name: "Open pull request for failed merge"
-    image: nixery.dev/shell/tea
-    when:
-      status:
-        - failure
-      event:
-        - cron
-      cron:
-        - sync-main-with-upstream
-        - sync-b12f-with-main
-        - sync-teutat3s-with-main
-    environment:
-      TEA_CONFIG:
-        from_secret: tea_config
-    commands:
-      - mkdir -p ~/.config/tea
-      - echo "$$TEA_CONFIG" > ~/.config/tea/config.yml
-      - tea pulls create --base main --head devos
-
-  - name: "Notify matrix"
-    image: plugins/matrix
-    when:
-      status:
-        - failure
-      event:
-        - cron
-      cron:
-        - sync-main-with-upstream
-        - sync-b12f-with-main
-        - sync-teutat3s-with-main
-    settings:
-      homeserver: https://matrix.pub.solar
-      roomid: dfQBqwkhIzrFjMSsxy:pub.solar
-      username:
-        from_secret: matrix_username
-      password:
-        from_secret: matrix_password
-      template: "Upstreaming {{ build.status }} [{{ build.branch }}#{{ truncate build.commit 8 }}]({{ build.link }}) by {{ build.author }}. [Pull requests](https://git.b12f.io/pub-solar/os/pulls)"
-
-trigger:
-  event:
-    - cron
-
 ---
 kind: pipeline
 type: docker
@@ -98,11 +9,11 @@ steps:
     when:
       event:
         - pull_request
-        - tag
     environment:
       NIX_FLAGS: "--print-build-logs --verbose"
     commands:
       - 'echo DEBUG: Using NIX_FLAGS: $NIX_FLAGS'
+      - nix $$NIX_FLAGS flake show
       - nix $$NIX_FLAGS build ".#nixosConfigurations.PubSolarOS.config.system.build.toplevel"
       - nix $$NIX_FLAGS develop --command echo OK
 
@@ -113,18 +24,19 @@ name: Tests
 
 steps:
   - name: "Tests"
-    when:
-      event:
-        - pull_request
-        - tag
     environment:
       NIX_FLAGS: "--print-build-logs --verbose"
     commands:
       - 'echo DEBUG: Using NIX_FLAGS: $NIX_FLAGS'
       - nix $$NIX_FLAGS build ".#checks.x86_64-linux.customTestFor-PubSolarOS-firstTest"
-      #- nix $$NIX_FLAGS flake check
-      #- nix $$NIX_FLAGS develop --command echo OK
-      #- nix $$NIX_FLAGS develop --command bud --help
+      - nix-store --read-log result
+      - nix $$NIX_FLAGS flake check
+      - nix $$NIX_FLAGS develop --command echo OK
+
+trigger:
+  ref:
+    - refs/tags/v*
+    - refs/tags/t*
 
 ---
 kind: pipeline
@@ -134,14 +46,15 @@ name: Publish ISO
 steps:
   - name: "Build ISO"
     image: docker.nix-community.org/nixpkgs/nix-flakes:latest
+    environment:
+      NIX_FLAGS: "--print-build-logs --verbose"
     volumes:
       - name: file-exchange
         path: /var/nix/iso-cache
     commands:
       - |
-        nix --print-build-logs --verbose \
-          build \
-            '.#nixosConfigurations.bootstrap.config.system.build.bootstrapIso'
+        nix $$NIX_FLAGS build \
+          '.#nixosConfigurations.bootstrap.config.system.build.bootstrapIso'
       - cp $(readlink -f result)/iso/*.iso /var/nix/iso-cache/
 
   - name: "Publish ISO"
@@ -167,8 +80,10 @@ depends_on:
   - Check
 
 trigger:
+  branch:
+    - main
   event:
-    - tag
+    - push
 
 volumes:
   - name: file-exchange
@@ -176,6 +91,6 @@ volumes:
 
 ---
 kind: signature
-hmac: da951ba8ede88996728acfb47846e01880eb0e3b91f66e47848d6c1cc727c5d9
+hmac: f78042286446a0649b61bdd28240caf7650cf995804acb714b92d145fa028bdf
 
 ...
-- 
2.44.2


From 553e23baf9e25a77323b1c06f5e75e37713a4fc0 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Sun, 14 Aug 2022 21:40:29 +0200
Subject: [PATCH 08/39] ci: add upload artifacts step

---
 .drone.yml | 29 ++++++++++++++++++++++++++---
 1 file changed, 26 insertions(+), 3 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 986eee5c..84ef47c9 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -13,9 +13,8 @@ steps:
       NIX_FLAGS: "--print-build-logs --verbose"
     commands:
       - 'echo DEBUG: Using NIX_FLAGS: $NIX_FLAGS'
-      - nix $$NIX_FLAGS flake show
+      - nix $$NIX_FLAGS develop --command nix flake show
       - nix $$NIX_FLAGS build ".#nixosConfigurations.PubSolarOS.config.system.build.toplevel"
-      - nix $$NIX_FLAGS develop --command echo OK
 
 ---
 kind: pipeline
@@ -33,6 +32,25 @@ steps:
       - nix $$NIX_FLAGS flake check
       - nix $$NIX_FLAGS develop --command echo OK
 
+  - name: "Upload artifacts"
+    environment:
+      TRITON_DONT_SOURCE_PROFILE: 1
+      PRIVATE_SSH_KEY:
+        from_secret: private_ssh_key
+      MANTA_USER: pub_solar
+      MANTA_URL: https://eu-central.manta.greenbaum.cloud
+      MANTA_KEY_ID: "02:ae:79:2b:8f:7f:51:ba:c6:3c:ea:6f:f7:bb:d1:6a"
+    commands:
+      - export TARGET_DIR="$${DRONE_REPO}/$${DRONE_BUILD_NUMBER}"
+      - echo env var TARGET_DIR is set to $$TARGET_DIR
+      - "mkdir ~/.ssh && chmod 700 ~/.ssh"
+      - echo "$$PRIVATE_SSH_KEY" > ~/.ssh/id_ed25519 && chmod 600 ~/.ssh/id_ed25519
+      - nix flake new --template "git+https://git.greenbaum.cloud/dev/tritonshell?ref=main" ./tritonshell
+      - git add tritonshell
+      - cd tritonshell
+      - nix develop --command mput -p -f ../result/foot_wayland_info.png ~~/public/$${TARGET_DIR}
+      - nix develop --command mput -p -f ../result/test-wayland.out ~~/public/$${TARGET_DIR}
+
 trigger:
   ref:
     - refs/tags/v*
@@ -89,8 +107,13 @@ volumes:
   - name: file-exchange
     temp: {}
 
+---
+kind: secret
+name: private_ssh_key
+data: cSWd6rIg8Z51hD+KMenYPX669qb6PWdh9V80Z1YpED68Ffoy73tWEoBjEs2pKUJpcL8qGxMjj5Ot2TAK6iUs5Qnv+ZKmjvvttgVCfKdHE6ULT+aOPdl3PvvKV6VY5iapE7aXmPF5NWuMe4G6OJiA/IP5U4P4hspAUV4/MlAjiLYDNtfJSXpA/5Hv5PvjuTM2RartUdXLdFe5qXfMFlmFKeU6J9jxf0BFY9lwhniOsxTGo6YQmf0fEqRd6i2AeKN58Oevir3H5rKQvDhCAUmPxT8rEHYoG7sgkt4ow+0gWyLuoimetZHHT/0IKbSWpQV9rfgxMa7L9TvN9pe573dKjFcGpJpbUsaL8O7R/Av6APzcNBWwNArMcD7/nSuj/33bppCJfC3IA5KLrRqi2Tt5nVw7Wm5eYX4iloftCBFsuI2Zj3B9eW4wrKy4k/CvP7klinaoyfGrt48Z3K3JCOUnwaZH/4xTE8+V0UeYEfDjU10etVa27I//sxK/yBRNrX3pRXnwQS997/zW8KHhzh7C4BUNkKj9k2qjxFPRKJp3knbfHlEsirfFcPXoDSRlBHpvDqKzNkxtAA==
+
 ---
 kind: signature
-hmac: f78042286446a0649b61bdd28240caf7650cf995804acb714b92d145fa028bdf
+hmac: 82e3f3690bafae2ff1962ebc24504275dba0dbca707e14b2a389b31a9f7b57c0
 
 ...
-- 
2.44.2


From 8feaa494cbafcbd426873fa43b1089cb0354b5ae Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Wed, 24 Aug 2022 22:36:53 +0200
Subject: [PATCH 09/39] ci: add matrix notify step, fix ssh key id

---
 .drone.yml | 34 +++++++++++++++++++++++++++-------
 1 file changed, 27 insertions(+), 7 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 84ef47c9..0f6e6f7a 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -39,7 +39,7 @@ steps:
         from_secret: private_ssh_key
       MANTA_USER: pub_solar
       MANTA_URL: https://eu-central.manta.greenbaum.cloud
-      MANTA_KEY_ID: "02:ae:79:2b:8f:7f:51:ba:c6:3c:ea:6f:f7:bb:d1:6a"
+      MANTA_KEY_ID: "5d:5f:3d:22:8d:37:1f:e6:d6:ab:06:18:d9:a2:04:67"
     commands:
       - export TARGET_DIR="$${DRONE_REPO}/$${DRONE_BUILD_NUMBER}"
       - echo env var TARGET_DIR is set to $$TARGET_DIR
@@ -56,6 +56,31 @@ trigger:
     - refs/tags/v*
     - refs/tags/t*
 
+---
+kind: pipeline
+type: docker
+name: Notification
+
+steps:
+  - name: "Notify matrix"
+    image: plugins/matrix
+    settings:
+      homeserver: https://matrix.pub.solar
+      roomid: dfQBqwkhIzrFjMSsxy:pub.solar
+      username:
+        from_secret: matrix_username
+      password:
+        from_secret: matrix_password
+      template: "Test run status: {{ build.status }}, artifacts uploaded to Manta: https://eu-central.manta.greenbaum.cloud/pub_solar/public/{{ repo.Owner }}/{{ repo.Name }}/{{ build.number }}"
+
+depends_on:
+  - Tests
+
+trigger:
+  ref:
+    - refs/tags/v*
+    - refs/tags/t*
+
 ---
 kind: pipeline
 type: docker
@@ -107,13 +132,8 @@ volumes:
   - name: file-exchange
     temp: {}
 
----
-kind: secret
-name: private_ssh_key
-data: cSWd6rIg8Z51hD+KMenYPX669qb6PWdh9V80Z1YpED68Ffoy73tWEoBjEs2pKUJpcL8qGxMjj5Ot2TAK6iUs5Qnv+ZKmjvvttgVCfKdHE6ULT+aOPdl3PvvKV6VY5iapE7aXmPF5NWuMe4G6OJiA/IP5U4P4hspAUV4/MlAjiLYDNtfJSXpA/5Hv5PvjuTM2RartUdXLdFe5qXfMFlmFKeU6J9jxf0BFY9lwhniOsxTGo6YQmf0fEqRd6i2AeKN58Oevir3H5rKQvDhCAUmPxT8rEHYoG7sgkt4ow+0gWyLuoimetZHHT/0IKbSWpQV9rfgxMa7L9TvN9pe573dKjFcGpJpbUsaL8O7R/Av6APzcNBWwNArMcD7/nSuj/33bppCJfC3IA5KLrRqi2Tt5nVw7Wm5eYX4iloftCBFsuI2Zj3B9eW4wrKy4k/CvP7klinaoyfGrt48Z3K3JCOUnwaZH/4xTE8+V0UeYEfDjU10etVa27I//sxK/yBRNrX3pRXnwQS997/zW8KHhzh7C4BUNkKj9k2qjxFPRKJp3knbfHlEsirfFcPXoDSRlBHpvDqKzNkxtAA==
-
 ---
 kind: signature
-hmac: 82e3f3690bafae2ff1962ebc24504275dba0dbca707e14b2a389b31a9f7b57c0
+hmac: b38ea67f7458383c2f7650d86a619efd065b59888d738d4471c83b0a0ad12e3d
 
 ...
-- 
2.44.2


From c2e5d8df3c6f01c58ec07f2bf7ce74c16f2f62f5 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Thu, 25 Aug 2022 15:42:33 +0200
Subject: [PATCH 10/39] ci: better matrix notify template message,

prefix manta path with ci/ and set target filename for mput
---
 .drone.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 0f6e6f7a..0bebe210 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -41,15 +41,15 @@ steps:
       MANTA_URL: https://eu-central.manta.greenbaum.cloud
       MANTA_KEY_ID: "5d:5f:3d:22:8d:37:1f:e6:d6:ab:06:18:d9:a2:04:67"
     commands:
-      - export TARGET_DIR="$${DRONE_REPO}/$${DRONE_BUILD_NUMBER}"
+      - export TARGET_DIR="ci/$${DRONE_REPO}/$${DRONE_BUILD_NUMBER}"
       - echo env var TARGET_DIR is set to $$TARGET_DIR
       - "mkdir ~/.ssh && chmod 700 ~/.ssh"
       - echo "$$PRIVATE_SSH_KEY" > ~/.ssh/id_ed25519 && chmod 600 ~/.ssh/id_ed25519
       - nix flake new --template "git+https://git.greenbaum.cloud/dev/tritonshell?ref=main" ./tritonshell
       - git add tritonshell
       - cd tritonshell
-      - nix develop --command mput -p -f ../result/foot_wayland_info.png ~~/public/$${TARGET_DIR}
-      - nix develop --command mput -p -f ../result/test-wayland.out ~~/public/$${TARGET_DIR}
+      - nix develop --command mput -p -f ../result/foot_wayland_info.png ~~/public/$${TARGET_DIR}/foot_wayland_info.png
+      - nix develop --command mput -p -f ../result/test-wayland.out ~~/public/$${TARGET_DIR}/test-wayland.out
 
 trigger:
   ref:
@@ -71,7 +71,7 @@ steps:
         from_secret: matrix_username
       password:
         from_secret: matrix_password
-      template: "Test run status: {{ build.status }}, artifacts uploaded to Manta: https://eu-central.manta.greenbaum.cloud/pub_solar/public/{{ repo.Owner }}/{{ repo.Name }}/{{ build.number }}"
+      template: "Test run triggered by tag: {{ build.tag }}. Test run exit status: {{ build.status }}. Artifacts uploaded to Manta: https://eu-central.manta.greenbaum.cloud/pub_solar/public/ci/{{ repo.Owner }}/{{ repo.Name }}/{{ build.number }}/foot_wayland_info.png"
 
 depends_on:
   - Tests
@@ -134,6 +134,6 @@ volumes:
 
 ---
 kind: signature
-hmac: b38ea67f7458383c2f7650d86a619efd065b59888d738d4471c83b0a0ad12e3d
+hmac: c6845bbec339e7ccfdb34889bfd56d25dc2c423eac255eb30f19b8d9e7bf9f1f
 
 ...
-- 
2.44.2


From 61220214356b9d719b0cbddc6e878586c3775e1c Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Sat, 27 Aug 2022 13:48:32 +0200
Subject: [PATCH 11/39] Bump flake.lock

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 857bb989..29228dcd 100644
--- a/flake.lock
+++ b/flake.lock
@@ -42,11 +42,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1657835815,
-        "narHash": "sha256-CnZszAYpNKydh6N7+xg+eRtWNVoAAGqc6bg+Lpgq1xc=",
+        "lastModified": 1661329936,
+        "narHash": "sha256-dafFjAcJPo0SdegK3E+SnTI8CNMgV/bBm/6CeDf82f8=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "54a24f042f93c79f5679f133faddedec61955cf2",
+        "rev": "ef0e7f41cdf8fae1d2390c4df246c90a364ed8d9",
         "type": "github"
       },
       "original": {
@@ -307,11 +307,11 @@
     },
     "latest_2": {
       "locked": {
-        "lastModified": 1660305968,
-        "narHash": "sha256-r0X1pZCSEA6mzt5OuTA7nHuLmvnbkwgpFAh1iLIx4GU=",
+        "lastModified": 1661361016,
+        "narHash": "sha256-Bjf6ZDnDc6glTwIIItvwfcaeJ5zWFM6GYfPajSArdUY=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c4a0efdd5a728e20791b8d8d2f26f90ac228ee8d",
+        "rev": "b784c5ae63dd288375af1b4d37b8a27dd8061887",
         "type": "github"
       },
       "original": {
@@ -358,11 +358,11 @@
     },
     "nixos": {
       "locked": {
-        "lastModified": 1660318005,
-        "narHash": "sha256-g9WCa9lVUmOV6dYRbEPjv/TLOR5hamjeCcKExVGS3OQ=",
+        "lastModified": 1661427965,
+        "narHash": "sha256-LJeSDbiebN0/eRt9vyOm+Bxljdsq5ZdalmmTk9Xpp30=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "5c211b47aeadcc178c5320afd4e74c7eed5c389f",
+        "rev": "058de3818577db19d1965c21e2479916a3eaaf95",
         "type": "github"
       },
       "original": {
@@ -378,11 +378,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1657748715,
-        "narHash": "sha256-WecDwDY/hEcDQYzFnccCNa+5Umht0lfjx/d1qGDy/rQ=",
+        "lastModified": 1660727616,
+        "narHash": "sha256-zYTIvdPMYMx/EYqXODAwIIU30RiEHqNHdgarIHuEYZc=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "3323b944d99b026aebfd8de439e001409dde067d",
+        "rev": "adccd191a0e83039d537e021f19495b7bad546a1",
         "type": "github"
       },
       "original": {
-- 
2.44.2


From 242de215d6801d6858fe935d2ef1170651909d49 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Sat, 27 Aug 2022 13:49:55 +0200
Subject: [PATCH 12/39] Switch to our digga fork, include upstream PR

divnix/digga#455 to fix bootstrap iso builds
---
 flake.lock | 11 ++++++-----
 flake.nix  |  2 +-
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index 29228dcd..794fd6d0 100644
--- a/flake.lock
+++ b/flake.lock
@@ -143,15 +143,16 @@
         "nixpkgs-unstable": "nixpkgs-unstable"
       },
       "locked": {
-        "lastModified": 1659622306,
-        "narHash": "sha256-Kpfm2PNs+kZU0W7qcugoPATLG8I2P7FJFGTgsf1LJiU=",
-        "owner": "divnix",
+        "lastModified": 1661600857,
+        "narHash": "sha256-KfQCcTtfvU0PXV4fD9XKIMcKx9lUUR0xWJoBgc12fKE=",
+        "owner": "pub-solar",
         "repo": "digga",
-        "rev": "d1193743a535d7fbbc7f3eda4e51295b10bd4d2c",
+        "rev": "c902b3ef0aa45cb4f336c390f647bb182c38a221",
         "type": "github"
       },
       "original": {
-        "owner": "divnix",
+        "owner": "pub-solar",
+        "ref": "fix/bootstrap-iso",
         "repo": "digga",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index b4335a8d..466d1077 100644
--- a/flake.nix
+++ b/flake.nix
@@ -11,7 +11,7 @@
       nixos.url = "github:nixos/nixpkgs/nixos-22.05";
       latest.url = "github:nixos/nixpkgs/nixos-unstable";
 
-      digga.url = "github:divnix/digga";
+      digga.url = "github:pub-solar/digga/fix/bootstrap-iso";
       digga.inputs.nixpkgs.follows = "nixos";
       digga.inputs.nixlib.follows = "nixos";
       digga.inputs.home-manager.follows = "home";
-- 
2.44.2


From 209eed069c066b1ae504ae7e43adc4f4f90bcceb Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Mon, 29 Aug 2022 11:53:55 +0200
Subject: [PATCH 13/39] Add comment how to build isoImage

---
 hosts/bootstrap.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/hosts/bootstrap.nix b/hosts/bootstrap.nix
index ba509911..7772b0f1 100644
--- a/hosts/bootstrap.nix
+++ b/hosts/bootstrap.nix
@@ -1,9 +1,6 @@
 { profiles, ... }:
 {
-  # build with: `nix build '.#nixosConfigurations.bootstrap.config.system.build.bootstrapIso'`
-  # reachable on the local link via ssh root@fe80::47%eno1
-  # where 'eno1' is replaced by your own machine's network
-  # interface that has the local link to the target machine
+  # build with: `nix build ".#nixosConfigurations.bootstrap.config.system.build.isoImage"`
   imports = [
     # profiles.networking
     profiles.users.root # make sure to configure ssh keys
-- 
2.44.2


From c1b672fe703a46a50dda2bcbca9f021606d41c0f Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Mon, 29 Aug 2022 11:55:20 +0200
Subject: [PATCH 14/39] Fix conflicting definition values, force use of

our defined value.

error: The option 'services.getty.autologinUser' has conflicting definition values:
       - In '/nix/store/zyh8f18z0m1r9jppvdcdivfvfxg0j3fv-source/nixos/modules/profiles/installation-device.nix': "nixos"
       - In '/nix/store/w82qigr5jqv9c6jhdrpdwixydk3rmbzw-source/modules/graphical': "pub-solar"
---
 modules/graphical/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/graphical/default.nix b/modules/graphical/default.nix
index a506c2ef..ede262b3 100644
--- a/modules/graphical/default.nix
+++ b/modules/graphical/default.nix
@@ -61,7 +61,7 @@ in
       };
     };
 
-    services.getty.autologinUser = mkIf cfg.autologin.enable "${psCfg.user.name}";
+    services.getty.autologinUser = mkIf cfg.autologin.enable (mkForce "${psCfg.user.name}");
 
     qt5 = {
       enable = true;
-- 
2.44.2


From 7b5696435a8ec65b4788647c8a3a42f92da58348 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Mon, 29 Aug 2022 15:19:07 +0200
Subject: [PATCH 15/39] Fix Build ISO ci step, use

'.#nixosConfigurations.bootstrap.config.system.build.isoImage'
---
 .drone.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 0bebe210..a170d5a2 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -97,7 +97,7 @@ steps:
     commands:
       - |
         nix $$NIX_FLAGS build \
-          '.#nixosConfigurations.bootstrap.config.system.build.bootstrapIso'
+          '.#nixosConfigurations.bootstrap.config.system.build.isoImage'
       - cp $(readlink -f result)/iso/*.iso /var/nix/iso-cache/
 
   - name: "Publish ISO"
@@ -134,6 +134,6 @@ volumes:
 
 ---
 kind: signature
-hmac: c6845bbec339e7ccfdb34889bfd56d25dc2c423eac255eb30f19b8d9e7bf9f1f
+hmac: 5d7c0ef5519ffe68189271b18d9084db55c9e14831f95234655f5387f9426db0
 
 ...
-- 
2.44.2


From 2fa84ab4aae51a50218344e177e9009bb9cbeba1 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Mon, 29 Aug 2022 16:47:31 +0200
Subject: [PATCH 16/39] Use more descriptive drone secret names

---
 .drone.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index a170d5a2..7da733c4 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -107,13 +107,13 @@ steps:
         path: /var/nix/iso-cache
     settings:
       host:
-        from_secret: ssh_host
+        from_secret: iso_web_ssh_host
       user:
-        from_secret: ssh_user
+        from_secret: iso_web_ssh_user
       port:
-        from_secret: ssh_port
+        from_secret: iso_web_ssh_port
       key:
-        from_secret: ssh_key
+        from_secret: iso_web_ssh_key
       target: /srv/os
       source:
         - /var/nix/iso-cache/*.iso
@@ -134,6 +134,6 @@ volumes:
 
 ---
 kind: signature
-hmac: 5d7c0ef5519ffe68189271b18d9084db55c9e14831f95234655f5387f9426db0
+hmac: 2b930bb5fe02006203b7c2fae8af75814749e8cec5f976ec0d6e64eae1b0c5db
 
 ...
-- 
2.44.2


From b7ba1b7ba9b87c7a60e3f2fe4772d8579b0ed711 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Thu, 1 Sep 2022 14:34:57 +0200
Subject: [PATCH 17/39] Fix hosts rebuilding with ISO config after #125

See: https://github.com/divnix/digga/pull/455#issuecomment-1231789444

Upstream fix found in https://github.com/montchr/dotfield/blob/e1b09712fef297ee6173f7010787cd5b2b574a17/nixos/default.nix#L85-L88
---
 flake.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index 466d1077..41cd4ff2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -92,7 +92,10 @@
             imports = [ (digga.lib.importExportableModules ./modules) ];
             modules = [
               { lib.our = self.lib; }
-              digga.nixosModules.bootstrapIso
+              # FIXME: upstream module causes a huge number of unnecessary
+              # dependencies to be pulled in for all systems -- many of them are
+              # graphical. should only be imported as needed.
+              # digga.nixosModules.bootstrapIso
               digga.nixosModules.nixConfig
               home.nixosModules.home-manager
               agenix.nixosModules.age
-- 
2.44.2


From d563b1d469a0a8bd2e170f450e8c6e790ee4efb9 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Thu, 1 Sep 2022 14:37:14 +0200
Subject: [PATCH 18/39] Fix swaylock-bg, now a bash script

- reference jq from pkgs
- shellcheck fixes
---
 pkgs/swaylock-bg.nix | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/pkgs/swaylock-bg.nix b/pkgs/swaylock-bg.nix
index b55c32ae..75bcd7de 100644
--- a/pkgs/swaylock-bg.nix
+++ b/pkgs/swaylock-bg.nix
@@ -3,18 +3,17 @@ self: with self; ''
   # swaylock
 
   # Make sure we aren't running twice
-  RUNNING=$(ps -A | grep swaylock | wc -l)
-  if [ $RUNNING -ne 0 ]; then
+  RUNNING=$(${procps}/bin/pgrep -c ${swaylock}/bin/swaylock)
+  if [ "$RUNNING" -ne 0 ]; then
     exit 0
   fi
 
-  IMAGE=$XDG_CONFIG_HOME/wallpaper.jpg
+  IMAGE="$XDG_CONFIG_HOME/wallpaper.jpg"
   LOCKARGS=""
 
-  for OUTPUT in `${sway}/bin/swaymsg -t get_outputs | jq -r '.[].name'`
+  for OUTPUT in $(${sway}/bin/swaymsg -t get_outputs | ${jq}/bin/jq -r '.[].name')
   do
       LOCKARGS="''${LOCKARGS} --image ''${OUTPUT}:''${IMAGE}"
-      IMAGES="''${IMAGES} ''${IMAGE}"
   done
   exec ${swaylock}/bin/swaylock $LOCKARGS
 ''
-- 
2.44.2


From 1767dcb0763cbfeed673200602b20e11c465da35 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Thu, 1 Sep 2022 14:38:10 +0200
Subject: [PATCH 19/39] Fix swayidle service

- add missing \
- reference swaylock-bg script from pkgs
---
 modules/sway/swayidle.service.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/sway/swayidle.service.nix b/modules/sway/swayidle.service.nix
index f10675fb..685d0f1d 100644
--- a/modules/sway/swayidle.service.nix
+++ b/modules/sway/swayidle.service.nix
@@ -12,11 +12,11 @@
     Environment = "PATH=/run/current-system/sw/bin:${pkgs.sway}/bin";
     ExecStart = ''${pkgs.swayidle}/bin/swayidle -w \
         after-resume 'swaymsg "output * dpms on"' \
-        before-sleep 'swaylock-bg' '' + (if psCfg.paranoia.enable then '' \
+        before-sleep '${pkgs.swaylock-bg}/bin/swaylock-bg' '' + (if psCfg.paranoia.enable then '' \
         timeout 120 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"' \
         timeout 150 'systemctl hibernate'
       '' else '' \
-        timeout 600 'swaylock-bg'
+        timeout 600 '${pkgs.swaylock-bg}/bin/swaylock-bg' \
         timeout 900 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"'
       '');
   };
-- 
2.44.2


From 0fbabc23b921fa8ac8ac5647d1ff6b5a360b70c4 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Thu, 1 Sep 2022 15:35:04 +0200
Subject: [PATCH 20/39] bootstap: host needs digga's bootstrapIso module

---
 flake.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/flake.nix b/flake.nix
index 41cd4ff2..4ac60e8a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -105,6 +105,11 @@
           imports = [ (digga.lib.importHosts ./hosts) ];
           hosts = {
             /* set host specific properties here */
+            bootstrap = {
+              modules = [
+                digga.nixosModules.bootstrapIso
+              ];
+            };
             PubSolarOS = {
               tests = [
                 (import ./tests/first-test.nix { pkgs = nixos.legacyPackages.x86_64-linux; lib = nixos.lib; })
-- 
2.44.2


From 612e5e35c0cab9ed9f836d1dc861a815d3921bbe Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Sat, 1 Oct 2022 23:12:48 +0200
Subject: [PATCH 21/39] Fix swayidle, lock, waybar menu

---
 modules/sway/config/config.d/mode_system.conf.nix | 15 +++++++++++----
 modules/sway/default.nix                          |  2 +-
 modules/sway/swayidle.service.nix                 |  8 ++++----
 3 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/modules/sway/config/config.d/mode_system.conf.nix b/modules/sway/config/config.d/mode_system.conf.nix
index f34ecc57..f01921c4 100644
--- a/modules/sway/config/config.d/mode_system.conf.nix
+++ b/modules/sway/config/config.d/mode_system.conf.nix
@@ -1,15 +1,22 @@
-{ psCfg, ... }: ''
+{ pkgs, psCfg, ... }: ''
   # Set shut down, restart and locking features
+'' + (if psCfg.core.hibernation.enable && !psCfg.paranoia.enable then ''
+  set $mode_system (e)xit, (h)ibernate, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown
+'' else if psCfg.paranoia.enable then ''
   set $mode_system (e)xit, (h)ibernate, (r)eboot, (Shift+s)hutdown
+'' else ''
+  set $mode_system (e)xit, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown
+'')
++ ''
   bindsym $mod+0 mode "$mode_system"
   mode "$mode_system" {
       bindsym e exec swaymsg exit, mode "default"
 '' + (if psCfg.core.hibernation.enable then ''
-  bindsym h exec systemctl hibernate, mode "default"
+      bindsym h exec systemctl hibernate, mode "default"
 '' else "")
 + (if !psCfg.paranoia.enable then ''
-  bindsym l exec swaylock-bg, mode "default"
-  bindsym s exec systemctl suspend, mode "default"
+      bindsym l exec ${pkgs.swaylock-bg}/bin/swaylock-bg, mode "default"
+      bindsym s exec systemctl suspend, mode "default"
 '' else "") + ''
       bindsym r exec systemctl reboot, mode "default"
       bindsym Shift+s exec systemctl poweroff, mode "default"
diff --git a/modules/sway/default.nix b/modules/sway/default.nix
index dd0e6055..c173e9ce 100644
--- a/modules/sway/default.nix
+++ b/modules/sway/default.nix
@@ -98,7 +98,7 @@ in
         xdg.configFile."sway/config.d/theme.conf".source = ./config/config.d/theme.conf;
         xdg.configFile."sway/config.d/gaps.conf".source = ./config/config.d/gaps.conf;
         xdg.configFile."sway/config.d/custom-keybindings.conf".source = ./config/config.d/custom-keybindings.conf;
-        xdg.configFile."sway/config.d/mode_system.conf".text = import ./config/config.d/mode_system.conf.nix { inherit psCfg; };
+        xdg.configFile."sway/config.d/mode_system.conf".text = import ./config/config.d/mode_system.conf.nix { inherit pkgs psCfg; };
         xdg.configFile."sway/config.d/applications.conf".source = ./config/config.d/applications.conf;
         xdg.configFile."sway/config.d/systemd.conf".source = ./config/config.d/systemd.conf;
       };
diff --git a/modules/sway/swayidle.service.nix b/modules/sway/swayidle.service.nix
index 685d0f1d..80a04518 100644
--- a/modules/sway/swayidle.service.nix
+++ b/modules/sway/swayidle.service.nix
@@ -9,14 +9,14 @@
   };
   Service = {
     Type = "simple";
-    Environment = "PATH=/run/current-system/sw/bin:${pkgs.sway}/bin";
-    ExecStart = ''${pkgs.swayidle}/bin/swayidle -w \
+    Environment = "PATH=/run/current-system/sw/bin:${pkgs.sway}/bin:${pkgs.swaylock-bg}/bin:${pkgs.swayidle}/bin";
+    ExecStart = ''swayidle -w \
         after-resume 'swaymsg "output * dpms on"' \
-        before-sleep '${pkgs.swaylock-bg}/bin/swaylock-bg' '' + (if psCfg.paranoia.enable then '' \
+        before-sleep 'swaylock-bg' '' + (if psCfg.paranoia.enable then '' \
         timeout 120 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"' \
         timeout 150 'systemctl hibernate'
       '' else '' \
-        timeout 600 '${pkgs.swaylock-bg}/bin/swaylock-bg' \
+        timeout 600 'swaylock-bg' \
         timeout 900 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"'
       '');
   };
-- 
2.44.2


From 1181cd6feafb4b7a3778fc8dc2a7434bfe2b4b54 Mon Sep 17 00:00:00 2001
From: hensoko <hensoko@noreply.example.org>
Date: Sun, 2 Oct 2022 01:17:34 +0000
Subject: [PATCH 22/39] Improve core module (#132)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-on: https://git.b12f.io/pub-solar/os/pulls/132
Reviewed-by: Benjamin Bädorf <hello@benjaminbaedorf.eu>
---
 modules/core/boot.nix       |  2 +-
 modules/core/default.nix    |  8 +++---
 modules/core/networking.nix | 49 ++++++++++++++++++++++++-------------
 3 files changed, 37 insertions(+), 22 deletions(-)

diff --git a/modules/core/boot.nix b/modules/core/boot.nix
index 10f67dc4..cb16865d 100644
--- a/modules/core/boot.nix
+++ b/modules/core/boot.nix
@@ -19,7 +19,7 @@ in
   config = {
     boot = {
       # Enable plymouth for better experience of booting
-      plymouth.enable = true;
+      plymouth.enable = mkIf (!cfg.lite) (lib.mkDefault true);
 
       # Mount / luks device in initrd
       # Allow fstrim to work on it.
diff --git a/modules/core/default.nix b/modules/core/default.nix
index 80ca4926..9a3ea0fe 100644
--- a/modules/core/default.nix
+++ b/modules/core/default.nix
@@ -29,12 +29,12 @@ in
 
   config = {
     pub-solar = {
-      audio.enable = lib.mkIf (!cfg.lite) true;
-      crypto.enable = lib.mkIf (!cfg.lite) true;
-      devops.enable = lib.mkIf (!cfg.lite) true;
+      audio.enable = lib.mkIf (!cfg.lite) (lib.mkDefault true);
+      crypto.enable = lib.mkIf (!cfg.lite) (lib.mkDefault true);
+      devops.enable = lib.mkIf (!cfg.lite) (lib.mkDefault true);
 
       terminal-life = {
-        enable = true;
+        enable = lib.mkDefault true;
         lite = cfg.lite;
       };
     };
diff --git a/modules/core/networking.nix b/modules/core/networking.nix
index 5774f7eb..edfef42d 100644
--- a/modules/core/networking.nix
+++ b/modules/core/networking.nix
@@ -6,6 +6,15 @@ let cfg = config.pub-solar.core;
 in
 {
   options.pub-solar.core = {
+    enableCaddy = mkOption {
+      type = types.bool;
+      default = !cfg.lite;
+    };
+    enableHelp = mkOption {
+      type = types.bool;
+      default = !cfg.lite;
+    };
+
     binaryCaches = mkOption {
       type = types.listOf types.str;
       default = [ ];
@@ -16,11 +25,6 @@ in
       default = [ ];
       description = "Public keys of binary caches.";
     };
-    iwdConfig = mkOption {
-      type = with types; nullOr (attrsOf (attrsOf (oneOf [ bool int str ])));
-      default = null;
-      description = "Configuratoin of iNet Wireless Daemon.";
-    };
   };
   config = {
     # disable NetworkManager-wait-online by default
@@ -38,27 +42,38 @@ in
 
     # These entries get added to /etc/hosts
     networking.hosts = {
-      "127.0.0.1" = [ "cups.local" "help.local" "caddy.local" ];
+      "127.0.0.1" = [ ]
+        ++ lib.optionals cfg.enableCaddy [ "caddy.local" ]
+        ++ lib.optionals config.pub-solar.printing.enable [ "cups.local" ]
+        ++ lib.optionals cfg.enableHelp [ "help.local" ];
     };
 
     # Caddy reverse proxy for local services like cups
     services.caddy = {
-      enable = true;
+      enable = cfg.enableCaddy;
       globalConfig = ''
         default_bind 127.0.0.1
         auto_https off
       '';
-      extraConfig = ''
-        cups.local:80 {
-          request_header Host localhost:631
-          reverse_proxy unix//run/cups/cups.sock
-        }
+      extraConfig = concatStringsSep "\n" [
+        (lib.optionalString
+          config.pub-solar.printing.enable
+          ''
+            cups.local:80 {
+              request_header Host localhost:631
+              reverse_proxy unix//run/cups/cups.sock
+            }
+          '')
 
-        help.local:80 {
-          root * ${pkgs.psos-docs}/lib/html
-          file_server
-        }
-      '';
+        (lib.optionalString
+          cfg.enableHelp
+          ''
+            help.local:80 {
+              root * ${pkgs.psos-docs}/lib/html
+              file_server
+            }
+          '')
+      ];
     };
   };
 }
-- 
2.44.2


From e80195849422055e52d3e447cb92428cc88fca19 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Sun, 2 Oct 2022 04:10:50 +0200
Subject: [PATCH 23/39] Update inputs in flake.lock

---
 flake.lock | 54 +++++++++++++++++++++++++++---------------------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/flake.lock b/flake.lock
index 794fd6d0..4e02f07a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1652712410,
-        "narHash": "sha256-hMJ2TqLt0DleEnQFGUHK9sV2aAzJPU8pZeiZoqRozbE=",
+        "lastModified": 1664140963,
+        "narHash": "sha256-pFxDtOLduRFlol0Y4ShE+soRQX4kbhaCNBtDOvx7ykw=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "7e5e58b98c3dcbf497543ff6f22591552ebfe65b",
+        "rev": "6acb1fe5f8597d5ce63fc82bc7fcac7774b1cdf0",
         "type": "github"
       },
       "original": {
@@ -42,11 +42,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1661329936,
-        "narHash": "sha256-dafFjAcJPo0SdegK3E+SnTI8CNMgV/bBm/6CeDf82f8=",
+        "lastModified": 1664210064,
+        "narHash": "sha256-df6nKVZe/yAhmJ9csirTPahc0dldwm3HBhCVNA6qWr0=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "ef0e7f41cdf8fae1d2390c4df246c90a364ed8d9",
+        "rev": "02d2551c927b7d65ded1b3c7cd13da5cc7ae3fcf",
         "type": "github"
       },
       "original": {
@@ -192,11 +192,11 @@
     "flake-compat_3": {
       "flake": false,
       "locked": {
-        "lastModified": 1648199409,
-        "narHash": "sha256-JwPKdC2PoVBkG6E+eWw3j6BMR6sL3COpYWfif7RVb8Y=",
+        "lastModified": 1650374568,
+        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "64a525ee38886ab9028e6f61790de0832aa3ef03",
+        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
         "type": "github"
       },
       "original": {
@@ -256,11 +256,11 @@
     },
     "flake-utils_3": {
       "locked": {
-        "lastModified": 1649676176,
-        "narHash": "sha256-OWKJratjt2RW151VUlJPRALb7OU2S5s+f0vLj4o1bHM=",
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "a4b154ebbdc88c8498a5c7b01589addc9e9cb678",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
         "type": "github"
       },
       "original": {
@@ -308,11 +308,11 @@
     },
     "latest_2": {
       "locked": {
-        "lastModified": 1661361016,
-        "narHash": "sha256-Bjf6ZDnDc6glTwIIItvwfcaeJ5zWFM6GYfPajSArdUY=",
+        "lastModified": 1664538465,
+        "narHash": "sha256-EnlC7dDKX7X1wlnXkB1gmn9rBZQ0J9+biVTZHw//8us=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b784c5ae63dd288375af1b4d37b8a27dd8061887",
+        "rev": "10ecda252ce1b3b1d6403caeadbcc8f30d5ab796",
         "type": "github"
       },
       "original": {
@@ -329,11 +329,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1659610603,
-        "narHash": "sha256-LYgASYSPYo7O71WfeUOaEUzYfzuXm8c8eavJcel+pfI=",
+        "lastModified": 1662220400,
+        "narHash": "sha256-9o2OGQqu4xyLZP9K6kNe1pTHnyPz0Wr3raGYnr9AIgY=",
         "owner": "nmattia",
         "repo": "naersk",
-        "rev": "c6a45e4277fa58abd524681466d3450f896dc094",
+        "rev": "6944160c19cb591eb85bbf9b2f2768a935623ed3",
         "type": "github"
       },
       "original": {
@@ -359,11 +359,11 @@
     },
     "nixos": {
       "locked": {
-        "lastModified": 1661427965,
-        "narHash": "sha256-LJeSDbiebN0/eRt9vyOm+Bxljdsq5ZdalmmTk9Xpp30=",
+        "lastModified": 1664594436,
+        "narHash": "sha256-YHowMADGzdi7fKnGlg47qe0PIljq+11VqLarmXDuKxQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "058de3818577db19d1965c21e2479916a3eaaf95",
+        "rev": "9cac45850280978a21a3eb67b15a18f34cbffa2d",
         "type": "github"
       },
       "original": {
@@ -394,11 +394,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1660407119,
-        "narHash": "sha256-04lWO0pDbhAXFdL4v2VzzwgxrZ5IefKn+TmZPiPeKxg=",
+        "lastModified": 1664628729,
+        "narHash": "sha256-A1J0ZPhBfZZiWI6ipjKJ8+RpMllzOMu/An/8Tk3t4oo=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "12620020f76b1b5d2b0e6fbbda831ed4f5fe56e1",
+        "rev": "3024c67a2e9a35450558426c42e7419ab37efd95",
         "type": "github"
       },
       "original": {
@@ -460,11 +460,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1654975372,
-        "narHash": "sha256-wkNZ16akgKViuZzE/IM+bux4uaJ04KIwUeexH8gBjgw=",
+        "lastModified": 1664550666,
+        "narHash": "sha256-eXfMRd9uItEp3PsYI31FSVGPG9dVC6yF++65ZrGwW8A=",
         "owner": "berberman",
         "repo": "nvfetcher",
-        "rev": "d4b237c10f14f72f8266b0f658faad822e491e55",
+        "rev": "9763ad40d59a044e90726653d9253efaeeb053b2",
         "type": "github"
       },
       "original": {
-- 
2.44.2


From 986680cc26e75217b9365935f379581b84b26007 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Sun, 2 Oct 2022 23:59:08 +0200
Subject: [PATCH 24/39] bootstrap iso: add PubSolarOS naming, drone pipeline

adjustments to include a symlink to the latest iso built
---
 .drone.yml               | 13 +++++++++--
 hosts/bootstrap.nix      | 48 +++++++++++++++++++++++++++++++---------
 modules/core/default.nix |  9 ++++----
 3 files changed, 52 insertions(+), 18 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 7da733c4..b9718b8c 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -98,7 +98,14 @@ steps:
       - |
         nix $$NIX_FLAGS build \
           '.#nixosConfigurations.bootstrap.config.system.build.isoImage'
-      - cp $(readlink -f result)/iso/*.iso /var/nix/iso-cache/
+      - cp $(readlink -f result)/iso/PubSolarOS*.iso /var/nix/iso-cache/
+      - nix shell nixpkgs#findutils
+      - cd /var/nix/iso-cache/
+      - export ISO_NAME=$(find . -name '*.iso' -printf "%f\n")
+      - sha256sum $ISO_NAME > $ISO_NAME.sha256
+      - ln -s $ISO_NAME PubSolarOS-latest.iso
+      - cp $ISO_NAME.sha256 PubSolarOS-latest.iso.sha256
+      - nix run nixpkgs#gnused -- --in-place "s/$ISO_NAME/PubSolarOS-latest.iso/" PubSolarOS-latest.iso.sha256
 
   - name: "Publish ISO"
     image: appleboy/drone-scp
@@ -117,6 +124,8 @@ steps:
       target: /srv/os
       source:
         - /var/nix/iso-cache/*.iso
+        - /var/nix/iso-cache/*.iso.sha256
+      overwrite: true
       strip_components: 3
 
 depends_on:
@@ -134,6 +143,6 @@ volumes:
 
 ---
 kind: signature
-hmac: 2b930bb5fe02006203b7c2fae8af75814749e8cec5f976ec0d6e64eae1b0c5db
+hmac: 7b0b56a97294cd563eee2bde56abeea6dd0928e01729980a25f8c165a3f6e0f6
 
 ...
diff --git a/hosts/bootstrap.nix b/hosts/bootstrap.nix
index 7772b0f1..49422675 100644
--- a/hosts/bootstrap.nix
+++ b/hosts/bootstrap.nix
@@ -1,4 +1,18 @@
-{ profiles, ... }:
+{ config, lib, pkgs, profiles, ... }:
+with lib;
+let
+  # Gets hostname of host to be bundled inside iso
+  # Copied from https://github.com/divnix/digga/blob/30ffa0b02272dc56c94fd3c7d8a5a0f07ca197bf/modules/bootstrap-iso.nix#L3-L11
+  getFqdn = config:
+    let
+      net = config.networking;
+      fqdn =
+        if (net ? domain) && (net.domain != null)
+        then "${net.hostName}.${net.domain}"
+        else net.hostName;
+    in
+      fqdn;
+in
 {
   # build with: `nix build ".#nixosConfigurations.bootstrap.config.system.build.isoImage"`
   imports = [
@@ -10,16 +24,28 @@
     profiles.pub-solar-iso
   ];
 
-  boot.loader.systemd-boot.enable = true;
+  config = {
+    boot.loader.systemd-boot.enable = true;
 
-  # will be overridden by the bootstrapIso instrumentation
-  fileSystems."/" = { device = "/dev/disk/by-label/nixos"; };
+    # will be overridden by the bootstrapIso instrumentation
+    fileSystems."/" = { device = "/dev/disk/by-label/nixos"; };
 
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "21.05"; # Did you read the comment?
+    system.nixos.label = "PubSolarOS-" + config.system.nixos.version;
+
+    # mkForce because a similar transformation gets double applied otherwise
+    # https://github.com/divnix/digga/blob/30ffa0b02272dc56c94fd3c7d8a5a0f07ca197bf/modules/bootstrap-iso.nix#L17
+    # https://github.com/NixOS/nixpkgs/blob/aecd4d8349b94f9bd5718c74a5b789f233f67326/nixos/modules/installer/cd-dvd/installation-cd-base.nix#L21-L22
+    isoImage = {
+      isoBaseName =  mkForce (getFqdn config);
+      isoName = mkForce "${config.system.nixos.label}-${config.isoImage.isoBaseName}-${pkgs.stdenv.hostPlatform.system}.iso";
+    };
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "21.05"; # Did you read the comment?
+  };
 }
diff --git a/modules/core/default.nix b/modules/core/default.nix
index 9a3ea0fe..4f74b46d 100644
--- a/modules/core/default.nix
+++ b/modules/core/default.nix
@@ -2,7 +2,6 @@
 
 with lib;
 let
-  psCfg = config.pub-solar;
   cfg = config.pub-solar.core;
 in
 {
@@ -29,12 +28,12 @@ in
 
   config = {
     pub-solar = {
-      audio.enable = lib.mkIf (!cfg.lite) (lib.mkDefault true);
-      crypto.enable = lib.mkIf (!cfg.lite) (lib.mkDefault true);
-      devops.enable = lib.mkIf (!cfg.lite) (lib.mkDefault true);
+      audio.enable = mkIf (!cfg.lite) (mkDefault true);
+      crypto.enable = mkIf (!cfg.lite) (mkDefault true);
+      devops.enable = mkIf (!cfg.lite) (mkDefault true);
 
       terminal-life = {
-        enable = lib.mkDefault true;
+        enable = mkDefault true;
         lite = cfg.lite;
       };
     };
-- 
2.44.2


From f2ecc2d8b9ee6b5c0cbda2f3e8b5342e714e58b6 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Mon, 3 Oct 2022 02:30:08 +0200
Subject: [PATCH 25/39] ci: fix upload target path

---
 .drone.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index b9718b8c..5e20924e 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -121,7 +121,7 @@ steps:
         from_secret: iso_web_ssh_port
       key:
         from_secret: iso_web_ssh_key
-      target: /srv/os
+      target: /srv/os/download
       source:
         - /var/nix/iso-cache/*.iso
         - /var/nix/iso-cache/*.iso.sha256
@@ -143,6 +143,6 @@ volumes:
 
 ---
 kind: signature
-hmac: 7b0b56a97294cd563eee2bde56abeea6dd0928e01729980a25f8c165a3f6e0f6
+hmac: 8823c7103f6a075bb291a497c7ab5d5db47a91f9bc7d8ef95329b5620c9cf91d
 
 ...
-- 
2.44.2


From 8529a15177466a14be333e0fdc83e39f3eb4ee07 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Benjamin=20B=C3=A4dorf?= <hello@benjaminbaedorf.eu>
Date: Mon, 3 Oct 2022 03:57:34 +0200
Subject: [PATCH 26/39] Be more paranoid

The paranoia mode now also enables the firewall and closes down a couple
of small openSSH holes. `noexec` on the whole FS is left out as it will
make every existing PubSolarOS installation panic.
---
 modules/core/networking.nix  |  2 ++
 modules/paranoia/default.nix | 30 ++++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/modules/core/networking.nix b/modules/core/networking.nix
index edfef42d..c5ec9cbe 100644
--- a/modules/core/networking.nix
+++ b/modules/core/networking.nix
@@ -36,6 +36,8 @@ in
       wifi.backend = "iwd";
     };
 
+    networking.firewall.enable = true;
+
     # Customized binary caches list (with fallback to official binary cache)
     nix.binaryCaches = cfg.binaryCaches;
     nix.binaryCachePublicKeys = cfg.publicKeys;
diff --git a/modules/paranoia/default.nix b/modules/paranoia/default.nix
index 699ab13e..f5ceaeaf 100644
--- a/modules/paranoia/default.nix
+++ b/modules/paranoia/default.nix
@@ -21,5 +21,35 @@ in
   config = mkIf cfg.enable {
     pub-solar.core.hibernation.enable = true;
     services.logind.lidSwitch = "hibernate";
+
+    # The options below are directly taken from or inspired by
+    # https://xeiaso.net/blog/paranoid-nixos-2021-07-18
+
+    # Don't set this if you need sftp
+    services.openssh.allowSFTP = false;
+    services.openssh.openFirewall = false; # Lock yourself out
+
+    # Limit the use of sudo to the group wheel
+    security.sudo.execWheelOnly = true;
+
+    # Remove the complete default environment of packages like
+    # nano, perl and rsync
+    environment.defaultPackages = lib.mkForce [ ];
+
+    # fileSystems."/".options = [ "noexec" ];
+
+    services.openssh = {
+      enable = true;
+      openFirewall = false;
+      passwordAuthentication = false;
+      kbdInteractiveAuthentication = false;
+      extraConfig = ''
+        AllowTcpForwarding yes
+        X11Forwarding no
+        AllowAgentForwarding no
+        AllowStreamLocalForwarding no
+        AuthenticationMethods publickey
+      '';
+    };
   };
 }
-- 
2.44.2


From 6f3885d0caff8d36508080e4db60b4c62616c3f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Benjamin=20B=C3=A4dorf?= <hello@benjaminbaedorf.eu>
Date: Mon, 3 Oct 2022 04:07:48 +0200
Subject: [PATCH 27/39] Remove doubled openssh configs in paranoia module

---
 modules/paranoia/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/modules/paranoia/default.nix b/modules/paranoia/default.nix
index f5ceaeaf..75275a11 100644
--- a/modules/paranoia/default.nix
+++ b/modules/paranoia/default.nix
@@ -39,8 +39,6 @@ in
     # fileSystems."/".options = [ "noexec" ];
 
     services.openssh = {
-      enable = true;
-      openFirewall = false;
       passwordAuthentication = false;
       kbdInteractiveAuthentication = false;
       extraConfig = ''
-- 
2.44.2


From b23e1e16a42465ff3905905e43f3265ef8b62846 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Mon, 3 Oct 2022 04:11:16 +0200
Subject: [PATCH 28/39] alacritty: improve selection and cursor colors

---
 modules/graphical/alacritty.nix | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/modules/graphical/alacritty.nix b/modules/graphical/alacritty.nix
index e4e2f6ad..b389343c 100644
--- a/modules/graphical/alacritty.nix
+++ b/modules/graphical/alacritty.nix
@@ -100,10 +100,15 @@
       foreground = "0xe3e1e4";
     };
 
-    # Colors the cursor will use if `custom_cursor_colors` is true
+    # Cursor colors
+    #
+    # Colors which should be used to draw the terminal cursor.
+    #
+    # Allowed values are CellForeground/CellBackground, which reference the
+    # affected cell, or hexadecimal colors like #ff00ff.
     cursor = {
-      text = "0x1a181a";
-      cursor = "0xe3e1e4";
+      text = "CellBackground";
+      cursor = "CellForeground";
     };
 
     # Colors used for the search bar and match highlighting.
@@ -115,14 +120,25 @@
         background = "0x1a181a";
       };
       focused_match = {
-        foreground = "0xe5c463";
-        background = "0xe3e1e4";
+        foreground = "CellBackground";
+        background = "CellForeground";
       };
       #bar =
       #  background = "#c5c8c6";
       #  foreground = "#1d1f21";
     };
 
+    # Selection colors
+    #
+    # Colors which should be used to draw the selection area.
+    #
+    # Allowed values are CellForeground/CellBackground, which reference the
+    # affected cell, or hexadecimal colors like #ff00ff.
+    selection = {
+      text = "0x1a181a";
+      background = "0xf85e84";
+    };
+
     # Normal colors
     normal = {
       black = "0x1a181a";
-- 
2.44.2


From 5da560ef56cb081b4dd3bae67a3a2e67421487cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Benjamin=20B=C3=A4dorf?= <hello@benjaminbaedorf.eu>
Date: Mon, 3 Oct 2022 04:55:14 +0200
Subject: [PATCH 29/39] Open up SSH by default

---
 modules/core/services.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/core/services.nix b/modules/core/services.nix
index 61ba6ea0..41aa45e5 100644
--- a/modules/core/services.nix
+++ b/modules/core/services.nix
@@ -4,7 +4,9 @@
   # For rage encryption, all hosts need a ssh key pair
   services.openssh = {
     enable = true;
-    openFirewall = lib.mkDefault false;
+    # If you don't want the host to have SSH actually opened up to the net,
+    # set `services.openssh.openFirewall` to false in your config.
+    openFirewall = lib.mkDefault true;
   };
 
   # Service that makes Out of Memory Killer more effective
-- 
2.44.2


From f28d05e24eee55396773f165b40d374be795f414 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Wed, 5 Oct 2022 11:57:51 +0200
Subject: [PATCH 30/39] Change user.publicKeys to a SSH keys string list

---
 modules/user/default.nix       | 2 +-
 profiles/base-user/default.nix | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/user/default.nix b/modules/user/default.nix
index 2fd5958e..7c869380 100644
--- a/modules/user/default.nix
+++ b/modules/user/default.nix
@@ -23,7 +23,7 @@ in
       };
       publicKeys = mkOption {
         description = "User SSH public keys";
-        type = types.listOf types.path;
+        type = types.listOf types.str;
         default = [ ];
       };
       fullName = mkOption {
diff --git a/profiles/base-user/default.nix b/profiles/base-user/default.nix
index 9ff21c8e..374dca40 100644
--- a/profiles/base-user/default.nix
+++ b/profiles/base-user/default.nix
@@ -25,7 +25,7 @@ in
       ];
       initialHashedPassword = if psCfg.user.password != null then psCfg.user.password else "";
       shell = pkgs.zsh;
-      openssh.authorizedKeys.keyFiles = if psCfg.user.publicKeys != null then psCfg.user.publicKeys else [ ];
+      openssh.authorizedKeys.keys = if psCfg.user.publicKeys != null then psCfg.user.publicKeys else [ ];
     };
   };
 }
-- 
2.44.2


From d43bd8058058f7d3231b4422997e9a11eb03385b Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Wed, 5 Oct 2022 11:58:26 +0200
Subject: [PATCH 31/39] core: disable SSH passwordAuthentication by default

---
 modules/core/services.nix    | 1 +
 modules/paranoia/default.nix | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/core/services.nix b/modules/core/services.nix
index 41aa45e5..6ce74472 100644
--- a/modules/core/services.nix
+++ b/modules/core/services.nix
@@ -7,6 +7,7 @@
     # If you don't want the host to have SSH actually opened up to the net,
     # set `services.openssh.openFirewall` to false in your config.
     openFirewall = lib.mkDefault true;
+    passwordAuthentication = false;
   };
 
   # Service that makes Out of Memory Killer more effective
diff --git a/modules/paranoia/default.nix b/modules/paranoia/default.nix
index 75275a11..2dc439cf 100644
--- a/modules/paranoia/default.nix
+++ b/modules/paranoia/default.nix
@@ -39,7 +39,6 @@ in
     # fileSystems."/".options = [ "noexec" ];
 
     services.openssh = {
-      passwordAuthentication = false;
       kbdInteractiveAuthentication = false;
       extraConfig = ''
         AllowTcpForwarding yes
-- 
2.44.2


From 4520dece5f0a96e762c032e7d98d9080481f33a4 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Tue, 18 Oct 2022 16:24:43 +0200
Subject: [PATCH 32/39] neovim: use nvfetcher for custom plugins

---
 modules/terminal-life/nvim/default.nix | 72 ++-------------------
 overlays/neovim-plugins.nix            | 22 +++++++
 overlays/rnix-lsp.nix                  |  9 +--
 pkgs/_sources/generated.nix            | 90 ++++++++++++++++++++++++--
 pkgs/sources.toml                      | 28 ++++++++
 5 files changed, 140 insertions(+), 81 deletions(-)
 create mode 100644 overlays/neovim-plugins.nix

diff --git a/modules/terminal-life/nvim/default.nix b/modules/terminal-life/nvim/default.nix
index bc06943b..4df1892a 100644
--- a/modules/terminal-life/nvim/default.nix
+++ b/modules/terminal-life/nvim/default.nix
@@ -5,66 +5,6 @@ let
   xdg = config.home-manager.users."${psCfg.user.name}".xdg;
 
   preview-file = pkgs.writeShellScriptBin "preview-file" (import ./preview-file.nix pkgs);
-
-  vimagit-master = pkgs.vimUtils.buildVimPlugin {
-    name = "vimagit-master";
-    src = pkgs.fetchFromGitHub {
-      owner = "jreybert";
-      repo = "vimagit";
-      rev = "308650ddc1e9a94e49fae0ea04bbc1c45f23d4c4";
-      sha256 = "sha256-fhazQQqyFaO0fdoeNI9nBshwTDhKNHH262H/QThtuO0=";
-    };
-  };
-
-  instant-nvim = pkgs.vimUtils.buildVimPlugin {
-    name = "instant";
-    src = pkgs.fetchFromGitHub {
-      owner = "jbyuki";
-      repo = "instant.nvim";
-      rev = "c02d72267b12130609b7ad39b76cf7f4a3bc9554";
-      sha256 = "sha256-7Pr2Au/oGKp5kMXuLsQY4BK5Wny9L1EBdXtyS5EaZPI=";
-    };
-  };
-
-  vim-caddyfile = pkgs.vimUtils.buildVimPlugin {
-    name = "vim-caddyfile";
-    src = pkgs.fetchFromGitHub {
-      owner = "isobit";
-      repo = "vim-caddyfile";
-      rev = "24fe0720551883e407cb70ae1d7c03f162d1d5a0";
-      sha256 = "sha256-rRYv3vnt31g7hNTxttTD6BWdv5JJ+ko3rPNyDUEOZ9o=";
-    };
-  };
-
-  workspace = pkgs.vimUtils.buildVimPlugin {
-    name = "vim-workspace";
-    src = pkgs.fetchFromGitHub {
-      owner = "thaerkh";
-      repo = "vim-workspace";
-      rev = "c26b473f9b073f24bacecd38477f44c5cd1f5a62";
-      sha256 = "sha256-XV7opLyfkHIDO0+JJaO/x0za0gsHuklrzapTGdLHJmI=";
-    };
-  };
-
-  beautify = pkgs.vimUtils.buildVimPlugin {
-    name = "vim-beautify";
-    src = pkgs.fetchFromGitHub {
-      owner = "zeekay";
-      repo = "vim-beautify";
-      rev = "e0691483927dc5a0c051433602397419f9628623";
-      sha256 = "QPTCl6KaGcAjTS5yVDov9yxmv0fDaFoPLMsrtVIG6GQ=";
-    };
-  };
-
-  apprentice = pkgs.vimUtils.buildVimPlugin {
-    name = "vim-apprentice";
-    src = pkgs.fetchFromGitHub {
-      owner = "romainl";
-      repo = "Apprentice";
-      rev = "ecd41698037f15a58125b349be76dbd2595bfb6d";
-      sha256 = "sha256-9s7Yzn3IEJBjcyUq9NBIQ9wb45Xr7jOkEIoWf0lAYYg=";
-    };
-  };
 in
 {
   enable = true;
@@ -108,7 +48,7 @@ in
     lsp_extensions-nvim
     nvim-lspconfig
 
-    instant-nvim
+    instant-nvim-nvfetcher
 
     ack-vim
     vim-airline
@@ -119,23 +59,23 @@ in
     syntastic
     vim-gutentags
     vim-vinegar
-    workspace
+    vim-workspace-nvfetcher
 
     sonokai
     vim-hybrid-material
     vim-airline-themes
-    apprentice
+    vim-apprentice-nvfetcher
 
     fugitive
     vim-gitgutter
     vim-rhubarb
-    vimagit-master
+    vimagit-nvfetcher
 
     fzf-vim
     fzfWrapper
     vim-highlightedyank
 
-    beautify
+    vim-beautify-nvfetcher
     vim-surround
 
     vim-bufkill
@@ -144,7 +84,7 @@ in
     ansible-vim
     emmet-vim
     rust-vim
-    vim-caddyfile
+    vim-caddyfile-nvfetcher
     vim-go
     vim-javascript
     vim-json
diff --git a/overlays/neovim-plugins.nix b/overlays/neovim-plugins.nix
new file mode 100644
index 00000000..b022049c
--- /dev/null
+++ b/overlays/neovim-plugins.nix
@@ -0,0 +1,22 @@
+final: prev: {
+  vimPlugins = prev.vimPlugins // {
+    instant-nvim-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.instant-nvim-nvfetcher) pname version src;
+    };
+    vimagit-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.vimagit-nvfetcher) pname version src;
+    };
+    vim-caddyfile-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.vim-caddyfile-nvfetcher) pname version src;
+    };
+    vim-workspace-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.vim-workspace-nvfetcher) pname version src;
+    };
+    vim-beautify-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.vim-beautify-nvfetcher) pname version src;
+    };
+    vim-apprentice-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.vim-apprentice-nvfetcher) pname version src;
+    };
+  };
+}
diff --git a/overlays/rnix-lsp.nix b/overlays/rnix-lsp.nix
index 62c0f2b0..f755d110 100644
--- a/overlays/rnix-lsp.nix
+++ b/overlays/rnix-lsp.nix
@@ -1,13 +1,6 @@
 final: prev: {
   rnix-lsp = prev.rnix-lsp.overrideAttrs (oldAttrs: rec {
-    version = "unstable-2022-07-28";
-
-    src = prev.fetchFromGitHub {
-      owner = "nix-community";
-      repo = "rnix-lsp";
-      rev = "ff18e04551a39ccdab0ff9c83926db3807b23478";
-      sha256 = "sha256-4OIpATLdPQvryyhRQPELeqNYC0n6PCyjD6LCPdwOztc=";
-    };
+    inherit (prev.sources.rnix-lsp-nvfetcher) pname version src;
 
     cargoDeps = oldAttrs.cargoDeps.overrideAttrs (prev.lib.const {
       name = "rnix-lsp-vendor.tar.gz";
diff --git a/pkgs/_sources/generated.nix b/pkgs/_sources/generated.nix
index 71be3965..f8bdd149 100644
--- a/pkgs/_sources/generated.nix
+++ b/pkgs/_sources/generated.nix
@@ -1,16 +1,92 @@
 # This file was generated by nvfetcher, please do not modify it manually.
-{ fetchgit, fetchurl }:
+{ fetchgit, fetchurl, fetchFromGitHub }:
 {
+  instant-nvim-nvfetcher = {
+    pname = "instant-nvim-nvfetcher";
+    version = "294b6d08143b3db8f9db7f606829270149e1a786";
+    src = fetchFromGitHub ({
+      owner = "jbyuki";
+      repo = "instant.nvim";
+      rev = "294b6d08143b3db8f9db7f606829270149e1a786";
+      fetchSubmodules = false;
+      sha256 = "sha256-DXJWji/NR8ZCxe014rD51v3EHJHMhRQeOoI3SsY8mR4=";
+    });
+  };
   manix = {
     pname = "manix";
     version = "d08e7ca185445b929f097f8bfb1243a8ef3e10e4";
-    src = fetchgit {
-      url = "https://github.com/mlvzk/manix";
+    src = fetchFromGitHub ({
+      owner = "mlvzk";
+      repo = "manix";
       rev = "d08e7ca185445b929f097f8bfb1243a8ef3e10e4";
       fetchSubmodules = false;
-      deepClone = false;
-      leaveDotGit = false;
-      sha256 = "1b7xi8c2drbwzfz70czddc4j33s7g1alirv12dwl91hbqxifx8qs";
-    };
+      sha256 = "sha256-GqPuYscLhkR5E2HnSFV4R48hCWvtM3C++3zlJhiK/aw=";
+    });
+  };
+  rnix-lsp-nvfetcher = {
+    pname = "rnix-lsp-nvfetcher";
+    version = "6925256babec4307479a4080b44f2be38056f210";
+    src = fetchFromGitHub ({
+      owner = "nix-community";
+      repo = "rnix-lsp";
+      rev = "6925256babec4307479a4080b44f2be38056f210";
+      fetchSubmodules = false;
+      sha256 = "sha256-OKLyIXIXhUnRB3Xw+7zI3u6XkwF7Mrbfz1XaasV6i7Q=";
+    });
+  };
+  vim-apprentice-nvfetcher = {
+    pname = "vim-apprentice-nvfetcher";
+    version = "9942d0bb0a5d82f7a24450b00051c1f2cc008659";
+    src = fetchFromGitHub ({
+      owner = "romainl";
+      repo = "Apprentice";
+      rev = "9942d0bb0a5d82f7a24450b00051c1f2cc008659";
+      fetchSubmodules = false;
+      sha256 = "sha256-Xs+vTdnihNbBFPOKsW+NB40pqN9eaadqzc0DIeNoOFo=";
+    });
+  };
+  vim-beautify-nvfetcher = {
+    pname = "vim-beautify-nvfetcher";
+    version = "e0691483927dc5a0c051433602397419f9628623";
+    src = fetchFromGitHub ({
+      owner = "zeekay";
+      repo = "vim-beautify";
+      rev = "e0691483927dc5a0c051433602397419f9628623";
+      fetchSubmodules = false;
+      sha256 = "sha256-QPTCl6KaGcAjTS5yVDov9yxmv0fDaFoPLMsrtVIG6GQ=";
+    });
+  };
+  vim-caddyfile-nvfetcher = {
+    pname = "vim-caddyfile-nvfetcher";
+    version = "24fe0720551883e407cb70ae1d7c03f162d1d5a0";
+    src = fetchFromGitHub ({
+      owner = "isobit";
+      repo = "vim-caddyfile";
+      rev = "24fe0720551883e407cb70ae1d7c03f162d1d5a0";
+      fetchSubmodules = false;
+      sha256 = "sha256-rRYv3vnt31g7hNTxttTD6BWdv5JJ+ko3rPNyDUEOZ9o=";
+    });
+  };
+  vim-workspace-nvfetcher = {
+    pname = "vim-workspace-nvfetcher";
+    version = "c26b473f9b073f24bacecd38477f44c5cd1f5a62";
+    src = fetchFromGitHub ({
+      owner = "thaerkh";
+      repo = "vim-workspace";
+      rev = "c26b473f9b073f24bacecd38477f44c5cd1f5a62";
+      fetchSubmodules = false;
+      sha256 = "sha256-XV7opLyfkHIDO0+JJaO/x0za0gsHuklrzapTGdLHJmI=";
+    });
+  };
+  vimagit-nvfetcher = {
+    pname = "vimagit-nvfetcher";
+    version = "308650ddc1e9a94e49fae0ea04bbc1c45f23d4c4";
+    src = fetchFromGitHub ({
+      owner = "jreybert";
+      repo = "vimagit";
+      rev = "308650ddc1e9a94e49fae0ea04bbc1c45f23d4c4";
+      fetchSubmodules = false;
+      sha256 = "sha256-fhazQQqyFaO0fdoeNI9nBshwTDhKNHH262H/QThtuO0=";
+    });
   };
 }
diff --git a/pkgs/sources.toml b/pkgs/sources.toml
index f7af168e..b3535048 100644
--- a/pkgs/sources.toml
+++ b/pkgs/sources.toml
@@ -2,3 +2,31 @@
 [manix]
 src.git = "https://github.com/mlvzk/manix"
 fetch.github = "mlvzk/manix"
+
+[rnix-lsp-nvfetcher]
+src.git = "https://github.com/nix-community/rnix-lsp"
+fetch.github = "nix-community/rnix-lsp"
+
+[vimagit-nvfetcher]
+src.git = "https://github.com/jreybert/vimagit"
+fetch.github = "jreybert/vimagit"
+
+[instant-nvim-nvfetcher]
+src.git = "https://github.com/jbyuki/instant.nvim"
+fetch.github = "jbyuki/instant.nvim"
+
+[vim-caddyfile-nvfetcher]
+src.git = "https://github.com/isobit/vim-caddyfile"
+fetch.github = "isobit/vim-caddyfile"
+
+[vim-workspace-nvfetcher]
+src.git = "https://github.com/thaerkh/vim-workspace"
+fetch.github = "thaerkh/vim-workspace"
+
+[vim-beautify-nvfetcher]
+src.git = "https://github.com/zeekay/vim-beautify"
+fetch.github = "zeekay/vim-beautify"
+
+[vim-apprentice-nvfetcher]
+src.git = "https://github.com/romainl/Apprentice"
+fetch.github = "romainl/Apprentice"
-- 
2.44.2


From e69c8fe9c74e9e27d0897b338aa97a55067278de Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Tue, 18 Oct 2022 17:02:23 +0200
Subject: [PATCH 33/39] Bump flake.lock

---
 flake.lock | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/flake.lock b/flake.lock
index 4e02f07a..ebcef0ac 100644
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1664140963,
-        "narHash": "sha256-pFxDtOLduRFlol0Y4ShE+soRQX4kbhaCNBtDOvx7ykw=",
+        "lastModified": 1665870395,
+        "narHash": "sha256-Tsbqb27LDNxOoPLh0gw2hIb6L/6Ow/6lIBvqcHzEKBI=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "6acb1fe5f8597d5ce63fc82bc7fcac7774b1cdf0",
+        "rev": "a630400067c6d03c9b3e0455347dc8559db14288",
         "type": "github"
       },
       "original": {
@@ -42,11 +42,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1664210064,
-        "narHash": "sha256-df6nKVZe/yAhmJ9csirTPahc0dldwm3HBhCVNA6qWr0=",
+        "lastModified": 1665392861,
+        "narHash": "sha256-bCd8fYJMAb0LzabsiXl4nxECDoz483bJOCa2hjox7N0=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "02d2551c927b7d65ded1b3c7cd13da5cc7ae3fcf",
+        "rev": "ef56fd8979b5f4e800c4716f62076e00600b1172",
         "type": "github"
       },
       "original": {
@@ -276,11 +276,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1656169755,
-        "narHash": "sha256-Nlnm4jeQWEGjYrE6hxi/7HYHjBSZ/E0RtjCYifnNsWk=",
+        "lastModified": 1665996265,
+        "narHash": "sha256-/k9og6LDBQwT+f/tJ5ClcWiUl8kCX5m6ognhsAxOiCY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "4a3d01fb53f52ac83194081272795aa4612c2381",
+        "rev": "b81e128fc053ab3159d7b464d9b7dedc9d6a6891",
         "type": "github"
       },
       "original": {
@@ -308,11 +308,11 @@
     },
     "latest_2": {
       "locked": {
-        "lastModified": 1664538465,
-        "narHash": "sha256-EnlC7dDKX7X1wlnXkB1gmn9rBZQ0J9+biVTZHw//8us=",
+        "lastModified": 1665940183,
+        "narHash": "sha256-cPe3F7CtnxU9YbJpc3Adl4d9kX+turqTv5FxM98i8vg=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "10ecda252ce1b3b1d6403caeadbcc8f30d5ab796",
+        "rev": "104e8082de1b20f9d0e1f05b1028795ed0e0e4bc",
         "type": "github"
       },
       "original": {
@@ -359,11 +359,11 @@
     },
     "nixos": {
       "locked": {
-        "lastModified": 1664594436,
-        "narHash": "sha256-YHowMADGzdi7fKnGlg47qe0PIljq+11VqLarmXDuKxQ=",
+        "lastModified": 1666014999,
+        "narHash": "sha256-gvKl8xlPJreezNG1NVTJv/HdGC69MSrM+IpCxS+eFvw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9cac45850280978a21a3eb67b15a18f34cbffa2d",
+        "rev": "1935dd8fdab8e022a9d958419663162fd840014c",
         "type": "github"
       },
       "original": {
@@ -379,11 +379,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1660727616,
-        "narHash": "sha256-zYTIvdPMYMx/EYqXODAwIIU30RiEHqNHdgarIHuEYZc=",
+        "lastModified": 1666016402,
+        "narHash": "sha256-Cm/nrdUMXwXiFQforG1Mv8OA4o8yhuVx6E1eDFH4rew=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "adccd191a0e83039d537e021f19495b7bad546a1",
+        "rev": "688db42a1eb34853f050267ff65c975f664312f0",
         "type": "github"
       },
       "original": {
@@ -394,11 +394,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1664628729,
-        "narHash": "sha256-A1J0ZPhBfZZiWI6ipjKJ8+RpMllzOMu/An/8Tk3t4oo=",
+        "lastModified": 1665987993,
+        "narHash": "sha256-MvlaIYTRiqefG4dzI5p6vVCfl+9V8A1cPniUjcn6Ngc=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "3024c67a2e9a35450558426c42e7419ab37efd95",
+        "rev": "0e6593630071440eb89cd97a52921497482b22c6",
         "type": "github"
       },
       "original": {
-- 
2.44.2


From e4418bfe0c9c7ca95aac590e4466fee293db9f48 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Thu, 20 Oct 2022 13:56:57 +0200
Subject: [PATCH 34/39] drone: use our custom drone-scp image

---
 .drone.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 5e20924e..4cf4b3b2 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -108,7 +108,9 @@ steps:
       - nix run nixpkgs#gnused -- --in-place "s/$ISO_NAME/PubSolarOS-latest.iso/" PubSolarOS-latest.iso.sha256
 
   - name: "Publish ISO"
-    image: appleboy/drone-scp
+    # custom drone-scp image, source: https://git.b12f.io/pub-solar/drone-scp/
+    # docker build --tag registry.greenbaum.cloud/library/drone-scp:v1.6.5 --file ./docker/Dockerfile.linux.amd64 .
+    image: registry.greenbaum.cloud/library/drone-scp:v1.6.5
     volumes:
       - name: file-exchange
         path: /var/nix/iso-cache
@@ -125,7 +127,7 @@ steps:
       source:
         - /var/nix/iso-cache/*.iso
         - /var/nix/iso-cache/*.iso.sha256
-      overwrite: true
+      unlink_first: true
       strip_components: 3
 
 depends_on:
@@ -143,6 +145,6 @@ volumes:
 
 ---
 kind: signature
-hmac: 8823c7103f6a075bb291a497c7ab5d5db47a91f9bc7d8ef95329b5620c9cf91d
+hmac: 3e6a89e903e214f21d488eba82863683b130ef6dbc2dc352377d4fd94ab3cd0c
 
 ...
-- 
2.44.2


From eece344083ec64ce0d5f9006d2751fe33c91eb0e Mon Sep 17 00:00:00 2001
From: Hendrik Sokolowski <hensoko@gssws.de>
Date: Sun, 23 Oct 2022 18:33:11 +0200
Subject: [PATCH 35/39] Make resume_offset optional

---
 modules/core/hibernation.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/modules/core/hibernation.nix b/modules/core/hibernation.nix
index 0454d82b..a71ffd37 100644
--- a/modules/core/hibernation.nix
+++ b/modules/core/hibernation.nix
@@ -27,9 +27,7 @@ in
   config = {
     boot = mkIf cfg.enable {
       resumeDevice = cfg.resumeDevice;
-      kernelParams =
-        if (cfg.resumeOffset == null && cfg.enable) then builtins.abort "config.pub-solar.resumeOffset has to be set if config.pub-solar.enable is true."
-        else [ "resume_offset=${builtins.toString cfg.resumeOffset}" ];
+      kernelParams = mkIf (cfg.resumeOffset != null) [ "resume_offset=${builtins.toString cfg.resumeOffset}" ];
     };
   };
 }
-- 
2.44.2


From ea6233f57e994286bd989c4527f4999c108713db Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Tue, 18 Oct 2022 16:44:00 +0200
Subject: [PATCH 36/39] zsh: fetch plugins using nvfetcher

---
 modules/terminal-life/zsh/default.nix | 31 ++++---------------
 pkgs/_sources/generated.nix           | 44 +++++++++++++++++++++++++++
 pkgs/sources.toml                     | 16 ++++++++++
 3 files changed, 66 insertions(+), 25 deletions(-)

diff --git a/modules/terminal-life/zsh/default.nix b/modules/terminal-life/zsh/default.nix
index b68a4270..36ec41ad 100644
--- a/modules/terminal-life/zsh/default.nix
+++ b/modules/terminal-life/zsh/default.nix
@@ -40,46 +40,27 @@ in
     myip = "dig +short myip.opendns.com @208.67.222.222 2>&1";
   };
   plugins = [
+    # src gets fetched by nvfetcher, see: ./pkgs/sources.toml
     {
       # will source ohmyzsh/plugins/z/
       name = "zsh-plugins-z";
-      file = "plugins/z/z.sh";
-      src = pkgs.fetchFromGitHub {
-        owner = "ohmyzsh";
-        repo = "ohmyzsh";
-        rev = "249c708ed3a4a7a63d16a6e911a46b6fb9623cbd";
-        sha256 = "sha256-NAVotL5RxpS/zKnO+ngMIjv787lqc1dj/c4blQrQcvU=";
-      };
+      file = "plugins/z/z.plugin.zsh";
+      src = pkgs.sources.ohmyzsh.src;
     }
     {
       name = "zsh-powerlevel10k";
       file = "powerlevel10k.zsh-theme";
-      src = pkgs.fetchFromGitHub {
-        owner = "romkatv";
-        repo = "powerlevel10k";
-        rev = "2dd6a29e4d7a33bfef10973d6550e087be37ddee";
-        sha256 = "sha256-9vc4cMBCNOmPOyzGwnPeMrXXyQUq4pC9Du3AWl9+Rys=";
-      };
+      src = pkgs.sources.powerlevel10k.src;
     }
     {
       name = "zsh-fast-syntax-highlighting";
       file = "F-Sy-H.plugin.zsh";
-      src = pkgs.fetchFromGitHub {
-        owner = "z-shell";
-        repo = "F-Sy-H";
-        rev = "c4bdc485b67b58351a24f21fcac92c9e0232b939";
-        sha256 = "sha256-uXBGIdJwubuueNhQRdGxPUi0eJN17cflYAuHTjeQ8FQ=";
-      };
+      src = pkgs.sources.F-Sy-H.src;
     }
     {
       name = "zsh-nix-shell";
       file = "nix-shell.plugin.zsh";
-      src = pkgs.fetchFromGitHub {
-        owner = "chisui";
-        repo = "zsh-nix-shell";
-        rev = "af6f8a266ea1875b9a3e86e14796cadbe1cfbf08";
-        sha256 = "sha256-BjgMhILEL/qdgfno4LR64LSB8n9pC9R+gG7IQWwgyfQ=";
-      };
+      src = pkgs.sources.zsh-nix-shell.src;
     }
   ];
 
diff --git a/pkgs/_sources/generated.nix b/pkgs/_sources/generated.nix
index f8bdd149..30bcbdef 100644
--- a/pkgs/_sources/generated.nix
+++ b/pkgs/_sources/generated.nix
@@ -1,6 +1,17 @@
 # This file was generated by nvfetcher, please do not modify it manually.
 { fetchgit, fetchurl, fetchFromGitHub }:
 {
+  F-Sy-H = {
+    pname = "F-Sy-H";
+    version = "b935a87a75560f8173dd78deee6717c59d464e06";
+    src = fetchFromGitHub ({
+      owner = "z-shell";
+      repo = "F-Sy-H";
+      rev = "b935a87a75560f8173dd78deee6717c59d464e06";
+      fetchSubmodules = false;
+      sha256 = "sha256-448OlDnrDkUjvaSLDhXsa9bkgYXzj1Ju8CTpJVjH8LM=";
+    });
+  };
   instant-nvim-nvfetcher = {
     pname = "instant-nvim-nvfetcher";
     version = "294b6d08143b3db8f9db7f606829270149e1a786";
@@ -23,6 +34,28 @@
       sha256 = "sha256-GqPuYscLhkR5E2HnSFV4R48hCWvtM3C++3zlJhiK/aw=";
     });
   };
+  ohmyzsh = {
+    pname = "ohmyzsh";
+    version = "65a1e4edbe678cdac37ad96ca4bc4f6d77e27adf";
+    src = fetchFromGitHub ({
+      owner = "ohmyzsh";
+      repo = "ohmyzsh";
+      rev = "65a1e4edbe678cdac37ad96ca4bc4f6d77e27adf";
+      fetchSubmodules = false;
+      sha256 = "sha256-qyI7CU0vKhhADZfQtD73GsyAbqdMPhDQ1uA03h4erpw=";
+    });
+  };
+  powerlevel10k = {
+    pname = "powerlevel10k";
+    version = "8091c8a3a8a845c70046684235a01cd500075def";
+    src = fetchFromGitHub ({
+      owner = "romkatv";
+      repo = "powerlevel10k";
+      rev = "8091c8a3a8a845c70046684235a01cd500075def";
+      fetchSubmodules = false;
+      sha256 = "sha256-I0/tktXCbZ3hMYTNvPoWfOEYWRgmHoXsar/jcUB6bpo=";
+    });
+  };
   rnix-lsp-nvfetcher = {
     pname = "rnix-lsp-nvfetcher";
     version = "6925256babec4307479a4080b44f2be38056f210";
@@ -89,4 +122,15 @@
       sha256 = "sha256-fhazQQqyFaO0fdoeNI9nBshwTDhKNHH262H/QThtuO0=";
     });
   };
+  zsh-nix-shell = {
+    pname = "zsh-nix-shell";
+    version = "af6f8a266ea1875b9a3e86e14796cadbe1cfbf08";
+    src = fetchFromGitHub ({
+      owner = "chisui";
+      repo = "zsh-nix-shell";
+      rev = "af6f8a266ea1875b9a3e86e14796cadbe1cfbf08";
+      fetchSubmodules = false;
+      sha256 = "sha256-BjgMhILEL/qdgfno4LR64LSB8n9pC9R+gG7IQWwgyfQ=";
+    });
+  };
 }
diff --git a/pkgs/sources.toml b/pkgs/sources.toml
index b3535048..5ec5e936 100644
--- a/pkgs/sources.toml
+++ b/pkgs/sources.toml
@@ -3,6 +3,22 @@
 src.git = "https://github.com/mlvzk/manix"
 fetch.github = "mlvzk/manix"
 
+[ohmyzsh]
+src.git = "https://github.com/ohmyzsh/ohmyzsh"
+fetch.github = "ohmyzsh/ohmyzsh"
+
+[powerlevel10k]
+src.git = "https://github.com/romkatv/powerlevel10k"
+fetch.github = "romkatv/powerlevel10k"
+
+[F-Sy-H]
+src.git = "https://github.com/z-shell/F-Sy-H"
+fetch.github = "z-shell/F-Sy-H"
+
+[zsh-nix-shell]
+src.git = "https://github.com/chisui/zsh-nix-shell"
+fetch.github = "chisui/zsh-nix-shell"
+
 [rnix-lsp-nvfetcher]
 src.git = "https://github.com/nix-community/rnix-lsp"
 fetch.github = "nix-community/rnix-lsp"
-- 
2.44.2


From 630d0afc5e0b389c1ad956230b9ad96a381a157a Mon Sep 17 00:00:00 2001
From: Hendrik Sokolowski <hensoko@gssws.de>
Date: Sat, 15 Oct 2022 01:58:36 +0200
Subject: [PATCH 37/39] Update drone-config

---
 .drone.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 4cf4b3b2..b4d4bb92 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -1,11 +1,12 @@
 ---
 kind: pipeline
-type: docker
+type: exec
 name: Check
+node:
+  hosttype: baremetal
 
 steps:
   - name: "Check"
-    image: docker.nix-community.org/nixpkgs/nix-flakes:latest
     when:
       event:
         - pull_request
@@ -20,6 +21,8 @@ steps:
 kind: pipeline
 type: exec
 name: Tests
+node:
+  hosttype: baremetal
 
 steps:
   - name: "Tests"
@@ -145,6 +148,6 @@ volumes:
 
 ---
 kind: signature
-hmac: 3e6a89e903e214f21d488eba82863683b130ef6dbc2dc352377d4fd94ab3cd0c
+hmac: 291be33bbf2954d1f5e4bf569679e24a773e7d6f90db4765fb9dacb3686a825e
 
 ...
-- 
2.44.2


From 02c145697b3539077c7217ce4edc872c2a656408 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Mon, 7 Nov 2022 11:24:59 +0100
Subject: [PATCH 38/39] Pull in upstream commits from
 https://github.com/divnix/digga/pull/490

Improved flake-compat

Get the rev from the flake.lock file. Shouldn't be an issue for
first time users as the guide instructs users to generate a lock
file. `builtins.file` was used in accordance with nix.dev
reccommendations.

https://nix.dev/anti-patterns/language#reproducibility-referencing-top-level-directory-with

Rm tempfix
---
 flake.nix              |  3 +++
 lib/compat/default.nix |  8 ++++----
 shell/devos.nix        | 15 ---------------
 3 files changed, 7 insertions(+), 19 deletions(-)

diff --git a/flake.nix b/flake.nix
index 4ac60e8a..cce3f8ee 100644
--- a/flake.nix
+++ b/flake.nix
@@ -11,6 +11,9 @@
       nixos.url = "github:nixos/nixpkgs/nixos-22.05";
       latest.url = "github:nixos/nixpkgs/nixos-unstable";
 
+      flake-compat.url = "github:edolstra/flake-compat";
+      flake-compat.flake = false;
+
       digga.url = "github:pub-solar/digga/fix/bootstrap-iso";
       digga.inputs.nixpkgs.follows = "nixos";
       digga.inputs.nixlib.follows = "nixos";
diff --git a/lib/compat/default.nix b/lib/compat/default.nix
index 9d0c2837..ae3b4426 100644
--- a/lib/compat/default.nix
+++ b/lib/compat/default.nix
@@ -1,14 +1,14 @@
 let
-  rev = "e7e5d481a0e15dcd459396e55327749989e04ce0";
+  lock = builtins.fromJSON (builtins.readFile builtins.path { path = ../../flake.lock; name = "lockPath"; });
   flake = (import
     (
       fetchTarball {
-        url = "https://github.com/edolstra/flake-compat/archive/${rev}.tar.gz";
-        sha256 = "0zd3x46fswh5n6faq4x2kkpy6p3c6j593xbdlbsl40ppkclwc80x";
+        url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+        sha256 = lock.nodes.flake-compat.locked.narHash;
       }
     )
     {
-      src = ../../.;
+      src = builtins.path { path = ../../.; name = "projectRoot"; };
     });
 in
 flake
diff --git a/shell/devos.nix b/shell/devos.nix
index 9aefcc6f..382a6d34 100644
--- a/shell/devos.nix
+++ b/shell/devos.nix
@@ -28,21 +28,6 @@ in
   # override for our own welcome
   devshell.name = pkgs.lib.mkForce "PubSolarOS";
 
-  # tempfix: remove when merged https://github.com/numtide/devshell/pull/123
-  devshell.startup.load_profiles = pkgs.lib.mkForce (pkgs.lib.noDepEntry ''
-    # PATH is devshell's exorbitant privilige:
-    # fence against its pollution
-    _PATH=''${PATH}
-    # Load installed profiles
-    for file in "$DEVSHELL_DIR/etc/profile.d/"*.sh; do
-      # If that folder doesn't exist, bash loves to return the whole glob
-      [[ -f "$file" ]] && source "$file"
-    done
-    # Exert exorbitant privilige and leave no trace
-    export PATH=''${_PATH}
-    unset _PATH
-  '');
-
   commands = with pkgs; [
     (devos nix)
     (devos agenix)
-- 
2.44.2


From 06ed2a78a9fdf8bee7b83b31f1ae823d02c0168e Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Mon, 7 Nov 2022 11:26:58 +0100
Subject: [PATCH 39/39] Bump flake.lock

---
 flake.lock | 67 ++++++++++++++++++++++++++++++++++--------------------
 1 file changed, 42 insertions(+), 25 deletions(-)

diff --git a/flake.lock b/flake.lock
index ebcef0ac..060a2aea 100644
--- a/flake.lock
+++ b/flake.lock
@@ -42,11 +42,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1665392861,
-        "narHash": "sha256-bCd8fYJMAb0LzabsiXl4nxECDoz483bJOCa2hjox7N0=",
+        "lastModified": 1667419884,
+        "narHash": "sha256-oLNw87ZI5NxTMlNQBv1wG2N27CUzo9admaFlnmavpiY=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "ef56fd8979b5f4e800c4716f62076e00600b1172",
+        "rev": "cfc0125eafadc9569d3d6a16ee928375b77e3100",
         "type": "github"
       },
       "original": {
@@ -205,6 +205,22 @@
         "type": "github"
       }
     },
+    "flake-compat_4": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1650374568,
+        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "locked": {
         "lastModified": 1642700792,
@@ -256,11 +272,11 @@
     },
     "flake-utils_3": {
       "locked": {
-        "lastModified": 1659877975,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "lastModified": 1667077288,
+        "narHash": "sha256-bdC8sFNDpT0HK74u9fUkpbf1MEzVYJ+ka7NXCdgBoaA=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "rev": "6ee9ebb6b1ee695d2cacc4faa053a7b9baa76817",
         "type": "github"
       },
       "original": {
@@ -276,11 +292,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1665996265,
-        "narHash": "sha256-/k9og6LDBQwT+f/tJ5ClcWiUl8kCX5m6ognhsAxOiCY=",
+        "lastModified": 1667677389,
+        "narHash": "sha256-y9Zdq8vtsn0T5TO1iTvWA7JndYIAGjzCjbYVi/hOSmA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b81e128fc053ab3159d7b464d9b7dedc9d6a6891",
+        "rev": "87d55517f6f36aa1afbd7a4a064869d5a1d405b8",
         "type": "github"
       },
       "original": {
@@ -308,11 +324,11 @@
     },
     "latest_2": {
       "locked": {
-        "lastModified": 1665940183,
-        "narHash": "sha256-cPe3F7CtnxU9YbJpc3Adl4d9kX+turqTv5FxM98i8vg=",
+        "lastModified": 1667629849,
+        "narHash": "sha256-P+v+nDOFWicM4wziFK9S/ajF2lc0N2Rg9p6Y35uMoZI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "104e8082de1b20f9d0e1f05b1028795ed0e0e4bc",
+        "rev": "3bacde6273b09a21a8ccfba15586fb165078fb62",
         "type": "github"
       },
       "original": {
@@ -359,11 +375,11 @@
     },
     "nixos": {
       "locked": {
-        "lastModified": 1666014999,
-        "narHash": "sha256-gvKl8xlPJreezNG1NVTJv/HdGC69MSrM+IpCxS+eFvw=",
+        "lastModified": 1667653703,
+        "narHash": "sha256-Xow4vx52/g5zkhlgZnMEm/TEXsj+13jTPCc2jIhW1xU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "1935dd8fdab8e022a9d958419663162fd840014c",
+        "rev": "f09ad462c5a121d0239fde645aacb2221553a217",
         "type": "github"
       },
       "original": {
@@ -379,11 +395,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1666016402,
-        "narHash": "sha256-Cm/nrdUMXwXiFQforG1Mv8OA4o8yhuVx6E1eDFH4rew=",
+        "lastModified": 1666812839,
+        "narHash": "sha256-0nBDgjPU+iDsvz89W+cDEyhnFGSwCJmwDl/gMGqYiU0=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "688db42a1eb34853f050267ff65c975f664312f0",
+        "rev": "41f3518bc194389df22a3d198215eae75e6b5ab9",
         "type": "github"
       },
       "original": {
@@ -394,11 +410,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1665987993,
-        "narHash": "sha256-MvlaIYTRiqefG4dzI5p6vVCfl+9V8A1cPniUjcn6Ngc=",
+        "lastModified": 1667768008,
+        "narHash": "sha256-PGbX0s2hhXGnZDFVE6UIhPSOf5YegpWs5dUXpT/14F0=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "0e6593630071440eb89cd97a52921497482b22c6",
+        "rev": "f6483e0def85efb9c1e884efbaff45a5e7aabb34",
         "type": "github"
       },
       "original": {
@@ -453,18 +469,18 @@
     },
     "nvfetcher": {
       "inputs": {
-        "flake-compat": "flake-compat_3",
+        "flake-compat": "flake-compat_4",
         "flake-utils": "flake-utils_3",
         "nixpkgs": [
           "nixos"
         ]
       },
       "locked": {
-        "lastModified": 1664550666,
-        "narHash": "sha256-eXfMRd9uItEp3PsYI31FSVGPG9dVC6yF++65ZrGwW8A=",
+        "lastModified": 1667620329,
+        "narHash": "sha256-v1Zk7rtEbAGpevBGPZvZBKpwbmw4I+uVwxvd+pBlp3o=",
         "owner": "berberman",
         "repo": "nvfetcher",
-        "rev": "9763ad40d59a044e90726653d9253efaeeb053b2",
+        "rev": "294826951113dcd3aa9abbcacfb1aa5b95a19116",
         "type": "github"
       },
       "original": {
@@ -479,6 +495,7 @@
         "darwin": "darwin",
         "deploy": "deploy",
         "digga": "digga",
+        "flake-compat": "flake-compat_3",
         "home": "home",
         "latest": "latest_2",
         "naersk": "naersk",
-- 
2.44.2