.envrc

@@ -1 +1,9 @@
-use flake
+watch_file flake.nix
+watch_file flake.lock
+
+DEVENV_ROOT_FILE="$(mktemp)"
+printf %s "$PWD" > "$DEVENV_ROOT_FILE"
+if ! use flake . --override-input devenv-root "file+file://$DEVENV_ROOT_FILE"
+then
+  echo "devenv could not be built. The devenv environment was not loaded. Make the necessary changes to devenv.nix and hit enter to try again." >&2
+fi

README.md

@@ -2,51 +2,25 @@
 
 This is my cobbled together NixOS configuration. There are many like it, but this one is mine. Copy at your own risk.
 
-## Structure
-
-* common: Sane defaults that make sense to use for every host.
-* modules: Regular NixOS modules.
-* profiles: Higher-level NixOS modules that conform to different roles that a host may have.
-* packages: Packages that I couldn't fit anywhere else.
-* secrets: Agenix secrets.
-* hosts: Hosts exposed in `nixosConfigurations`.
-* pubkeys.nix: Nix expression with all my SSH public keys, used for OpenSSH, Agenix and Restic.
-* lib.nix: Nixpkgs' lib with some extra functionality.
-
-## Ports
-
-* 80X0: Public HTTP services that are proxied through nginx
-* 40X0: Syncthing instances (4000 being the system instance, subsequent ones are for individual users)
-
-## Installation
-
-```bash
-nix run git+https://codeberg.org/helvetica/puter.git#disk /path/to/disk
-# TODO: Configure additional disks
-mkdir -p /mnt/etc/ssh
-cat > /mnt/etc/ssh/ssh_host_ed25519_key
-chmod 600 /mnt/etc/ssh/ssh_host_ed25519_key
-ssh-keygen -f /mnt/etc/ssh/ssh_host_ed25519_key -y > /mnt/etc/ssh/ssh_host_ed25519_key.pub
-nixos-install --no-root-password --flake git+https://codeberg.org/helvetica/puter.git#hostname
-```
-
-## systemd-cryptenroll
-
-```bash
-systemd-cryptenroll /dev/sdX --tpm2-device=auto
-```
-
-## Create tar for sbctl
-
-```bash
-sudo sbctl create-keys
-sudo tar --create --directory /var/lib/sbctl . | agenix -e secure-boot/hostname.tar.age
-```
-
 ## TODO
 
-- [ ] Lanzaboote
-- [ ] Monitoring
-- [ ] Rom sync
+- [ ] lanzaboote
+- [ ] monitoring (prometheus)
+- [ ] logging (loki)
+- [ ] kiosk
+- [ ] tailscale and headscale
+- [ ] game rom sync insomniac
 - [ ] insomniac backups
 - [ ] nginx websites
+
+## port allocation
+
+* 80X0: public HTTP services that are proxied through nginx
+* 40X0: syncthing instances (4000 being the system instance, subsequent ones are for individual users)
+* 60X0: private HTTP services that are accessible via tailscale
+* 20XX: Administrative stuff, like prometheus etc.
+
+* 8000: vaultwarden
+* 8010: headscale
+
+* 4000: syncthing

classes/headful/clipboard.nix

@@ -0,0 +1,3 @@
+{pkgs, ...}: {
+  environment.systemPackages = [pkgs.wl-clipboard];
+}

classes/headful/codium.nix

@@ -0,0 +1,6 @@
+{pkgs, ...}: {
+  # TODO: wrap
+  environment.systemPackages = [
+    pkgs.vscodium
+  ];
+}

classes/headful/cosmic.nix

@@ -0,0 +1,17 @@
+{inputs, ...}: {
+  imports = [
+    inputs.nixos-cosmic.nixosModules.default
+  ];
+
+  nix.settings = {
+    substituters = ["https://cosmic.cachix.org"];
+    trusted-public-keys = ["cosmic.cachix.org-1:Dya9IyXD4xdBehWjrkPv6rtxpmMdRel02smYzA85dPE="];
+  };
+
+  services = {
+    desktopManager.cosmic.enable = true;
+    displayManager.cosmic-greeter.enable = true;
+  };
+
+  environment.sessionVariables.COSMIC_DATA_CONTROL_ENABLED = 1;
+}

classes/headful/devenv.nix

@@ -0,0 +1,3 @@
+{pkgs, ...}: {
+  environment.systemPackages = [pkgs.devenv];
+}

classes/headful/flatpak.nix

@@ -0,0 +1,7 @@
+{inputs, ...}: {
+  imports = [
+    inputs.flatpak.nixosModules.nix-flatpak
+  ];
+
+  services.flatpak.enable = true;
+}

classes/headful/fonts.nix

@@ -0,0 +1,27 @@
+{pkgs, ...}: {
+  fonts = {
+    enableDefaultPackages = true;
+    packages = [
+      pkgs.noto-fonts
+      pkgs.noto-fonts-extra
+      pkgs.noto-fonts-cjk-sans
+      pkgs.noto-fonts-cjk-serif
+      pkgs.noto-fonts-monochrome-emoji
+      pkgs.noto-fonts-color-emoji
+      pkgs.nerd-fonts.fira-code
+    ];
+
+    fontconfig = {
+      enable = true;
+
+      defaultFonts = {
+        monospace = ["FiraCode Nerd Font"];
+        sansSerif = ["Noto Sans"];
+        serif = ["Noto Serif"];
+        emoji = ["Noto Color Emoji" "Noto Emoji"];
+      };
+    };
+
+    fontDir.enable = true;
+  };
+}

classes/headful/gamemode.nix

@@ -0,0 +1,21 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  programs.gamemode = {
+    enable = true;
+    settings = {
+      general = {
+        renice = 10;
+      };
+      custom = {
+        start = "${lib.getExe pkgs.libnotify} 'GameMode started'";
+        end = "${lib.getExe pkgs.libnotify} 'GameMode stopped'";
+      };
+    };
+  };
+
+  users.groups.gamemode.members = config.users.normalUsers;
+}

classes/headful/hardware.nix

@@ -0,0 +1,10 @@
+{
+  hardware = {
+    bluetooth.enable = true;
+    steam-hardware.enable = true;
+    xone.enable = true;
+    xpadneo.enable = true;
+    opentabletdriver.enable = true;
+    graphics.enable = true;
+  };
+}

classes/headful/location.nix

@@ -0,0 +1,3 @@
+{
+  location.provider = "geoclue2";
+}

classes/headful/mullvad.nix

@@ -0,0 +1,6 @@
+{pkgs, ...}: {
+  services.mullvad-vpn = {
+    enable = true;
+    package = pkgs.mullvad-vpn;
+  };
+}

classes/headful/networking.nix

@@ -0,0 +1,10 @@
+{config, ...}: {
+  services.resolved.enable = true;
+
+  networking.networkmanager = {
+    enable = true;
+    dns = "systemd-resolved";
+  };
+
+  users.groups.networkmanager.members = config.users.normalUsers;
+}

classes/headful/pipewire.nix

@@ -0,0 +1,11 @@
+{
+  security.rtkit.enable = true;
+
+  services.pipewire = {
+    enable = true;
+    wireplumber.enable = true;
+    alsa.enable = true;
+    pulse.enable = true;
+    jack.enable = true;
+  };
+}

classes/headful/printing.nix

@@ -0,0 +1,6 @@
+{
+  services.printing = {
+    enable = true;
+    webInterface = true;
+  };
+}

classes/headful/wayland.nix

@@ -0,0 +1,6 @@
+{
+  environment.sessionVariables = {
+    NIXOS_OZONE_WL = "1";
+    SDL_VIDEODRIVER = "wayland";
+  };
+}

classes/headful/xdg.nix

@@ -0,0 +1,3 @@
+{
+  xdg.portal.xdgOpenUsePortal = true;
+}

classes/headless/networking.nix

@@ -0,0 +1,3 @@
+{
+  networking.useNetworkd = true;
+}

classes/headless/time.nix

@@ -0,0 +1,3 @@
+{
+  time.timeZone = "UTC";
+}

common/agenix.nix

@@ -1,5 +1,4 @@
-{ inputs, ... }:
-{
+{inputs, ...}: {
   imports = [
     inputs.agenix.nixosModules.default
   ];

common/bash.nix

@@ -0,0 +1,5 @@
+{
+  programs.bash.interactiveShellInit = ''
+    shopt -s autocd globstar nullglob extglob checkwinsize
+  '';
+}

common/boot.nix

@@ -1,24 +1,21 @@
-{config, inputs, ...}: {
-  imports = [
-    inputs.lanzaboote.nixosModules.lanzaboote
-  ];
-
-  fileSystems.${config.boot.loader.efi.efiSysMountPoint} = {
+{
+  fileSystems."/boot" = {
     label = "BOOT";
     fsType = "vfat";
   };
 
   boot = {
-    lanzaboote = {
+    loader = {
+      systemd-boot = {
         enable = true;
-      pkiBundle = "/var/lib/sbctl";
+        consoleMode = "max";
       };
 
-    initrd.systemd.enable = true;
-
-    loader.efi = {
+      efi = {
         canTouchEfiVariables = true;
         efiSysMountPoint = "/boot";
       };
     };
+    tmp.cleanOnBoot = true;
+  };
 }

common/bottom.nix

@@ -1,6 +1,3 @@
-{ pkgs, ... }:
-{
-  environment.systemPackages = [
-    pkgs.bottom
-  ];
+{pkgs, ...}: {
+  environment.systemPackages = [pkgs.bottom];
 }

common/comma.nix

@@ -1,8 +1,3 @@
-{ inputs, ... }:
 {
-  imports = [
-    inputs.nix-index-database.nixosModules.nix-index
-  ];
-
   programs.nix-index-database.comma.enable = true;
 }

common/command-not-found.nix

@@ -0,0 +1,4 @@
+{
+  # TODO
+  programs.command-not-found.enable = false;
+}

common/dbus.nix

@@ -0,0 +1,3 @@
+{
+  services.dbus.implementation = "broker";
+}

common/editor.nix

@@ -1,23 +0,0 @@
-{
-  inputs,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  package = inputs.hxwrap.packages.${pkgs.system}.default;
-in
-{
-  environment = {
-    systemPackages = [ package ];
-
-    sessionVariables =
-      let
-        exe = builtins.baseNameOf (lib.getExe package);
-      in
-      {
-        EDITOR = exe;
-        VISUAL = exe;
-      };
-  };
-}

common/fish.nix

@@ -0,0 +1,5 @@
+{pkgs, ...}: {
+  programs.fish.enable = true;
+
+  users.defaultUserShell = pkgs.fish;
+}

common/gc.nix

@@ -2,8 +2,6 @@
   nix.gc = {
     automatic = true;
     dates = "daily";
-    options = "--delete-older-than 30d";
+    options = "--delete-older-than 7d";
   };
-
-  boot.loader.systemd-boot.configurationLimit = 5;
 }

common/git.nix

@@ -1,10 +1,6 @@
-{pkgs, ...}: {
+{
   programs.git = {
     enable = true;
     lfs.enable = true;
   };
-
-  environment.systemPackages = [
-    pkgs.gitui
-  ];
 }

common/gitui.nix

@@ -1,6 +1,5 @@
-{ pkgs, ... }:
-{
+{pkgs, ...}: {
   environment.systemPackages = [
-    pkgs.shpool
+    pkgs.gitui
   ];
 }

common/helix.nix

@@ -0,0 +1,16 @@
+{
+  lib,
+  pkgs,
+  ...
+}: let
+  package = pkgs.helix;
+in {
+  environment.systemPackages = [package];
+
+  environment.sessionVariables = let
+    exe = builtins.baseNameOf (lib.getExe package);
+  in {
+    EDITOR = exe;
+    VISUAL = exe;
+  };
+}

common/networking.nix

@@ -1,9 +1,5 @@
-{ attrName, pkgs, ... }:
-{
-  networking = {
-    hostName = attrName;
-    nftables.enable = true;
-  };
+{pkgs, ...}: {
+  networking.nftables.enable = true;
 
   environment.systemPackages = [
     pkgs.nixos-firewall-tool

common/nini.nix

@@ -1,10 +0,0 @@
-{inputs, ...}: {
-  imports = [
-    inputs.nini.nixosModules.default
-  ];
-
-  programs.nini = {
-    enable = true;
-    flakeref = "git+https://forgejo.helveticanonstandard.net/helvetica/puter.git";
-  };
-}

common/nix-index-database.nix

@@ -0,0 +1,5 @@
+{inputs, ...}: {
+  imports = [
+    inputs.nix-index-database.nixosModules.nix-index
+  ];
+}

common/nix.nix

@@ -3,8 +3,7 @@
   inputs,
   lib,
   ...
-}:
-{
+}: {
   nix = {
     registry = lib.mapAttrs (_: value: {flake = value;}) inputs;
 
@@ -25,4 +24,5 @@
   };
 
   nixpkgs.config.allowUnfree = true;
+  hardware.enableAllFirmware = true;
 }

common/pubkeys.nix

@@ -2,10 +2,8 @@
   lib,
   self,
   ...
-}:
-{
-  options.pubkeys =
-    let
+}: {
+  options.pubkeys = let
     inherit (lib) types;
   in
     lib.mkOption {
@@ -13,7 +11,6 @@
       description = ''
         Public keys.
       '';
-      readOnly = true;
     };
 
   config.pubkeys = lib.mkForce (import (self + /pubkeys.nix));

common/puter.nix

@@ -0,0 +1,12 @@
+{
+  pkgs,
+  self,
+  ...
+}: {
+  environment = {
+    systemPackages = [
+      self.packages.${pkgs.system}.puter
+    ];
+    sessionVariables.PUTER_FLAKEREF = "git+https://forgejo@tea.wrz.one/lukas/puter.git";
+  };
+}

common/ripgrep.nix

@@ -1,5 +1,4 @@
-{ pkgs, ... }:
-{
+{pkgs, ...}: {
   environment.systemPackages = [
     pkgs.ripgrep
   ];

common/secure-boot.nix

@@ -1,12 +0,0 @@
-{self, attrName, config, lib, pkgs, ...}: let
-  inherit (config.age) secrets;
-in{
-  age.secrets.secure-boot.file = self + /secrets/secure-boot/${attrName}.tar.age;
-
-  system.activationScripts.secureboot = let
-    target = config.boot.lanzaboote.pkiBundle;
-  in ''
-    mkdir --parents ${target}
-    ${lib.getExe pkgs.gnutar} --extract --file ${secrets.secure-boot.path} --directory ${target}
-  '';
-}

common/shell.nix

@@ -1,18 +0,0 @@
-{ config, ... }:
-{
-  programs = {
-    fish.enable = true;
-
-    bash.interactiveShellInit = ''
-      shopt -s autocd globstar nullglob extglob checkwinsize
-    '';
-
-    starship = {
-      enable = true;
-      interactiveOnly = true;
-      settings.format = "$all";
-    };
-  };
-
-  users.defaultUserShell = config.programs.fish.package;
-}

common/starship.nix

@@ -0,0 +1,7 @@
+{
+  programs.starship = {
+    enable = true;
+    interactiveOnly = true;
+    settings.format = "$all";
+  };
+}

common/sudo.nix

@@ -3,8 +3,6 @@
     enable = true;
     execWheelOnly = true;
     wheelNeedsPassword = true;
-    extraConfig = ''
-      Defaults lecture="never"
-    '';
+    extraConfig = "Defaults lecture=\"never\"";
   };
 }

common/swap.nix

@@ -1,6 +1,3 @@
 {
-  zramSwap = {
-    enable = true;
-    memoryPercent = 50;
-  };
+  zramSwap.enable = true;
 }

common/syncthing.nix

@@ -1,8 +1,6 @@
-{ config, ... }:
-let
+{config, ...}: let
   inherit (config.networking) hostName;
-in
-{
+in {
   services.syncthing = {
     enable = true;
     systemService = true;

common/tailscale.nix

@@ -1,12 +1,14 @@
-{ config, ... }:
-{
+{config, ...}: {
   services.tailscale = {
     enable = true;
     openFirewall = true;
-    useRoutingFeatures = "both"; # TODO
   };
 
-  networking.firewall.trustedInterfaces = [
+  networking.firewall = {
+    trustedInterfaces = [
       config.services.tailscale.interfaceName
     ];
+    # Required to connect to Tailscale exit nodes
+    checkReversePath = "loose";
+  };
 }

common/tmp.nix

@@ -1,6 +0,0 @@
-{
-  boot.tmp = {
-    useTmpfs = true;
-    tmpfsSize = "50%";
-  };
-}

common/users.nix

@@ -1,13 +1,11 @@
 {
-  self,
   config,
+  lib,
   ...
-}:
-let
+}: let
   inherit (config.users) mainUser;
-in
-{
-  age.secrets."user-${mainUser}".file = self + /secrets/users/${mainUser}.age;
+in {
+  age.secrets = lib.mkSecrets {"user-${mainUser}" = {};};
 
   users = {
     mutableUsers = false;

common/wheel.nix

@@ -1,4 +1,3 @@
-{ config, ... }:
-{
+{config, ...}: {
   users.groups.wheel.members = config.users.normalUsers;
 }

common/yazi.nix

@@ -0,0 +1,3 @@
+{
+  programs.yazi.enable = true;
+}

common/zellij.nix

@@ -1,6 +1,5 @@
-{ pkgs, ... }:
-{
+{pkgs, ...}: {
   environment.systemPackages = [
-    pkgs.freetube
+    pkgs.zellij
   ];
 }

devenv.nix

@@ -0,0 +1,21 @@
+{
+  languages.python.enable = true;
+
+  pre-commit.hooks = {
+    # Nix
+    alejandra.enable = true;
+    deadnix.enable = true;
+    statix.enable = true;
+
+    # Flakes
+    flake-checker.enable = true;
+
+    # Shell
+    shellcheck.enable = true;
+
+    # Python
+    pyright.enable = true;
+    ruff.enable = true;
+    ruff-format.enable = true;
+  };
+}

flake.lock

@@ -8,11 +8,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1745630506,
-        "narHash": "sha256-bHCFgGeu8XjWlVuaWzi3QONjDW3coZDqSHvnd4l7xus=",
+        "lastModified": 1736955230,
+        "narHash": "sha256-uenf8fv2eG5bKM8C/UvFaiJMZ4IpUFaQxk9OH5t/1gA=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "96e078c646b711aee04b82ba01aefbff87004ded",
+        "rev": "e600439ec4c273cf11e06fe4d9d906fb98fa097c",
         "type": "github"
       },
       "original": {
@@ -21,6 +21,34 @@
         "type": "github"
       }
     },
+    "cachix": {
+      "inputs": {
+        "devenv": [
+          "devenv"
+        ],
+        "flake-compat": [
+          "devenv"
+        ],
+        "git-hooks": [
+          "devenv"
+        ],
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1742042642,
+        "narHash": "sha256-D0gP8srrX0qj+wNYNPdtVJsQuFzIng3q43thnHXQ/es=",
+        "owner": "cachix",
+        "repo": "cachix",
+        "rev": "a624d3eaf4b1d225f918de8543ed739f2f574203",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "ref": "latest",
+        "repo": "cachix",
+        "type": "github"
+      }
+    },
     "crane": {
       "locked": {
         "lastModified": 1731098351,
@@ -44,11 +72,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1744478979,
-        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
+        "lastModified": 1700795494,
+        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
+        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
         "type": "github"
       },
       "original": {
@@ -58,23 +86,41 @@
         "type": "github"
       }
     },
-    "flake-compat": {
-      "flake": false,
+    "devenv": {
+      "inputs": {
+        "cachix": "cachix",
+        "flake-compat": "flake-compat",
+        "git-hooks": "git-hooks",
+        "nix": "nix",
+        "nixpkgs": "nixpkgs_4"
+      },
       "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "lastModified": 1743783972,
+        "narHash": "sha256-5wPsNCnWmeLpLxavsftA9L7tnYgtlexV7FwLegxtpy4=",
+        "owner": "cachix",
+        "repo": "devenv",
+        "rev": "2f53e2f867e0c2ba18b880e66169366e5f8ca554",
         "type": "github"
       },
       "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
+        "owner": "cachix",
+        "repo": "devenv",
         "type": "github"
       }
     },
-    "flake-compat_2": {
+    "devenv-root": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-d6xi4mKdjkX2JFicDIv5niSzpyI0m/Hnm8GGAIU04kY=",
+        "type": "file",
+        "url": "file:///dev/null"
+      },
+      "original": {
+        "type": "file",
+        "url": "file:///dev/null"
+      }
+    },
+    "flake-compat": {
       "flake": false,
       "locked": {
         "lastModified": 1733328505,
@@ -90,14 +136,30 @@
         "type": "github"
       }
     },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-compat_3": {
       "flake": false,
       "locked": {
-        "lastModified": 1746162366,
-        "narHash": "sha256-5SSSZ/oQkwfcAz/o/6TlejlVGqeK08wyREBQ5qFFPhM=",
+        "lastModified": 1717312683,
+        "narHash": "sha256-FrlieJH50AuvagamEvWMIE6D2OAnERuDboFDYAED/dE=",
         "owner": "nix-community",
         "repo": "flake-compat",
-        "rev": "0f158086a2ecdbb138cd0429410e44994f1b7e4b",
+        "rev": "38fd3954cf65ce6faf3d0d45cd26059e059f07ea",
         "type": "github"
       },
       "original": {
@@ -106,7 +168,45 @@
         "type": "github"
       }
     },
+    "flake-compat_4": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "devenv",
+          "nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1712014858,
+        "narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "9126214d0a59633752a136528f5f3b9aa8565b7d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
       "inputs": {
         "nixpkgs-lib": "nixpkgs-lib"
       },
@@ -124,43 +224,7 @@
         "type": "github"
       }
     },
-    "flake-parts_2": {
-      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib_2"
-      },
-      "locked": {
-        "lastModified": 1743550720,
-        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
     "flake-parts_3": {
-      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib_3"
-      },
-      "locked": {
-        "lastModified": 1743550720,
-        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "lanzaboote",
@@ -181,9 +245,9 @@
         "type": "github"
       }
     },
-    "flake-parts_5": {
+    "flake-parts_4": {
       "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib_4"
+        "nixpkgs-lib": "nixpkgs-lib_2"
       },
       "locked": {
         "lastModified": 1743550720,
@@ -199,65 +263,70 @@
         "type": "github"
       }
     },
-    "flake-parts_6": {
-      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib_5"
-      },
+    "flatpak": {
       "locked": {
-        "lastModified": 1743550720,
-        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
+        "lastModified": 1739444422,
+        "narHash": "sha256-iAVVHi7X3kWORftY+LVbRiStRnQEob2TULWyjMS6dWg=",
+        "owner": "gmodena",
+        "repo": "nix-flatpak",
+        "rev": "5e54c3ca05a7c7d968ae1ddeabe01d2a9bc1e177",
         "type": "github"
       },
       "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
+        "owner": "gmodena",
+        "ref": "latest",
+        "repo": "nix-flatpak",
         "type": "github"
       }
     },
-    "flake-parts_7": {
+    "git-hooks": {
       "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib_6"
+        "flake-compat": [
+          "devenv"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "devenv",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1743550720,
-        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
+        "lastModified": 1742649964,
+        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
         "type": "github"
       },
       "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
         "type": "github"
       }
     },
-    "forgesync": {
-      "inputs": {
-        "flake-parts": "flake-parts_2",
-        "nixpkgs": "nixpkgs_2",
-        "pyproject-build-systems": "pyproject-build-systems",
-        "pyproject-nix": "pyproject-nix",
-        "uv2nix": "uv2nix"
-      },
-      "locked": {
-        "lastModified": 1746299148,
-        "narHash": "sha256-OL9j+S8m4zC2dCqjaWLt6Ooc7EzRjJC/olLVj7mqd/M=",
-        "ref": "refs/heads/main",
-        "rev": "e2e0f134da1444b298d4a4601390664124d0a5c4",
-        "revCount": 10,
-        "type": "git",
-        "url": "https://codeberg.org/helvetica/forgesync.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://codeberg.org/helvetica/forgesync.git"
-      }
-    },
     "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "devenv",
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "gitignore_2": {
       "inputs": {
         "nixpkgs": [
           "lanzaboote",
@@ -281,11 +350,11 @@
     },
     "hardware": {
       "locked": {
-        "lastModified": 1747129300,
-        "narHash": "sha256-L3clA5YGeYCF47ghsI7Tcex+DnaaN/BbQ4dR2wzoiKg=",
+        "lastModified": 1743420942,
+        "narHash": "sha256-b/exDDQSLmENZZgbAEI3qi9yHkuXAXCPbormD8CSJXo=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "e81fd167b33121269149c57806599045fd33eeed",
+        "rev": "de6fc5551121c59c01e2a3d45b277a6d05077bc4",
         "type": "github"
       },
       "original": {
@@ -302,11 +371,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745494811,
-        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
+        "lastModified": 1703113217,
+        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
+        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
         "type": "github"
       },
       "original": {
@@ -315,33 +384,12 @@
         "type": "github"
       }
     },
-    "hxwrap": {
-      "inputs": {
-        "flake-parts": "flake-parts_3",
-        "nixpkgs": "nixpkgs_3"
-      },
-      "locked": {
-        "lastModified": 1745088587,
-        "narHash": "sha256-85AYHWayJVq/dxgk/S4RH7u6w59Akyr1fVttR8KBh8g=",
-        "ref": "refs/heads/main",
-        "rev": "8fa5d5d550add7bf6cfd0a619dfac0e8a03b2bae",
-        "revCount": 21,
-        "type": "git",
-        "url": "https://codeberg.org/helvetica/hxwrap.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://codeberg.org/helvetica/hxwrap.git"
-      }
-    },
     "lanzaboote": {
       "inputs": {
         "crane": "crane",
-        "flake-compat": "flake-compat",
-        "flake-parts": "flake-parts_4",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
+        "flake-compat": "flake-compat_2",
+        "flake-parts": "flake-parts_3",
+        "nixpkgs": "nixpkgs_5",
         "pre-commit-hooks-nix": "pre-commit-hooks-nix",
         "rust-overlay": "rust-overlay"
       },
@@ -360,62 +408,72 @@
         "type": "github"
       }
     },
+    "libgit2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1697646580,
+        "narHash": "sha256-oX4Z3S9WtJlwvj0uH9HlYcWv+x1hqp8mhXl7HsLu2f0=",
+        "owner": "libgit2",
+        "repo": "libgit2",
+        "rev": "45fd9ed7ae1a9b74b957ef4f337bc3c8b3df01b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "libgit2",
+        "repo": "libgit2",
+        "type": "github"
+      }
+    },
     "musicomp": {
       "inputs": {
-        "flake-parts": "flake-parts_5",
-        "nixpkgs": "nixpkgs_4"
+        "flake-parts": "flake-parts_4",
+        "nixpkgs": "nixpkgs_6"
       },
       "locked": {
-        "lastModified": 1744916606,
-        "narHash": "sha256-6l7xP5DTAc7E+gO2xu9aX5BjyuDNLMdeS6oFFrpsulg=",
+        "lastModified": 1744068246,
+        "narHash": "sha256-ZrLuwXT0uRxa4hyMyCe/IG9lKZEqAM+lUgLKcCiZjbA=",
         "ref": "refs/heads/main",
-        "rev": "0c6b26ce38dbc39d360904ddd98eab1159b922e1",
-        "revCount": 3,
-        "type": "git",
-        "url": "https://codeberg.org/helvetica/musicomp.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://codeberg.org/helvetica/musicomp.git"
-      }
-    },
-    "myphps": {
-      "inputs": {
-        "flake-parts": "flake-parts_6",
-        "nixpkgs": "nixpkgs_5",
-        "phps": "phps"
-      },
-      "locked": {
-        "lastModified": 1746369841,
-        "narHash": "sha256-/k3MQPXdsXJ0FDEsT1YvBG9ugRXk1nuE9MCb1wAMGQc=",
-        "ref": "refs/heads/main",
-        "rev": "dbe35541ef6923f411685434cc535d0854b55b6a",
-        "revCount": 5,
-        "type": "git",
-        "url": "https://codeberg.org/helvetica/myphps.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://codeberg.org/helvetica/myphps.git"
-      }
-    },
-    "nini": {
-      "inputs": {
-        "flake-parts": "flake-parts_7",
-        "nixpkgs": "nixpkgs_7"
-      },
-      "locked": {
-        "lastModified": 1747493683,
-        "narHash": "sha256-SEszNrbvTzxjFM7apKnL8LaarvDAzcuuQXj8r+ikJdk=",
-        "ref": "refs/heads/main",
-        "rev": "a61825fc51a2b52cebd01ce58910707383e08b02",
+        "rev": "66aa356585132605e8bd9cc630fab7416f3caf3d",
         "revCount": 2,
         "type": "git",
-        "url": "https://codeberg.org/helvetica/nini.git"
+        "url": "https://codeberg.org/helveticanonstandard/musicomp.git"
       },
       "original": {
         "type": "git",
-        "url": "https://codeberg.org/helvetica/nini.git"
+        "url": "https://codeberg.org/helveticanonstandard/musicomp.git"
+      }
+    },
+    "nix": {
+      "inputs": {
+        "flake-compat": [
+          "devenv"
+        ],
+        "flake-parts": "flake-parts",
+        "libgit2": "libgit2",
+        "nixpkgs": "nixpkgs_3",
+        "nixpkgs-23-11": [
+          "devenv"
+        ],
+        "nixpkgs-regression": [
+          "devenv"
+        ],
+        "pre-commit-hooks": [
+          "devenv"
+        ]
+      },
+      "locked": {
+        "lastModified": 1741798497,
+        "narHash": "sha256-E3j+3MoY8Y96mG1dUIiLFm2tZmNbRvSiyN7CrSKuAVg=",
+        "owner": "domenkozar",
+        "repo": "nix",
+        "rev": "f3f44b2baaf6c4c6e179de8cbb1cc6db031083cd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "domenkozar",
+        "ref": "devenv-2.24",
+        "repo": "nix",
+        "type": "github"
       }
     },
     "nix-index-database": {
@@ -425,11 +483,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747470409,
-        "narHash": "sha256-R9TP2//BDKyjNzuZybplIZm7HQEnwL8khs7EmmTPYP4=",
+        "lastModified": 1743911143,
+        "narHash": "sha256-4j4JPwr0TXHH4ZyorXN5yIcmqIQr0WYacsuPA4ktONo=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "c1f63a0c3bf1b2fe05124ccb099333163e2184a7",
+        "rev": "a36f6a7148aec2c77d78e4466215cceb2f5f4bfb",
         "type": "github"
       },
       "original": {
@@ -441,16 +499,16 @@
     "nixos-cosmic": {
       "inputs": {
         "flake-compat": "flake-compat_3",
-        "nixpkgs": "nixpkgs_8",
+        "nixpkgs": "nixpkgs_7",
         "nixpkgs-stable": "nixpkgs-stable_2",
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1747491978,
-        "narHash": "sha256-Jn7um1fnf2bI9N8gvG5jIHvIJxxLaXd+2+wHXyW0Frs=",
+        "lastModified": 1744137608,
+        "narHash": "sha256-KEuKL7lM2ZqKzvaGIptVDAce29CAR4ZSgWtFD3PnpB0=",
         "owner": "lilyinstarlight",
         "repo": "nixos-cosmic",
-        "rev": "2a7be063557ffc19ab1d8ab18bfd1721df8355c5",
+        "rev": "d20b15f629985fe6900925bef462f947e4a75b2f",
         "type": "github"
       },
       "original": {
@@ -461,11 +519,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1745391562,
-        "narHash": "sha256-sPwcCYuiEopaafePqlG826tBhctuJsLx/mhKKM5Fmjo=",
+        "lastModified": 1703013332,
+        "narHash": "sha256-+tFNwMvlXLbJZXiMHqYq77z/RfmpfpiI3yjL6o/Zo9M=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8a2f738d9d1f1d986b5a4cd2fd2061a7127237d7",
+        "rev": "54aac082a4d9bb5bbc5c4e899603abfb76a3f6d6",
         "type": "github"
       },
       "original": {
@@ -505,66 +563,6 @@
         "type": "github"
       }
     },
-    "nixpkgs-lib_3": {
-      "locked": {
-        "lastModified": 1743296961,
-        "narHash": "sha256-b1EdN3cULCqtorQ4QeWgLMrd5ZGOjLSLemfa00heasc=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "e4822aea2a6d1cdd36653c134cacfd64c97ff4fa",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
-    "nixpkgs-lib_4": {
-      "locked": {
-        "lastModified": 1743296961,
-        "narHash": "sha256-b1EdN3cULCqtorQ4QeWgLMrd5ZGOjLSLemfa00heasc=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "e4822aea2a6d1cdd36653c134cacfd64c97ff4fa",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
-    "nixpkgs-lib_5": {
-      "locked": {
-        "lastModified": 1743296961,
-        "narHash": "sha256-b1EdN3cULCqtorQ4QeWgLMrd5ZGOjLSLemfa00heasc=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "e4822aea2a6d1cdd36653c134cacfd64c97ff4fa",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
-    "nixpkgs-lib_6": {
-      "locked": {
-        "lastModified": 1743296961,
-        "narHash": "sha256-b1EdN3cULCqtorQ4QeWgLMrd5ZGOjLSLemfa00heasc=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "e4822aea2a6d1cdd36653c134cacfd64c97ff4fa",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
     "nixpkgs-stable": {
       "locked": {
         "lastModified": 1730741070,
@@ -583,11 +581,11 @@
     },
     "nixpkgs-stable_2": {
       "locked": {
-        "lastModified": 1747335874,
-        "narHash": "sha256-IKKIXTSYJMmUtE+Kav5Rob8SgLPnfnq4Qu8LyT4gdqQ=",
+        "lastModified": 1743975612,
+        "narHash": "sha256-o4FjFOUmjSRMK7dn0TFdAT0RRWUWD+WsspPHa+qEQT8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ba8b70ee098bc5654c459d6a95dfc498b91ff858",
+        "rev": "a880f49904d68b5e53338d1e8c7bf80f59903928",
         "type": "github"
       },
       "original": {
@@ -599,11 +597,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1745526057,
-        "narHash": "sha256-ITSpPDwvLBZBnPRS2bUcHY3gZSwis/uTe255QgMtTLA=",
+        "lastModified": 1733212471,
+        "narHash": "sha256-M1+uCoV5igihRfcUKrr1riygbe73/dzNnzPsmaLCmpo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f771eb401a46846c1aebd20552521b233dd7e18b",
+        "rev": "55d15ad12a74eb7d4646254e13638ad0c4128776",
         "type": "github"
       },
       "original": {
@@ -615,21 +613,53 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1744932701,
-        "narHash": "sha256-fusHbZCyv126cyArUwwKrLdCkgVAIaa/fQJYFlCEqiU=",
+        "lastModified": 1717432640,
+        "narHash": "sha256-+f9c4/ZX5MWDOuB1rKoWj+lBNm0z0rs4CK47HBLxy1o=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b024ced1aac25639f8ca8fdfc2f8c4fbd66c48ef",
+        "rev": "88269ab3044128b7c2f4c7d68448b2fb50456870",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "release-24.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1733477122,
+        "narHash": "sha256-qamMCz5mNpQmgBwc8SB5tVMlD5sbwVIToVZtSxMph9s=",
+        "owner": "cachix",
+        "repo": "devenv-nixpkgs",
+        "rev": "7bd9e84d0452f6d2e63b6e6da29fe73fac951857",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "ref": "rolling",
+        "repo": "devenv-nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1731919951,
+        "narHash": "sha256-vOM6ETpl1yu9KLi/icTmLJIPbbdJCdAVYUXZceO/Ce4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "04386ac325a813047fc314d4b4d838a5b1e3c7fe",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable-small",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_6": {
       "locked": {
         "lastModified": 1743964447,
         "narHash": "sha256-nEo1t3Q0F+0jQ36HJfbJtiRU4OI+/0jX/iITURKe3EE=",
@@ -645,38 +675,6 @@
         "type": "github"
       }
     },
-    "nixpkgs_5": {
-      "locked": {
-        "lastModified": 1744463964,
-        "narHash": "sha256-LWqduOgLHCFxiTNYi3Uj5Lgz0SR+Xhw3kr/3Xd0GPTM=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "2631b0b7abcea6e640ce31cd78ea58910d31e650",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_6": {
-      "locked": {
-        "lastModified": 1744502386,
-        "narHash": "sha256-QAd1L37eU7ktL2WeLLLTmI6P9moz9+a/ONO8qNBYJgM=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "f6db44a8daa59c40ae41ba6e5823ec77fe0d2124",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nixpkgs_7": {
       "locked": {
         "lastModified": 1743964447,
@@ -695,32 +693,32 @@
     },
     "nixpkgs_8": {
       "locked": {
-        "lastModified": 1747327360,
-        "narHash": "sha256-LSmTbiq/nqZR9B2t4MRnWG7cb0KVNU70dB7RT4+wYK4=",
+        "lastModified": 1743689281,
+        "narHash": "sha256-y7Hg5lwWhEOgflEHRfzSH96BOt26LaYfrYWzZ+VoVdg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e06158e58f3adee28b139e9c2bcfcc41f8625b46",
+        "rev": "2bfc080955153be0be56724be6fa5477b4eefabb",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixpkgs-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "phps": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
-        "nixpkgs": "nixpkgs_6",
+        "flake-compat": "flake-compat_4",
+        "nixpkgs": "nixpkgs_8",
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1744527323,
-        "narHash": "sha256-2EyP6SxJsmBFMHArrTGw1J+Ned3aRMUZzbzmJZHDbNo=",
+        "lastModified": 1744001863,
+        "narHash": "sha256-0pYw0Idtion++srUKsmGX7mq1weozdVE8gR+inoedUo=",
         "owner": "fossar",
         "repo": "nix-phps",
-        "rev": "f6b53caf2b1c2d592cbac5156f729ef79495992a",
+        "rev": "220ed74315dc7cd64a6181efd3d583a3607ef01f",
         "type": "github"
       },
       "original": {
@@ -735,7 +733,7 @@
           "lanzaboote",
           "flake-compat"
         ],
-        "gitignore": "gitignore",
+        "gitignore": "gitignore_2",
         "nixpkgs": [
           "lanzaboote",
           "nixpkgs"
@@ -756,73 +754,23 @@
         "type": "github"
       }
     },
-    "pyproject-build-systems": {
-      "inputs": {
-        "nixpkgs": [
-          "forgesync",
-          "nixpkgs"
-        ],
-        "pyproject-nix": [
-          "forgesync",
-          "pyproject-nix"
-        ],
-        "uv2nix": [
-          "forgesync",
-          "uv2nix"
-        ]
-      },
-      "locked": {
-        "lastModified": 1744599653,
-        "narHash": "sha256-nysSwVVjG4hKoOjhjvE6U5lIKA8sEr1d1QzEfZsannU=",
-        "owner": "pyproject-nix",
-        "repo": "build-system-pkgs",
-        "rev": "7dba6dbc73120e15b558754c26024f6c93015dd7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "build-system-pkgs",
-        "type": "github"
-      }
-    },
-    "pyproject-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "forgesync",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1743438845,
-        "narHash": "sha256-1GSaoubGtvsLRwoYwHjeKYq40tLwvuFFVhGrG8J9Oek=",
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "rev": "8063ec98edc459571d042a640b1c5e334ecfca1e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "agenix": "agenix",
-        "flake-parts": "flake-parts",
-        "forgesync": "forgesync",
+        "devenv": "devenv",
+        "devenv-root": "devenv-root",
+        "flake-parts": "flake-parts_2",
+        "flatpak": "flatpak",
         "hardware": "hardware",
-        "hxwrap": "hxwrap",
         "lanzaboote": "lanzaboote",
         "musicomp": "musicomp",
-        "myphps": "myphps",
-        "nini": "nini",
         "nix-index-database": "nix-index-database",
         "nixos-cosmic": "nixos-cosmic",
         "nixpkgs": [
           "nixos-cosmic",
           "nixpkgs"
-        ]
+        ],
+        "phps": "phps"
       }
     },
     "rust-overlay": {
@@ -854,11 +802,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747449297,
-        "narHash": "sha256-veyXchTz6eWwvuW5X49UluHkheHkFcqHJSwGuKBhrmQ=",
+        "lastModified": 1744079607,
+        "narHash": "sha256-5cog6Qd6w/bINdLO5mOysAHOHey8PwFXk4IWo+y+Czg=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "f44db7d7cea4528288780c6347756173a8248225",
+        "rev": "f6b62cc99c25e79a1c17e9fca91dc6b6faebec6c",
         "type": "github"
       },
       "original": {
@@ -914,31 +862,6 @@
         "repo": "flake-utils",
         "type": "github"
       }
-    },
-    "uv2nix": {
-      "inputs": {
-        "nixpkgs": [
-          "forgesync",
-          "nixpkgs"
-        ],
-        "pyproject-nix": [
-          "forgesync",
-          "pyproject-nix"
-        ]
-      },
-      "locked": {
-        "lastModified": 1745697651,
-        "narHash": "sha256-r4A/fkiCenEapHkjJWPiNUZEfviuXMCr6mRozJ5dC4o=",
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "rev": "cb6508484d534dafd097713b575f2aebc3417de0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -4,60 +4,74 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     flake-parts.url = "github:hercules-ci/flake-parts";
+    devenv-root = {
+      url = "file+file:///dev/null";
+      flake = false;
+    };
+    devenv.url = "github:cachix/devenv";
     hardware.url = "github:NixOS/nixos-hardware";
     agenix.url = "github:ryantm/agenix";
+    phps.url = "github:fossar/nix-phps";
+    lanzaboote.url = "github:nix-community/lanzaboote/v0.4.2";
+    flatpak.url = "github:gmodena/nix-flatpak?ref=latest";
     nixpkgs.follows = "nixos-cosmic/nixpkgs";
     nixos-cosmic.url = "github:lilyinstarlight/nixos-cosmic";
     nix-index-database = {
       url = "github:nix-community/nix-index-database";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    musicomp.url = "git+https://codeberg.org/helvetica/musicomp.git";
-    hxwrap.url = "git+https://codeberg.org/helvetica/hxwrap.git";
-    myphps.url = "git+https://codeberg.org/helvetica/myphps.git";
-    forgesync.url = "git+https://codeberg.org/helvetica/forgesync.git";
-    nini.url = "git+https://codeberg.org/helvetica/nini.git";
-    lanzaboote = {
-      url = "github:nix-community/lanzaboote/v0.4.2";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    musicomp.url = "git+https://codeberg.org/helveticanonstandard/musicomp.git";
   };
 
-  outputs =
-    {
+  nixConfig = {
+    extra-substituters = "https://cosmic.cachix.org";
+    extra-trusted-public-keys = "cosmic.cachix.org-1:Dya9IyXD4xdBehWjrkPv6rtxpmMdRel02smYzA85dPE=";
+  };
+
+  outputs = {
     self,
     nixpkgs,
     flake-parts,
     ...
   } @ inputs:
     flake-parts.lib.mkFlake {inherit inputs;} {
-      systems = [
-        "x86_64-linux"
-        "aarch64-linux"
+      imports = [
+        inputs.devenv.flakeModule
       ];
 
+      systems = ["x86_64-linux" "aarch64-linux"];
+
       flake = {
         lib = nixpkgs.lib.extend (import ./lib.nix);
 
-        nixosConfigurations = self.lib.genNixosConfigurations inputs;
+        nixosConfigurations = self.lib.genNixosConfigurations {inherit inputs;};
       };
 
-      perSystem =
-        {
+      perSystem = {
         pkgs,
         inputs',
         lib,
         ...
-        }:
-        {
-          devShells.default = pkgs.mkShellNoCC {
+      }: {
+        devenv.shells.default = {
+          devenv.root = let
+            devenvRootFileContent = builtins.readFile inputs.devenv-root.outPath;
+          in
+            lib.mkIf (devenvRootFileContent != "") devenvRootFileContent;
+
+          name = "puter";
+
+          imports = [
+            ./devenv.nix
+          ];
+
           packages = [
-              inputs'.agenix.packages.default
+            inputs'.agenix.packages.agenix
           ];
         };
 
         packages = lib.packagesFromDirectoryRecursive {
-            inherit (pkgs) callPackage newScope;
+          inherit (pkgs) callPackage;
           directory = ./packages;
         };
       };

hosts/abacus/forgejo.nix

@@ -1,105 +0,0 @@
-{
-  self,
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.services.forgejo;
-  inherit (config.age) secrets;
-in
-{
-  age.secrets = {
-    forgejo-mailer = {
-      file = self + /secrets/forgejo/mailer.age;
-      mode = "400";
-      owner = cfg.user;
-    };
-
-    forgejo-admin = {
-      file = self + /secrets/forgejo/admin.age;
-      mode = "400";
-      owner = cfg.user;
-    };
-  };
-
-  services.forgejo = {
-    enable = true;
-    package = pkgs.forgejo;
-    database.type = "postgres";
-    lfs.enable = true;
-    dump = {
-      enable = true;
-      interval = "*-*-* 02:00:00";
-      backupDir = "/srv/backup/forgejo";
-    };
-    settings = {
-      server = {
-        DOMAIN = "forgejo.helveticanonstandard.net";
-        ROOT_URL = "https://${cfg.settings.server.DOMAIN}/";
-        HTTP_ADDR = "127.0.0.1";
-        HTTP_PORT = 8060;
-      };
-
-      service = {
-        DISABLE_REGISTRATION = true;
-        ENABLE_NOTIFY_MAIL = true;
-      };
-
-      # TODO: Enable
-      federation = {
-        ENABLED = false;
-        SHARE_USER_STATISTICS = false;
-      };
-
-      mailer = {
-        ENABLED = true;
-        SMTP_ADDR = "smtp.fastmail.com";
-        FROM = "tea@wrz.one";
-        USER = "lukas@wrz.one";
-      };
-    };
-
-    secrets.mailer.PASSWD = secrets.forgejo-mailer.path;
-  };
-
-  systemd.services.forgejo.preStart = lib.getExe (
-    pkgs.writeShellApplication {
-      name = "forgejo-init-admin";
-      text =
-        let
-          forgejoExe = lib.getExe cfg.package;
-          passwordFile = secrets.forgejo-admin.path;
-        in
-        ''
-          admins=$(${forgejoExe} admin user list --admin | wc --lines)
-          admins=$((admins - 1))
-
-          if ((admins < 1)); then
-            ${forgejoExe} admin user create \
-              --admin \
-              --email helvetica@helveticanonstandard.net \
-              --username helvetica \
-              --password "$(cat -- ${passwordFile})"
-          fi
-        '';
-    }
-  );
-
-  services.nginx.virtualHosts.${cfg.settings.server.DOMAIN} = {
-    enableACME = true;
-    forceSSL = true;
-
-    extraConfig = ''
-      client_max_body_size 512M;
-    '';
-
-    locations."/".proxyPass =
-      let
-        host = cfg.settings.server.HTTP_ADDR;
-        port = builtins.toString cfg.settings.server.HTTP_PORT;
-      in
-      "http://${host}:${port}";
-  };
-}

hosts/abacus/navidrome.nix

@@ -1,32 +0,0 @@
-{ config, ... }:
-let
-  virtualHostName = "navidrome.helveticanonstandard.net";
-in
-{
-  services.navidrome = {
-    enable = true;
-    settings = {
-      Address = "localhost";
-      Port = 8050;
-      MusicFolder = "/srv/music";
-      EnableSharing = true;
-      # Backup = {
-      #   Path = "/srv/backup/navidrome";
-      #   Count = 1;
-      #   Schedule = "0 2 * * *";
-      # };
-    };
-  };
-
-  services.nginx.virtualHosts.${virtualHostName} = {
-    enableACME = true;
-    forceSSL = true;
-
-    locations."/".proxyPass =
-      let
-        host = config.services.navidrome.settings.Address;
-        port = builtins.toString config.services.navidrome.settings.Port;
-      in
-      "http://${host}:${port}";
-  };
-}

hosts/abacus/networking.nix

@@ -1,23 +0,0 @@
-{
-  networking =
-    let
-      interface = "enp1s0";
-    in
-    {
-      domain = "wrz.one";
-      interfaces.${interface}.ipv6.addresses = [
-        {
-          address = "2a01:4f8:c013:e64a::2";
-          prefixLength = 64;
-        }
-      ];
-      defaultGateway6 = {
-        address = "fe80::1";
-        inherit interface;
-      };
-      firewall.allowedTCPPorts = [
-        80
-        443
-      ];
-    };
-}

hosts/abacus/nginx.nix

@@ -1,33 +0,0 @@
-{ config, ... }:
-{
-  services.nginx = {
-    enable = true;
-
-    recommendedGzipSettings = true;
-    recommendedOptimisation = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-
-    commonHttpConfig = ''
-      error_log stderr;
-      access_log /var/log/nginx/access.log;
-    '';
-
-    virtualHosts =
-      let
-        matchAll = ''~.*'';
-        matchWww = ''~^www\.(?<domain>.+)$'';
-      in
-      {
-        # Redirect anything that doesn't match any server name to networking.domain
-        ${matchAll} = {
-          default = true;
-          rejectSSL = true;
-
-          globalRedirect = config.networking.domain;
-        };
-        # Redirect www to non-www
-        ${matchWww}.globalRedirect = "$domain";
-      };
-  };
-}

hosts/abacus/profiles.nix

@@ -1,3 +0,0 @@
-{
-  profiles.server.enable = true;
-}

hosts/abacus/restic.nix

@@ -1,42 +0,0 @@
-{
-  attrName,
-  config,
-  lib,
-  ...
-}:
-let
-  secretName = "restic-${attrName}";
-  secret = config.age.secrets.${secretName};
-in
-{
-  age.secrets = lib.mkSecrets { ${secretName} = { }; };
-
-  services.restic.backups.remote = {
-    repository = "sftp:u459482@u459482.your-storagebox.de:/${attrName}";
-    initialize = true;
-    paths = [
-      config.services.vaultwarden.backupDir
-      config.services.syncthing.dataDir
-      config.services.forgejo.stateDir
-      config.services.forgejo.dump.backupDir
-      config.services.postgresqlBackup.location
-      # config.services.navidrome.settings.Backup.Path
-      # TODO: Add stateDir options for these
-      "/var/lib/headscale"
-      "/var/lib/navidrome"
-    ];
-    passwordFile = secret.path;
-    pruneOpts = [
-      "--keep-daily 7"
-      "--keep-weekly 5"
-      "--keep-monthly 12"
-    ];
-    timerConfig = {
-      OnCalendar = "*-*-* 03:00:00";
-      Persistent = true;
-    };
-    extraOptions = [
-      "sftp.args='-i /etc/ssh/ssh_host_ed25519_key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'"
-    ];
-  };
-}

hosts/abacus/static-sites.nix

@@ -1,34 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  parent = "/var/www";
-  sites = [
-    "wrz.one"
-    "helveticanonstandard.net"
-  ];
-in
-lib.mkMerge (
-  map (
-    virtualHostName:
-    let
-      root = "${parent}/${virtualHostName}";
-    in
-    {
-      services.nginx.virtualHosts.${virtualHostName} = {
-        enableACME = true;
-        forceSSL = true;
-
-        inherit root;
-      };
-
-      systemd.tmpfiles.settings."10-static-sites".${root}.d = {
-        user = config.users.mainUser;
-        group = "users";
-        mode = "0755";
-      };
-    }
-  ) sites
-)

hosts/abacus/system.nix

@@ -1,3 +0,0 @@
-{
-  system.stateVersion = "25.05";
-}

hosts/flamingo/profiles.nix

@@ -1,9 +0,0 @@
-{
-  profiles = {
-    desktop.enable = true;
-    emulation.enable = true;
-    gaming.enable = true;
-    piracy.enable = true;
-    productivity.enable = true;
-  };
-}

hosts/glacier/profiles.nix

@@ -1,9 +0,0 @@
-{
-  profiles = {
-    desktop.enable = true;
-    emulation.enable = true;
-    gaming.enable = true;
-    piracy.enable = true;
-    productivity.enable = true;
-  };
-}

hosts/headful/flamingo/hardware.nix

@@ -2,8 +2,7 @@
   inputs,
   modulesPath,
   ...
-}:
-{
+}: {
   imports = [
     "${modulesPath}/installer/scan/not-detected.nix"
 
@@ -13,12 +12,7 @@
   nixpkgs.hostPlatform = "x86_64-linux";
 
   boot = {
-    initrd.availableKernelModules = [
-      "xhci_pci"
-      "nvme"
-      "usb_storage"
-      "sd_mod"
-    ];
+    initrd.availableKernelModules = ["xhci_pci" "nvme" "usb_storage" "sd_mod"];
     kernelModules = ["kvm-intel"];
   };
 

hosts/headful/flamingo/libreoffice.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "org.libreoffice.LibreOffice"
+  ];
+}

hosts/headful/flamingo/librewolf.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "io.gitlab.librewolf-community"
+  ];
+}

hosts/headful/flamingo/mpv.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "io.mpv.Mpv"
+  ];
+}

hosts/headful/flamingo/supersonic.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "io.github.dweymouth.supersonic"
+  ];
+}

hosts/headful/glacier/gimp.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "org.gimp.GIMP"
+  ];
+}

hosts/headful/glacier/hardware.nix

@@ -2,8 +2,7 @@
   inputs,
   modulesPath,
   ...
-}:
-{
+}: {
   imports = [
     "${modulesPath}/installer/scan/not-detected.nix"
 
@@ -16,17 +15,11 @@
 
   boot = {
     initrd = {
-      availableKernelModules = [
-        "nvme"
-        "ahci"
-        "xhci_pci"
-        "usbhid"
-        "usb_storage"
-        "sd_mod"
-      ];
+      availableKernelModules = ["nvme" "ahci" "xhci_pci" "usbhid" "usb_storage" "sd_mod"];
       kernelModules = ["amdgpu"];
     };
     kernelModules = ["kvm-amd"];
+    binfmt.emulatedSystems = ["aarch64-linux"];
   };
 
   powerManagement.cpuFreqGovernor = "performance";

hosts/headful/glacier/inkscape.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "org.inkscape.Inkscape"
+  ];
+}

hosts/headful/glacier/lanzaboote.nix

@@ -0,0 +1,3 @@
+{
+  setups.secureBoot.enable = true;
+}

hosts/headful/glacier/libreoffice.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "org.libreoffice.LibreOffice"
+  ];
+}

hosts/headful/glacier/librewolf.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "io.gitlab.librewolf-community"
+  ];
+}

hosts/headful/glacier/mpv.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "io.mpv.Mpv"
+  ];
+}

hosts/headful/glacier/steam.nix

@@ -0,0 +1,6 @@
+{
+  services.flatpak.packages = [
+    "com.valvesoftware.Steam"
+    "com.github.Matoking.protontricks"
+  ];
+}

hosts/headful/glacier/supersonic.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "io.github.dweymouth.supersonic"
+  ];
+}

hosts/headful/insomniac/cosmic.nix

@@ -0,0 +1,17 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  services.greetd.settings.initial_session = {
+    user = config.users.mainUser;
+    command = ''
+      ${lib.getExe' pkgs.coreutils "env"} XCURSOR_THEME="''${XCURSOR_THEME:-Pop}" systemd-cat --identifier start-cosmic ${lib.getExe' pkgs.cosmic-session "start-cosmic"}
+    '';
+  };
+
+  environment.cosmic.excludePackages = [
+    pkgs.cosmic-store
+  ];
+}

hosts/headful/insomniac/dolphin.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "org.DolphinEmu.dolphin-emu"
+  ];
+}

hosts/headful/insomniac/flatpak.nix

@@ -0,0 +1,6 @@
+{
+  services.flatpak.update.auto = {
+    enable = true;
+    onCalendar = "weekly";
+  };
+}

hosts/headful/insomniac/freetube.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "io.freetubeapp.FreeTube"
+  ];
+}

hosts/headful/insomniac/hardware.nix

@@ -2,8 +2,7 @@
   inputs,
   modulesPath,
   ...
-}:
-{
+}: {
   imports = [
     "${modulesPath}/installer/scan/not-detected.nix"
 
@@ -16,13 +15,7 @@
 
   boot = {
     initrd = {
-      availableKernelModules = [
-        "nvme"
-        "xhci_pci"
-        "ahci"
-        "usb_storage"
-        "sd_mod"
-      ];
+      availableKernelModules = ["nvme" "xhci_pci" "ahci" "usb_storage" "sd_mod"];
       kernelModules = ["amdgpu"];
     };
     kernelModules = ["kvm-amd"];

hosts/headful/insomniac/rmg.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "com.github.Rosalie241.RMG"
+  ];
+}

hosts/headful/insomniac/steam.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "com.valvesoftware.Steam"
+  ];
+}

hosts/headful/insomniac/supersonic.nix

@@ -0,0 +1,5 @@
+{
+  services.flatpak.packages = [
+    "io.github.dweymouth.supersonic"
+  ];
+}

hosts/headful/insomniac/users.nix

@@ -2,11 +2,9 @@
   config,
   lib,
   ...
-}:
-let
+}: let
   inherit (config.users) mainUser;
-in
-{
+in {
   users = {
     mainUser = lib.mkForce "insomniac";
     users.${mainUser}.description = lib.mkForce "Insomniac";

hosts/headful/work/docker.nix

@@ -2,8 +2,7 @@
   config,
   pkgs,
   ...
-}:
-{
+}: {
   virtualisation.docker.enable = true;
 
   environment.systemPackages = [