stuff

.envrc

@@ -1,9 +1 @@
-watch_file flake.nix
+use flake
-watch_file flake.lock
-
-DEVENV_ROOT_FILE="$(mktemp)"
-printf %s "$PWD" > "$DEVENV_ROOT_FILE"
-if ! use flake . --override-input devenv-root "file+file://$DEVENV_ROOT_FILE"
-then
-  echo "devenv could not be built. The devenv environment was not loaded. Make the necessary changes to devenv.nix and hit enter to try again." >&2
-fi

README.md

@@ -2,25 +2,51 @@
 
 This is my cobbled together NixOS configuration. There are many like it, but this one is mine. Copy at your own risk.
 
+## Structure
+
+* common: Sane defaults that make sense to use for every host.
+* modules: Regular NixOS modules.
+* profiles: Higher-level NixOS modules that conform to different roles that a host may have.
+* packages: Packages that I couldn't fit anywhere else.
+* secrets: Agenix secrets.
+* hosts: Hosts exposed in `nixosConfigurations`.
+* pubkeys.nix: Nix expression with all my SSH public keys, used for OpenSSH, Agenix and Restic.
+* lib.nix: Nixpkgs' lib with some extra functionality.
+
+## Ports
+
+* 80X0: Public HTTP services that are proxied through nginx
+* 40X0: Syncthing instances (4000 being the system instance, subsequent ones are for individual users)
+
+## Installation
+
+```bash
+nix run git+https://codeberg.org/helvetica/puter.git#disk /path/to/disk
+# TODO: Configure additional disks
+mkdir -p /mnt/etc/ssh
+cat > /mnt/etc/ssh/ssh_host_ed25519_key
+chmod 600 /mnt/etc/ssh/ssh_host_ed25519_key
+ssh-keygen -f /mnt/etc/ssh/ssh_host_ed25519_key -y > /mnt/etc/ssh/ssh_host_ed25519_key.pub
+nixos-install --no-root-password --flake git+https://codeberg.org/helvetica/puter.git#hostname
+```
+
+## systemd-cryptenroll
+
+```bash
+systemd-cryptenroll /dev/sdX --tpm2-device=auto
+```
+
+## Create tar for sbctl
+
+```bash
+sudo sbctl create-keys
+sudo tar --create --directory /var/lib/sbctl . | agenix -e secure-boot/hostname.tar.age
+```
+
 ## TODO
 
-- [ ] lanzaboote
+- [ ] Lanzaboote
-- [ ] monitoring (prometheus)
+- [ ] Monitoring
-- [ ] logging (loki)
+- [ ] Rom sync
-- [ ] kiosk
-- [ ] tailscale and headscale
-- [ ] game rom sync insomniac
 - [ ] insomniac backups
 - [ ] nginx websites
-
-## port allocation
-
-* 80X0: public HTTP services that are proxied through nginx
-* 40X0: syncthing instances (4000 being the system instance, subsequent ones are for individual users)
-* 60X0: private HTTP services that are accessible via tailscale
-* 20XX: Administrative stuff, like prometheus etc.
-
-* 8000: vaultwarden
-* 8010: headscale
-
-* 4000: syncthing

classes/headful/clipboard.nix

@@ -1,3 +0,0 @@
-{pkgs, ...}: {
-  environment.systemPackages = [pkgs.wl-clipboard];
-}

classes/headful/codium.nix

@@ -1,6 +0,0 @@
-{pkgs, ...}: {
-  # TODO: wrap
-  environment.systemPackages = [
-    pkgs.vscodium
-  ];
-}

classes/headful/cosmic.nix

@@ -1,17 +0,0 @@
-{inputs, ...}: {
-  imports = [
-    inputs.nixos-cosmic.nixosModules.default
-  ];
-
-  nix.settings = {
-    substituters = ["https://cosmic.cachix.org"];
-    trusted-public-keys = ["cosmic.cachix.org-1:Dya9IyXD4xdBehWjrkPv6rtxpmMdRel02smYzA85dPE="];
-  };
-
-  services = {
-    desktopManager.cosmic.enable = true;
-    displayManager.cosmic-greeter.enable = true;
-  };
-
-  environment.sessionVariables.COSMIC_DATA_CONTROL_ENABLED = 1;
-}

classes/headful/devenv.nix

@@ -1,3 +0,0 @@
-{pkgs, ...}: {
-  environment.systemPackages = [pkgs.devenv];
-}

classes/headful/flatpak.nix

@@ -1,7 +0,0 @@
-{inputs, ...}: {
-  imports = [
-    inputs.flatpak.nixosModules.nix-flatpak
-  ];
-
-  services.flatpak.enable = true;
-}

classes/headful/fonts.nix

@@ -1,27 +0,0 @@
-{pkgs, ...}: {
-  fonts = {
-    enableDefaultPackages = true;
-    packages = [
-      pkgs.noto-fonts
-      pkgs.noto-fonts-extra
-      pkgs.noto-fonts-cjk-sans
-      pkgs.noto-fonts-cjk-serif
-      pkgs.noto-fonts-monochrome-emoji
-      pkgs.noto-fonts-color-emoji
-      pkgs.nerd-fonts.fira-code
-    ];
-
-    fontconfig = {
-      enable = true;
-
-      defaultFonts = {
-        monospace = ["FiraCode Nerd Font"];
-        sansSerif = ["Noto Sans"];
-        serif = ["Noto Serif"];
-        emoji = ["Noto Color Emoji" "Noto Emoji"];
-      };
-    };
-
-    fontDir.enable = true;
-  };
-}

classes/headful/gamemode.nix

@@ -1,21 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: {
-  programs.gamemode = {
-    enable = true;
-    settings = {
-      general = {
-        renice = 10;
-      };
-      custom = {
-        start = "${lib.getExe pkgs.libnotify} 'GameMode started'";
-        end = "${lib.getExe pkgs.libnotify} 'GameMode stopped'";
-      };
-    };
-  };
-
-  users.groups.gamemode.members = config.users.normalUsers;
-}

classes/headful/hardware.nix

@@ -1,10 +0,0 @@
-{
-  hardware = {
-    bluetooth.enable = true;
-    steam-hardware.enable = true;
-    xone.enable = true;
-    xpadneo.enable = true;
-    opentabletdriver.enable = true;
-    graphics.enable = true;
-  };
-}

classes/headful/location.nix

@@ -1,3 +0,0 @@
-{
-  location.provider = "geoclue2";
-}

classes/headful/mullvad.nix

@@ -1,6 +0,0 @@
-{pkgs, ...}: {
-  services.mullvad-vpn = {
-    enable = true;
-    package = pkgs.mullvad-vpn;
-  };
-}

classes/headful/networking.nix

@@ -1,10 +0,0 @@
-{config, ...}: {
-  services.resolved.enable = true;
-
-  networking.networkmanager = {
-    enable = true;
-    dns = "systemd-resolved";
-  };
-
-  users.groups.networkmanager.members = config.users.normalUsers;
-}

classes/headful/pipewire.nix

@@ -1,11 +0,0 @@
-{
-  security.rtkit.enable = true;
-
-  services.pipewire = {
-    enable = true;
-    wireplumber.enable = true;
-    alsa.enable = true;
-    pulse.enable = true;
-    jack.enable = true;
-  };
-}

classes/headful/printing.nix

@@ -1,6 +0,0 @@
-{
-  services.printing = {
-    enable = true;
-    webInterface = true;
-  };
-}

classes/headful/wayland.nix

@@ -1,6 +0,0 @@
-{
-  environment.sessionVariables = {
-    NIXOS_OZONE_WL = "1";
-    SDL_VIDEODRIVER = "wayland";
-  };
-}

classes/headful/xdg.nix

@@ -1,3 +0,0 @@
-{
-  xdg.portal.xdgOpenUsePortal = true;
-}

classes/headless/networking.nix

@@ -1,3 +0,0 @@
-{
-  networking.useNetworkd = true;
-}

classes/headless/time.nix

@@ -1,3 +0,0 @@
-{
-  time.timeZone = "UTC";
-}

common/agenix.nix

@@ -1,4 +1,5 @@
-{inputs, ...}: {
+{ inputs, ... }:
+{
   imports = [
     inputs.agenix.nixosModules.default
   ];

common/bash.nix

@@ -1,5 +0,0 @@
-{
-  programs.bash.interactiveShellInit = ''
-    shopt -s autocd globstar nullglob extglob checkwinsize
-  '';
-}

common/boot.nix

@@ -1,21 +1,24 @@
-{
+{config, inputs, ...}: {
-  fileSystems."/boot" = {
+  imports = [
+    inputs.lanzaboote.nixosModules.lanzaboote
+  ];
+
+  fileSystems.${config.boot.loader.efi.efiSysMountPoint} = {
     label = "BOOT";
     fsType = "vfat";
   };
 
   boot = {
-    loader = {
+    lanzaboote = {
-      systemd-boot = {
+      enable = true;
-        enable = true;
+      pkiBundle = "/var/lib/sbctl";
-        consoleMode = "max";
+    };
-      };
+
-
+    initrd.systemd.enable = true;
-      efi = {
+
-        canTouchEfiVariables = true;
+    loader.efi = {
-        efiSysMountPoint = "/boot";
+      canTouchEfiVariables = true;
-      };
+      efiSysMountPoint = "/boot";
     };
-    tmp.cleanOnBoot = true;
   };
 }

common/bottom.nix

@@ -1,3 +1,6 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
-  environment.systemPackages = [pkgs.bottom];
+{
+  environment.systemPackages = [
+    pkgs.bottom
+  ];
 }

common/comma.nix

@@ -1,3 +1,8 @@
+{ inputs, ... }:
 {
+  imports = [
+    inputs.nix-index-database.nixosModules.nix-index
+  ];
+
   programs.nix-index-database.comma.enable = true;
 }

common/command-not-found.nix

@@ -1,4 +0,0 @@
-{
-  # TODO
-  programs.command-not-found.enable = false;
-}

common/dbus.nix

@@ -1,3 +0,0 @@
-{
-  services.dbus.implementation = "broker";
-}

common/editor.nix

@@ -0,0 +1,23 @@
+{
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  package = inputs.hxwrap.packages.${pkgs.system}.default;
+in
+{
+  environment = {
+    systemPackages = [ package ];
+
+    sessionVariables =
+      let
+        exe = builtins.baseNameOf (lib.getExe package);
+      in
+      {
+        EDITOR = exe;
+        VISUAL = exe;
+      };
+  };
+}

common/fish.nix

@@ -1,5 +0,0 @@
-{pkgs, ...}: {
-  programs.fish.enable = true;
-
-  users.defaultUserShell = pkgs.fish;
-}

common/gc.nix

@@ -2,6 +2,8 @@
   nix.gc = {
     automatic = true;
     dates = "daily";
-    options = "--delete-older-than 7d";
+    options = "--delete-older-than 30d";
   };
+
+  boot.loader.systemd-boot.configurationLimit = 5;
 }

common/git.nix

@@ -1,6 +1,10 @@
-{
+{pkgs, ...}: {
   programs.git = {
     enable = true;
     lfs.enable = true;
   };
+
+  environment.systemPackages = [
+    pkgs.gitui
+  ];
 }

common/helix.nix

@@ -1,16 +0,0 @@
-{
-  lib,
-  pkgs,
-  ...
-}: let
-  package = pkgs.helix;
-in {
-  environment.systemPackages = [package];
-
-  environment.sessionVariables = let
-    exe = builtins.baseNameOf (lib.getExe package);
-  in {
-    EDITOR = exe;
-    VISUAL = exe;
-  };
-}

common/networking.nix

@@ -1,5 +1,9 @@
-{pkgs, ...}: {
+{ attrName, pkgs, ... }:
-  networking.nftables.enable = true;
+{
+  networking = {
+    hostName = attrName;
+    nftables.enable = true;
+  };
 
   environment.systemPackages = [
     pkgs.nixos-firewall-tool

common/nini.nix

@@ -0,0 +1,10 @@
+{inputs, ...}: {
+  imports = [
+    inputs.nini.nixosModules.default
+  ];
+
+  programs.nini = {
+    enable = true;
+    flakeref = "git+https://forgejo.helveticanonstandard.net/helvetica/puter.git";
+  };
+}

common/nix-index-database.nix

@@ -1,5 +0,0 @@
-{inputs, ...}: {
-  imports = [
-    inputs.nix-index-database.nixosModules.nix-index
-  ];
-}

common/nix.nix

@@ -3,16 +3,17 @@
   inputs,
   lib,
   ...
-}: {
+}:
+{
   nix = {
-    registry = lib.mapAttrs (_: value: {flake = value;}) inputs;
+    registry = lib.mapAttrs (_: value: { flake = value; }) inputs;
 
     nixPath = lib.mapAttrsToList (key: _: "${key}=flake:${key}") config.nix.registry;
 
     optimise.automatic = true;
 
     settings = {
-      trusted-users = ["root"] ++ config.users.normalUsers;
+      trusted-users = [ "root" ] ++ config.users.normalUsers;
       experimental-features = [
         "nix-command"
         "flakes"
@@ -24,5 +25,4 @@
   };
 
   nixpkgs.config.allowUnfree = true;
-  hardware.enableAllFirmware = true;
 }

common/puter.nix

@@ -1,12 +0,0 @@
-{
-  pkgs,
-  self,
-  ...
-}: {
-  environment = {
-    systemPackages = [
-      self.packages.${pkgs.system}.puter
-    ];
-    sessionVariables.PUTER_FLAKEREF = "git+https://forgejo@tea.wrz.one/lukas/puter.git";
-  };
-}

common/ripgrep.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   environment.systemPackages = [
     pkgs.ripgrep
   ];

common/secure-boot.nix

@@ -0,0 +1,12 @@
+{self, attrName, config, lib, pkgs, ...}: let
+  inherit (config.age) secrets;
+in{
+  age.secrets.secure-boot.file = self + /secrets/secure-boot/${attrName}.tar.age;
+
+  system.activationScripts.secureboot = let
+    target = config.boot.lanzaboote.pkiBundle;
+  in ''
+    mkdir --parents ${target}
+    ${lib.getExe pkgs.gnutar} --extract --file ${secrets.secure-boot.path} --directory ${target}
+  '';
+}

common/shell.nix

@@ -0,0 +1,18 @@
+{ config, ... }:
+{
+  programs = {
+    fish.enable = true;
+
+    bash.interactiveShellInit = ''
+      shopt -s autocd globstar nullglob extglob checkwinsize
+    '';
+
+    starship = {
+      enable = true;
+      interactiveOnly = true;
+      settings.format = "$all";
+    };
+  };
+
+  users.defaultUserShell = config.programs.fish.package;
+}

common/shpool.nix

@@ -1,5 +1,6 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   environment.systemPackages = [
-    pkgs.gitui
+    pkgs.shpool
   ];
 }

common/ssh.nix

@@ -1,5 +1,5 @@
 {
-  age.identityPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+  age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
   services.openssh = {
     enable = true;

common/starship.nix

@@ -1,7 +0,0 @@
-{
-  programs.starship = {
-    enable = true;
-    interactiveOnly = true;
-    settings.format = "$all";
-  };
-}

common/sudo.nix

@@ -3,6 +3,8 @@
     enable = true;
     execWheelOnly = true;
     wheelNeedsPassword = true;
-    extraConfig = "Defaults lecture=\"never\"";
+    extraConfig = ''
+      Defaults lecture="never"
+    '';
   };
 }

common/swap.nix

@@ -1,3 +1,6 @@
 {
-  zramSwap.enable = true;
+  zramSwap = {
+    enable = true;
+    memoryPercent = 50;
+  };
 }

common/syncthing.nix

@@ -1,6 +1,8 @@
-{config, ...}: let
+{ config, ... }:
+let
   inherit (config.networking) hostName;
-in {
+in
+{
   services.syncthing = {
     enable = true;
     systemService = true;

common/tailscale.nix

@@ -1,14 +1,12 @@
-{config, ...}: {
+{ config, ... }:
+{
   services.tailscale = {
     enable = true;
     openFirewall = true;
+    useRoutingFeatures = "both"; # TODO
   };
 
-  networking.firewall = {
+  networking.firewall.trustedInterfaces = [
-    trustedInterfaces = [
+    config.services.tailscale.interfaceName
-      config.services.tailscale.interfaceName
+  ];
-    ];
-    # Required to connect to Tailscale exit nodes
-    checkReversePath = "loose";
-  };
 }

common/tmp.nix

@@ -0,0 +1,6 @@
+{
+  boot.tmp = {
+    useTmpfs = true;
+    tmpfsSize = "50%";
+  };
+}

common/users.nix

@@ -1,11 +1,13 @@
 {
+  self,
   config,
-  lib,
   ...
-}: let
+}:
+let
   inherit (config.users) mainUser;
-in {
+in
-  age.secrets = lib.mkSecrets {"user-${mainUser}" = {};};
+{
+  age.secrets."user-${mainUser}".file = self + /secrets/users/${mainUser}.age;
 
   users = {
     mutableUsers = false;
@@ -20,7 +22,7 @@ in {
         isNormalUser = true;
         hashedPasswordFile = config.age.secrets."user-${mainUser}".path;
         openssh.authorizedKeys.keys = builtins.attrValues config.pubkeys.users;
-        extraGroups = ["wheel"]; #TODO remove
+        extraGroups = [ "wheel" ]; # TODO remove
       };
     };
   };

common/wheel.nix

@@ -1,3 +1,4 @@
-{config, ...}: {
+{ config, ... }:
+{
   users.groups.wheel.members = config.users.normalUsers;
 }

common/yazi.nix

@@ -1,3 +0,0 @@
-{
-  programs.yazi.enable = true;
-}

devenv.nix

@@ -1,21 +0,0 @@
-{
-  languages.python.enable = true;
-
-  pre-commit.hooks = {
-    # Nix
-    alejandra.enable = true;
-    deadnix.enable = true;
-    statix.enable = true;
-
-    # Flakes
-    flake-checker.enable = true;
-
-    # Shell
-    shellcheck.enable = true;
-
-    # Python
-    pyright.enable = true;
-    ruff.enable = true;
-    ruff-format.enable = true;
-  };
-}

flake.lock

@@ -8,11 +8,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1736955230,
+        "lastModified": 1745630506,
-        "narHash": "sha256-uenf8fv2eG5bKM8C/UvFaiJMZ4IpUFaQxk9OH5t/1gA=",
+        "narHash": "sha256-bHCFgGeu8XjWlVuaWzi3QONjDW3coZDqSHvnd4l7xus=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "e600439ec4c273cf11e06fe4d9d906fb98fa097c",
+        "rev": "96e078c646b711aee04b82ba01aefbff87004ded",
         "type": "github"
       },
       "original": {
@@ -21,34 +21,6 @@
         "type": "github"
       }
     },
-    "cachix": {
-      "inputs": {
-        "devenv": [
-          "devenv"
-        ],
-        "flake-compat": [
-          "devenv"
-        ],
-        "git-hooks": [
-          "devenv"
-        ],
-        "nixpkgs": "nixpkgs_2"
-      },
-      "locked": {
-        "lastModified": 1742042642,
-        "narHash": "sha256-D0gP8srrX0qj+wNYNPdtVJsQuFzIng3q43thnHXQ/es=",
-        "owner": "cachix",
-        "repo": "cachix",
-        "rev": "a624d3eaf4b1d225f918de8543ed739f2f574203",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "ref": "latest",
-        "repo": "cachix",
-        "type": "github"
-      }
-    },
     "crane": {
       "locked": {
         "lastModified": 1731098351,
@@ -72,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1700795494,
+        "lastModified": 1744478979,
-        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
         "type": "github"
       },
       "original": {
@@ -86,57 +58,7 @@
         "type": "github"
       }
     },
-    "devenv": {
-      "inputs": {
-        "cachix": "cachix",
-        "flake-compat": "flake-compat",
-        "git-hooks": "git-hooks",
-        "nix": "nix",
-        "nixpkgs": "nixpkgs_4"
-      },
-      "locked": {
-        "lastModified": 1743783972,
-        "narHash": "sha256-5wPsNCnWmeLpLxavsftA9L7tnYgtlexV7FwLegxtpy4=",
-        "owner": "cachix",
-        "repo": "devenv",
-        "rev": "2f53e2f867e0c2ba18b880e66169366e5f8ca554",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "devenv",
-        "type": "github"
-      }
-    },
-    "devenv-root": {
-      "flake": false,
-      "locked": {
-        "narHash": "sha256-d6xi4mKdjkX2JFicDIv5niSzpyI0m/Hnm8GGAIU04kY=",
-        "type": "file",
-        "url": "file:///dev/null"
-      },
-      "original": {
-        "type": "file",
-        "url": "file:///dev/null"
-      }
-    },
     "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_2": {
       "flake": false,
       "locked": {
         "lastModified": 1696426674,
@@ -152,23 +74,7 @@
         "type": "github"
       }
     },
-    "flake-compat_3": {
+    "flake-compat_2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1717312683,
-        "narHash": "sha256-FrlieJH50AuvagamEvWMIE6D2OAnERuDboFDYAED/dE=",
-        "owner": "nix-community",
-        "repo": "flake-compat",
-        "rev": "38fd3954cf65ce6faf3d0d45cd26059e059f07ea",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_4": {
       "flake": false,
       "locked": {
         "lastModified": 1733328505,
@@ -184,29 +90,23 @@
         "type": "github"
       }
     },
-    "flake-parts": {
+    "flake-compat_3": {
-      "inputs": {
+      "flake": false,
-        "nixpkgs-lib": [
-          "devenv",
-          "nix",
-          "nixpkgs"
-        ]
-      },
       "locked": {
-        "lastModified": 1712014858,
+        "lastModified": 1746162366,
-        "narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
+        "narHash": "sha256-5SSSZ/oQkwfcAz/o/6TlejlVGqeK08wyREBQ5qFFPhM=",
-        "owner": "hercules-ci",
+        "owner": "nix-community",
-        "repo": "flake-parts",
+        "repo": "flake-compat",
-        "rev": "9126214d0a59633752a136528f5f3b9aa8565b7d",
+        "rev": "0f158086a2ecdbb138cd0429410e44994f1b7e4b",
         "type": "github"
       },
       "original": {
-        "owner": "hercules-ci",
+        "owner": "nix-community",
-        "repo": "flake-parts",
+        "repo": "flake-compat",
         "type": "github"
       }
     },
-    "flake-parts_2": {
+    "flake-parts": {
       "inputs": {
         "nixpkgs-lib": "nixpkgs-lib"
       },
@@ -224,7 +124,43 @@
         "type": "github"
       }
     },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib_2"
+      },
+      "locked": {
+        "lastModified": 1743550720,
+        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib_3"
+      },
+      "locked": {
+        "lastModified": 1743550720,
+        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "lanzaboote",
@@ -245,9 +181,9 @@
         "type": "github"
       }
     },
-    "flake-parts_4": {
+    "flake-parts_5": {
       "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib_2"
+        "nixpkgs-lib": "nixpkgs-lib_4"
       },
       "locked": {
         "lastModified": 1743550720,
@@ -263,70 +199,65 @@
         "type": "github"
       }
     },
-    "flatpak": {
+    "flake-parts_6": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib_5"
+      },
       "locked": {
-        "lastModified": 1739444422,
+        "lastModified": 1743550720,
-        "narHash": "sha256-iAVVHi7X3kWORftY+LVbRiStRnQEob2TULWyjMS6dWg=",
+        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
-        "owner": "gmodena",
+        "owner": "hercules-ci",
-        "repo": "nix-flatpak",
+        "repo": "flake-parts",
-        "rev": "5e54c3ca05a7c7d968ae1ddeabe01d2a9bc1e177",
+        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
         "type": "github"
       },
       "original": {
-        "owner": "gmodena",
+        "owner": "hercules-ci",
-        "ref": "latest",
+        "repo": "flake-parts",
-        "repo": "nix-flatpak",
         "type": "github"
       }
     },
-    "git-hooks": {
+    "flake-parts_7": {
       "inputs": {
-        "flake-compat": [
+        "nixpkgs-lib": "nixpkgs-lib_6"
-          "devenv"
-        ],
-        "gitignore": "gitignore",
-        "nixpkgs": [
-          "devenv",
-          "nixpkgs"
-        ]
       },
       "locked": {
-        "lastModified": 1742649964,
+        "lastModified": 1743550720,
-        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
+        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
-        "owner": "cachix",
+        "owner": "hercules-ci",
-        "repo": "git-hooks.nix",
+        "repo": "flake-parts",
-        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
+        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
         "type": "github"
       },
       "original": {
-        "owner": "cachix",
+        "owner": "hercules-ci",
-        "repo": "git-hooks.nix",
+        "repo": "flake-parts",
         "type": "github"
       }
     },
+    "forgesync": {
+      "inputs": {
+        "flake-parts": "flake-parts_2",
+        "nixpkgs": "nixpkgs_2",
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix"
+      },
+      "locked": {
+        "lastModified": 1746299148,
+        "narHash": "sha256-OL9j+S8m4zC2dCqjaWLt6Ooc7EzRjJC/olLVj7mqd/M=",
+        "ref": "refs/heads/main",
+        "rev": "e2e0f134da1444b298d4a4601390664124d0a5c4",
+        "revCount": 10,
+        "type": "git",
+        "url": "https://codeberg.org/helvetica/forgesync.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://codeberg.org/helvetica/forgesync.git"
+      }
+    },
     "gitignore": {
-      "inputs": {
-        "nixpkgs": [
-          "devenv",
-          "git-hooks",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1709087332,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "type": "github"
-      }
-    },
-    "gitignore_2": {
       "inputs": {
         "nixpkgs": [
           "lanzaboote",
@@ -350,11 +281,11 @@
     },
     "hardware": {
       "locked": {
-        "lastModified": 1743420942,
+        "lastModified": 1747129300,
-        "narHash": "sha256-b/exDDQSLmENZZgbAEI3qi9yHkuXAXCPbormD8CSJXo=",
+        "narHash": "sha256-L3clA5YGeYCF47ghsI7Tcex+DnaaN/BbQ4dR2wzoiKg=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "de6fc5551121c59c01e2a3d45b277a6d05077bc4",
+        "rev": "e81fd167b33121269149c57806599045fd33eeed",
         "type": "github"
       },
       "original": {
@@ -371,11 +302,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1703113217,
+        "lastModified": 1745494811,
-        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
         "type": "github"
       },
       "original": {
@@ -384,12 +315,33 @@
         "type": "github"
       }
     },
+    "hxwrap": {
+      "inputs": {
+        "flake-parts": "flake-parts_3",
+        "nixpkgs": "nixpkgs_3"
+      },
+      "locked": {
+        "lastModified": 1745088587,
+        "narHash": "sha256-85AYHWayJVq/dxgk/S4RH7u6w59Akyr1fVttR8KBh8g=",
+        "ref": "refs/heads/main",
+        "rev": "8fa5d5d550add7bf6cfd0a619dfac0e8a03b2bae",
+        "revCount": 21,
+        "type": "git",
+        "url": "https://codeberg.org/helvetica/hxwrap.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://codeberg.org/helvetica/hxwrap.git"
+      }
+    },
     "lanzaboote": {
       "inputs": {
         "crane": "crane",
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat",
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_4",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
         "pre-commit-hooks-nix": "pre-commit-hooks-nix",
         "rust-overlay": "rust-overlay"
       },
@@ -408,72 +360,62 @@
         "type": "github"
       }
     },
-    "libgit2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1697646580,
-        "narHash": "sha256-oX4Z3S9WtJlwvj0uH9HlYcWv+x1hqp8mhXl7HsLu2f0=",
-        "owner": "libgit2",
-        "repo": "libgit2",
-        "rev": "45fd9ed7ae1a9b74b957ef4f337bc3c8b3df01b5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "libgit2",
-        "repo": "libgit2",
-        "type": "github"
-      }
-    },
     "musicomp": {
       "inputs": {
-        "flake-parts": "flake-parts_4",
+        "flake-parts": "flake-parts_5",
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1744068246,
+        "lastModified": 1744916606,
-        "narHash": "sha256-ZrLuwXT0uRxa4hyMyCe/IG9lKZEqAM+lUgLKcCiZjbA=",
+        "narHash": "sha256-6l7xP5DTAc7E+gO2xu9aX5BjyuDNLMdeS6oFFrpsulg=",
         "ref": "refs/heads/main",
-        "rev": "66aa356585132605e8bd9cc630fab7416f3caf3d",
+        "rev": "0c6b26ce38dbc39d360904ddd98eab1159b922e1",
-        "revCount": 2,
+        "revCount": 3,
         "type": "git",
-        "url": "https://codeberg.org/helveticanonstandard/musicomp.git"
+        "url": "https://codeberg.org/helvetica/musicomp.git"
       },
       "original": {
         "type": "git",
-        "url": "https://codeberg.org/helveticanonstandard/musicomp.git"
+        "url": "https://codeberg.org/helvetica/musicomp.git"
       }
     },
-    "nix": {
+    "myphps": {
       "inputs": {
-        "flake-compat": [
+        "flake-parts": "flake-parts_6",
-          "devenv"
+        "nixpkgs": "nixpkgs_5",
-        ],
+        "phps": "phps"
-        "flake-parts": "flake-parts",
-        "libgit2": "libgit2",
-        "nixpkgs": "nixpkgs_3",
-        "nixpkgs-23-11": [
-          "devenv"
-        ],
-        "nixpkgs-regression": [
-          "devenv"
-        ],
-        "pre-commit-hooks": [
-          "devenv"
-        ]
       },
       "locked": {
-        "lastModified": 1741798497,
+        "lastModified": 1746369841,
-        "narHash": "sha256-E3j+3MoY8Y96mG1dUIiLFm2tZmNbRvSiyN7CrSKuAVg=",
+        "narHash": "sha256-/k3MQPXdsXJ0FDEsT1YvBG9ugRXk1nuE9MCb1wAMGQc=",
-        "owner": "domenkozar",
+        "ref": "refs/heads/main",
-        "repo": "nix",
+        "rev": "dbe35541ef6923f411685434cc535d0854b55b6a",
-        "rev": "f3f44b2baaf6c4c6e179de8cbb1cc6db031083cd",
+        "revCount": 5,
-        "type": "github"
+        "type": "git",
+        "url": "https://codeberg.org/helvetica/myphps.git"
       },
       "original": {
-        "owner": "domenkozar",
+        "type": "git",
-        "ref": "devenv-2.24",
+        "url": "https://codeberg.org/helvetica/myphps.git"
-        "repo": "nix",
+      }
-        "type": "github"
+    },
+    "nini": {
+      "inputs": {
+        "flake-parts": "flake-parts_7",
+        "nixpkgs": "nixpkgs_7"
+      },
+      "locked": {
+        "lastModified": 1747493683,
+        "narHash": "sha256-SEszNrbvTzxjFM7apKnL8LaarvDAzcuuQXj8r+ikJdk=",
+        "ref": "refs/heads/main",
+        "rev": "a61825fc51a2b52cebd01ce58910707383e08b02",
+        "revCount": 2,
+        "type": "git",
+        "url": "https://codeberg.org/helvetica/nini.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://codeberg.org/helvetica/nini.git"
       }
     },
     "nix-index-database": {
@@ -483,11 +425,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743911143,
+        "lastModified": 1747470409,
-        "narHash": "sha256-4j4JPwr0TXHH4ZyorXN5yIcmqIQr0WYacsuPA4ktONo=",
+        "narHash": "sha256-R9TP2//BDKyjNzuZybplIZm7HQEnwL8khs7EmmTPYP4=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "a36f6a7148aec2c77d78e4466215cceb2f5f4bfb",
+        "rev": "c1f63a0c3bf1b2fe05124ccb099333163e2184a7",
         "type": "github"
       },
       "original": {
@@ -499,16 +441,16 @@
     "nixos-cosmic": {
       "inputs": {
         "flake-compat": "flake-compat_3",
-        "nixpkgs": "nixpkgs_7",
+        "nixpkgs": "nixpkgs_8",
         "nixpkgs-stable": "nixpkgs-stable_2",
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1744137608,
+        "lastModified": 1747491978,
-        "narHash": "sha256-KEuKL7lM2ZqKzvaGIptVDAce29CAR4ZSgWtFD3PnpB0=",
+        "narHash": "sha256-Jn7um1fnf2bI9N8gvG5jIHvIJxxLaXd+2+wHXyW0Frs=",
         "owner": "lilyinstarlight",
         "repo": "nixos-cosmic",
-        "rev": "d20b15f629985fe6900925bef462f947e4a75b2f",
+        "rev": "2a7be063557ffc19ab1d8ab18bfd1721df8355c5",
         "type": "github"
       },
       "original": {
@@ -519,11 +461,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1703013332,
+        "lastModified": 1745391562,
-        "narHash": "sha256-+tFNwMvlXLbJZXiMHqYq77z/RfmpfpiI3yjL6o/Zo9M=",
+        "narHash": "sha256-sPwcCYuiEopaafePqlG826tBhctuJsLx/mhKKM5Fmjo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "54aac082a4d9bb5bbc5c4e899603abfb76a3f6d6",
+        "rev": "8a2f738d9d1f1d986b5a4cd2fd2061a7127237d7",
         "type": "github"
       },
       "original": {
@@ -563,6 +505,66 @@
         "type": "github"
       }
     },
+    "nixpkgs-lib_3": {
+      "locked": {
+        "lastModified": 1743296961,
+        "narHash": "sha256-b1EdN3cULCqtorQ4QeWgLMrd5ZGOjLSLemfa00heasc=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "e4822aea2a6d1cdd36653c134cacfd64c97ff4fa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib_4": {
+      "locked": {
+        "lastModified": 1743296961,
+        "narHash": "sha256-b1EdN3cULCqtorQ4QeWgLMrd5ZGOjLSLemfa00heasc=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "e4822aea2a6d1cdd36653c134cacfd64c97ff4fa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib_5": {
+      "locked": {
+        "lastModified": 1743296961,
+        "narHash": "sha256-b1EdN3cULCqtorQ4QeWgLMrd5ZGOjLSLemfa00heasc=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "e4822aea2a6d1cdd36653c134cacfd64c97ff4fa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib_6": {
+      "locked": {
+        "lastModified": 1743296961,
+        "narHash": "sha256-b1EdN3cULCqtorQ4QeWgLMrd5ZGOjLSLemfa00heasc=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "e4822aea2a6d1cdd36653c134cacfd64c97ff4fa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
     "nixpkgs-stable": {
       "locked": {
         "lastModified": 1730741070,
@@ -581,11 +583,11 @@
     },
     "nixpkgs-stable_2": {
       "locked": {
-        "lastModified": 1743975612,
+        "lastModified": 1747335874,
-        "narHash": "sha256-o4FjFOUmjSRMK7dn0TFdAT0RRWUWD+WsspPHa+qEQT8=",
+        "narHash": "sha256-IKKIXTSYJMmUtE+Kav5Rob8SgLPnfnq4Qu8LyT4gdqQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a880f49904d68b5e53338d1e8c7bf80f59903928",
+        "rev": "ba8b70ee098bc5654c459d6a95dfc498b91ff858",
         "type": "github"
       },
       "original": {
@@ -597,11 +599,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1733212471,
+        "lastModified": 1745526057,
-        "narHash": "sha256-M1+uCoV5igihRfcUKrr1riygbe73/dzNnzPsmaLCmpo=",
+        "narHash": "sha256-ITSpPDwvLBZBnPRS2bUcHY3gZSwis/uTe255QgMtTLA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "55d15ad12a74eb7d4646254e13638ad0c4128776",
+        "rev": "f771eb401a46846c1aebd20552521b233dd7e18b",
         "type": "github"
       },
       "original": {
@@ -613,53 +615,21 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1717432640,
+        "lastModified": 1744932701,
-        "narHash": "sha256-+f9c4/ZX5MWDOuB1rKoWj+lBNm0z0rs4CK47HBLxy1o=",
+        "narHash": "sha256-fusHbZCyv126cyArUwwKrLdCkgVAIaa/fQJYFlCEqiU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "88269ab3044128b7c2f4c7d68448b2fb50456870",
+        "rev": "b024ced1aac25639f8ca8fdfc2f8c4fbd66c48ef",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "release-24.05",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_4": {
-      "locked": {
-        "lastModified": 1733477122,
-        "narHash": "sha256-qamMCz5mNpQmgBwc8SB5tVMlD5sbwVIToVZtSxMph9s=",
-        "owner": "cachix",
-        "repo": "devenv-nixpkgs",
-        "rev": "7bd9e84d0452f6d2e63b6e6da29fe73fac951857",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "ref": "rolling",
-        "repo": "devenv-nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_5": {
-      "locked": {
-        "lastModified": 1731919951,
-        "narHash": "sha256-vOM6ETpl1yu9KLi/icTmLJIPbbdJCdAVYUXZceO/Ce4=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "04386ac325a813047fc314d4b4d838a5b1e3c7fe",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable-small",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_6": {
       "locked": {
         "lastModified": 1743964447,
         "narHash": "sha256-nEo1t3Q0F+0jQ36HJfbJtiRU4OI+/0jX/iITURKe3EE=",
@@ -675,6 +645,38 @@
         "type": "github"
       }
     },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1744463964,
+        "narHash": "sha256-LWqduOgLHCFxiTNYi3Uj5Lgz0SR+Xhw3kr/3Xd0GPTM=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "2631b0b7abcea6e640ce31cd78ea58910d31e650",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1744502386,
+        "narHash": "sha256-QAd1L37eU7ktL2WeLLLTmI6P9moz9+a/ONO8qNBYJgM=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "f6db44a8daa59c40ae41ba6e5823ec77fe0d2124",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs_7": {
       "locked": {
         "lastModified": 1743964447,
@@ -693,32 +695,32 @@
     },
     "nixpkgs_8": {
       "locked": {
-        "lastModified": 1743689281,
+        "lastModified": 1747327360,
-        "narHash": "sha256-y7Hg5lwWhEOgflEHRfzSH96BOt26LaYfrYWzZ+VoVdg=",
+        "narHash": "sha256-LSmTbiq/nqZR9B2t4MRnWG7cb0KVNU70dB7RT4+wYK4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2bfc080955153be0be56724be6fa5477b4eefabb",
+        "rev": "e06158e58f3adee28b139e9c2bcfcc41f8625b46",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "phps": {
       "inputs": {
-        "flake-compat": "flake-compat_4",
+        "flake-compat": "flake-compat_2",
-        "nixpkgs": "nixpkgs_8",
+        "nixpkgs": "nixpkgs_6",
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1744001863,
+        "lastModified": 1744527323,
-        "narHash": "sha256-0pYw0Idtion++srUKsmGX7mq1weozdVE8gR+inoedUo=",
+        "narHash": "sha256-2EyP6SxJsmBFMHArrTGw1J+Ned3aRMUZzbzmJZHDbNo=",
         "owner": "fossar",
         "repo": "nix-phps",
-        "rev": "220ed74315dc7cd64a6181efd3d583a3607ef01f",
+        "rev": "f6b53caf2b1c2d592cbac5156f729ef79495992a",
         "type": "github"
       },
       "original": {
@@ -733,7 +735,7 @@
           "lanzaboote",
           "flake-compat"
         ],
-        "gitignore": "gitignore_2",
+        "gitignore": "gitignore",
         "nixpkgs": [
           "lanzaboote",
           "nixpkgs"
@@ -754,23 +756,73 @@
         "type": "github"
       }
     },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": [
+          "forgesync",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "forgesync",
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "forgesync",
+          "uv2nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744599653,
+        "narHash": "sha256-nysSwVVjG4hKoOjhjvE6U5lIKA8sEr1d1QzEfZsannU=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "7dba6dbc73120e15b558754c26024f6c93015dd7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "forgesync",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1743438845,
+        "narHash": "sha256-1GSaoubGtvsLRwoYwHjeKYq40tLwvuFFVhGrG8J9Oek=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "8063ec98edc459571d042a640b1c5e334ecfca1e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "agenix": "agenix",
-        "devenv": "devenv",
+        "flake-parts": "flake-parts",
-        "devenv-root": "devenv-root",
+        "forgesync": "forgesync",
-        "flake-parts": "flake-parts_2",
-        "flatpak": "flatpak",
         "hardware": "hardware",
+        "hxwrap": "hxwrap",
         "lanzaboote": "lanzaboote",
         "musicomp": "musicomp",
+        "myphps": "myphps",
+        "nini": "nini",
         "nix-index-database": "nix-index-database",
         "nixos-cosmic": "nixos-cosmic",
         "nixpkgs": [
           "nixos-cosmic",
           "nixpkgs"
-        ],
+        ]
-        "phps": "phps"
       }
     },
     "rust-overlay": {
@@ -802,11 +854,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744079607,
+        "lastModified": 1747449297,
-        "narHash": "sha256-5cog6Qd6w/bINdLO5mOysAHOHey8PwFXk4IWo+y+Czg=",
+        "narHash": "sha256-veyXchTz6eWwvuW5X49UluHkheHkFcqHJSwGuKBhrmQ=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "f6b62cc99c25e79a1c17e9fca91dc6b6faebec6c",
+        "rev": "f44db7d7cea4528288780c6347756173a8248225",
         "type": "github"
       },
       "original": {
@@ -862,6 +914,31 @@
         "repo": "flake-utils",
         "type": "github"
       }
+    },
+    "uv2nix": {
+      "inputs": {
+        "nixpkgs": [
+          "forgesync",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "forgesync",
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1745697651,
+        "narHash": "sha256-r4A/fkiCenEapHkjJWPiNUZEfviuXMCr6mRozJ5dC4o=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "cb6508484d534dafd097713b575f2aebc3417de0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -4,76 +4,62 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     flake-parts.url = "github:hercules-ci/flake-parts";
-    devenv-root = {
-      url = "file+file:///dev/null";
-      flake = false;
-    };
-    devenv.url = "github:cachix/devenv";
     hardware.url = "github:NixOS/nixos-hardware";
     agenix.url = "github:ryantm/agenix";
-    phps.url = "github:fossar/nix-phps";
-    lanzaboote.url = "github:nix-community/lanzaboote/v0.4.2";
-    flatpak.url = "github:gmodena/nix-flatpak?ref=latest";
     nixpkgs.follows = "nixos-cosmic/nixpkgs";
     nixos-cosmic.url = "github:lilyinstarlight/nixos-cosmic";
     nix-index-database = {
       url = "github:nix-community/nix-index-database";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    musicomp.url = "git+https://codeberg.org/helveticanonstandard/musicomp.git";
+    musicomp.url = "git+https://codeberg.org/helvetica/musicomp.git";
+    hxwrap.url = "git+https://codeberg.org/helvetica/hxwrap.git";
+    myphps.url = "git+https://codeberg.org/helvetica/myphps.git";
+    forgesync.url = "git+https://codeberg.org/helvetica/forgesync.git";
+    nini.url = "git+https://codeberg.org/helvetica/nini.git";
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/v0.4.2";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
-  nixConfig = {
+  outputs =
-    extra-substituters = "https://cosmic.cachix.org";
+    {
-    extra-trusted-public-keys = "cosmic.cachix.org-1:Dya9IyXD4xdBehWjrkPv6rtxpmMdRel02smYzA85dPE=";
+      self,
-  };
+      nixpkgs,
-
+      flake-parts,
-  outputs = {
+      ...
-    self,
+    }@inputs:
-    nixpkgs,
+    flake-parts.lib.mkFlake { inherit inputs; } {
-    flake-parts,
+      systems = [
-    ...
+        "x86_64-linux"
-  } @ inputs:
+        "aarch64-linux"
-    flake-parts.lib.mkFlake {inherit inputs;} {
-      imports = [
-        inputs.devenv.flakeModule
       ];
 
-      systems = ["x86_64-linux" "aarch64-linux"];
-
       flake = {
         lib = nixpkgs.lib.extend (import ./lib.nix);
 
-        nixosConfigurations = self.lib.genNixosConfigurations {inherit inputs;};
+        nixosConfigurations = self.lib.genNixosConfigurations inputs;
       };
 
-      perSystem = {
+      perSystem =
-        pkgs,
+        {
-        inputs',
+          pkgs,
-        lib,
+          inputs',
-        ...
+          lib,
-      }: {
+          ...
-        devenv.shells.default = {
+        }:
-          devenv.root = let
+        {
-            devenvRootFileContent = builtins.readFile inputs.devenv-root.outPath;
+          devShells.default = pkgs.mkShellNoCC {
-          in
+            packages = [
-            lib.mkIf (devenvRootFileContent != "") devenvRootFileContent;
+              inputs'.agenix.packages.default
+            ];
+          };
 
-          name = "puter";
+          packages = lib.packagesFromDirectoryRecursive {
-
+            inherit (pkgs) callPackage newScope;
-          imports = [
+            directory = ./packages;
-            ./devenv.nix
+          };
-          ];
-
-          packages = [
-            inputs'.agenix.packages.agenix
-          ];
         };
-
-        packages = lib.packagesFromDirectoryRecursive {
-          inherit (pkgs) callPackage;
-          directory = ./packages;
-        };
-      };
     };
 }

hosts/abacus/authorized-keys.nix

@@ -1,4 +1,5 @@
-{config, ...}: {
+{ config, ... }:
+{
   users.users.root.openssh.authorizedKeys.keys = [
     config.pubkeys.hosts.vessel
   ];

hosts/abacus/filesystems.nix

@@ -1,14 +1,15 @@
-{config, ...}: {
+{ config, ... }:
+{
   fileSystems = {
     "/" = {
       fsType = "ext4";
       label = "main";
-      options = ["noatime"];
+      options = [ "noatime" ];
     };
     ${config.services.navidrome.settings.MusicFolder} = {
       label = "music";
       fsType = "ext4";
-      options = ["noatime"];
+      options = [ "noatime" ];
     };
   };
 }

hosts/abacus/forgejo.nix

@@ -0,0 +1,105 @@
+{
+  self,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.forgejo;
+  inherit (config.age) secrets;
+in
+{
+  age.secrets = {
+    forgejo-mailer = {
+      file = self + /secrets/forgejo/mailer.age;
+      mode = "400";
+      owner = cfg.user;
+    };
+
+    forgejo-admin = {
+      file = self + /secrets/forgejo/admin.age;
+      mode = "400";
+      owner = cfg.user;
+    };
+  };
+
+  services.forgejo = {
+    enable = true;
+    package = pkgs.forgejo;
+    database.type = "postgres";
+    lfs.enable = true;
+    dump = {
+      enable = true;
+      interval = "*-*-* 02:00:00";
+      backupDir = "/srv/backup/forgejo";
+    };
+    settings = {
+      server = {
+        DOMAIN = "forgejo.helveticanonstandard.net";
+        ROOT_URL = "https://${cfg.settings.server.DOMAIN}/";
+        HTTP_ADDR = "127.0.0.1";
+        HTTP_PORT = 8060;
+      };
+
+      service = {
+        DISABLE_REGISTRATION = true;
+        ENABLE_NOTIFY_MAIL = true;
+      };
+
+      # TODO: Enable
+      federation = {
+        ENABLED = false;
+        SHARE_USER_STATISTICS = false;
+      };
+
+      mailer = {
+        ENABLED = true;
+        SMTP_ADDR = "smtp.fastmail.com";
+        FROM = "tea@wrz.one";
+        USER = "lukas@wrz.one";
+      };
+    };
+
+    secrets.mailer.PASSWD = secrets.forgejo-mailer.path;
+  };
+
+  systemd.services.forgejo.preStart = lib.getExe (
+    pkgs.writeShellApplication {
+      name = "forgejo-init-admin";
+      text =
+        let
+          forgejoExe = lib.getExe cfg.package;
+          passwordFile = secrets.forgejo-admin.path;
+        in
+        ''
+          admins=$(${forgejoExe} admin user list --admin | wc --lines)
+          admins=$((admins - 1))
+
+          if ((admins < 1)); then
+            ${forgejoExe} admin user create \
+              --admin \
+              --email helvetica@helveticanonstandard.net \
+              --username helvetica \
+              --password "$(cat -- ${passwordFile})"
+          fi
+        '';
+    }
+  );
+
+  services.nginx.virtualHosts.${cfg.settings.server.DOMAIN} = {
+    enableACME = true;
+    forceSSL = true;
+
+    extraConfig = ''
+      client_max_body_size 512M;
+    '';
+
+    locations."/".proxyPass =
+      let
+        host = cfg.settings.server.HTTP_ADDR;
+        port = builtins.toString cfg.settings.server.HTTP_PORT;
+      in
+      "http://${host}:${port}";
+  };
+}

hosts/abacus/hardware.nix

@@ -1,11 +1,18 @@
-{modulesPath, ...}: {
+{ modulesPath, ... }:
+{
   imports = [
     "${modulesPath}/profiles/qemu-guest.nix"
   ];
 
   nixpkgs.hostPlatform = "aarch64-linux";
 
-  boot.initrd.availableKernelModules = ["xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod"];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "virtio_pci"
+    "virtio_scsi"
+    "usbhid"
+    "sr_mod"
+  ];
 
   powerManagement.cpuFreqGovernor = "performance";
 }

hosts/abacus/headscale.nix

@@ -1,6 +1,8 @@
-{config, ...}: let
+{ config, ... }:
+let
   virtualHostName = "headscale.helveticanonstandard.net";
-in {
+in
+{
   services.headscale = {
     enable = true;
     address = "127.0.0.1";
@@ -16,10 +18,12 @@ in {
     forceSSL = true;
     enableACME = true;
     locations."/" = {
-      proxyPass = let
+      proxyPass =
-        host = config.services.headscale.address;
+        let
-        port = builtins.toString config.services.headscale.port;
+          host = config.services.headscale.address;
-      in "http://${host}:${port}";
+          port = builtins.toString config.services.headscale.port;
+        in
+        "http://${host}:${port}";
       proxyWebsockets = true;
     };
   };

hosts/abacus/mealie.nix

@@ -1,11 +1,13 @@
-{config, ...}: let
+{ config, ... }:
+let
   virtualHostName = "mealie.helveticanonstandard.net";
-in {
+in
+{
   services.mealie = {
     enable = true;
     settings = {
       BASE_URL = "https://${virtualHostName}";
-      ALLOW_SIGNUP = false;
+      ALLOW_SIGNUP = "false";
     };
     listenAddress = "127.0.0.1";
     port = 8040;
@@ -15,9 +17,11 @@ in {
     enableACME = true;
     forceSSL = true;
 
-    locations."/".proxyPass = let
+    locations."/".proxyPass =
-      host = config.services.mealie.listenAddress;
+      let
-      port = builtins.toString config.services.mealie.port;
+        host = config.services.mealie.listenAddress;
-    in "http://${host}:${port}";
+        port = builtins.toString config.services.mealie.port;
+      in
+      "http://${host}:${port}";
   };
 }

hosts/abacus/navidrome.nix

@@ -0,0 +1,32 @@
+{ config, ... }:
+let
+  virtualHostName = "navidrome.helveticanonstandard.net";
+in
+{
+  services.navidrome = {
+    enable = true;
+    settings = {
+      Address = "localhost";
+      Port = 8050;
+      MusicFolder = "/srv/music";
+      EnableSharing = true;
+      # Backup = {
+      #   Path = "/srv/backup/navidrome";
+      #   Count = 1;
+      #   Schedule = "0 2 * * *";
+      # };
+    };
+  };
+
+  services.nginx.virtualHosts.${virtualHostName} = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/".proxyPass =
+      let
+        host = config.services.navidrome.settings.Address;
+        port = builtins.toString config.services.navidrome.settings.Port;
+      in
+      "http://${host}:${port}";
+  };
+}

hosts/abacus/networking.nix

@@ -0,0 +1,23 @@
+{
+  networking =
+    let
+      interface = "enp1s0";
+    in
+    {
+      domain = "wrz.one";
+      interfaces.${interface}.ipv6.addresses = [
+        {
+          address = "2a01:4f8:c013:e64a::2";
+          prefixLength = 64;
+        }
+      ];
+      defaultGateway6 = {
+        address = "fe80::1";
+        inherit interface;
+      };
+      firewall.allowedTCPPorts = [
+        80
+        443
+      ];
+    };
+}

hosts/abacus/nginx.nix

@@ -0,0 +1,33 @@
+{ config, ... }:
+{
+  services.nginx = {
+    enable = true;
+
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+
+    commonHttpConfig = ''
+      error_log stderr;
+      access_log /var/log/nginx/access.log;
+    '';
+
+    virtualHosts =
+      let
+        matchAll = ''~.*'';
+        matchWww = ''~^www\.(?<domain>.+)$'';
+      in
+      {
+        # Redirect anything that doesn't match any server name to networking.domain
+        ${matchAll} = {
+          default = true;
+          rejectSSL = true;
+
+          globalRedirect = config.networking.domain;
+        };
+        # Redirect www to non-www
+        ${matchWww}.globalRedirect = "$domain";
+      };
+  };
+}

hosts/abacus/profiles.nix

@@ -0,0 +1,3 @@
+{
+  profiles.server.enable = true;
+}

hosts/abacus/restic.nix

@@ -0,0 +1,42 @@
+{
+  attrName,
+  config,
+  lib,
+  ...
+}:
+let
+  secretName = "restic-${attrName}";
+  secret = config.age.secrets.${secretName};
+in
+{
+  age.secrets = lib.mkSecrets { ${secretName} = { }; };
+
+  services.restic.backups.remote = {
+    repository = "sftp:u459482@u459482.your-storagebox.de:/${attrName}";
+    initialize = true;
+    paths = [
+      config.services.vaultwarden.backupDir
+      config.services.syncthing.dataDir
+      config.services.forgejo.stateDir
+      config.services.forgejo.dump.backupDir
+      config.services.postgresqlBackup.location
+      # config.services.navidrome.settings.Backup.Path
+      # TODO: Add stateDir options for these
+      "/var/lib/headscale"
+      "/var/lib/navidrome"
+    ];
+    passwordFile = secret.path;
+    pruneOpts = [
+      "--keep-daily 7"
+      "--keep-weekly 5"
+      "--keep-monthly 12"
+    ];
+    timerConfig = {
+      OnCalendar = "*-*-* 03:00:00";
+      Persistent = true;
+    };
+    extraOptions = [
+      "sftp.args='-i /etc/ssh/ssh_host_ed25519_key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'"
+    ];
+  };
+}

hosts/abacus/static-sites.nix

@@ -0,0 +1,34 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  parent = "/var/www";
+  sites = [
+    "wrz.one"
+    "helveticanonstandard.net"
+  ];
+in
+lib.mkMerge (
+  map (
+    virtualHostName:
+    let
+      root = "${parent}/${virtualHostName}";
+    in
+    {
+      services.nginx.virtualHosts.${virtualHostName} = {
+        enableACME = true;
+        forceSSL = true;
+
+        inherit root;
+      };
+
+      systemd.tmpfiles.settings."10-static-sites".${root}.d = {
+        user = config.users.mainUser;
+        group = "users";
+        mode = "0755";
+      };
+    }
+  ) sites
+)

hosts/abacus/system.nix

@@ -0,0 +1,3 @@
+{
+  system.stateVersion = "25.05";
+}

hosts/abacus/vaultwarden.nix

@@ -2,27 +2,25 @@
   config,
   lib,
   ...
-}: let
+}:
-  virtualHostName = "vault.wrz.one";
+let
-  backupDir = "/srv/backup/vaultwarden";
+  virtualHostName = "vault.helveticanonstandard.net";
-in {
+in
-  age.secrets = lib.mkSecrets {vaultwarden = {};};
+{
+  # TODO: tailscale
+
+  age.secrets = lib.mkSecrets { vaultwarden = { }; };
 
   services.vaultwarden = {
     enable = true;
-
     dbBackend = "sqlite";
-
+    backupDir = "/srv/backup/vaultwarden";
-    inherit backupDir;
 
     config = {
       DOMAIN = "https://${virtualHostName}";
-
       SIGNUPS_ALLOWED = false;
       INVITATIONS_ALLOWED = false;
-
       ENABLE_WEBSOCKET = true;
-
       ROCKET_ADDRESS = "127.0.0.1";
       ROCKET_PORT = 8000;
     };
@@ -37,10 +35,12 @@ in {
     forceSSL = true;
 
     locations."/" = {
-      proxyPass = let
+      proxyPass =
-        host = config.services.vaultwarden.config.ROCKET_ADDRESS;
+        let
-        port = builtins.toString config.services.vaultwarden.config.ROCKET_PORT;
+          host = config.services.vaultwarden.config.ROCKET_ADDRESS;
-      in "http://${host}:${port}";
+          port = builtins.toString config.services.vaultwarden.config.ROCKET_PORT;
+        in
+        "http://${host}:${port}";
       proxyWebsockets = true;
     };
   };

hosts/flamingo/filesystems.nix

@@ -4,6 +4,6 @@
   fileSystems."/" = {
     fsType = "ext4";
     device = "/dev/mapper/main";
-    options = ["noatime"];
+    options = [ "noatime" ];
   };
 }

hosts/flamingo/hardware.nix

@@ -2,7 +2,8 @@
   inputs,
   modulesPath,
   ...
-}: {
+}:
+{
   imports = [
     "${modulesPath}/installer/scan/not-detected.nix"
 
@@ -12,8 +13,13 @@
   nixpkgs.hostPlatform = "x86_64-linux";
 
   boot = {
-    initrd.availableKernelModules = ["xhci_pci" "nvme" "usb_storage" "sd_mod"];
+    initrd.availableKernelModules = [
-    kernelModules = ["kvm-intel"];
+      "xhci_pci"
+      "nvme"
+      "usb_storage"
+      "sd_mod"
+    ];
+    kernelModules = [ "kvm-intel" ];
   };
 
   powerManagement.cpuFreqGovernor = "powersave";

hosts/flamingo/profiles.nix

@@ -0,0 +1,9 @@
+{
+  profiles = {
+    desktop.enable = true;
+    emulation.enable = true;
+    gaming.enable = true;
+    piracy.enable = true;
+    productivity.enable = true;
+  };
+}

hosts/glacier/filesystems.nix

@@ -4,6 +4,6 @@
   fileSystems."/" = {
     fsType = "ext4";
     device = "/dev/mapper/main";
-    options = ["noatime"];
+    options = [ "noatime" ];
   };
 }

hosts/glacier/hardware.nix

@@ -2,7 +2,8 @@
   inputs,
   modulesPath,
   ...
-}: {
+}:
+{
   imports = [
     "${modulesPath}/installer/scan/not-detected.nix"
 
@@ -15,11 +16,17 @@
 
   boot = {
     initrd = {
-      availableKernelModules = ["nvme" "ahci" "xhci_pci" "usbhid" "usb_storage" "sd_mod"];
+      availableKernelModules = [
-      kernelModules = ["amdgpu"];
+        "nvme"
+        "ahci"
+        "xhci_pci"
+        "usbhid"
+        "usb_storage"
+        "sd_mod"
+      ];
+      kernelModules = [ "amdgpu" ];
     };
-    kernelModules = ["kvm-amd"];
+    kernelModules = [ "kvm-amd" ];
-    binfmt.emulatedSystems = ["aarch64-linux"];
   };
 
   powerManagement.cpuFreqGovernor = "performance";

hosts/glacier/profiles.nix

@@ -0,0 +1,9 @@
+{
+  profiles = {
+    desktop.enable = true;
+    emulation.enable = true;
+    gaming.enable = true;
+    piracy.enable = true;
+    productivity.enable = true;
+  };
+}

hosts/headful/flamingo/libreoffice.nix

@@ -1,5 +0,0 @@
-{
-  services.flatpak.packages = [
-    "org.libreoffice.LibreOffice"
-  ];
-}

hosts/headful/flamingo/librewolf.nix

@@ -1,5 +0,0 @@
-{
-  services.flatpak.packages = [
-    "io.gitlab.librewolf-community"
-  ];
-}

hosts/headful/flamingo/mpv.nix

@@ -1,5 +0,0 @@
-{
-  services.flatpak.packages = [
-    "io.mpv.Mpv"
-  ];
-}

hosts/headful/flamingo/supersonic.nix

@@ -1,5 +0,0 @@
-{
-  services.flatpak.packages = [
-    "io.github.dweymouth.supersonic"
-  ];
-}

hosts/headful/glacier/gimp.nix

@@ -1,5 +0,0 @@
-{
-  services.flatpak.packages = [
-    "org.gimp.GIMP"
-  ];
-}

hosts/headful/glacier/inkscape.nix

@@ -1,5 +0,0 @@
-{
-  services.flatpak.packages = [
-    "org.inkscape.Inkscape"
-  ];
-}

hosts/headful/glacier/lanzaboote.nix

@@ -1,3 +0,0 @@
-{
-  setups.secureBoot.enable = true;
-}

hosts/headful/glacier/libreoffice.nix

@@ -1,5 +0,0 @@
-{
-  services.flatpak.packages = [
-    "org.libreoffice.LibreOffice"
-  ];
-}

hosts/headful/glacier/librewolf.nix

@@ -1,5 +0,0 @@
-{
-  services.flatpak.packages = [
-    "io.gitlab.librewolf-community"
-  ];
-}

hosts/headful/glacier/mpv.nix

@@ -1,5 +0,0 @@
-{
-  services.flatpak.packages = [
-    "io.mpv.Mpv"
-  ];
-}

hosts/headful/glacier/steam.nix

@@ -1,6 +0,0 @@
-{
-  services.flatpak.packages = [
-    "com.valvesoftware.Steam"
-    "com.github.Matoking.protontricks"
-  ];
-}

hosts/headful/glacier/supersonic.nix

@@ -1,5 +0,0 @@
-{
-  services.flatpak.packages = [
-    "io.github.dweymouth.supersonic"
-  ];
-}

hosts/headful/insomniac/cosmic.nix

@@ -1,17 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: {
-  services.greetd.settings.initial_session = {
-    user = config.users.mainUser;
-    command = ''
-      ${lib.getExe' pkgs.coreutils "env"} XCURSOR_THEME="''${XCURSOR_THEME:-Pop}" systemd-cat --identifier start-cosmic ${lib.getExe' pkgs.cosmic-session "start-cosmic"}
-    '';
-  };
-
-  environment.cosmic.excludePackages = [
-    pkgs.cosmic-store
-  ];
-}

hosts/headful/insomniac/dolphin.nix

@@ -1,5 +0,0 @@
-{
-  services.flatpak.packages = [
-    "org.DolphinEmu.dolphin-emu"
-  ];
-}

hosts/headful/insomniac/flatpak.nix

@@ -1,6 +0,0 @@
-{
-  services.flatpak.update.auto = {
-    enable = true;
-    onCalendar = "weekly";
-  };
-}

hosts/headful/insomniac/freetube.nix

@@ -1,5 +0,0 @@
-{
-  services.flatpak.packages = [
-    "io.freetubeapp.FreeTube"
-  ];
-}

hosts/headful/insomniac/rmg.nix

@@ -1,5 +0,0 @@
-{
-  services.flatpak.packages = [
-    "com.github.Rosalie241.RMG"
-  ];
-}

hosts/headful/insomniac/steam.nix

@@ -1,5 +0,0 @@
-{
-  services.flatpak.packages = [
-    "com.valvesoftware.Steam"
-  ];
-}

hosts/headful/insomniac/supersonic.nix

@@ -1,5 +0,0 @@
-{
-  services.flatpak.packages = [
-    "io.github.dweymouth.supersonic"
-  ];
-}

hosts/headful/work/kubectl.nix

@@ -1,6 +0,0 @@
-{pkgs, ...}: {
-  environment.systemPackages = [
-    pkgs.kubectl
-    pkgs.awscli
-  ];
-}

hosts/headful/work/php.nix

@@ -1,95 +0,0 @@
-{
-  lib,
-  inputs,
-  pkgs,
-  ...
-}: let
-  supportedPhps = [
-    "php72"
-    "php73"
-    "php74"
-    "php80"
-    "php81"
-    "php82"
-    "php83"
-    "php84"
-  ];
-
-  selectedPhp = lib.last supportedPhps;
-
-  extraConfig = ''
-    memory_limit = -1
-
-    xdebug.mode = develop,coverage,gcstats,profile,debug,trace
-    xdebug.discover_client_host = 1
-    xdebug.client_host = localhost
-  '';
-
-  # Wrap all PHP versions with the extensions I need and bundle composer
-  phps = lib.genAttrs supportedPhps (
-    phpName: let
-      phpBase = inputs.phps.packages.${pkgs.system}.${phpName};
-      phpWithEnv = phpBase.buildEnv {
-        extensions = {
-          enabled,
-          all,
-        }:
-          enabled
-          ++ [all.xdebug]
-          ++ (
-            if (lib.versionAtLeast phpBase.version "8")
-            then [all.amqp]
-            else []
-          );
-        inherit extraConfig;
-      };
-      phpWithTools = pkgs.symlinkJoin {
-        inherit (phpWithEnv) name version meta passthru;
-        paths = [
-          phpWithEnv
-          phpWithEnv.packages.composer
-        ];
-      };
-    in
-      phpWithTools
-  );
-
-  prefix = "/var/lib/phps";
-
-  # Tell Symfony's CLI where it can access the different PHP versions
-  symfony-cli = let
-    package = pkgs.symfony-cli;
-  in
-    pkgs.symlinkJoin {
-      inherit (package) pname version meta;
-
-      paths = [package];
-
-      buildInputs = [pkgs.makeWrapper];
-
-      postBuild = ''
-        wrapProgram $out/bin/${package.meta.mainProgram} \
-          --suffix PATH : ${pkgs.lib.makeBinPath (
-          builtins.attrValues phps
-        )}
-      '';
-    };
-in {
-  nix.settings = {
-    substituters = ["https://fossar.cachix.org/"];
-    trusted-public-keys = ["fossar.cachix.org-1:Zv6FuqIboeHPWQS7ysLCJ7UT7xExb4OE8c4LyGb5AsE="];
-  };
-
-  # Link PHP installations so that PhpStorm knows about them
-  systemd.tmpfiles.settings =
-    builtins.mapAttrs (name: drv: {
-      "${prefix}/${name}"."L+".argument = drv.outPath;
-    })
-    phps;
-
-  environment.systemPackages = [
-    pkgs.jetbrains.phpstorm
-    phps.${selectedPhp}
-    symfony-cli
-  ];
-}