hosts/hypnos: rebuild

Flake lock file updates:

• Updated input 'hyprland':
    'github:hyprwm/Hyprland/5b1b79c29c5e0ea974b2a9da5d122dd0f3bedca6?narHash=sha256-zpQr4jkAoARBI22dFDnRekUagdRt6Mfc%2BThpSSHm90s%3D' (2026-01-08)
  → 'github:hyprwm/Hyprland/81e7498ec27156ee97aabba6fe4993412d98d1ab?narHash=sha256-/E66%2BtcVBnvJcOFL/CjnjBfKew6A2e%2B28EZrcRHioBw%3D' (2026-01-09)
• Updated input 'niri':
    'github:sodiboo/niri-flake/28e3e179cb997a26ffa30238f9ac700744b03a65?narHash=sha256-GSHlkIV/X8oOS15fCwdH1v1HhnYDY/beK9SCgAR0loA%3D' (2026-01-09)
  → 'github:sodiboo/niri-flake/95cbdad2ebce328c7b3fca09d9129e02d318b075?narHash=sha256-%2BRmYWQUHSSSF%2B/bVR2U/K7y6Z97fH4vvVW73IDouTFg%3D' (2026-01-10)
• Updated input 'niri/niri-unstable':
    'github:YaLTeR/niri/10df9f4717cbd4efd20ae796eb6b0aa400127bdc?narHash=sha256-qS4tdG2iUQwSld9dTH1gk8GcIOrRi9umMgPv8MGDIA0%3D' (2026-01-07)
  → 'github:YaLTeR/niri/a6baef7b68fcb60dfc57a9fc04e983cfd8a028ac?narHash=sha256-4thwWvKFEAFNtolJNN3i9wQ78jMI5VmejiLtjv3vNdc%3D' (2026-01-10)
• Updated input 'nix-topology':
    'github:oddlama/nix-topology/c02ed65766ba5153f38bb43e43a60fe5a1fff7d2?narHash=sha256-ofVU9FpGR8mLtI6UDnRSbpvXZBB%2B2xWUw3x8OcAYSNE%3D' (2026-01-09)
  → 'github:oddlama/nix-topology/924a60a75e17b8c405c5cf0c721449f6441b9967?narHash=sha256-VfU/4wlBPcyAfqftIyw5Yk9GPYVwMowRZcvnPBn%2BOwk%3D' (2026-01-09)
• Removed input 'nix-topology/devshell'
• Removed input 'nix-topology/devshell/nixpkgs'
• Added input 'nix-topology/flake-parts':
    'github:hercules-ci/flake-parts/a34fae9c08a15ad73f295041fec82323541400a9?narHash=sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw%3D' (2025-12-15)
• Added input 'nix-topology/flake-parts/nixpkgs-lib':
    'github:nix-community/nixpkgs.lib/2075416fcb47225d9b68ac469a5c4801a9c4dd85?narHash=sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo%3D' (2025-12-14)
• Removed input 'nix-topology/flake-utils'
• Removed input 'nix-topology/flake-utils/systems'
• Removed input 'nix-topology/pre-commit-hooks'
• Updated input 'nixpkgs-unstable':
    'github:NixOS/nixpkgs/5912c1772a44e31bf1c63c0390b90501e5026886?narHash=sha256-Mj3d3PfwltLmukFal5i3fFt27L6NiKXdBezC1EBuZs4%3D' (2026-01-07)
  → 'github:NixOS/nixpkgs/3497aa5c9457a9d88d71fa93a4a8368816fbeeba?narHash=sha256-dhhvQY67aboBk8b0/u0XB6vwHdgbROZT3fJAjyNh5Ww%3D' (2026-01-08)
• Updated input 'treefmt-nix':
    'github:numtide/treefmt-nix/778a1d691f1ef45dd68c661715c5bf8cbf131c80?narHash=sha256-QfX6g3Wj2vQe7oBJEbTf0npvC6sJoDbF9hb2%2BgM5tf8%3D' (2026-01-07)
  → 'github:numtide/treefmt-nix/0c445aa21b01fd1d4bb58927f7b268568af87b20?narHash=sha256-b2gJDJfi%2BTbA7Hu2sKip%2B1mWqya0GJaWrrXQjpbOVTU%3D' (2026-01-10)

flake.lock

@@ -71,11 +71,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765900596,
+        "lastModified": 1767024902,
-        "narHash": "sha256-+hn8v9jkkLP9m+o0Nm5SiEq10W0iWDSotH2XfjU45fA=",
+        "narHash": "sha256-sMdk6QkMDhIOnvULXKUM8WW8iyi551SWw2i6KQHbrrU=",
         "owner": "hyprwm",
         "repo": "aquamarine",
-        "rev": "d83c97f8f5c0aae553c1489c7d9eff3eadcadace",
+        "rev": "b8a0c5ba5a9fbd2c660be7dd98bdde0ff3798556",
         "type": "github"
       },
       "original": {
@@ -185,27 +185,6 @@
         "type": "github"
       }
     },
-    "devshell_3": {
-      "inputs": {
-        "nixpkgs": [
-          "nix-topology",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1728330715,
-        "narHash": "sha256-xRJ2nPOXb//u1jaBnDP56M7v5ldavjbtR6lfGqSvcKg=",
-        "owner": "numtide",
-        "repo": "devshell",
-        "rev": "dd6b80932022cea34a019e2bb32f6fa9e494dfef",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "devshell",
-        "type": "github"
-      }
-    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -261,15 +240,15 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1761588595,
+        "lastModified": 1767039857,
-        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
-        "owner": "edolstra",
+        "owner": "NixOS",
         "repo": "flake-compat",
-        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
         "type": "github"
       },
       "original": {
-        "owner": "edolstra",
+        "owner": "NixOS",
         "repo": "flake-compat",
         "type": "github"
       }
@@ -293,15 +272,15 @@
     "flake-compat_4": {
       "flake": false,
       "locked": {
-        "lastModified": 1761588595,
+        "lastModified": 1767039857,
-        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
-        "owner": "edolstra",
+        "owner": "NixOS",
         "repo": "flake-compat",
-        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
         "type": "github"
       },
       "original": {
-        "owner": "edolstra",
+        "owner": "NixOS",
         "repo": "flake-compat",
         "type": "github"
       }
@@ -331,6 +310,24 @@
       "inputs": {
         "nixpkgs-lib": "nixpkgs-lib"
       },
+      "locked": {
+        "lastModified": 1767609335,
+        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib_2"
+      },
       "locked": {
         "lastModified": 1765835352,
         "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
@@ -345,7 +342,7 @@
         "type": "github"
       }
     },
-    "flake-parts_3": {
+    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "nixvim",
@@ -370,24 +367,6 @@
       "inputs": {
         "systems": "systems_4"
       },
-      "locked": {
-        "lastModified": 1726560853,
-        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_5"
-      },
       "locked": {
         "lastModified": 1731533236,
         "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
@@ -517,11 +496,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766553861,
+        "lastModified": 1767910483,
-        "narHash": "sha256-ZbnG01yA3O8Yr1vUm3+NQ2qk9iRhS5bloAnuXHHy7+c=",
+        "narHash": "sha256-MOU5YdVu4DVwuT5ztXgQpPuRRBjSjUGIdUzOQr9iQOY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0999ed8f965bbbd991437ad9c5ed3434cecbc30e",
+        "rev": "82fb7dedaad83e5e279127a38ef410bcfac6d77c",
         "type": "github"
       },
       "original": {
@@ -531,6 +510,27 @@
         "type": "github"
       }
     },
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
+          "impermanence",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1747978958,
+        "narHash": "sha256-pQQnbxWpY3IiZqgelXHIe/OAE/Yv4NSQq7fch7M6nXQ=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "7419250703fd5eb50e99bdfb07a86671939103ea",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
     "hyprcursor": {
       "inputs": {
         "hyprlang": [
@@ -576,11 +576,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763733840,
+        "lastModified": 1766946335,
-        "narHash": "sha256-JnET78yl5RvpGuDQy3rCycOCkiKoLr5DN1fPhRNNMco=",
+        "narHash": "sha256-MRD+Jr2bY11MzNDfenENhiK6pvN+nHygxdHoHbZ1HtE=",
         "owner": "hyprwm",
         "repo": "hyprgraphics",
-        "rev": "8f1bec691b2d198c60cccabca7a94add2df4ed1a",
+        "rev": "4af02a3925b454deb1c36603843da528b67ded6c",
         "type": "github"
       },
       "original": {
@@ -606,11 +606,11 @@
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1766761711,
+        "lastModified": 1768000181,
-        "narHash": "sha256-m9VZ9cxYUl9Q9+ROSKmYpVeyIAvz1faqNqBKZ4WamWI=",
+        "narHash": "sha256-/E66+tcVBnvJcOFL/CjnjBfKew6A2e+28EZrcRHioBw=",
         "owner": "hyprwm",
         "repo": "Hyprland",
-        "rev": "33df518f97b930316742736ecb07dc322da4c5d3",
+        "rev": "81e7498ec27156ee97aabba6fe4993412d98d1ab",
         "type": "github"
       },
       "original": {
@@ -652,11 +652,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765643131,
+        "lastModified": 1767023960,
-        "narHash": "sha256-CCGohW5EBIRy4B7vTyBMqPgsNcaNenVad/wszfddET0=",
+        "narHash": "sha256-R2HgtVS1G3KSIKAQ77aOZ+Q0HituOmPgXW9nBNkpp3Q=",
         "owner": "hyprwm",
         "repo": "hyprland-guiutils",
-        "rev": "e50ae912813bdfa8372d62daf454f48d6df02297",
+        "rev": "c2e906261142f5dd1ee0bfc44abba23e2754c660",
         "type": "github"
       },
       "original": {
@@ -682,11 +682,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766258034,
+        "lastModified": 1767723101,
-        "narHash": "sha256-0EoL8X+sYexDBusF9XyY2WoGKRqnARA+vfh/3uAi/j0=",
+        "narHash": "sha256-jObY8O7OI+91hoE137APsDxm0235/Yx+HhFIip187zM=",
         "owner": "hyprwm",
         "repo": "hyprland-plugins",
-        "rev": "3e29d68d5a830c542643a52d4be726661eaa85e7",
+        "rev": "fef398ed5e4faf59bc43b915e46a75cfe8b16697",
         "type": "github"
       },
       "original": {
@@ -813,11 +813,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766160771,
+        "lastModified": 1766253372,
-        "narHash": "sha256-roINUGikWRqqgKrD4iotKbGj3ZKJl3hjMz5l/SyKrHw=",
+        "narHash": "sha256-1+p4Kw8HdtMoFSmJtfdwjxM4bPxDK9yg27SlvUMpzWA=",
         "owner": "hyprwm",
         "repo": "hyprutils",
-        "rev": "5ac060bfcf2f12b3a6381156ebbc13826a05b09f",
+        "rev": "51a4f93ce8572e7b12b7284eb9e6e8ebf16b4be9",
         "type": "github"
       },
       "original": {
@@ -867,11 +867,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766253200,
+        "lastModified": 1767473322,
-        "narHash": "sha256-26qPwrd3od+xoYVywSB7hC2cz9ivN46VPLlrsXyGxvE=",
+        "narHash": "sha256-RGOeG+wQHeJ6BKcsSB8r0ZU77g9mDvoQzoTKj2dFHwA=",
         "owner": "hyprwm",
         "repo": "hyprwire",
-        "rev": "1079777525b30a947c8d657fac158e00ae85de9d",
+        "rev": "d5e7d6b49fe780353c1cf9a1cf39fa8970bd9d11",
         "type": "github"
       },
       "original": {
@@ -881,12 +881,16 @@
       }
     },
     "impermanence": {
+      "inputs": {
+        "home-manager": "home-manager_2",
+        "nixpkgs": "nixpkgs_2"
+      },
       "locked": {
-        "lastModified": 1737831083,
+        "lastModified": 1767822991,
-        "narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=",
+        "narHash": "sha256-iyrn9AcPZCoyxX4OT8eMkBsjG7SRUQXXS/V1JzxS7rA=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
+        "rev": "82e5bc4508cab9e8d5a136626276eb5bbce5e9c5",
         "type": "github"
       },
       "original": {
@@ -951,11 +955,11 @@
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
       },
       "locked": {
-        "lastModified": 1766765523,
+        "lastModified": 1768053065,
-        "narHash": "sha256-DCk3GKdKZNjpvNuDy9ZVfVwCy3tlm96/UZnYkJO7N44=",
+        "narHash": "sha256-+RmYWQUHSSSF+/bVR2U/K7y6Z97fH4vvVW73IDouTFg=",
         "owner": "sodiboo",
         "repo": "niri-flake",
-        "rev": "a3e638c75d07de759421e6f34bd69c3f9a0a3567",
+        "rev": "95cbdad2ebce328c7b3fca09d9129e02d318b075",
         "type": "github"
       },
       "original": {
@@ -984,11 +988,11 @@
     "niri-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1766751930,
+        "lastModified": 1768048242,
-        "narHash": "sha256-83/YSW6c58i/iwGzAFApuMy6MCgoIaROeCcoIGh+ViU=",
+        "narHash": "sha256-4thwWvKFEAFNtolJNN3i9wQ78jMI5VmejiLtjv3vNdc=",
         "owner": "YaLTeR",
         "repo": "niri",
-        "rev": "b5640d5293ad8dca06cb447692ea7cbb21680eb1",
+        "rev": "a6baef7b68fcb60dfc57a9fc04e983cfd8a028ac",
         "type": "github"
       },
       "original": {
@@ -999,21 +1003,17 @@
     },
     "nix-topology": {
       "inputs": {
-        "devshell": "devshell_3",
+        "flake-parts": "flake-parts_3",
-        "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "pre-commit-hooks": [
-          "pre-commit-hooks"
         ]
       },
       "locked": {
-        "lastModified": 1765969653,
+        "lastModified": 1767999039,
-        "narHash": "sha256-qVpQxyvdByeDfb+d+jhbyNna2Ie+w85iHpt4Qu0rv/E=",
+        "narHash": "sha256-VfU/4wlBPcyAfqftIyw5Yk9GPYVwMowRZcvnPBn+Owk=",
         "owner": "oddlama",
         "repo": "nix-topology",
-        "rev": "0ed73e5a1b65eb8ed388d070ebe8dedb9182f466",
+        "rev": "924a60a75e17b8c405c5cf0c721449f6441b9967",
         "type": "github"
       },
       "original": {
@@ -1024,11 +1024,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1766568855,
+        "lastModified": 1767185284,
-        "narHash": "sha256-UXVtN77D7pzKmzOotFTStgZBqpOcf8cO95FcupWp4Zo=",
+        "narHash": "sha256-ljDBUDpD1Cg5n3mJI81Hz5qeZAwCGxon4kQW3Ho3+6Q=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "c5db9569ac9cc70929c268ac461f4003e3e5ca80",
+        "rev": "40b1a28dce561bea34858287fbb23052c3ee63fe",
         "type": "github"
       },
       "original": {
@@ -1063,11 +1063,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1766070988,
+        "lastModified": 1767379071,
-        "narHash": "sha256-G/WVghka6c4bAzMhTwT2vjLccg/awmHkdKSd2JrycLc=",
+        "narHash": "sha256-EgE0pxsrW9jp9YFMkHL9JMXxcqi/OoumPJYwf+Okucw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c6245e83d836d0433170a16eb185cefe0572f8b8",
+        "rev": "fb7944c166a3b630f177938e478f0378e64ce108",
         "type": "github"
       },
       "original": {
@@ -1092,13 +1092,28 @@
         "type": "github"
       }
     },
+    "nixpkgs-lib_2": {
+      "locked": {
+        "lastModified": 1765674936,
+        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1766736597,
+        "lastModified": 1767799921,
-        "narHash": "sha256-BASnpCLodmgiVn0M1MU2Pqyoz0aHwar/0qLkp7CjvSQ=",
+        "narHash": "sha256-r4GVX+FToWVE2My8VVZH4V0pTIpnu2ZE8/Z4uxGEMBE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f560ccec6b1116b22e6ed15f4c510997d99d5852",
+        "rev": "d351d0653aeb7877273920cd3e823994e7579b0b",
         "type": "github"
       },
       "original": {
@@ -1110,11 +1125,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1766651565,
+        "lastModified": 1767892417,
-        "narHash": "sha256-QEhk0eXgyIqTpJ/ehZKg9IKS7EtlWxF3N7DXy42zPfU=",
+        "narHash": "sha256-dhhvQY67aboBk8b0/u0XB6vwHdgbROZT3fJAjyNh5Ww=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3e2499d5539c16d0d173ba53552a4ff8547f4539",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
         "type": "github"
       },
       "original": {
@@ -1125,11 +1140,27 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1766736597,
+        "lastModified": 1748026106,
-        "narHash": "sha256-BASnpCLodmgiVn0M1MU2Pqyoz0aHwar/0qLkp7CjvSQ=",
+        "narHash": "sha256-6m1Y3/4pVw1RWTsrkAK2VMYSzG4MMIj7sqUy7o8th1o=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "063f43f2dbdef86376cc29ad646c45c46e93234c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1767799921,
+        "narHash": "sha256-r4GVX+FToWVE2My8VVZH4V0pTIpnu2ZE8/Z4uxGEMBE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f560ccec6b1116b22e6ed15f4c510997d99d5852",
+        "rev": "d351d0653aeb7877273920cd3e823994e7579b0b",
         "type": "github"
       },
       "original": {
@@ -1140,19 +1171,19 @@
     },
     "nixvim": {
       "inputs": {
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_4",
         "nixpkgs": [
           "nixpkgs"
         ],
         "nuschtosSearch": "nuschtosSearch",
-        "systems": "systems_6"
+        "systems": "systems_5"
       },
       "locked": {
-        "lastModified": 1766725080,
+        "lastModified": 1767448089,
-        "narHash": "sha256-JG0KvKmVyAQZ4PxKVDy7FGGUirt1lLhWwGwy9ExLCoI=",
+        "narHash": "sha256-U1fHsZBnFrUil731NHD9Sg5HoiG+eSHau8OFuClhwW0=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "2d3184cd3dd31f6eb57eb4ddfe2387ebd141f1e5",
+        "rev": "983751b66f255bbea1adc185364e9e7b73f82358",
         "type": "github"
       },
       "original": {
@@ -1162,9 +1193,29 @@
         "type": "github"
       }
     },
+    "noctalia": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768055992,
+        "narHash": "sha256-vbhRHMcRrKzJ8cppwCQL1Hjk0wqDorDTAG894paemiM=",
+        "owner": "noctalia-dev",
+        "repo": "noctalia-shell",
+        "rev": "10bd2aa303be259fe39c7f95433bb4a12657ad72",
+        "type": "github"
+      },
+      "original": {
+        "owner": "noctalia-dev",
+        "repo": "noctalia-shell",
+        "type": "github"
+      }
+    },
     "nuschtosSearch": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils",
         "ixx": "ixx",
         "nixpkgs": [
           "nixvim",
@@ -1195,11 +1246,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765911976,
+        "lastModified": 1767281941,
-        "narHash": "sha256-t3T/xm8zstHRLx+pIHxVpQTiySbKqcQbK+r+01XVKc0=",
+        "narHash": "sha256-6MkqajPICgugsuZ92OMoQcgSHnD6sJHwk8AxvMcIgTE=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "b68b780b69702a090c8bb1b973bab13756cc7a27",
+        "rev": "f0927703b7b1c8d97511c4116eb9b4ec6645a0fa",
         "type": "github"
       },
       "original": {
@@ -1217,11 +1268,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765911976,
+        "lastModified": 1767281941,
-        "narHash": "sha256-t3T/xm8zstHRLx+pIHxVpQTiySbKqcQbK+r+01XVKc0=",
+        "narHash": "sha256-6MkqajPICgugsuZ92OMoQcgSHnD6sJHwk8AxvMcIgTE=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "b68b780b69702a090c8bb1b973bab13756cc7a27",
+        "rev": "f0927703b7b1c8d97511c4116eb9b4ec6645a0fa",
         "type": "github"
       },
       "original": {
@@ -1249,13 +1300,15 @@
         "nix-topology": "nix-topology",
         "nixos-hardware": "nixos-hardware",
         "nixos-mailserver": "nixos-mailserver",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "nixvim": "nixvim",
+        "noctalia": "noctalia",
         "pre-commit-hooks": "pre-commit-hooks_2",
         "secrets": "secrets",
         "thunderbird-gnome-theme": "thunderbird-gnome-theme",
-        "treefmt-nix": "treefmt-nix_2"
+        "treefmt-nix": "treefmt-nix_2",
+        "zen-browser": "zen-browser"
       }
     },
     "secrets": {
@@ -1349,21 +1402,6 @@
         "type": "github"
       }
     },
-    "systems_6": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "thunderbird-gnome-theme": {
       "flake": false,
       "locked": {
@@ -1408,11 +1446,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766000401,
+        "lastModified": 1768031762,
-        "narHash": "sha256-+cqN4PJz9y0JQXfAK5J1drd0U05D5fcAGhzhfVrDlsI=",
+        "narHash": "sha256-b2gJDJfi+TbA7Hu2sKip+1mWqya0GJaWrrXQjpbOVTU=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "42d96e75aa56a3f70cab7e7dc4a32868db28e8fd",
+        "rev": "0c445aa21b01fd1d4bb58927f7b268568af87b20",
         "type": "github"
       },
       "original": {
@@ -1500,11 +1538,11 @@
     "xwayland-satellite-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1766429945,
+        "lastModified": 1767932953,
-        "narHash": "sha256-9Kv4gWagx/u4RfZJzBMAoagW9ava5waxd+XoTkzqF7E=",
+        "narHash": "sha256-V8+DrPOp940J6icERAaGuDQTKyEyZzFuRw363XwDKXg=",
         "owner": "Supreeeme",
         "repo": "xwayland-satellite",
-        "rev": "0dde7ca1d3a8e8c5082533d76084e2aa02bef70e",
+        "rev": "bc47ef59501556fc2584155ddef76493752dd727",
         "type": "github"
       },
       "original": {
@@ -1512,6 +1550,26 @@
         "repo": "xwayland-satellite",
         "type": "github"
       }
+    },
+    "zen-browser": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1767618227,
+        "narHash": "sha256-9+XVF47E9NCVs249SSsDtr7YdG/23/lCJmWAjQvOfqI=",
+        "owner": "youwen5",
+        "repo": "zen-browser-flake",
+        "rev": "1586e49b3908b058e221f11d843eb46392dba17b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "youwen5",
+        "repo": "zen-browser-flake",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -60,13 +60,13 @@
       flake = false;
     };
 
-    nixos-hardware.url = "github:NixOS/nixos-hardware";
-
     niri = {
       url = "github:sodiboo/niri-flake";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    nixos-hardware.url = "github:NixOS/nixos-hardware";
+
     nixos-mailserver = {
       url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-25.11";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -86,7 +86,11 @@
     nix-topology = {
       url = "github:oddlama/nix-topology";
       inputs.nixpkgs.follows = "nixpkgs";
-      inputs.pre-commit-hooks.follows = "pre-commit-hooks";
+    };
+
+    noctalia = {
+      url = "github:noctalia-dev/noctalia-shell";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     pre-commit-hooks = {
@@ -108,6 +112,11 @@
       url = "github:numtide/treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    zen-browser = {
+      url = "github:youwen5/zen-browser-flake";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -141,7 +150,7 @@
       perSystem =
         { pkgs, ... }:
         {
-          formatter = pkgs.nixfmt-rfc-style;
+          formatter = pkgs.nixfmt;
 
           legacyPackages = pkgs.lib.packagesFromDirectoryRecursive {
             callPackage = pkgs.callPackage;
@@ -173,7 +182,7 @@
                 no-lambda-arg = true;
               };
               mdformat.enable = true;
-              nixfmt-rfc-style.enable = true;
+              nixfmt.enable = true;
               shellcheck.enable = true;
             };
           };

hosts/artemis/hardware-configuration.nix

@@ -68,8 +68,9 @@ in
       "amdgpu.sched_hw_submission=4"
       "audit=0"
     ];
-    kernelPackages = pkgs.linuxPackages_6_17;
+    kernelPackages = pkgs.linuxPackages_6_18;
     supportedFilesystems = [ "ntfs" ];
+    zfs.package = pkgs.zfs_2_4;
   };
 
   hardware = {

hosts/common.nix

@@ -30,7 +30,7 @@
           config = {
             allowUnfree = true;
           };
-          system = final.system;
+          system = final.stdenv.hostPlatform.system;
         };
       })
       (import ../overlays/default.nix)
@@ -80,9 +80,10 @@
 
   nix = {
     package = pkgs.nixVersions.stable;
-    extraOptions = ''
+    settings.extra-experimental-features = [
-      experimental-features = nix-command flakes
+      "flakes"
-    '';
+      "nix-command"
+    ];
     buildMachines = [
       {
         hostName = "10.0.1.235";

hosts/hypnos/0001-Add-apple_set_os-EFI-boot-service.patch

@@ -1,101 +0,0 @@
-From d310ddee0fb8e7a5a8b89668c6cb8f9dc863ce94 Mon Sep 17 00:00:00 2001
-From: Jordan Holt <jordan@vimium.com>
-Date: Sun, 28 Apr 2024 15:59:52 +0100
-Subject: [PATCH] Add apple_set_os EFI boot service
-
----
- drivers/firmware/efi/libstub/x86-stub.c | 59 +++++++++++++++++++++++++
- include/linux/efi.h                     |  1 +
- 2 files changed, 60 insertions(+)
-
-diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi/libstub/x86-stub.c
-index d5a8182cf..be722c43a 100644
---- a/drivers/firmware/efi/libstub/x86-stub.c
-+++ b/drivers/firmware/efi/libstub/x86-stub.c
-@@ -449,6 +449,63 @@ static void setup_graphics(struct boot_params *boot_params)
- 	}
- }
-
-+typedef struct {
-+	u64 version;
-+	void (*set_os_version) (const char *os_version);
-+	void (*set_os_vendor) (const char *os_vendor);
-+} apple_set_os_interface_t;
-+
-+static efi_status_t apple_set_os()
-+{
-+	apple_set_os_interface_t *set_os;
-+	efi_guid_t set_os_guid = APPLE_SET_OS_PROTOCOL_GUID;
-+	efi_status_t status;
-+	void **handles;
-+	unsigned long i, nr_handles, size = 0;
-+
-+	status = efi_bs_call(locate_handle, EFI_LOCATE_BY_PROTOCOL,
-+			     &set_os_guid, NULL, &size, handles);
-+
-+	if (status == EFI_BUFFER_TOO_SMALL) {
-+		status = efi_bs_call(allocate_pool, EFI_LOADER_DATA,
-+				     size, &handles);
-+
-+		if (status != EFI_SUCCESS)
-+			return status;
-+
-+		status = efi_bs_call(locate_handle, EFI_LOCATE_BY_PROTOCOL,
-+				     &set_os_guid, NULL, &size, handles);
-+	}
-+
-+	if (status != EFI_SUCCESS)
-+		goto free_handle;
-+
-+	nr_handles = size / sizeof(void *);
-+	for (i = 0; i < nr_handles; i++) {
-+		void *h = handles[i];
-+
-+		status = efi_bs_call(handle_protocol, h,
-+				     &set_os_guid, &set_os);
-+
-+		if (status != EFI_SUCCESS || !set_os)
-+			continue;
-+
-+		if (set_os->version > 0) {
-+			efi_bs_call((unsigned long)set_os->set_os_version,
-+					"Mac OS X 10.9");
-+		}
-+
-+		if (set_os->version >= 2) {
-+			efi_bs_call((unsigned long)set_os->set_os_vendor,
-+					"Apple Inc.");
-+		}
-+	}
-+
-+free_handle:
-+	efi_bs_call(free_pool, uga_handle);
-+
-+	return status;
-+}
-
- static void __noreturn efi_exit(efi_handle_t handle, efi_status_t status)
- {
-@@ -951,6 +1008,8 @@ void __noreturn efi_stub_entry(efi_handle_t handle,
-
- 	setup_unaccepted_memory();
-
-+	apple_set_os();
-+
- 	status = exit_boot(boot_params, handle);
- 	if (status != EFI_SUCCESS) {
- 		efi_err("exit_boot() failed!\n");
-diff --git a/include/linux/efi.h b/include/linux/efi.h
-index d59b0947f..81158014f 100644
---- a/include/linux/efi.h
-+++ b/include/linux/efi.h
-@@ -385,6 +385,7 @@ void efi_native_runtime_setup(void);
- #define EFI_MEMORY_ATTRIBUTES_TABLE_GUID	EFI_GUID(0xdcfa911d, 0x26eb, 0x469f,  0xa2, 0x20, 0x38, 0xb7, 0xdc, 0x46, 0x12, 0x20)
- #define EFI_CONSOLE_OUT_DEVICE_GUID		EFI_GUID(0xd3b36f2c, 0xd551, 0x11d4,  0x9a, 0x46, 0x00, 0x90, 0x27, 0x3f, 0xc1, 0x4d)
- #define APPLE_PROPERTIES_PROTOCOL_GUID		EFI_GUID(0x91bd12fe, 0xf6c3, 0x44fb,  0xa5, 0xb7, 0x51, 0x22, 0xab, 0x30, 0x3a, 0xe0)
-+#define APPLE_SET_OS_PROTOCOL_GUID		EFI_GUID(0xc5c5da95, 0x7d5c, 0x45e6,  0xb2, 0xf1, 0x3f, 0xd5, 0x2b, 0xb1, 0x00, 0x77)
- #define EFI_TCG2_PROTOCOL_GUID			EFI_GUID(0x607f766c, 0x7455, 0x42be,  0x93, 0x0b, 0xe4, 0xd7, 0x6d, 0xb2, 0x72, 0x0f)
- #define EFI_TCG2_FINAL_EVENTS_TABLE_GUID	EFI_GUID(0x1e2ed096, 0x30e2, 0x4254,  0xbd, 0x89, 0x86, 0x3b, 0xbe, 0xf8, 0x23, 0x25)
- #define EFI_LOAD_FILE_PROTOCOL_GUID		EFI_GUID(0x56ec3091, 0x954c, 0x11d2,  0x8e, 0x3f, 0x00, 0xa0, 0xc9, 0x69, 0x72, 0x3b)
---
-2.42.0

hosts/hypnos/README.md

@@ -24,16 +24,24 @@ Apple SSD SM0512F | `/dev/sda1` (EFI, 256 MiB, NixOS Boot) <br> `/dev/sda2` (ZFS
 rpool/
 ├── local
 │   ├── nix
-│   └── tmp
-├── system
 │   ├── root
-│   └── var
+│   └── state
-└── user
+└── safe
-    └── home
+    └── persist
 ```
 
 See [Graham Christensen's article](https://grahamc.com/blog/nixos-on-zfs/#datasets) for the motivation behind these datasets.
 
+#### Impermanence
+
+This machine uses [impermanence](https://github.com/nix-community/impermanence) and is rolled back to a clean state on each reboot.
+
+Mountpoint | Persists across reboots? | Backed up?
+--- | --- | ---
+`/` | No | Yes
+`/state` | Yes | No
+`/persist` | Yes | Yes
+
 ### Networks
 
 - DHCP on `10.0.1.0/24` subnet.

hosts/hypnos/default.nix

@@ -4,50 +4,113 @@
   pkgs,
   ...
 }:
-
+let
+  inherit (lib)
+    mkForce
+    ;
+in
 {
   imports = [
     inputs.disko.nixosModules.disko
     ./hardware-configuration.nix
     ./disko-config.nix
     ../desktop.nix
+    ../../modules/nixos/deterministic-ids.nix
     ../../users/jordan
   ];
 
   nixpkgs = {
     hostPlatform = "x86_64-linux";
     config = {
-      nvidia.acceptLicense = true;
+      permittedInsecurePackages = [ "broadcom-sta-6.30.223.271-59-6.12.63" ];
-      permittedInsecurePackages = [ "broadcom-sta-6.30.223.271-57-6.12.41" ];
     };
   };
 
   age.rekey.hostPubkey = ./ssh_host_ed25519_key.pub;
 
-  boot.loader = {
+  boot = {
-    systemd-boot.enable = true;
+    loader = {
-    efi.canTouchEfiVariables = true;
+      systemd-boot.enable = true;
+      efi.canTouchEfiVariables = true;
+    };
+    initrd.systemd = {
+      enable = true;
+      extraBin.cryptsetup = "${pkgs.cryptsetup}/bin/cryptsetup";
+      services."zfs-import-rpool".after = [ "cryptsetup.target" ];
+    };
+    tmp.useTmpfs = true;
   };
 
-  networking.hostId = "cf791898";
+  console.earlySetup = true;
 
-  # nvidia 470 driver doesn't work with Wayland
+  systemd.network.enable = true;
-  services = {
+  systemd.network.wait-online.enable = false;
-    xserver = {
+
-      displayManager.gdm.wayland = lib.mkForce false;
+  networking = {
-      videoDrivers = [ "nvidia" ];
+    hostId = "cf791898";
-    };
+    useNetworkd = true;
-    displayManager = {
+    dhcpcd.enable = false;
-      defaultSession = "gnome-xorg";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        22 # SSH
+      ];
     };
   };
 
+  services.resolved = {
+    enable = true;
+    dnssec = "false";
+    fallbackDns = [
+      "9.9.9.9"
+      "2620:fe::fe"
+      "1.1.1.1"
+      "2606:4700:4700::1111"
+    ];
+    llmnr = "false";
+    extraConfig = ''
+      MulticastDNS=false
+    '';
+  };
+
   # Workaround for label rendering bug in GTK4 with nvidia 470 driver
   environment.sessionVariables.GSK_RENDERER = "gl";
 
-  environment.systemPackages = [
+  environment.persistence."/persist".enable = mkForce true;
-    pkgs.moonlight-qt
+  environment.persistence."/state".enable = mkForce true;
-  ];
+
+  modules = {
+    system.desktop.gnome.enable = mkForce false;
+  };
+
+  services.openssh.settings.PermitRootLogin = mkForce "prohibit-password";
+
+  users = {
+    users = {
+      root = {
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILVHTjsyMIV4THNw6yz0OxAxGnC+41gX72UrPqTzR+OS jordan@vimium.com"
+        ];
+      };
+    };
+  };
+
+  users.deterministicIds =
+    let
+      uidGid = id: {
+        uid = id;
+        gid = id;
+      };
+    in
+    {
+      systemd-oom = uidGid 999;
+      systemd-coredump = uidGid 998;
+      sshd = uidGid 997;
+      nscd = uidGid 996;
+      polkituser = uidGid 995;
+      rtkit = uidGid 994;
+      lpadmin = uidGid 993;
+    };
 
   system.stateVersion = "22.11";
 }

hosts/hypnos/disko-config.nix

@@ -8,20 +8,32 @@
         content = {
           type = "gpt";
           partitions = {
-            ESP = {
+            efi = {
               size = "256M";
-              type = "EF00";
+              type = "ef00";
               content = {
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
               };
             };
-            zfs = {
+            swap = {
+              size = "8G";
+              content = {
+                type = "swap";
+                randomEncryption = true;
+              };
+            };
+            rpool = {
               size = "100%";
               content = {
-                type = "zfs";
+                type = "luks";
-                pool = "rpool";
+                name = "rpool_ata-APPLE_SSD_SM0512F_S1K5NYBF736152";
+                settings.allowDiscards = true;
+                content = {
+                  type = "zfs";
+                  pool = "rpool";
+                };
               };
             };
           };
@@ -35,87 +47,59 @@
           ashift = "12";
         };
         rootFsOptions = {
-          canmount = "off";
+          compression = "zstd";
-          mountpoint = "none";
+          acltype = "posix";
-          dnodesize = "auto";
+          atime = "off";
           xattr = "sa";
+          dnodesize = "auto";
+          mountpoint = "none";
+          canmount = "off";
+          devices = "off";
+          exec = "off";
+          setuid = "off";
         };
-        postCreateHook = "zfs snapshot rpool@blank";
         datasets = {
-          local = {
+          "local" = {
             type = "zfs_fs";
+          };
+          "local/root" = {
+            type = "zfs_fs";
+            mountpoint = "/";
             options = {
-              mountpoint = "none";
+              canmount = "noauto";
+              mountpoint = "/";
+              exec = "on";
+              setuid = "on";
             };
+            postCreateHook = "zfs snapshot rpool/local/root@blank";
           };
           "local/nix" = {
             type = "zfs_fs";
             mountpoint = "/nix";
             options = {
-              atime = "off";
+              canmount = "noauto";
-              mountpoint = "legacy";
+              mountpoint = "/nix";
+              exec = "on";
+              setuid = "on";
             };
           };
-          "local/tmp" = {
+          "local/state" = {
             type = "zfs_fs";
-            mountpoint = "/tmp";
+            mountpoint = "/state";
             options = {
-              setuid = "off";
+              canmount = "noauto";
-              devices = "off";
+              mountpoint = "/state";
-              mountpoint = "legacy";
             };
           };
-          system = {
+          "safe" = {
             type = "zfs_fs";
-            mountpoint = "/";
-            options = {
-              mountpoint = "legacy";
-            };
           };
-          "system/var" = {
+          "safe/persist" = {
             type = "zfs_fs";
-            mountpoint = "/var";
+            mountpoint = "/persist";
             options = {
-              mountpoint = "legacy";
+              canmount = "noauto";
-            };
+              mountpoint = "/persist";
-          };
-          "system/var/tmp" = {
-            type = "zfs_fs";
-            mountpoint = "/var/tmp";
-            options = {
-              devices = "off";
-              mountpoint = "legacy";
-            };
-          };
-          "system/var/log" = {
-            type = "zfs_fs";
-            mountpoint = "/var/log";
-            options = {
-              compression = "on";
-              acltype = "posix";
-              mountpoint = "legacy";
-            };
-          };
-          user = {
-            type = "zfs_fs";
-            options = {
-              mountpoint = "none";
-              encryption = "aes-256-gcm";
-              keyformat = "passphrase";
-              keylocation = "file:///tmp/secret.key";
-            };
-            # use this to read the key during boot
-            postCreateHook = ''
-              zfs set keylocation="prompt" "rpool/$name";
-            '';
-          };
-          "user/home" = {
-            type = "zfs_fs";
-            mountpoint = "/home";
-            options = {
-              setuid = "off";
-              devices = "off";
-              mountpoint = "legacy";
             };
           };
         };

hosts/hypnos/hardware-configuration.nix

@@ -30,7 +30,6 @@
     ];
     extraModulePackages = [
       config.boot.kernelPackages.broadcom_sta
-      config.boot.kernelPackages.nvidiaPackages.legacy_470
     ];
   };
 
@@ -40,11 +39,6 @@
 
   hardware = {
     cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-    nvidia = {
-      package = config.boot.kernelPackages.nvidiaPackages.legacy_470;
-      modesetting.enable = true;
-      powerManagement.enable = true;
-    };
     graphics = {
       enable = true;
       extraPackages = with pkgs; [

hosts/odyssey/default.nix

@@ -83,6 +83,12 @@
     };
   };
 
+  # We actually use the home-manager module to add the actual portal config,
+  # but need this so relevant implementations are found
+  environment.pathsToLink = [
+    "/share/xdg-desktop-portal"
+  ];
+
   modules = {
     hardware.presonus-studio.enable = true;
     services = {
@@ -102,7 +108,7 @@
     };
     system.desktop = {
       gnome.enable = lib.mkForce false;
-      hyprland.enable = true;
+      hyprland.enable = lib.mkForce false;
     };
   };
 

modules/nixos/deterministic-ids.nix

@@ -0,0 +1,100 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  inherit (lib)
+    concatLists
+    flip
+    mapAttrsToList
+    mkDefault
+    mkIf
+    mkOption
+    types
+    ;
+
+  cfg = config.users.deterministicIds;
+in
+{
+  options = {
+    users.deterministicIds = mkOption {
+      default = { };
+      description = ''
+        Maps a user or group name to its expected uid/gid values. If a user/group is
+        used on the system without specifying a uid/gid, this module will assign the
+        corresponding ids defined here, or show an error if the definition is missing.
+      '';
+      type = types.attrsOf (
+        types.submodule {
+          options = {
+            uid = mkOption {
+              type = types.nullOr types.int;
+              default = null;
+              description = "The uid to assign if it is missing in `users.users.<name>`.";
+            };
+            gid = mkOption {
+              type = types.nullOr types.int;
+              default = null;
+              description = "The gid to assign if it is missing in `users.groups.<name>`.";
+            };
+          };
+        }
+      );
+    };
+
+    users.users = mkOption {
+      type = types.attrsOf (
+        types.submodule (
+          { name, ... }:
+          {
+            config.uid =
+              let
+                deterministicUid = cfg.${name}.uid or null;
+              in
+              mkIf (deterministicUid != null) (mkDefault deterministicUid);
+          }
+        )
+      );
+    };
+
+    users.groups = mkOption {
+      type = types.attrsOf (
+        types.submodule (
+          { name, ... }:
+          {
+            config.gid =
+              let
+                deterministicGid = cfg.${name}.gid or null;
+              in
+              mkIf (deterministicGid != null) (mkDefault deterministicGid);
+          }
+        )
+      );
+    };
+  };
+
+  config = {
+    assertions =
+      concatLists (
+        flip mapAttrsToList config.users.users (
+          name: user: [
+            {
+              assertion = user.uid != null;
+              message = "non-deterministic uid detected for '${name}', please assign one via `users.deterministicIds`";
+            }
+            {
+              assertion = !user.autoSubUidGidRange;
+              message = "non-deterministic subUids/subGids detected for: ${name}";
+            }
+          ]
+        )
+      )
+      ++ flip mapAttrsToList config.users.groups (
+        name: group: {
+          assertion = group.gid != null;
+          message = "non-deterministic gid detected for '${name}', please assign one via `users.deterministicIds`";
+        }
+      );
+  };
+}

modules/nixos/impermanence.nix

@@ -1,21 +1,14 @@
 {
   config,
-  pkgs,
   lib,
   ...
 }:
 let
   inherit (lib)
-    attrNames
-    flip
-    isAttrs
-    mapAttrs
     mkIf
-    mkMerge
-    mkOption
     optionals
-    types
     ;
+  zfsPkg = config.boot.zfs.package;
 in
 {
   boot.zfs.forceImportRoot = false;
@@ -31,7 +24,7 @@ in
         unitConfig.DefaultDependencies = "no";
         serviceConfig = {
           Type = "oneshot";
-          ExecStart = "${pkgs.zfs}/bin/zfs rollback -r rpool/local/root@blank";
+          ExecStart = "${zfsPkg}/bin/zfs rollback -r rpool/local/root@blank";
         };
       };
 
@@ -88,60 +81,4 @@ in
   };
 
   users.mutableUsers = !config.environment.persistence."/persist".enable;
-
-  # For each user that has a home-manager config, merge the locally defined
-  # persistence options that we defined above.
-  imports =
-    let
-      mkUserFiles = map (
-        x: { parentDirectory.mode = "700"; } // (if isAttrs x then x else { file = x; })
-      );
-      mkUserDirs = map (x: { mode = "700"; } // (if isAttrs x then x else { directory = x; }));
-    in
-    [
-      {
-        environment.persistence = mkMerge (
-          flip map (attrNames config.home-manager.users) (
-            user:
-            let
-              hmUserCfg = config.home-manager.users.${user};
-            in
-            flip mapAttrs hmUserCfg.home.persistence (
-              _: sourceCfg: {
-                users.${user} = {
-                  files = mkUserFiles sourceCfg.files;
-                  directories = mkUserDirs sourceCfg.directories;
-                };
-              }
-            )
-          )
-        );
-      }
-    ];
-
-  home-manager.sharedModules = [
-    {
-      options.home.persistence = mkOption {
-        description = "Additional persistence config for the given source path";
-        default = { };
-        type = types.attrsOf (
-          types.submodule {
-            options = {
-              files = mkOption {
-                description = "Additional files to persist via NixOS impermanence.";
-                type = types.listOf (types.either types.attrs types.str);
-                default = [ ];
-              };
-
-              directories = mkOption {
-                description = "Additional directories to persist via NixOS impermanence.";
-                type = types.listOf (types.either types.attrs types.str);
-                default = [ ];
-              };
-            };
-          }
-        );
-      };
-    }
-  ];
 }

modules/nixos/podman.nix

@@ -1,5 +1,4 @@
 {
-  pkgs,
   lib,
   config,
   ...
@@ -9,6 +8,7 @@ with lib;
 
 let
   cfg = config.modules.podman;
+  zfsPkg = config.boot.zfs.package;
 in
 {
   options.modules.podman = {
@@ -29,7 +29,7 @@ in
           dates = "weekly";
           flags = [ "--all" ];
         };
-        extraPackages = [ pkgs.zfs ];
+        extraPackages = [ zfsPkg ];
       };
 
       containers.storage.settings.storage = {

secrets/rekeyed/hypnos/59884012552f74517db9f43d996a8b80-nix-access-tokens.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 5PDipg VUUf0H5YtcvVIQGHWSRUjCCWJFC8uyifg9jb3dcKQEM
+2u40LYxerTKD200Mkp/UhMFDwRQy/u74lpFa7JG783g
+-> vSi-grease xC k Y9 7n3c
+WC+dOm6hxAlN9zTouhlfHvZCHfJaGnqOMa5jSIw
+--- 0ywtnNEFe21IGFUvzuzK0dO65YKZCymavaqHOmKB9iQ
+Lš\_%£™ø%2{ÀˆSªžè eMî‡c¹8ˆÝHzÂ`zžà×<C3A0>LTJ1öðm6JE¡pñd`žÍÁMfÙâ5Äî½ü×ðKAØ<Vb‹ù_¿‘ÉǬhæÖí¶o# “‚Ôa€ªóí¸ñ7j„„q>ùW.¤ C«ŸðÏ:Ü¿K•¸«©q]_U
•–#‘/M=×-PÓ¦

users/guest/default.nix

@@ -160,7 +160,7 @@ in
       enable = true;
       settings = {
         default_session = {
-          command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --sessions ${desktops}/share/xsessions:${desktops}/share/wayland-sessions";
+          command = "${pkgs.tuigreet}/bin/tuigreet --time --sessions ${desktops}/share/xsessions:${desktops}/share/wayland-sessions";
         };
       };
     };

users/jordan/common/git.nix

@@ -17,6 +17,9 @@
         email = "jordan@vimium.com";
         name = "Jordan Holt";
       };
+      rebase.autosquash = true;
+      push.default = "current";
+      pull.rebase = true;
     };
     ignores = [
       ".Trash-*"
@@ -37,10 +40,5 @@
       key = "B8CFFF61F1CCF520";
       signByDefault = true;
     };
-    extraConfig = {
-      rebase.autosquash = true;
-      push.default = "current";
-      pull.rebase = true;
-    };
   };
 }

users/jordan/common/optional/graphical/awesome.nix

@@ -0,0 +1,10 @@
+{
+  ...
+}:
+
+{
+  xsession = {
+    enable = true;
+    windowManager.awesome.enable = true;
+  };
+}

users/jordan/common/optional/graphical/niri.nix

@@ -1,8 +1,8 @@
 {
-  config,
   lib,
-  inputs,
   pkgs,
+  config,
+  inputs,
   ...
 }:
 let
@@ -15,38 +15,62 @@ in
     inputs.niri.homeModules.niri
   ];
 
+  services.gnome-keyring.enable = true;
   xdg.portal = {
     enable = true;
     xdgOpenUsePortal = true;
     config.niri = {
       default = [
-        "gnome"
         "gtk"
+        "gnome"
       ];
-      "org.freedesktop.impl.portal.Access" = "gtk";
+      "org.freedesktop.impl.portal.Access" = [ "gtk" ];
-      "org.freedesktop.impl.portal.Notification" = "gtk";
+      "org.freedesktop.impl.portal.Notification" = [ "gtk" ];
-      "org.freedesktop.impl.portal.Secret" = "gnome-keyring";
+      "org.freedesktop.impl.portal.Secret" = [ "gnome-keyring" ];
-      "org.freedesktop.impl.portal.FileChooser" = "gtk";
+      "org.freedesktop.impl.portal.FileChooser" = [ "gtk" ];
-      "org.freedesktop.impl.portal.ScreenCast" = [ "gnome" ];
+      "org.freedesktop.impl.portal.ScreenCast" = [ "xdg-desktop-portal-gnome" ];
-      "org.freedesktop.impl.portal.Screenshot" = [ "gnome" ];
+      "org.freedesktop.impl.portal.Screenshot" = [ "xdg-desktop-portal-gnome" ];
     };
-    extraPortals = with pkgs; [
+    extraPortals = [
-      xdg-desktop-portal-gtk
+      pkgs.gnome-keyring
-      xdg-desktop-portal-gnome
+      pkgs.xdg-desktop-portal-gtk
+      pkgs.xdg-desktop-portal-gnome
     ];
   };
 
+  programs.zsh.initContent = lib.mkOrder 9999 ''
+    if [[ -t 0 && "$(tty || true)" == /dev/tty1 && -z "$DISPLAY" && -z "$WAYLAND_DISPLAY" ]]; then
+      echo "Login shell detected. Starting wayland..."
+      niri-session
+    fi
+  '';
+
   programs.niri = {
     enable = true;
     package = pkgs.niri-unstable;
 
     settings = {
       xwayland-satellite.path = getExe pkgs.xwayland-satellite-stable;
+
+      environment = {
+        "QT_QPA_PLATFORM" = "wayland";
+        "XDG_SESSION_TYPE" = "wayland";
+        "NIXOS_OZONE_WL" = "1";
+        "MOZ_ENABLE_WAYLAND" = "1";
+        "MOZ_WEBRENDER" = "1";
+        "_JAVA_AWT_WM_NONREPARENTING" = "1";
+        "QT_WAYLAND_DISABLE_WINDOWDECORATION" = "1";
+        "GDK_BACKEND" = "wayland";
+        "GBM_BACKEND" = "nvidia-drm";
+        "GSK_RENDERER" = "vulkan";
+        "LIBVA_DRIVER_NAME" = "nvidia";
+      };
+
       input = {
         keyboard = {
           xkb = {
             layout = "us";
-            variant = "intl";
+            options = "ctrl:nocaps";
           };
 
           repeat-delay = 235;
@@ -72,6 +96,7 @@ in
 
       gestures.hot-corners.enable = false;
       debug.honor-xdg-activation-with-invalid-serial = true;
+
       binds = with config.lib.niri.actions; {
         "Mod+T".action = spawn "kitty";
         "Mod+b".action = spawn "firefox";
@@ -93,6 +118,7 @@ in
           allow-when-locked = true;
         };
         "Mod+Q".action = close-window;
+        "Mod+Space".action = spawn "noctalia-shell" "ipc" "call" "launcher" "toggle";
 
         "Mod+n".action = focus-column-left;
         "Mod+left".action = focus-column-left;
@@ -171,19 +197,18 @@ in
 
         "Mod+y".action = toggle-column-tabbed-display;
 
-        #"Print".action = screenshot;
+        "Print".action.screenshot = { };
-        #"Ctrl+Print".action = screenshot-screen {};
+        "Ctrl+Print".action.screenshot-screen = {
-        #"Alt+Print".action = screenshot-window;
+          show-pointer = false;
+        };
+        "Alt+Print".action.screenshot-window = { };
 
         "Mod+Escape" = {
           action = toggle-keyboard-shortcuts-inhibit;
           allow-inhibiting = false;
         };
 
-        # The quit action will show a confirmation dialog to avoid accidental exits.
         "Mod+Ctrl+Escape".action = quit;
-        # Powers off the monitors. To turn them back on, do any input like
-        # moving the mouse or pressing any other key.
         "Mod+Shift+P".action = power-off-monitors;
       };
 
@@ -225,7 +250,6 @@ in
           inactive.color = "#505050";
         };
         shadow = {
-          # on
           softness = 30;
           spread = 5;
           offset = {
@@ -234,10 +258,8 @@ in
           };
           draw-behind-window = true;
           color = "#00000070";
-          # inactive-color "#00000054"
         };
         tab-indicator = {
-          # off
           hide-when-single-tab = true;
           place-within-column = true;
           gap = 5;
@@ -252,10 +274,52 @@ in
           inactive.color = "gray";
         };
         insert-hint = {
-          # off
           display.color = "#ffc87f80";
         };
       };
     };
   };
+
+  home.packages = [
+    pkgs.dconf
+  ];
+
+  home.pointerCursor = {
+    enable = true;
+    gtk.enable = true;
+    name = "macOS";
+    package = pkgs.apple-cursor;
+    size = 28;
+  };
+
+  gtk = {
+    enable = true;
+
+    iconTheme = {
+      name = "MoreWaita";
+      package = pkgs.unstable.morewaita-icon-theme;
+    };
+  };
+
+  fonts.fontconfig = {
+    enable = true;
+    defaultFonts = {
+      sansSerif = [
+        "Adwaita Sans"
+      ];
+      emoji = [
+        "Apple Color Emoji"
+      ];
+    };
+  };
+
+  programs.kitty = {
+    enable = true;
+    settings = {
+      background = "#000000";
+      background_opacity = 0.8;
+    };
+  };
+
+  services.gpg-agent.pinentry.package = pkgs.pinentry-gnome3;
 }

users/jordan/common/optional/graphical/noctalia.nix

@@ -0,0 +1,172 @@
+{
+  inputs,
+  ...
+}:
+{
+  imports = [
+    inputs.noctalia.homeModules.default
+  ];
+
+  programs.niri.settings = {
+    overview.workspace-shadow.enable = false;
+  };
+
+  programs.noctalia-shell = {
+    enable = true;
+    systemd.enable = true;
+
+    settings = {
+      audio = {
+        cavaFrameRate = 60;
+        volumeOverdrive = true;
+      };
+      bar = {
+        density = "compact";
+        marginHorizontal = 0.2;
+        marginVertical = 0.1;
+        position = "bottom";
+        showCapsule = false;
+        showOutline = false;
+        transparent = false;
+        outerCorners = false;
+        widgets = {
+          center = [
+            {
+              id = "Tray";
+              blacklist = [ ];
+              colorizeIcons = false;
+              drawerEnabled = false;
+              hidePassive = false;
+              pinned = [ ];
+            }
+            {
+              id = "Workspace";
+              characterCount = 10;
+              colorizeIcons = false;
+              enableScrollWheel = false;
+              followFocusedScreen = false;
+              hideUnoccupied = false;
+              labelMode = "name";
+              showApplications = false;
+              showLabelsOnlyWhenOccupied = false;
+            }
+          ];
+          left = [
+            {
+              id = "ControlCenter";
+              colorizeDistroLogo = false;
+              colorizeSystemIcon = "none";
+              customIconPath = "";
+              enableColorization = false;
+              icon = "noctalia";
+              useDistroLogo = true;
+            }
+            { id = "WallpaperSelector"; }
+            {
+              id = "Spacer";
+              width = 20;
+            }
+            {
+              id = "SystemMonitor";
+              diskPath = "/persist";
+              showCpuTemp = true;
+              showCpuUsage = true;
+              showDiskUsage = true;
+              showGpuTemp = true;
+              showMemoryAsPercent = true;
+              showMemoryUsage = true;
+              showNetworkStats = true;
+              usePrimaryColor = false;
+            }
+            {
+              id = "AudioVisualizer";
+              colorName = "primary";
+              hideWhenIdle = false;
+              width = 200;
+            }
+          ];
+          right = [
+            {
+              id = "MediaMini";
+              hideMode = "hidden";
+              hideWhenIdle = false;
+              maxWidth = 145;
+              scrollingMode = "hover";
+              showAlbumArt = false;
+              showArtistFirst = true;
+              showProgressRing = true;
+              showVisualizer = false;
+              useFixedWidth = false;
+              visualizerType = "linear";
+            }
+            {
+              id = "Spacer";
+              width = 20;
+            }
+            {
+              id = "Microphone";
+              displayMode = "alwaysShow";
+            }
+            {
+              id = "Volume";
+              displayMode = "alwaysShow";
+            }
+            {
+              id = "Brightness";
+              displayMode = "alwaysShow";
+            }
+            {
+              id = "Spacer";
+              width = 20;
+            }
+            {
+              id = "Battery";
+              displayMode = "alwaysShow";
+              showNoctaliaPerformance = false;
+              showPowerProfiles = false;
+              warningThreshold = 20;
+            }
+            {
+              id = "NotificationHistory";
+              hideWhenZero = true;
+              showUnreadBadge = true;
+            }
+            {
+              id = "Clock";
+              customFont = "";
+              formatHorizontal = "ddd dd.MM. HH:mm:ss";
+              formatVertical = "HH mm - dd MM";
+              useCustomFont = false;
+              usePrimaryColor = false;
+            }
+          ];
+        };
+      };
+      colorSchemes = {
+        predefinedScheme = "Ayu";
+      };
+      general = {
+        animationSpeed = 1.5;
+        radiusRatio = 0.4;
+        shadowDirection = "center";
+        shadowOffsetX = 0;
+        shadowOffsetY = 0;
+        showSessionButtonsOnLockScreen = false;
+      };
+      location = {
+        firstDayOfWeek = 0;
+        name = "Manchester, UK";
+      };
+      systemMonitor = {
+        enableNvidiaGpu = true;
+      };
+      ui = {
+        fontDefault = "Adwaita Sans";
+        fontFixed = "Adwaita Mono";
+        panelBackgroundOpacity = 1;
+      };
+      notifications.enabled = true;
+      dock.enabled = false;
+    };
+  };
+}

users/jordan/common/shell.nix

@@ -1,6 +1,7 @@
 {
   lib,
   pkgs,
+  config,
   ...
 }:
 let
@@ -19,7 +20,7 @@ in
         strategy = [ "completion" ];
       };
       defaultKeymap = "viins";
-      dotDir = ".config/zsh";
+      dotDir = "${config.xdg.configHome}/zsh";
       enableCompletion = true;
       enableVteIntegration = true;
 

users/jordan/common/ssh.nix

@@ -5,6 +5,24 @@
 {
   programs.ssh = {
     enable = true;
+    enableDefaultConfig = false;
+    matchBlocks."*" = {
+      forwardAgent = false;
+      addKeysToAgent = "yes";
+      compression = false;
+      serverAliveInterval = 0;
+      serverAliveCountMax = 3;
+      hashKnownHosts = false;
+      userKnownHostsFile = "~/.ssh/known_hosts";
+      controlMaster = "no";
+      controlPath = "~/.ssh/master-%r@%n:%p";
+      controlPersist = "no";
+    };
+  };
+
+  services.ssh-agent = {
+    enable = true;
+    enableZshIntegration = true;
   };
 
   home.persistence."/state".files = [

users/jordan/default.nix

@@ -15,11 +15,21 @@ in
 {
   age.secrets."passwords/users/jordan".file = "${inputs.secrets}/passwords/users/jordan.age";
 
-  age.secrets.open-webui-api-key = {
+  age.secrets = {
-    rekeyFile = ./secrets/open-webui-api-key.age;
+    open-webui-api-key = {
-    owner = "jordan";
+      rekeyFile = ./secrets/open-webui-api-key.age;
+      owner = "jordan";
+    };
+    nix-access-tokens = {
+      rekeyFile = ./secrets/nix-access-tokens.age;
+    };
   };
 
+  # Increase rate limit with read-only token
+  nix.extraOptions = ''
+    !include ${config.age.secrets.nix-access-tokens.path}
+  '';
+
   users.users.${name} = {
     description = "Jordan Holt";
     extraGroups = [
@@ -37,7 +47,9 @@ in
     ];
     shell = pkgs.zsh;
     uid = 1000;
-  };
+    createHome = true;
+  }
+  // lib.optionalAttrs (!config.users.mutableUsers) { autoSubUidGidRange = false; };
 
   home-manager.users.${name} = {
     imports = [
@@ -49,12 +61,14 @@ in
       ./common/ssh.nix
       {
         home.persistence."/state" = {
+          enable = false;
           directories = [
             "Downloads"
             ".local/state/wireplumber"
           ];
         };
         home.persistence."/persist" = {
+          enable = false;
           directories = [
             "Desktop"
             "Documents"

users/jordan/helios.nix

@@ -7,7 +7,7 @@
   imports = [
     ./common/optional/graphical/firefox.nix
     ./common/optional/graphical/fonts.nix
-    ./common/optional/graphical/niri.nix
+    ./common/optional/graphical/hyprland
     ./common/optional/graphical/mimeapps.nix
   ];
 

users/jordan/hypnos.nix

@@ -5,9 +5,9 @@
 
 {
   imports = [
+    ./common/optional/graphical/awesome.nix
     ./common/optional/graphical/firefox.nix
     ./common/optional/graphical/fonts.nix
-    ./common/optional/graphical/gnome.nix
   ];
 
   home.packages = with pkgs; [

users/jordan/odyssey.nix

@@ -1,4 +1,5 @@
 {
+  inputs,
   pkgs,
   ...
 }:
@@ -7,28 +8,35 @@
   imports = [
     ./common/optional/graphical/firefox.nix
     ./common/optional/graphical/fonts.nix
-    ./common/optional/graphical/hyprland
     ./common/optional/graphical/libreoffice.nix
     ./common/optional/graphical/mimeapps.nix
+    ./common/optional/graphical/niri.nix
+    ./common/optional/graphical/noctalia.nix
     ./common/optional/graphical/thunderbird.nix
   ];
 
   programs.nh.enable = true;
 
-  home.packages = with pkgs; [
+  home.packages =
-    # ardour
+    with pkgs;
-    audacity
+    [
-    blender
+      # ardour
-    gimp
+      audacity
-    handbrake
+      blender
-    inkscape
+      gimp
-    # jellyfin-media-player
+      handbrake
-    krita
+      inkscape
-    unstable.lutris
+      # jellyfin-media-player
-    mkvtoolnix
+      krita
-    # obs-studio
+      unstable.lutris
-    pcsx2
+      mkvtoolnix
-    qbittorrent
+      mpv
-    xemu
+      # obs-studio
-  ];
+      pcsx2
+      qbittorrent
+      xemu
+    ]
+    ++ [
+      inputs.zen-browser.packages.${pkgs.stdenv.hostPlatform.system}.default
+    ];
 }