From 0fbabc23b921fa8ac8ac5647d1ff6b5a360b70c4 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Thu, 1 Sep 2022 15:35:04 +0200
Subject: [PATCH 01/20] bootstap: host needs digga's bootstrapIso module

---
 flake.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/flake.nix b/flake.nix
index 41cd4ff2..4ac60e8a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -105,6 +105,11 @@
           imports = [ (digga.lib.importHosts ./hosts) ];
           hosts = {
             /* set host specific properties here */
+            bootstrap = {
+              modules = [
+                digga.nixosModules.bootstrapIso
+              ];
+            };
             PubSolarOS = {
               tests = [
                 (import ./tests/first-test.nix { pkgs = nixos.legacyPackages.x86_64-linux; lib = nixos.lib; })
-- 
2.44.1


From 612e5e35c0cab9ed9f836d1dc861a815d3921bbe Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Sat, 1 Oct 2022 23:12:48 +0200
Subject: [PATCH 02/20] Fix swayidle, lock, waybar menu

---
 modules/sway/config/config.d/mode_system.conf.nix | 15 +++++++++++----
 modules/sway/default.nix                          |  2 +-
 modules/sway/swayidle.service.nix                 |  8 ++++----
 3 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/modules/sway/config/config.d/mode_system.conf.nix b/modules/sway/config/config.d/mode_system.conf.nix
index f34ecc57..f01921c4 100644
--- a/modules/sway/config/config.d/mode_system.conf.nix
+++ b/modules/sway/config/config.d/mode_system.conf.nix
@@ -1,15 +1,22 @@
-{ psCfg, ... }: ''
+{ pkgs, psCfg, ... }: ''
   # Set shut down, restart and locking features
+'' + (if psCfg.core.hibernation.enable && !psCfg.paranoia.enable then ''
+  set $mode_system (e)xit, (h)ibernate, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown
+'' else if psCfg.paranoia.enable then ''
   set $mode_system (e)xit, (h)ibernate, (r)eboot, (Shift+s)hutdown
+'' else ''
+  set $mode_system (e)xit, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown
+'')
++ ''
   bindsym $mod+0 mode "$mode_system"
   mode "$mode_system" {
       bindsym e exec swaymsg exit, mode "default"
 '' + (if psCfg.core.hibernation.enable then ''
-  bindsym h exec systemctl hibernate, mode "default"
+      bindsym h exec systemctl hibernate, mode "default"
 '' else "")
 + (if !psCfg.paranoia.enable then ''
-  bindsym l exec swaylock-bg, mode "default"
-  bindsym s exec systemctl suspend, mode "default"
+      bindsym l exec ${pkgs.swaylock-bg}/bin/swaylock-bg, mode "default"
+      bindsym s exec systemctl suspend, mode "default"
 '' else "") + ''
       bindsym r exec systemctl reboot, mode "default"
       bindsym Shift+s exec systemctl poweroff, mode "default"
diff --git a/modules/sway/default.nix b/modules/sway/default.nix
index dd0e6055..c173e9ce 100644
--- a/modules/sway/default.nix
+++ b/modules/sway/default.nix
@@ -98,7 +98,7 @@ in
         xdg.configFile."sway/config.d/theme.conf".source = ./config/config.d/theme.conf;
         xdg.configFile."sway/config.d/gaps.conf".source = ./config/config.d/gaps.conf;
         xdg.configFile."sway/config.d/custom-keybindings.conf".source = ./config/config.d/custom-keybindings.conf;
-        xdg.configFile."sway/config.d/mode_system.conf".text = import ./config/config.d/mode_system.conf.nix { inherit psCfg; };
+        xdg.configFile."sway/config.d/mode_system.conf".text = import ./config/config.d/mode_system.conf.nix { inherit pkgs psCfg; };
         xdg.configFile."sway/config.d/applications.conf".source = ./config/config.d/applications.conf;
         xdg.configFile."sway/config.d/systemd.conf".source = ./config/config.d/systemd.conf;
       };
diff --git a/modules/sway/swayidle.service.nix b/modules/sway/swayidle.service.nix
index 685d0f1d..80a04518 100644
--- a/modules/sway/swayidle.service.nix
+++ b/modules/sway/swayidle.service.nix
@@ -9,14 +9,14 @@
   };
   Service = {
     Type = "simple";
-    Environment = "PATH=/run/current-system/sw/bin:${pkgs.sway}/bin";
-    ExecStart = ''${pkgs.swayidle}/bin/swayidle -w \
+    Environment = "PATH=/run/current-system/sw/bin:${pkgs.sway}/bin:${pkgs.swaylock-bg}/bin:${pkgs.swayidle}/bin";
+    ExecStart = ''swayidle -w \
         after-resume 'swaymsg "output * dpms on"' \
-        before-sleep '${pkgs.swaylock-bg}/bin/swaylock-bg' '' + (if psCfg.paranoia.enable then '' \
+        before-sleep 'swaylock-bg' '' + (if psCfg.paranoia.enable then '' \
         timeout 120 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"' \
         timeout 150 'systemctl hibernate'
       '' else '' \
-        timeout 600 '${pkgs.swaylock-bg}/bin/swaylock-bg' \
+        timeout 600 'swaylock-bg' \
         timeout 900 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"'
       '');
   };
-- 
2.44.1


From 1181cd6feafb4b7a3778fc8dc2a7434bfe2b4b54 Mon Sep 17 00:00:00 2001
From: hensoko <hensoko@noreply.example.org>
Date: Sun, 2 Oct 2022 01:17:34 +0000
Subject: [PATCH 03/20] Improve core module (#132)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-on: https://git.b12f.io/pub-solar/os/pulls/132
Reviewed-by: Benjamin Bädorf <hello@benjaminbaedorf.eu>
---
 modules/core/boot.nix       |  2 +-
 modules/core/default.nix    |  8 +++---
 modules/core/networking.nix | 49 ++++++++++++++++++++++++-------------
 3 files changed, 37 insertions(+), 22 deletions(-)

diff --git a/modules/core/boot.nix b/modules/core/boot.nix
index 10f67dc4..cb16865d 100644
--- a/modules/core/boot.nix
+++ b/modules/core/boot.nix
@@ -19,7 +19,7 @@ in
   config = {
     boot = {
       # Enable plymouth for better experience of booting
-      plymouth.enable = true;
+      plymouth.enable = mkIf (!cfg.lite) (lib.mkDefault true);
 
       # Mount / luks device in initrd
       # Allow fstrim to work on it.
diff --git a/modules/core/default.nix b/modules/core/default.nix
index 80ca4926..9a3ea0fe 100644
--- a/modules/core/default.nix
+++ b/modules/core/default.nix
@@ -29,12 +29,12 @@ in
 
   config = {
     pub-solar = {
-      audio.enable = lib.mkIf (!cfg.lite) true;
-      crypto.enable = lib.mkIf (!cfg.lite) true;
-      devops.enable = lib.mkIf (!cfg.lite) true;
+      audio.enable = lib.mkIf (!cfg.lite) (lib.mkDefault true);
+      crypto.enable = lib.mkIf (!cfg.lite) (lib.mkDefault true);
+      devops.enable = lib.mkIf (!cfg.lite) (lib.mkDefault true);
 
       terminal-life = {
-        enable = true;
+        enable = lib.mkDefault true;
         lite = cfg.lite;
       };
     };
diff --git a/modules/core/networking.nix b/modules/core/networking.nix
index 5774f7eb..edfef42d 100644
--- a/modules/core/networking.nix
+++ b/modules/core/networking.nix
@@ -6,6 +6,15 @@ let cfg = config.pub-solar.core;
 in
 {
   options.pub-solar.core = {
+    enableCaddy = mkOption {
+      type = types.bool;
+      default = !cfg.lite;
+    };
+    enableHelp = mkOption {
+      type = types.bool;
+      default = !cfg.lite;
+    };
+
     binaryCaches = mkOption {
       type = types.listOf types.str;
       default = [ ];
@@ -16,11 +25,6 @@ in
       default = [ ];
       description = "Public keys of binary caches.";
     };
-    iwdConfig = mkOption {
-      type = with types; nullOr (attrsOf (attrsOf (oneOf [ bool int str ])));
-      default = null;
-      description = "Configuratoin of iNet Wireless Daemon.";
-    };
   };
   config = {
     # disable NetworkManager-wait-online by default
@@ -38,27 +42,38 @@ in
 
     # These entries get added to /etc/hosts
     networking.hosts = {
-      "127.0.0.1" = [ "cups.local" "help.local" "caddy.local" ];
+      "127.0.0.1" = [ ]
+        ++ lib.optionals cfg.enableCaddy [ "caddy.local" ]
+        ++ lib.optionals config.pub-solar.printing.enable [ "cups.local" ]
+        ++ lib.optionals cfg.enableHelp [ "help.local" ];
     };
 
     # Caddy reverse proxy for local services like cups
     services.caddy = {
-      enable = true;
+      enable = cfg.enableCaddy;
       globalConfig = ''
         default_bind 127.0.0.1
         auto_https off
       '';
-      extraConfig = ''
-        cups.local:80 {
-          request_header Host localhost:631
-          reverse_proxy unix//run/cups/cups.sock
-        }
+      extraConfig = concatStringsSep "\n" [
+        (lib.optionalString
+          config.pub-solar.printing.enable
+          ''
+            cups.local:80 {
+              request_header Host localhost:631
+              reverse_proxy unix//run/cups/cups.sock
+            }
+          '')
 
-        help.local:80 {
-          root * ${pkgs.psos-docs}/lib/html
-          file_server
-        }
-      '';
+        (lib.optionalString
+          cfg.enableHelp
+          ''
+            help.local:80 {
+              root * ${pkgs.psos-docs}/lib/html
+              file_server
+            }
+          '')
+      ];
     };
   };
 }
-- 
2.44.1


From e80195849422055e52d3e447cb92428cc88fca19 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Sun, 2 Oct 2022 04:10:50 +0200
Subject: [PATCH 04/20] Update inputs in flake.lock

---
 flake.lock | 54 +++++++++++++++++++++++++++---------------------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/flake.lock b/flake.lock
index 794fd6d0..4e02f07a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1652712410,
-        "narHash": "sha256-hMJ2TqLt0DleEnQFGUHK9sV2aAzJPU8pZeiZoqRozbE=",
+        "lastModified": 1664140963,
+        "narHash": "sha256-pFxDtOLduRFlol0Y4ShE+soRQX4kbhaCNBtDOvx7ykw=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "7e5e58b98c3dcbf497543ff6f22591552ebfe65b",
+        "rev": "6acb1fe5f8597d5ce63fc82bc7fcac7774b1cdf0",
         "type": "github"
       },
       "original": {
@@ -42,11 +42,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1661329936,
-        "narHash": "sha256-dafFjAcJPo0SdegK3E+SnTI8CNMgV/bBm/6CeDf82f8=",
+        "lastModified": 1664210064,
+        "narHash": "sha256-df6nKVZe/yAhmJ9csirTPahc0dldwm3HBhCVNA6qWr0=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "ef0e7f41cdf8fae1d2390c4df246c90a364ed8d9",
+        "rev": "02d2551c927b7d65ded1b3c7cd13da5cc7ae3fcf",
         "type": "github"
       },
       "original": {
@@ -192,11 +192,11 @@
     "flake-compat_3": {
       "flake": false,
       "locked": {
-        "lastModified": 1648199409,
-        "narHash": "sha256-JwPKdC2PoVBkG6E+eWw3j6BMR6sL3COpYWfif7RVb8Y=",
+        "lastModified": 1650374568,
+        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "64a525ee38886ab9028e6f61790de0832aa3ef03",
+        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
         "type": "github"
       },
       "original": {
@@ -256,11 +256,11 @@
     },
     "flake-utils_3": {
       "locked": {
-        "lastModified": 1649676176,
-        "narHash": "sha256-OWKJratjt2RW151VUlJPRALb7OU2S5s+f0vLj4o1bHM=",
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "a4b154ebbdc88c8498a5c7b01589addc9e9cb678",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
         "type": "github"
       },
       "original": {
@@ -308,11 +308,11 @@
     },
     "latest_2": {
       "locked": {
-        "lastModified": 1661361016,
-        "narHash": "sha256-Bjf6ZDnDc6glTwIIItvwfcaeJ5zWFM6GYfPajSArdUY=",
+        "lastModified": 1664538465,
+        "narHash": "sha256-EnlC7dDKX7X1wlnXkB1gmn9rBZQ0J9+biVTZHw//8us=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b784c5ae63dd288375af1b4d37b8a27dd8061887",
+        "rev": "10ecda252ce1b3b1d6403caeadbcc8f30d5ab796",
         "type": "github"
       },
       "original": {
@@ -329,11 +329,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1659610603,
-        "narHash": "sha256-LYgASYSPYo7O71WfeUOaEUzYfzuXm8c8eavJcel+pfI=",
+        "lastModified": 1662220400,
+        "narHash": "sha256-9o2OGQqu4xyLZP9K6kNe1pTHnyPz0Wr3raGYnr9AIgY=",
         "owner": "nmattia",
         "repo": "naersk",
-        "rev": "c6a45e4277fa58abd524681466d3450f896dc094",
+        "rev": "6944160c19cb591eb85bbf9b2f2768a935623ed3",
         "type": "github"
       },
       "original": {
@@ -359,11 +359,11 @@
     },
     "nixos": {
       "locked": {
-        "lastModified": 1661427965,
-        "narHash": "sha256-LJeSDbiebN0/eRt9vyOm+Bxljdsq5ZdalmmTk9Xpp30=",
+        "lastModified": 1664594436,
+        "narHash": "sha256-YHowMADGzdi7fKnGlg47qe0PIljq+11VqLarmXDuKxQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "058de3818577db19d1965c21e2479916a3eaaf95",
+        "rev": "9cac45850280978a21a3eb67b15a18f34cbffa2d",
         "type": "github"
       },
       "original": {
@@ -394,11 +394,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1660407119,
-        "narHash": "sha256-04lWO0pDbhAXFdL4v2VzzwgxrZ5IefKn+TmZPiPeKxg=",
+        "lastModified": 1664628729,
+        "narHash": "sha256-A1J0ZPhBfZZiWI6ipjKJ8+RpMllzOMu/An/8Tk3t4oo=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "12620020f76b1b5d2b0e6fbbda831ed4f5fe56e1",
+        "rev": "3024c67a2e9a35450558426c42e7419ab37efd95",
         "type": "github"
       },
       "original": {
@@ -460,11 +460,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1654975372,
-        "narHash": "sha256-wkNZ16akgKViuZzE/IM+bux4uaJ04KIwUeexH8gBjgw=",
+        "lastModified": 1664550666,
+        "narHash": "sha256-eXfMRd9uItEp3PsYI31FSVGPG9dVC6yF++65ZrGwW8A=",
         "owner": "berberman",
         "repo": "nvfetcher",
-        "rev": "d4b237c10f14f72f8266b0f658faad822e491e55",
+        "rev": "9763ad40d59a044e90726653d9253efaeeb053b2",
         "type": "github"
       },
       "original": {
-- 
2.44.1


From 986680cc26e75217b9365935f379581b84b26007 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Sun, 2 Oct 2022 23:59:08 +0200
Subject: [PATCH 05/20] bootstrap iso: add PubSolarOS naming, drone pipeline

adjustments to include a symlink to the latest iso built
---
 .drone.yml               | 13 +++++++++--
 hosts/bootstrap.nix      | 48 +++++++++++++++++++++++++++++++---------
 modules/core/default.nix |  9 ++++----
 3 files changed, 52 insertions(+), 18 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 7da733c4..b9718b8c 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -98,7 +98,14 @@ steps:
       - |
         nix $$NIX_FLAGS build \
           '.#nixosConfigurations.bootstrap.config.system.build.isoImage'
-      - cp $(readlink -f result)/iso/*.iso /var/nix/iso-cache/
+      - cp $(readlink -f result)/iso/PubSolarOS*.iso /var/nix/iso-cache/
+      - nix shell nixpkgs#findutils
+      - cd /var/nix/iso-cache/
+      - export ISO_NAME=$(find . -name '*.iso' -printf "%f\n")
+      - sha256sum $ISO_NAME > $ISO_NAME.sha256
+      - ln -s $ISO_NAME PubSolarOS-latest.iso
+      - cp $ISO_NAME.sha256 PubSolarOS-latest.iso.sha256
+      - nix run nixpkgs#gnused -- --in-place "s/$ISO_NAME/PubSolarOS-latest.iso/" PubSolarOS-latest.iso.sha256
 
   - name: "Publish ISO"
     image: appleboy/drone-scp
@@ -117,6 +124,8 @@ steps:
       target: /srv/os
       source:
         - /var/nix/iso-cache/*.iso
+        - /var/nix/iso-cache/*.iso.sha256
+      overwrite: true
       strip_components: 3
 
 depends_on:
@@ -134,6 +143,6 @@ volumes:
 
 ---
 kind: signature
-hmac: 2b930bb5fe02006203b7c2fae8af75814749e8cec5f976ec0d6e64eae1b0c5db
+hmac: 7b0b56a97294cd563eee2bde56abeea6dd0928e01729980a25f8c165a3f6e0f6
 
 ...
diff --git a/hosts/bootstrap.nix b/hosts/bootstrap.nix
index 7772b0f1..49422675 100644
--- a/hosts/bootstrap.nix
+++ b/hosts/bootstrap.nix
@@ -1,4 +1,18 @@
-{ profiles, ... }:
+{ config, lib, pkgs, profiles, ... }:
+with lib;
+let
+  # Gets hostname of host to be bundled inside iso
+  # Copied from https://github.com/divnix/digga/blob/30ffa0b02272dc56c94fd3c7d8a5a0f07ca197bf/modules/bootstrap-iso.nix#L3-L11
+  getFqdn = config:
+    let
+      net = config.networking;
+      fqdn =
+        if (net ? domain) && (net.domain != null)
+        then "${net.hostName}.${net.domain}"
+        else net.hostName;
+    in
+      fqdn;
+in
 {
   # build with: `nix build ".#nixosConfigurations.bootstrap.config.system.build.isoImage"`
   imports = [
@@ -10,16 +24,28 @@
     profiles.pub-solar-iso
   ];
 
-  boot.loader.systemd-boot.enable = true;
+  config = {
+    boot.loader.systemd-boot.enable = true;
 
-  # will be overridden by the bootstrapIso instrumentation
-  fileSystems."/" = { device = "/dev/disk/by-label/nixos"; };
+    # will be overridden by the bootstrapIso instrumentation
+    fileSystems."/" = { device = "/dev/disk/by-label/nixos"; };
 
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "21.05"; # Did you read the comment?
+    system.nixos.label = "PubSolarOS-" + config.system.nixos.version;
+
+    # mkForce because a similar transformation gets double applied otherwise
+    # https://github.com/divnix/digga/blob/30ffa0b02272dc56c94fd3c7d8a5a0f07ca197bf/modules/bootstrap-iso.nix#L17
+    # https://github.com/NixOS/nixpkgs/blob/aecd4d8349b94f9bd5718c74a5b789f233f67326/nixos/modules/installer/cd-dvd/installation-cd-base.nix#L21-L22
+    isoImage = {
+      isoBaseName =  mkForce (getFqdn config);
+      isoName = mkForce "${config.system.nixos.label}-${config.isoImage.isoBaseName}-${pkgs.stdenv.hostPlatform.system}.iso";
+    };
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "21.05"; # Did you read the comment?
+  };
 }
diff --git a/modules/core/default.nix b/modules/core/default.nix
index 9a3ea0fe..4f74b46d 100644
--- a/modules/core/default.nix
+++ b/modules/core/default.nix
@@ -2,7 +2,6 @@
 
 with lib;
 let
-  psCfg = config.pub-solar;
   cfg = config.pub-solar.core;
 in
 {
@@ -29,12 +28,12 @@ in
 
   config = {
     pub-solar = {
-      audio.enable = lib.mkIf (!cfg.lite) (lib.mkDefault true);
-      crypto.enable = lib.mkIf (!cfg.lite) (lib.mkDefault true);
-      devops.enable = lib.mkIf (!cfg.lite) (lib.mkDefault true);
+      audio.enable = mkIf (!cfg.lite) (mkDefault true);
+      crypto.enable = mkIf (!cfg.lite) (mkDefault true);
+      devops.enable = mkIf (!cfg.lite) (mkDefault true);
 
       terminal-life = {
-        enable = lib.mkDefault true;
+        enable = mkDefault true;
         lite = cfg.lite;
       };
     };
-- 
2.44.1


From f2ecc2d8b9ee6b5c0cbda2f3e8b5342e714e58b6 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Mon, 3 Oct 2022 02:30:08 +0200
Subject: [PATCH 06/20] ci: fix upload target path

---
 .drone.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index b9718b8c..5e20924e 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -121,7 +121,7 @@ steps:
         from_secret: iso_web_ssh_port
       key:
         from_secret: iso_web_ssh_key
-      target: /srv/os
+      target: /srv/os/download
       source:
         - /var/nix/iso-cache/*.iso
         - /var/nix/iso-cache/*.iso.sha256
@@ -143,6 +143,6 @@ volumes:
 
 ---
 kind: signature
-hmac: 7b0b56a97294cd563eee2bde56abeea6dd0928e01729980a25f8c165a3f6e0f6
+hmac: 8823c7103f6a075bb291a497c7ab5d5db47a91f9bc7d8ef95329b5620c9cf91d
 
 ...
-- 
2.44.1


From 8529a15177466a14be333e0fdc83e39f3eb4ee07 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Benjamin=20B=C3=A4dorf?= <hello@benjaminbaedorf.eu>
Date: Mon, 3 Oct 2022 03:57:34 +0200
Subject: [PATCH 07/20] Be more paranoid

The paranoia mode now also enables the firewall and closes down a couple
of small openSSH holes. `noexec` on the whole FS is left out as it will
make every existing PubSolarOS installation panic.
---
 modules/core/networking.nix  |  2 ++
 modules/paranoia/default.nix | 30 ++++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/modules/core/networking.nix b/modules/core/networking.nix
index edfef42d..c5ec9cbe 100644
--- a/modules/core/networking.nix
+++ b/modules/core/networking.nix
@@ -36,6 +36,8 @@ in
       wifi.backend = "iwd";
     };
 
+    networking.firewall.enable = true;
+
     # Customized binary caches list (with fallback to official binary cache)
     nix.binaryCaches = cfg.binaryCaches;
     nix.binaryCachePublicKeys = cfg.publicKeys;
diff --git a/modules/paranoia/default.nix b/modules/paranoia/default.nix
index 699ab13e..f5ceaeaf 100644
--- a/modules/paranoia/default.nix
+++ b/modules/paranoia/default.nix
@@ -21,5 +21,35 @@ in
   config = mkIf cfg.enable {
     pub-solar.core.hibernation.enable = true;
     services.logind.lidSwitch = "hibernate";
+
+    # The options below are directly taken from or inspired by
+    # https://xeiaso.net/blog/paranoid-nixos-2021-07-18
+
+    # Don't set this if you need sftp
+    services.openssh.allowSFTP = false;
+    services.openssh.openFirewall = false; # Lock yourself out
+
+    # Limit the use of sudo to the group wheel
+    security.sudo.execWheelOnly = true;
+
+    # Remove the complete default environment of packages like
+    # nano, perl and rsync
+    environment.defaultPackages = lib.mkForce [ ];
+
+    # fileSystems."/".options = [ "noexec" ];
+
+    services.openssh = {
+      enable = true;
+      openFirewall = false;
+      passwordAuthentication = false;
+      kbdInteractiveAuthentication = false;
+      extraConfig = ''
+        AllowTcpForwarding yes
+        X11Forwarding no
+        AllowAgentForwarding no
+        AllowStreamLocalForwarding no
+        AuthenticationMethods publickey
+      '';
+    };
   };
 }
-- 
2.44.1


From 6f3885d0caff8d36508080e4db60b4c62616c3f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Benjamin=20B=C3=A4dorf?= <hello@benjaminbaedorf.eu>
Date: Mon, 3 Oct 2022 04:07:48 +0200
Subject: [PATCH 08/20] Remove doubled openssh configs in paranoia module

---
 modules/paranoia/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/modules/paranoia/default.nix b/modules/paranoia/default.nix
index f5ceaeaf..75275a11 100644
--- a/modules/paranoia/default.nix
+++ b/modules/paranoia/default.nix
@@ -39,8 +39,6 @@ in
     # fileSystems."/".options = [ "noexec" ];
 
     services.openssh = {
-      enable = true;
-      openFirewall = false;
       passwordAuthentication = false;
       kbdInteractiveAuthentication = false;
       extraConfig = ''
-- 
2.44.1


From b23e1e16a42465ff3905905e43f3265ef8b62846 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Mon, 3 Oct 2022 04:11:16 +0200
Subject: [PATCH 09/20] alacritty: improve selection and cursor colors

---
 modules/graphical/alacritty.nix | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/modules/graphical/alacritty.nix b/modules/graphical/alacritty.nix
index e4e2f6ad..b389343c 100644
--- a/modules/graphical/alacritty.nix
+++ b/modules/graphical/alacritty.nix
@@ -100,10 +100,15 @@
       foreground = "0xe3e1e4";
     };
 
-    # Colors the cursor will use if `custom_cursor_colors` is true
+    # Cursor colors
+    #
+    # Colors which should be used to draw the terminal cursor.
+    #
+    # Allowed values are CellForeground/CellBackground, which reference the
+    # affected cell, or hexadecimal colors like #ff00ff.
     cursor = {
-      text = "0x1a181a";
-      cursor = "0xe3e1e4";
+      text = "CellBackground";
+      cursor = "CellForeground";
     };
 
     # Colors used for the search bar and match highlighting.
@@ -115,14 +120,25 @@
         background = "0x1a181a";
       };
       focused_match = {
-        foreground = "0xe5c463";
-        background = "0xe3e1e4";
+        foreground = "CellBackground";
+        background = "CellForeground";
       };
       #bar =
       #  background = "#c5c8c6";
       #  foreground = "#1d1f21";
     };
 
+    # Selection colors
+    #
+    # Colors which should be used to draw the selection area.
+    #
+    # Allowed values are CellForeground/CellBackground, which reference the
+    # affected cell, or hexadecimal colors like #ff00ff.
+    selection = {
+      text = "0x1a181a";
+      background = "0xf85e84";
+    };
+
     # Normal colors
     normal = {
       black = "0x1a181a";
-- 
2.44.1


From 5da560ef56cb081b4dd3bae67a3a2e67421487cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Benjamin=20B=C3=A4dorf?= <hello@benjaminbaedorf.eu>
Date: Mon, 3 Oct 2022 04:55:14 +0200
Subject: [PATCH 10/20] Open up SSH by default

---
 modules/core/services.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/core/services.nix b/modules/core/services.nix
index 61ba6ea0..41aa45e5 100644
--- a/modules/core/services.nix
+++ b/modules/core/services.nix
@@ -4,7 +4,9 @@
   # For rage encryption, all hosts need a ssh key pair
   services.openssh = {
     enable = true;
-    openFirewall = lib.mkDefault false;
+    # If you don't want the host to have SSH actually opened up to the net,
+    # set `services.openssh.openFirewall` to false in your config.
+    openFirewall = lib.mkDefault true;
   };
 
   # Service that makes Out of Memory Killer more effective
-- 
2.44.1


From f28d05e24eee55396773f165b40d374be795f414 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Wed, 5 Oct 2022 11:57:51 +0200
Subject: [PATCH 11/20] Change user.publicKeys to a SSH keys string list

---
 modules/user/default.nix       | 2 +-
 profiles/base-user/default.nix | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/user/default.nix b/modules/user/default.nix
index 2fd5958e..7c869380 100644
--- a/modules/user/default.nix
+++ b/modules/user/default.nix
@@ -23,7 +23,7 @@ in
       };
       publicKeys = mkOption {
         description = "User SSH public keys";
-        type = types.listOf types.path;
+        type = types.listOf types.str;
         default = [ ];
       };
       fullName = mkOption {
diff --git a/profiles/base-user/default.nix b/profiles/base-user/default.nix
index 9ff21c8e..374dca40 100644
--- a/profiles/base-user/default.nix
+++ b/profiles/base-user/default.nix
@@ -25,7 +25,7 @@ in
       ];
       initialHashedPassword = if psCfg.user.password != null then psCfg.user.password else "";
       shell = pkgs.zsh;
-      openssh.authorizedKeys.keyFiles = if psCfg.user.publicKeys != null then psCfg.user.publicKeys else [ ];
+      openssh.authorizedKeys.keys = if psCfg.user.publicKeys != null then psCfg.user.publicKeys else [ ];
     };
   };
 }
-- 
2.44.1


From d43bd8058058f7d3231b4422997e9a11eb03385b Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Wed, 5 Oct 2022 11:58:26 +0200
Subject: [PATCH 12/20] core: disable SSH passwordAuthentication by default

---
 modules/core/services.nix    | 1 +
 modules/paranoia/default.nix | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/core/services.nix b/modules/core/services.nix
index 41aa45e5..6ce74472 100644
--- a/modules/core/services.nix
+++ b/modules/core/services.nix
@@ -7,6 +7,7 @@
     # If you don't want the host to have SSH actually opened up to the net,
     # set `services.openssh.openFirewall` to false in your config.
     openFirewall = lib.mkDefault true;
+    passwordAuthentication = false;
   };
 
   # Service that makes Out of Memory Killer more effective
diff --git a/modules/paranoia/default.nix b/modules/paranoia/default.nix
index 75275a11..2dc439cf 100644
--- a/modules/paranoia/default.nix
+++ b/modules/paranoia/default.nix
@@ -39,7 +39,6 @@ in
     # fileSystems."/".options = [ "noexec" ];
 
     services.openssh = {
-      passwordAuthentication = false;
       kbdInteractiveAuthentication = false;
       extraConfig = ''
         AllowTcpForwarding yes
-- 
2.44.1


From 4520dece5f0a96e762c032e7d98d9080481f33a4 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Tue, 18 Oct 2022 16:24:43 +0200
Subject: [PATCH 13/20] neovim: use nvfetcher for custom plugins

---
 modules/terminal-life/nvim/default.nix | 72 ++-------------------
 overlays/neovim-plugins.nix            | 22 +++++++
 overlays/rnix-lsp.nix                  |  9 +--
 pkgs/_sources/generated.nix            | 90 ++++++++++++++++++++++++--
 pkgs/sources.toml                      | 28 ++++++++
 5 files changed, 140 insertions(+), 81 deletions(-)
 create mode 100644 overlays/neovim-plugins.nix

diff --git a/modules/terminal-life/nvim/default.nix b/modules/terminal-life/nvim/default.nix
index bc06943b..4df1892a 100644
--- a/modules/terminal-life/nvim/default.nix
+++ b/modules/terminal-life/nvim/default.nix
@@ -5,66 +5,6 @@ let
   xdg = config.home-manager.users."${psCfg.user.name}".xdg;
 
   preview-file = pkgs.writeShellScriptBin "preview-file" (import ./preview-file.nix pkgs);
-
-  vimagit-master = pkgs.vimUtils.buildVimPlugin {
-    name = "vimagit-master";
-    src = pkgs.fetchFromGitHub {
-      owner = "jreybert";
-      repo = "vimagit";
-      rev = "308650ddc1e9a94e49fae0ea04bbc1c45f23d4c4";
-      sha256 = "sha256-fhazQQqyFaO0fdoeNI9nBshwTDhKNHH262H/QThtuO0=";
-    };
-  };
-
-  instant-nvim = pkgs.vimUtils.buildVimPlugin {
-    name = "instant";
-    src = pkgs.fetchFromGitHub {
-      owner = "jbyuki";
-      repo = "instant.nvim";
-      rev = "c02d72267b12130609b7ad39b76cf7f4a3bc9554";
-      sha256 = "sha256-7Pr2Au/oGKp5kMXuLsQY4BK5Wny9L1EBdXtyS5EaZPI=";
-    };
-  };
-
-  vim-caddyfile = pkgs.vimUtils.buildVimPlugin {
-    name = "vim-caddyfile";
-    src = pkgs.fetchFromGitHub {
-      owner = "isobit";
-      repo = "vim-caddyfile";
-      rev = "24fe0720551883e407cb70ae1d7c03f162d1d5a0";
-      sha256 = "sha256-rRYv3vnt31g7hNTxttTD6BWdv5JJ+ko3rPNyDUEOZ9o=";
-    };
-  };
-
-  workspace = pkgs.vimUtils.buildVimPlugin {
-    name = "vim-workspace";
-    src = pkgs.fetchFromGitHub {
-      owner = "thaerkh";
-      repo = "vim-workspace";
-      rev = "c26b473f9b073f24bacecd38477f44c5cd1f5a62";
-      sha256 = "sha256-XV7opLyfkHIDO0+JJaO/x0za0gsHuklrzapTGdLHJmI=";
-    };
-  };
-
-  beautify = pkgs.vimUtils.buildVimPlugin {
-    name = "vim-beautify";
-    src = pkgs.fetchFromGitHub {
-      owner = "zeekay";
-      repo = "vim-beautify";
-      rev = "e0691483927dc5a0c051433602397419f9628623";
-      sha256 = "QPTCl6KaGcAjTS5yVDov9yxmv0fDaFoPLMsrtVIG6GQ=";
-    };
-  };
-
-  apprentice = pkgs.vimUtils.buildVimPlugin {
-    name = "vim-apprentice";
-    src = pkgs.fetchFromGitHub {
-      owner = "romainl";
-      repo = "Apprentice";
-      rev = "ecd41698037f15a58125b349be76dbd2595bfb6d";
-      sha256 = "sha256-9s7Yzn3IEJBjcyUq9NBIQ9wb45Xr7jOkEIoWf0lAYYg=";
-    };
-  };
 in
 {
   enable = true;
@@ -108,7 +48,7 @@ in
     lsp_extensions-nvim
     nvim-lspconfig
 
-    instant-nvim
+    instant-nvim-nvfetcher
 
     ack-vim
     vim-airline
@@ -119,23 +59,23 @@ in
     syntastic
     vim-gutentags
     vim-vinegar
-    workspace
+    vim-workspace-nvfetcher
 
     sonokai
     vim-hybrid-material
     vim-airline-themes
-    apprentice
+    vim-apprentice-nvfetcher
 
     fugitive
     vim-gitgutter
     vim-rhubarb
-    vimagit-master
+    vimagit-nvfetcher
 
     fzf-vim
     fzfWrapper
     vim-highlightedyank
 
-    beautify
+    vim-beautify-nvfetcher
     vim-surround
 
     vim-bufkill
@@ -144,7 +84,7 @@ in
     ansible-vim
     emmet-vim
     rust-vim
-    vim-caddyfile
+    vim-caddyfile-nvfetcher
     vim-go
     vim-javascript
     vim-json
diff --git a/overlays/neovim-plugins.nix b/overlays/neovim-plugins.nix
new file mode 100644
index 00000000..b022049c
--- /dev/null
+++ b/overlays/neovim-plugins.nix
@@ -0,0 +1,22 @@
+final: prev: {
+  vimPlugins = prev.vimPlugins // {
+    instant-nvim-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.instant-nvim-nvfetcher) pname version src;
+    };
+    vimagit-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.vimagit-nvfetcher) pname version src;
+    };
+    vim-caddyfile-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.vim-caddyfile-nvfetcher) pname version src;
+    };
+    vim-workspace-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.vim-workspace-nvfetcher) pname version src;
+    };
+    vim-beautify-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.vim-beautify-nvfetcher) pname version src;
+    };
+    vim-apprentice-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.vim-apprentice-nvfetcher) pname version src;
+    };
+  };
+}
diff --git a/overlays/rnix-lsp.nix b/overlays/rnix-lsp.nix
index 62c0f2b0..f755d110 100644
--- a/overlays/rnix-lsp.nix
+++ b/overlays/rnix-lsp.nix
@@ -1,13 +1,6 @@
 final: prev: {
   rnix-lsp = prev.rnix-lsp.overrideAttrs (oldAttrs: rec {
-    version = "unstable-2022-07-28";
-
-    src = prev.fetchFromGitHub {
-      owner = "nix-community";
-      repo = "rnix-lsp";
-      rev = "ff18e04551a39ccdab0ff9c83926db3807b23478";
-      sha256 = "sha256-4OIpATLdPQvryyhRQPELeqNYC0n6PCyjD6LCPdwOztc=";
-    };
+    inherit (prev.sources.rnix-lsp-nvfetcher) pname version src;
 
     cargoDeps = oldAttrs.cargoDeps.overrideAttrs (prev.lib.const {
       name = "rnix-lsp-vendor.tar.gz";
diff --git a/pkgs/_sources/generated.nix b/pkgs/_sources/generated.nix
index 71be3965..f8bdd149 100644
--- a/pkgs/_sources/generated.nix
+++ b/pkgs/_sources/generated.nix
@@ -1,16 +1,92 @@
 # This file was generated by nvfetcher, please do not modify it manually.
-{ fetchgit, fetchurl }:
+{ fetchgit, fetchurl, fetchFromGitHub }:
 {
+  instant-nvim-nvfetcher = {
+    pname = "instant-nvim-nvfetcher";
+    version = "294b6d08143b3db8f9db7f606829270149e1a786";
+    src = fetchFromGitHub ({
+      owner = "jbyuki";
+      repo = "instant.nvim";
+      rev = "294b6d08143b3db8f9db7f606829270149e1a786";
+      fetchSubmodules = false;
+      sha256 = "sha256-DXJWji/NR8ZCxe014rD51v3EHJHMhRQeOoI3SsY8mR4=";
+    });
+  };
   manix = {
     pname = "manix";
     version = "d08e7ca185445b929f097f8bfb1243a8ef3e10e4";
-    src = fetchgit {
-      url = "https://github.com/mlvzk/manix";
+    src = fetchFromGitHub ({
+      owner = "mlvzk";
+      repo = "manix";
       rev = "d08e7ca185445b929f097f8bfb1243a8ef3e10e4";
       fetchSubmodules = false;
-      deepClone = false;
-      leaveDotGit = false;
-      sha256 = "1b7xi8c2drbwzfz70czddc4j33s7g1alirv12dwl91hbqxifx8qs";
-    };
+      sha256 = "sha256-GqPuYscLhkR5E2HnSFV4R48hCWvtM3C++3zlJhiK/aw=";
+    });
+  };
+  rnix-lsp-nvfetcher = {
+    pname = "rnix-lsp-nvfetcher";
+    version = "6925256babec4307479a4080b44f2be38056f210";
+    src = fetchFromGitHub ({
+      owner = "nix-community";
+      repo = "rnix-lsp";
+      rev = "6925256babec4307479a4080b44f2be38056f210";
+      fetchSubmodules = false;
+      sha256 = "sha256-OKLyIXIXhUnRB3Xw+7zI3u6XkwF7Mrbfz1XaasV6i7Q=";
+    });
+  };
+  vim-apprentice-nvfetcher = {
+    pname = "vim-apprentice-nvfetcher";
+    version = "9942d0bb0a5d82f7a24450b00051c1f2cc008659";
+    src = fetchFromGitHub ({
+      owner = "romainl";
+      repo = "Apprentice";
+      rev = "9942d0bb0a5d82f7a24450b00051c1f2cc008659";
+      fetchSubmodules = false;
+      sha256 = "sha256-Xs+vTdnihNbBFPOKsW+NB40pqN9eaadqzc0DIeNoOFo=";
+    });
+  };
+  vim-beautify-nvfetcher = {
+    pname = "vim-beautify-nvfetcher";
+    version = "e0691483927dc5a0c051433602397419f9628623";
+    src = fetchFromGitHub ({
+      owner = "zeekay";
+      repo = "vim-beautify";
+      rev = "e0691483927dc5a0c051433602397419f9628623";
+      fetchSubmodules = false;
+      sha256 = "sha256-QPTCl6KaGcAjTS5yVDov9yxmv0fDaFoPLMsrtVIG6GQ=";
+    });
+  };
+  vim-caddyfile-nvfetcher = {
+    pname = "vim-caddyfile-nvfetcher";
+    version = "24fe0720551883e407cb70ae1d7c03f162d1d5a0";
+    src = fetchFromGitHub ({
+      owner = "isobit";
+      repo = "vim-caddyfile";
+      rev = "24fe0720551883e407cb70ae1d7c03f162d1d5a0";
+      fetchSubmodules = false;
+      sha256 = "sha256-rRYv3vnt31g7hNTxttTD6BWdv5JJ+ko3rPNyDUEOZ9o=";
+    });
+  };
+  vim-workspace-nvfetcher = {
+    pname = "vim-workspace-nvfetcher";
+    version = "c26b473f9b073f24bacecd38477f44c5cd1f5a62";
+    src = fetchFromGitHub ({
+      owner = "thaerkh";
+      repo = "vim-workspace";
+      rev = "c26b473f9b073f24bacecd38477f44c5cd1f5a62";
+      fetchSubmodules = false;
+      sha256 = "sha256-XV7opLyfkHIDO0+JJaO/x0za0gsHuklrzapTGdLHJmI=";
+    });
+  };
+  vimagit-nvfetcher = {
+    pname = "vimagit-nvfetcher";
+    version = "308650ddc1e9a94e49fae0ea04bbc1c45f23d4c4";
+    src = fetchFromGitHub ({
+      owner = "jreybert";
+      repo = "vimagit";
+      rev = "308650ddc1e9a94e49fae0ea04bbc1c45f23d4c4";
+      fetchSubmodules = false;
+      sha256 = "sha256-fhazQQqyFaO0fdoeNI9nBshwTDhKNHH262H/QThtuO0=";
+    });
   };
 }
diff --git a/pkgs/sources.toml b/pkgs/sources.toml
index f7af168e..b3535048 100644
--- a/pkgs/sources.toml
+++ b/pkgs/sources.toml
@@ -2,3 +2,31 @@
 [manix]
 src.git = "https://github.com/mlvzk/manix"
 fetch.github = "mlvzk/manix"
+
+[rnix-lsp-nvfetcher]
+src.git = "https://github.com/nix-community/rnix-lsp"
+fetch.github = "nix-community/rnix-lsp"
+
+[vimagit-nvfetcher]
+src.git = "https://github.com/jreybert/vimagit"
+fetch.github = "jreybert/vimagit"
+
+[instant-nvim-nvfetcher]
+src.git = "https://github.com/jbyuki/instant.nvim"
+fetch.github = "jbyuki/instant.nvim"
+
+[vim-caddyfile-nvfetcher]
+src.git = "https://github.com/isobit/vim-caddyfile"
+fetch.github = "isobit/vim-caddyfile"
+
+[vim-workspace-nvfetcher]
+src.git = "https://github.com/thaerkh/vim-workspace"
+fetch.github = "thaerkh/vim-workspace"
+
+[vim-beautify-nvfetcher]
+src.git = "https://github.com/zeekay/vim-beautify"
+fetch.github = "zeekay/vim-beautify"
+
+[vim-apprentice-nvfetcher]
+src.git = "https://github.com/romainl/Apprentice"
+fetch.github = "romainl/Apprentice"
-- 
2.44.1


From e69c8fe9c74e9e27d0897b338aa97a55067278de Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Tue, 18 Oct 2022 17:02:23 +0200
Subject: [PATCH 14/20] Bump flake.lock

---
 flake.lock | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/flake.lock b/flake.lock
index 4e02f07a..ebcef0ac 100644
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1664140963,
-        "narHash": "sha256-pFxDtOLduRFlol0Y4ShE+soRQX4kbhaCNBtDOvx7ykw=",
+        "lastModified": 1665870395,
+        "narHash": "sha256-Tsbqb27LDNxOoPLh0gw2hIb6L/6Ow/6lIBvqcHzEKBI=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "6acb1fe5f8597d5ce63fc82bc7fcac7774b1cdf0",
+        "rev": "a630400067c6d03c9b3e0455347dc8559db14288",
         "type": "github"
       },
       "original": {
@@ -42,11 +42,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1664210064,
-        "narHash": "sha256-df6nKVZe/yAhmJ9csirTPahc0dldwm3HBhCVNA6qWr0=",
+        "lastModified": 1665392861,
+        "narHash": "sha256-bCd8fYJMAb0LzabsiXl4nxECDoz483bJOCa2hjox7N0=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "02d2551c927b7d65ded1b3c7cd13da5cc7ae3fcf",
+        "rev": "ef56fd8979b5f4e800c4716f62076e00600b1172",
         "type": "github"
       },
       "original": {
@@ -276,11 +276,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1656169755,
-        "narHash": "sha256-Nlnm4jeQWEGjYrE6hxi/7HYHjBSZ/E0RtjCYifnNsWk=",
+        "lastModified": 1665996265,
+        "narHash": "sha256-/k9og6LDBQwT+f/tJ5ClcWiUl8kCX5m6ognhsAxOiCY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "4a3d01fb53f52ac83194081272795aa4612c2381",
+        "rev": "b81e128fc053ab3159d7b464d9b7dedc9d6a6891",
         "type": "github"
       },
       "original": {
@@ -308,11 +308,11 @@
     },
     "latest_2": {
       "locked": {
-        "lastModified": 1664538465,
-        "narHash": "sha256-EnlC7dDKX7X1wlnXkB1gmn9rBZQ0J9+biVTZHw//8us=",
+        "lastModified": 1665940183,
+        "narHash": "sha256-cPe3F7CtnxU9YbJpc3Adl4d9kX+turqTv5FxM98i8vg=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "10ecda252ce1b3b1d6403caeadbcc8f30d5ab796",
+        "rev": "104e8082de1b20f9d0e1f05b1028795ed0e0e4bc",
         "type": "github"
       },
       "original": {
@@ -359,11 +359,11 @@
     },
     "nixos": {
       "locked": {
-        "lastModified": 1664594436,
-        "narHash": "sha256-YHowMADGzdi7fKnGlg47qe0PIljq+11VqLarmXDuKxQ=",
+        "lastModified": 1666014999,
+        "narHash": "sha256-gvKl8xlPJreezNG1NVTJv/HdGC69MSrM+IpCxS+eFvw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9cac45850280978a21a3eb67b15a18f34cbffa2d",
+        "rev": "1935dd8fdab8e022a9d958419663162fd840014c",
         "type": "github"
       },
       "original": {
@@ -379,11 +379,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1660727616,
-        "narHash": "sha256-zYTIvdPMYMx/EYqXODAwIIU30RiEHqNHdgarIHuEYZc=",
+        "lastModified": 1666016402,
+        "narHash": "sha256-Cm/nrdUMXwXiFQforG1Mv8OA4o8yhuVx6E1eDFH4rew=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "adccd191a0e83039d537e021f19495b7bad546a1",
+        "rev": "688db42a1eb34853f050267ff65c975f664312f0",
         "type": "github"
       },
       "original": {
@@ -394,11 +394,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1664628729,
-        "narHash": "sha256-A1J0ZPhBfZZiWI6ipjKJ8+RpMllzOMu/An/8Tk3t4oo=",
+        "lastModified": 1665987993,
+        "narHash": "sha256-MvlaIYTRiqefG4dzI5p6vVCfl+9V8A1cPniUjcn6Ngc=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "3024c67a2e9a35450558426c42e7419ab37efd95",
+        "rev": "0e6593630071440eb89cd97a52921497482b22c6",
         "type": "github"
       },
       "original": {
-- 
2.44.1


From e4418bfe0c9c7ca95aac590e4466fee293db9f48 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Thu, 20 Oct 2022 13:56:57 +0200
Subject: [PATCH 15/20] drone: use our custom drone-scp image

---
 .drone.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 5e20924e..4cf4b3b2 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -108,7 +108,9 @@ steps:
       - nix run nixpkgs#gnused -- --in-place "s/$ISO_NAME/PubSolarOS-latest.iso/" PubSolarOS-latest.iso.sha256
 
   - name: "Publish ISO"
-    image: appleboy/drone-scp
+    # custom drone-scp image, source: https://git.b12f.io/pub-solar/drone-scp/
+    # docker build --tag registry.greenbaum.cloud/library/drone-scp:v1.6.5 --file ./docker/Dockerfile.linux.amd64 .
+    image: registry.greenbaum.cloud/library/drone-scp:v1.6.5
     volumes:
       - name: file-exchange
         path: /var/nix/iso-cache
@@ -125,7 +127,7 @@ steps:
       source:
         - /var/nix/iso-cache/*.iso
         - /var/nix/iso-cache/*.iso.sha256
-      overwrite: true
+      unlink_first: true
       strip_components: 3
 
 depends_on:
@@ -143,6 +145,6 @@ volumes:
 
 ---
 kind: signature
-hmac: 8823c7103f6a075bb291a497c7ab5d5db47a91f9bc7d8ef95329b5620c9cf91d
+hmac: 3e6a89e903e214f21d488eba82863683b130ef6dbc2dc352377d4fd94ab3cd0c
 
 ...
-- 
2.44.1


From eece344083ec64ce0d5f9006d2751fe33c91eb0e Mon Sep 17 00:00:00 2001
From: Hendrik Sokolowski <hensoko@gssws.de>
Date: Sun, 23 Oct 2022 18:33:11 +0200
Subject: [PATCH 16/20] Make resume_offset optional

---
 modules/core/hibernation.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/modules/core/hibernation.nix b/modules/core/hibernation.nix
index 0454d82b..a71ffd37 100644
--- a/modules/core/hibernation.nix
+++ b/modules/core/hibernation.nix
@@ -27,9 +27,7 @@ in
   config = {
     boot = mkIf cfg.enable {
       resumeDevice = cfg.resumeDevice;
-      kernelParams =
-        if (cfg.resumeOffset == null && cfg.enable) then builtins.abort "config.pub-solar.resumeOffset has to be set if config.pub-solar.enable is true."
-        else [ "resume_offset=${builtins.toString cfg.resumeOffset}" ];
+      kernelParams = mkIf (cfg.resumeOffset != null) [ "resume_offset=${builtins.toString cfg.resumeOffset}" ];
     };
   };
 }
-- 
2.44.1


From ea6233f57e994286bd989c4527f4999c108713db Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Tue, 18 Oct 2022 16:44:00 +0200
Subject: [PATCH 17/20] zsh: fetch plugins using nvfetcher

---
 modules/terminal-life/zsh/default.nix | 31 ++++---------------
 pkgs/_sources/generated.nix           | 44 +++++++++++++++++++++++++++
 pkgs/sources.toml                     | 16 ++++++++++
 3 files changed, 66 insertions(+), 25 deletions(-)

diff --git a/modules/terminal-life/zsh/default.nix b/modules/terminal-life/zsh/default.nix
index b68a4270..36ec41ad 100644
--- a/modules/terminal-life/zsh/default.nix
+++ b/modules/terminal-life/zsh/default.nix
@@ -40,46 +40,27 @@ in
     myip = "dig +short myip.opendns.com @208.67.222.222 2>&1";
   };
   plugins = [
+    # src gets fetched by nvfetcher, see: ./pkgs/sources.toml
     {
       # will source ohmyzsh/plugins/z/
       name = "zsh-plugins-z";
-      file = "plugins/z/z.sh";
-      src = pkgs.fetchFromGitHub {
-        owner = "ohmyzsh";
-        repo = "ohmyzsh";
-        rev = "249c708ed3a4a7a63d16a6e911a46b6fb9623cbd";
-        sha256 = "sha256-NAVotL5RxpS/zKnO+ngMIjv787lqc1dj/c4blQrQcvU=";
-      };
+      file = "plugins/z/z.plugin.zsh";
+      src = pkgs.sources.ohmyzsh.src;
     }
     {
       name = "zsh-powerlevel10k";
       file = "powerlevel10k.zsh-theme";
-      src = pkgs.fetchFromGitHub {
-        owner = "romkatv";
-        repo = "powerlevel10k";
-        rev = "2dd6a29e4d7a33bfef10973d6550e087be37ddee";
-        sha256 = "sha256-9vc4cMBCNOmPOyzGwnPeMrXXyQUq4pC9Du3AWl9+Rys=";
-      };
+      src = pkgs.sources.powerlevel10k.src;
     }
     {
       name = "zsh-fast-syntax-highlighting";
       file = "F-Sy-H.plugin.zsh";
-      src = pkgs.fetchFromGitHub {
-        owner = "z-shell";
-        repo = "F-Sy-H";
-        rev = "c4bdc485b67b58351a24f21fcac92c9e0232b939";
-        sha256 = "sha256-uXBGIdJwubuueNhQRdGxPUi0eJN17cflYAuHTjeQ8FQ=";
-      };
+      src = pkgs.sources.F-Sy-H.src;
     }
     {
       name = "zsh-nix-shell";
       file = "nix-shell.plugin.zsh";
-      src = pkgs.fetchFromGitHub {
-        owner = "chisui";
-        repo = "zsh-nix-shell";
-        rev = "af6f8a266ea1875b9a3e86e14796cadbe1cfbf08";
-        sha256 = "sha256-BjgMhILEL/qdgfno4LR64LSB8n9pC9R+gG7IQWwgyfQ=";
-      };
+      src = pkgs.sources.zsh-nix-shell.src;
     }
   ];
 
diff --git a/pkgs/_sources/generated.nix b/pkgs/_sources/generated.nix
index f8bdd149..30bcbdef 100644
--- a/pkgs/_sources/generated.nix
+++ b/pkgs/_sources/generated.nix
@@ -1,6 +1,17 @@
 # This file was generated by nvfetcher, please do not modify it manually.
 { fetchgit, fetchurl, fetchFromGitHub }:
 {
+  F-Sy-H = {
+    pname = "F-Sy-H";
+    version = "b935a87a75560f8173dd78deee6717c59d464e06";
+    src = fetchFromGitHub ({
+      owner = "z-shell";
+      repo = "F-Sy-H";
+      rev = "b935a87a75560f8173dd78deee6717c59d464e06";
+      fetchSubmodules = false;
+      sha256 = "sha256-448OlDnrDkUjvaSLDhXsa9bkgYXzj1Ju8CTpJVjH8LM=";
+    });
+  };
   instant-nvim-nvfetcher = {
     pname = "instant-nvim-nvfetcher";
     version = "294b6d08143b3db8f9db7f606829270149e1a786";
@@ -23,6 +34,28 @@
       sha256 = "sha256-GqPuYscLhkR5E2HnSFV4R48hCWvtM3C++3zlJhiK/aw=";
     });
   };
+  ohmyzsh = {
+    pname = "ohmyzsh";
+    version = "65a1e4edbe678cdac37ad96ca4bc4f6d77e27adf";
+    src = fetchFromGitHub ({
+      owner = "ohmyzsh";
+      repo = "ohmyzsh";
+      rev = "65a1e4edbe678cdac37ad96ca4bc4f6d77e27adf";
+      fetchSubmodules = false;
+      sha256 = "sha256-qyI7CU0vKhhADZfQtD73GsyAbqdMPhDQ1uA03h4erpw=";
+    });
+  };
+  powerlevel10k = {
+    pname = "powerlevel10k";
+    version = "8091c8a3a8a845c70046684235a01cd500075def";
+    src = fetchFromGitHub ({
+      owner = "romkatv";
+      repo = "powerlevel10k";
+      rev = "8091c8a3a8a845c70046684235a01cd500075def";
+      fetchSubmodules = false;
+      sha256 = "sha256-I0/tktXCbZ3hMYTNvPoWfOEYWRgmHoXsar/jcUB6bpo=";
+    });
+  };
   rnix-lsp-nvfetcher = {
     pname = "rnix-lsp-nvfetcher";
     version = "6925256babec4307479a4080b44f2be38056f210";
@@ -89,4 +122,15 @@
       sha256 = "sha256-fhazQQqyFaO0fdoeNI9nBshwTDhKNHH262H/QThtuO0=";
     });
   };
+  zsh-nix-shell = {
+    pname = "zsh-nix-shell";
+    version = "af6f8a266ea1875b9a3e86e14796cadbe1cfbf08";
+    src = fetchFromGitHub ({
+      owner = "chisui";
+      repo = "zsh-nix-shell";
+      rev = "af6f8a266ea1875b9a3e86e14796cadbe1cfbf08";
+      fetchSubmodules = false;
+      sha256 = "sha256-BjgMhILEL/qdgfno4LR64LSB8n9pC9R+gG7IQWwgyfQ=";
+    });
+  };
 }
diff --git a/pkgs/sources.toml b/pkgs/sources.toml
index b3535048..5ec5e936 100644
--- a/pkgs/sources.toml
+++ b/pkgs/sources.toml
@@ -3,6 +3,22 @@
 src.git = "https://github.com/mlvzk/manix"
 fetch.github = "mlvzk/manix"
 
+[ohmyzsh]
+src.git = "https://github.com/ohmyzsh/ohmyzsh"
+fetch.github = "ohmyzsh/ohmyzsh"
+
+[powerlevel10k]
+src.git = "https://github.com/romkatv/powerlevel10k"
+fetch.github = "romkatv/powerlevel10k"
+
+[F-Sy-H]
+src.git = "https://github.com/z-shell/F-Sy-H"
+fetch.github = "z-shell/F-Sy-H"
+
+[zsh-nix-shell]
+src.git = "https://github.com/chisui/zsh-nix-shell"
+fetch.github = "chisui/zsh-nix-shell"
+
 [rnix-lsp-nvfetcher]
 src.git = "https://github.com/nix-community/rnix-lsp"
 fetch.github = "nix-community/rnix-lsp"
-- 
2.44.1


From 630d0afc5e0b389c1ad956230b9ad96a381a157a Mon Sep 17 00:00:00 2001
From: Hendrik Sokolowski <hensoko@gssws.de>
Date: Sat, 15 Oct 2022 01:58:36 +0200
Subject: [PATCH 18/20] Update drone-config

---
 .drone.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 4cf4b3b2..b4d4bb92 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -1,11 +1,12 @@
 ---
 kind: pipeline
-type: docker
+type: exec
 name: Check
+node:
+  hosttype: baremetal
 
 steps:
   - name: "Check"
-    image: docker.nix-community.org/nixpkgs/nix-flakes:latest
     when:
       event:
         - pull_request
@@ -20,6 +21,8 @@ steps:
 kind: pipeline
 type: exec
 name: Tests
+node:
+  hosttype: baremetal
 
 steps:
   - name: "Tests"
@@ -145,6 +148,6 @@ volumes:
 
 ---
 kind: signature
-hmac: 3e6a89e903e214f21d488eba82863683b130ef6dbc2dc352377d4fd94ab3cd0c
+hmac: 291be33bbf2954d1f5e4bf569679e24a773e7d6f90db4765fb9dacb3686a825e
 
 ...
-- 
2.44.1


From 02c145697b3539077c7217ce4edc872c2a656408 Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Mon, 7 Nov 2022 11:24:59 +0100
Subject: [PATCH 19/20] Pull in upstream commits from
 https://github.com/divnix/digga/pull/490

Improved flake-compat

Get the rev from the flake.lock file. Shouldn't be an issue for
first time users as the guide instructs users to generate a lock
file. `builtins.file` was used in accordance with nix.dev
reccommendations.

https://nix.dev/anti-patterns/language#reproducibility-referencing-top-level-directory-with

Rm tempfix
---
 flake.nix              |  3 +++
 lib/compat/default.nix |  8 ++++----
 shell/devos.nix        | 15 ---------------
 3 files changed, 7 insertions(+), 19 deletions(-)

diff --git a/flake.nix b/flake.nix
index 4ac60e8a..cce3f8ee 100644
--- a/flake.nix
+++ b/flake.nix
@@ -11,6 +11,9 @@
       nixos.url = "github:nixos/nixpkgs/nixos-22.05";
       latest.url = "github:nixos/nixpkgs/nixos-unstable";
 
+      flake-compat.url = "github:edolstra/flake-compat";
+      flake-compat.flake = false;
+
       digga.url = "github:pub-solar/digga/fix/bootstrap-iso";
       digga.inputs.nixpkgs.follows = "nixos";
       digga.inputs.nixlib.follows = "nixos";
diff --git a/lib/compat/default.nix b/lib/compat/default.nix
index 9d0c2837..ae3b4426 100644
--- a/lib/compat/default.nix
+++ b/lib/compat/default.nix
@@ -1,14 +1,14 @@
 let
-  rev = "e7e5d481a0e15dcd459396e55327749989e04ce0";
+  lock = builtins.fromJSON (builtins.readFile builtins.path { path = ../../flake.lock; name = "lockPath"; });
   flake = (import
     (
       fetchTarball {
-        url = "https://github.com/edolstra/flake-compat/archive/${rev}.tar.gz";
-        sha256 = "0zd3x46fswh5n6faq4x2kkpy6p3c6j593xbdlbsl40ppkclwc80x";
+        url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+        sha256 = lock.nodes.flake-compat.locked.narHash;
       }
     )
     {
-      src = ../../.;
+      src = builtins.path { path = ../../.; name = "projectRoot"; };
     });
 in
 flake
diff --git a/shell/devos.nix b/shell/devos.nix
index 9aefcc6f..382a6d34 100644
--- a/shell/devos.nix
+++ b/shell/devos.nix
@@ -28,21 +28,6 @@ in
   # override for our own welcome
   devshell.name = pkgs.lib.mkForce "PubSolarOS";
 
-  # tempfix: remove when merged https://github.com/numtide/devshell/pull/123
-  devshell.startup.load_profiles = pkgs.lib.mkForce (pkgs.lib.noDepEntry ''
-    # PATH is devshell's exorbitant privilige:
-    # fence against its pollution
-    _PATH=''${PATH}
-    # Load installed profiles
-    for file in "$DEVSHELL_DIR/etc/profile.d/"*.sh; do
-      # If that folder doesn't exist, bash loves to return the whole glob
-      [[ -f "$file" ]] && source "$file"
-    done
-    # Exert exorbitant privilige and leave no trace
-    export PATH=''${_PATH}
-    unset _PATH
-  '');
-
   commands = with pkgs; [
     (devos nix)
     (devos agenix)
-- 
2.44.1


From 06ed2a78a9fdf8bee7b83b31f1ae823d02c0168e Mon Sep 17 00:00:00 2001
From: teutat3s <teutates@mailbox.org>
Date: Mon, 7 Nov 2022 11:26:58 +0100
Subject: [PATCH 20/20] Bump flake.lock

---
 flake.lock | 67 ++++++++++++++++++++++++++++++++++--------------------
 1 file changed, 42 insertions(+), 25 deletions(-)

diff --git a/flake.lock b/flake.lock
index ebcef0ac..060a2aea 100644
--- a/flake.lock
+++ b/flake.lock
@@ -42,11 +42,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1665392861,
-        "narHash": "sha256-bCd8fYJMAb0LzabsiXl4nxECDoz483bJOCa2hjox7N0=",
+        "lastModified": 1667419884,
+        "narHash": "sha256-oLNw87ZI5NxTMlNQBv1wG2N27CUzo9admaFlnmavpiY=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "ef56fd8979b5f4e800c4716f62076e00600b1172",
+        "rev": "cfc0125eafadc9569d3d6a16ee928375b77e3100",
         "type": "github"
       },
       "original": {
@@ -205,6 +205,22 @@
         "type": "github"
       }
     },
+    "flake-compat_4": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1650374568,
+        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "locked": {
         "lastModified": 1642700792,
@@ -256,11 +272,11 @@
     },
     "flake-utils_3": {
       "locked": {
-        "lastModified": 1659877975,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "lastModified": 1667077288,
+        "narHash": "sha256-bdC8sFNDpT0HK74u9fUkpbf1MEzVYJ+ka7NXCdgBoaA=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "rev": "6ee9ebb6b1ee695d2cacc4faa053a7b9baa76817",
         "type": "github"
       },
       "original": {
@@ -276,11 +292,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1665996265,
-        "narHash": "sha256-/k9og6LDBQwT+f/tJ5ClcWiUl8kCX5m6ognhsAxOiCY=",
+        "lastModified": 1667677389,
+        "narHash": "sha256-y9Zdq8vtsn0T5TO1iTvWA7JndYIAGjzCjbYVi/hOSmA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b81e128fc053ab3159d7b464d9b7dedc9d6a6891",
+        "rev": "87d55517f6f36aa1afbd7a4a064869d5a1d405b8",
         "type": "github"
       },
       "original": {
@@ -308,11 +324,11 @@
     },
     "latest_2": {
       "locked": {
-        "lastModified": 1665940183,
-        "narHash": "sha256-cPe3F7CtnxU9YbJpc3Adl4d9kX+turqTv5FxM98i8vg=",
+        "lastModified": 1667629849,
+        "narHash": "sha256-P+v+nDOFWicM4wziFK9S/ajF2lc0N2Rg9p6Y35uMoZI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "104e8082de1b20f9d0e1f05b1028795ed0e0e4bc",
+        "rev": "3bacde6273b09a21a8ccfba15586fb165078fb62",
         "type": "github"
       },
       "original": {
@@ -359,11 +375,11 @@
     },
     "nixos": {
       "locked": {
-        "lastModified": 1666014999,
-        "narHash": "sha256-gvKl8xlPJreezNG1NVTJv/HdGC69MSrM+IpCxS+eFvw=",
+        "lastModified": 1667653703,
+        "narHash": "sha256-Xow4vx52/g5zkhlgZnMEm/TEXsj+13jTPCc2jIhW1xU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "1935dd8fdab8e022a9d958419663162fd840014c",
+        "rev": "f09ad462c5a121d0239fde645aacb2221553a217",
         "type": "github"
       },
       "original": {
@@ -379,11 +395,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1666016402,
-        "narHash": "sha256-Cm/nrdUMXwXiFQforG1Mv8OA4o8yhuVx6E1eDFH4rew=",
+        "lastModified": 1666812839,
+        "narHash": "sha256-0nBDgjPU+iDsvz89W+cDEyhnFGSwCJmwDl/gMGqYiU0=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "688db42a1eb34853f050267ff65c975f664312f0",
+        "rev": "41f3518bc194389df22a3d198215eae75e6b5ab9",
         "type": "github"
       },
       "original": {
@@ -394,11 +410,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1665987993,
-        "narHash": "sha256-MvlaIYTRiqefG4dzI5p6vVCfl+9V8A1cPniUjcn6Ngc=",
+        "lastModified": 1667768008,
+        "narHash": "sha256-PGbX0s2hhXGnZDFVE6UIhPSOf5YegpWs5dUXpT/14F0=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "0e6593630071440eb89cd97a52921497482b22c6",
+        "rev": "f6483e0def85efb9c1e884efbaff45a5e7aabb34",
         "type": "github"
       },
       "original": {
@@ -453,18 +469,18 @@
     },
     "nvfetcher": {
       "inputs": {
-        "flake-compat": "flake-compat_3",
+        "flake-compat": "flake-compat_4",
         "flake-utils": "flake-utils_3",
         "nixpkgs": [
           "nixos"
         ]
       },
       "locked": {
-        "lastModified": 1664550666,
-        "narHash": "sha256-eXfMRd9uItEp3PsYI31FSVGPG9dVC6yF++65ZrGwW8A=",
+        "lastModified": 1667620329,
+        "narHash": "sha256-v1Zk7rtEbAGpevBGPZvZBKpwbmw4I+uVwxvd+pBlp3o=",
         "owner": "berberman",
         "repo": "nvfetcher",
-        "rev": "9763ad40d59a044e90726653d9253efaeeb053b2",
+        "rev": "294826951113dcd3aa9abbcacfb1aa5b95a19116",
         "type": "github"
       },
       "original": {
@@ -479,6 +495,7 @@
         "darwin": "darwin",
         "deploy": "deploy",
         "digga": "digga",
+        "flake-compat": "flake-compat_3",
         "home": "home",
         "latest": "latest_2",
         "naersk": "naersk",
-- 
2.44.1