improvements

common/networking.nix

@@ -0,0 +1,10 @@
+{pkgs, ...}: {
+  networking = {
+    nftables.enable = true;
+    useNetworkd = true;
+  };
+
+  environment.systemPackages = [
+    pkgs.nixos-firewall-tool
+  ];
+}

disk/disk.bash

@@ -4,9 +4,19 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-opts=$(getopt --options r:m:b:l:c: --longoptions=root:,mapping:,boot-label:,main-label:,cryptmain-label: --name "$0" -- "$@")
+progname="$0"
 
-eval set -- "$opts"
+error() {
+    for line in "$@"; do
+        printf '%s\n' "$progname: $line" 1>&2
+    done
+
+    exit 1
+}
+
+args=$(getopt --options r:m:b:l:c: --longoptions=root:,mapping:,boot-label:,main-label:,cryptmain-label: --name "$progname" -- "$@")
+
+eval set -- "$args"
 
 root=/mnt
 mapping=main
@@ -15,36 +25,39 @@ mainlbl=main
 cryptmainlbl=cryptmain
 while true; do
   case "$1" in
-  -r | --root)
+  (-r | --root)
     root=$2
     shift 2
     ;;
-  -m | --mapping)
+  (-m | --mapping)
     mapping=$2
     shift 2
     ;;
-  -b | --boot-label)
+  (-b | --boot-label)
     bootlbl=${2^^}
     shift 2
     ;;
-  -l | --main-label)
+  (-l | --main-label)
     mainlbl=$2
     shift 2
     ;;
-  -c | --cryptmain-label)
+  (-c | --cryptmain-label)
     cryptmainlbl=$2
     shift 2
     ;;
-  --)
+  (--)
     shift
     break
     ;;
   esac
 done
 
-if [[ $# != 1 ]]; then
-  printf '%s\n' "$0: an argument specifying the block device is required" 1>&2
-  exit 1
+if (( $# < 1 )); then
+  error 'an argument specifying the block device is required'
+fi
+
+if (( $# > 1 )); then
+  error 'too many arguments'
 fi
 
 blkdev=$1

flake.lock

@@ -111,11 +111,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1734951937,
-        "narHash": "sha256-oYitbnWHQIEmd5e/e8yvuy6T41zVVe/V8868nOnwNfk=",
+        "lastModified": 1735241861,
+        "narHash": "sha256-n8Ww/v5eCKi0+zGe+5nfAPpxGsYu4MRWokWyzryswS4=",
         "owner": "cachix",
         "repo": "devenv",
-        "rev": "4b8677f62022e6a235cc4e93a6bbc3d57b77817f",
+        "rev": "991abff153b995192bf36655394246fc97ba8627",
         "type": "github"
       },
       "original": {
@@ -570,11 +570,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1735004289,
-        "narHash": "sha256-cJmBhr59xQXwkvF+EZPhKTebgHyqXoei8u2Qq2QJYzE=",
+        "lastModified": 1735255080,
+        "narHash": "sha256-MM+hxbkcTmRN8jzpxZJQ7DsfuV3PlQYH0iIua9lgSWo=",
         "owner": "lilyinstarlight",
         "repo": "nixos-cosmic",
-        "rev": "b9bfb93c7632a0e007a3a05fe77c0475d05e045a",
+        "rev": "804adac95a3beb37f7a47d5a9b6251ad697412ce",
         "type": "github"
       },
       "original": {
@@ -625,11 +625,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1734875076,
-        "narHash": "sha256-Pzyb+YNG5u3zP79zoi8HXYMs15Q5dfjDgwCdUI5B0nY=",
+        "lastModified": 1734991663,
+        "narHash": "sha256-8T660guvdaOD+2/Cj970bWlQwAyZLKrrbkhYOFcY1YE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1807c2b91223227ad5599d7067a61665c52d1295",
+        "rev": "6c90912761c43e22b6fb000025ab96dd31c971ff",
         "type": "github"
       },
       "original": {
@@ -790,11 +790,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1734834660,
-        "narHash": "sha256-bm8V+Cu8rWJA+vKQnc94mXTpSDgvedyoDKxTVi/uJfw=",
+        "lastModified": 1735093658,
+        "narHash": "sha256-eIUYGDtairggo7+JXSwN7b6Zr03BJ7tsZL/U0NkDr0s=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "b070e6030118680977bc2388868c4b3963872134",
+        "rev": "ca249a1d98eff27e92665ac462b9d47f58141925",
         "type": "github"
       },
       "original": {