flake/nixpkgs: 2023-05-22 -> 2023-05-24

```
• Updated input 'nixpkgs-unpatched':
    'github:nixos/nixpkgs/7084250df3d7f9735087d3234407f3c1fc2400e3' (2023-05-22)
  → 'github:nixos/nixpkgs/f91ee3065de91a3531329a674a45ddcb3467a650' (2023-05-24)
```

.sops.yaml

@@ -8,7 +8,7 @@ keys:
   - &host_servo age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf
   - &host_moby age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt
 creation_rules:
-  - path_regex: secrets/universal*
+  - path_regex: secrets/common*
     key_groups:
     - age:
       - *user_desko_colin
@@ -26,19 +26,19 @@ creation_rules:
       - *user_lappy_colin
       - *user_servo_colin
       - *host_servo
-  - path_regex: secrets/desko.yaml$
+  - path_regex: secrets/desko*
     key_groups:
     - age:
       - *user_desko_colin
       - *user_lappy_colin
       - *host_desko
-  - path_regex: secrets/lappy.yaml$
+  - path_regex: secrets/lappy*
     key_groups:
     - age:
       - *user_lappy_colin
       - *user_desko_colin
       - *host_lappy
-  - path_regex: secrets/moby.yaml$
+  - path_regex: secrets/moby*
     key_groups:
     - age:
       - *user_desko_colin

README.md

@@ -0,0 +1,108 @@
+## What's Here
+
+this is the top-level repo from which i configure/deploy all my NixOS machines:
+- desktop
+- laptop
+- server
+- mobile phone
+
+i enjoy a monorepo approach. this repo references [nixpkgs][nixpkgs], a couple 3rd party
+nix modules like [sops][sops], the sources for [uninsane.org][uninsane-org], and that's
+about it. custom derivations and modules (some of which i try to upstream) live
+directly here; even the sources for those packages is often kept here too.
+
+[nixpkgs]: https://github.com/NixOS/nixpkgs
+[sops]: https://github.com/Mic92/sops-nix
+[uninsane-org]: https://uninsane.org
+
+## Layout
+- `hosts/`
+    - the bulk of config which isn't factored with external use in mind.
+    - that is, if you were to add this repo to a flake.nix for your own use,
+      you won't likely be depending on anything in this directory.
+- `integrations/`
+    - code intended for consumption by external tools (e.g. the Nix User Repos)
+- `modules/`
+    - config which is gated behind `enable` flags, in similar style to nixpkgs'
+      `nixos/` directory.
+    - if you depend on this repo, it's most likely for something in this directory.
+- `nixpatches/`
+    - literally, diffs i apply atop upstream nixpkgs before performing further eval.
+- `overlays/`
+    - exposed via the `overlays` output in `flake.nix`.
+    - predominantly a list of `callPackage` directives.
+- `pkgs/`
+    - derivations for things not yet packaged in nixpkgs.
+    - derivations for things from nixpkgs which i need to `override` for some reason.
+    - inline code for wholly custom packages (e.g. `pkgs/additional/sane-scripts/` for CLI tools
+      that are highly specific to my setup).
+- `scripts/`
+    - scripts which are referenced by other things in this repo.
+    - these aren't generally user-facing, but they're factored out so that they can
+      be invoked directly when i need to debug.
+- `secrets/`
+    - encrypted keys, API tokens, anything which one or more of my machines needs
+      read access to but shouldn't be world-readable.
+    - not much to see here
+- `templates/`
+    - exposed via the `templates` output in `flake.nix`.
+    - used to instantiate short-lived environments.
+    - used to auto-fill the boiler-plate portions of new packages.
+
+
+## Key Points of Interest
+
+i.e. you might find value in using these in your own config:
+
+- `modules/fs/`
+    - use this to statically define leafs and nodes anywhere in the filesystem,
+      not just inside `/nix/store`.
+    - e.g. specify that `/var/www` should be:
+        - owned by a specific user/group
+        - set to a specific mode
+        - symlinked to some other path
+        - populated with some statically-defined data
+        - populated according to some script
+        - created as a dependency of some service (e.g. `nginx`)
+    - values defined here are applied neither at evaluation time _nor_ at activation time.
+        - rather, they become systemd services.
+        - systemd manages dependencies
+        - e.g. link `/var/www -> /mnt/my-drive/www` only _after_ `/mnt/my-drive/www` appears)
+    - this is akin to using [Home Manager's][home-manager] file API -- the part which lets you
+      statically define `~/.config` files -- just with a different philosophy.
+- `modules/persist/`
+    - my alternative to the Impermanence module.
+    - this builds atop `modules/fs/` to achieve things stock impermanence can't:
+        - persist things to encrypted storage which is unlocked at login time (pam_mount).
+        - "persist" cache directories -- to free up RAM -- but auto-wipe them on mount
+          and encrypt them to ephemeral keys so they're unreadable post shutdown/unmount.
+- `modules/programs.nix`
+    - like nixpkgs' `programs` options, but allows both system-wide or per-user deployment.
+    - allows `fs` and `persist` config values to be gated behind program deployment:
+        - e.g. `/home/<user>/.mozilla/firefox` is persisted only for users who
+          `sane.programs.firefox.enableFor.user."<user>" = true;`
+- `modules/users.nix`
+    - convenience layer atop the above modules so that you can just write
+      `fs.".config/git"` instead of `fs."/home/colin/.config/git"`
+
+some things in here could easily find broader use. if you would find benefit in
+them being factored out of my config, message me and we could work to make that happen.
+
+[home-manager]: https://github.com/nix-community/home-manager
+
+## Using This Repo In Your Own Config
+
+this should be a pretty "standard" flake. just reference it, and import either
+- `nixosModules.sane` (for the modules)
+- `overlays.pkgs` (for the packages)
+
+## Mirrors
+
+this repo exists in a few known locations:
+- primary: <https://git.uninsane.org/colin/nix-files>
+- mirror: <https://github.com/nix-community/nur-combined/tree/master/repos/colinsane>
+
+## Contact
+
+if you want to contact me for questions, or collaborate to split something useful into a shared repo, etc,
+you can reach me via any method listed [here](https://uninsane.org/about).

TODO.md

@@ -0,0 +1,73 @@
+## BUGS
+- why i need to manually restart `wireguard-wg-ovpns` on servo periodically
+	- else DNS fails
+
+## REFACTORING:
+### sops/secrets
+- attach secrets to the thing they're used by (sane.programs)
+- rework secrets to leverage `sane.fs`
+- remove sops activation script as it's covered by my systemd sane.fs impl
+
+### roles
+- allow any host to take the role of `uninsane.org`
+    - will make it easier to test new services?
+
+### upstreaming
+- bump nodejs version in lemmy-ui
+- add updateScripts to all my packages in nixpkgs
+- fix lightdm-mobile-greeter for newer libhandy
+- port zecwallet-lite to a from-source build
+- fix or abandon Whalebird
+
+
+## IMPROVEMENTS:
+### security/resilience
+- validate duplicity backups!
+- encrypt more ~ dirs (~/archives, ~/records, ..?)
+    - best to do this after i know for sure i have good backups
+- have `sane.programs` be wrapped such that they run in a cgroup?
+    - at least, only give them access to the portion of the fs they *need*.
+    - Android takes approach of giving each app its own user: could hack that in here.
+- canaries for important services
+    - e.g. daily email checks; daily backup checks
+
+### user experience
+- firefox/librewolf: don't show browserpass/sponsorblock/metamask "first run" on every boot
+- moby: improve gPodder launch time
+- moby: replace jellyfin-desktop with jellyfin-vue?
+    - allows (maybe) to cache media for offline use
+    - "newer" jellyfin client
+    - not packaged for nix
+- find a nice desktop ActivityPub client
+- package Nix/NixOS docs for Zeal
+    - install [doc-browser](https://github.com/qwfy/doc-browser)
+    - this supports both dash (zeal) *and* the datasets from <https://devdocs.io> (which includes nix!)
+    - install [devhelp](https://wiki.gnome.org/Apps/Devhelp)  (gnome)
+- auto-mount servo
+- have xdg-open parse `<repo:...> URIs (or adjust them so that it _can_ parse)
+- `sane.programs`: auto-populate defaults with everything from `pkgs`
+- zsh: disable "command not found" corrections
+- sxmo: allow rotation to the upside-down position
+    - see: <repo:mil/sxmo-utils:scripts/core/sxmo_autorotate.sh>
+    - all orientations *except* upside down are supported
+- sxmo: launch with auto-rotation enabled
+
+### perf
+- why does nixos-rebuild switch take 5 minutes when net is flakey?
+    - trying to auto-mount servo?
+    - something to do with systemd services restarting/stalling
+    - maybe wireguard & its refresh operation, specifically?
+- fix OOM for large builds like webkitgtk
+    - these use significant /tmp space.
+    - either place /tmp on encrypted-cleared-at-boot storage
+        - which probably causes each CPU load for the encryption
+    - **or set up encrypted swap**
+        - encrypted swap could remove the need for my encrypted-cleared-at-boot stuff
+
+
+## NEW FEATURES:
+- add a FTP-accessible file share to servo
+    - just /var/www?
+- migrate MAME cabinet to nix
+    - boot it from PXE from servo?
+- enable IPv6

flake.lock

@@ -18,11 +18,11 @@
     "mobile-nixos": {
       "flake": false,
       "locked": {
-        "lastModified": 1680563603,
-        "narHash": "sha256-gxSci3NTlzgkAOhaC93Q4lReX/Pjd7++imD85JOAlps=",
+        "lastModified": 1683422260,
+        "narHash": "sha256-79zaClbubRkBNlJ04OSADILuLQHH48N5fu296hEWYlw=",
         "owner": "nixos",
         "repo": "mobile-nixos",
-        "rev": "4aa0afd84005b79be4d5361b56a60df9e9bd4ea3",
+        "rev": "ba4638836e94a8f16d1d1f9e8c0530b86078029c",
         "type": "github"
       },
       "original": {
@@ -36,11 +36,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1678202930,
-        "narHash": "sha256-SF82/tTnagdazlETJLzXD9kjZ6lyk38agdLbmMx1UZE=",
+        "lastModified": 1684319086,
+        "narHash": "sha256-5wwlkWqP1cQUPXp/PJsi09FkgAule5yBghngRZZbUQg=",
         "owner": "edolstra",
         "repo": "nix-serve",
-        "rev": "3b6d30016d910a43e0e16f94170440a3e0b8fa8d",
+        "rev": "e6e3d09438e803daa5374ad8edf1271289348456",
         "type": "github"
       },
       "original": {
@@ -66,11 +66,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1682173319,
-        "narHash": "sha256-tPhOpJJ+wrWIusvGgIB2+x6ILfDkEgQMX0BTtM5vd/4=",
+        "lastModified": 1684632198,
+        "narHash": "sha256-SdxMPd0WmU9MnDBuuy7ouR++GftrThmSGL7PCQj/uVI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ee7ec1c71adc47d2e3c2d5eb0d6b8fbbd42a8d1c",
+        "rev": "d0dade110dc7072d67ce27826cfe9ab2ab0cf247",
         "type": "github"
       },
       "original": {
@@ -82,16 +82,16 @@
     },
     "nixpkgs-unpatched": {
       "locked": {
-        "lastModified": 1682404149,
-        "narHash": "sha256-vilYNldFXiu56HGD0lPcWsiED7EmjGMViCLZoQsv7Jk=",
+        "lastModified": 1684935479,
+        "narHash": "sha256-6QMMsXMr2nhmOPHdti2j3KRHt+bai2zw+LJfdCl97Mk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d0ea36ece469a71a909ebff90777c2f7a49478bb",
+        "rev": "f91ee3065de91a3531329a674a45ddcb3467a650",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "staging-next",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -113,11 +113,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1682338428,
-        "narHash": "sha256-T7AL/Us6ecxowjMAlO77GETTQO2SO+1XX2+Y/OSfHk8=",
+        "lastModified": 1684637723,
+        "narHash": "sha256-0vAxL7MVMhGbTkAyvzLvleELHjVsaS43p+PR1h9gzNQ=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "7c8e9727a2ecf9994d4a63d577ad5327e933b6a4",
+        "rev": "4ccdfb573f323a108a44c13bb7730e42baf962a9",
         "type": "github"
       },
       "original": {
@@ -134,11 +134,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1681952179,
-        "narHash": "sha256-GfI682y7LJXj6p0kcYIyzVKFNKtkEbxvMGu5VjSPeN4=",
+        "lastModified": 1684528780,
+        "narHash": "sha256-QdYxjcTCCLPv++1v9tJBL98nn/AFx0fmzlgzcLK6KRE=",
         "ref": "refs/heads/master",
-        "rev": "3b9ce28b7a65d516eedddac67a224493399e5b1e",
-        "revCount": 190,
+        "rev": "f3747a1dad3d34880613821faf26357ba432d3d7",
+        "revCount": 194,
         "type": "git",
         "url": "https://git.uninsane.org/colin/uninsane"
       },

flake.nix

@@ -43,8 +43,8 @@
     #   - use `staging` if no staging-next branch has been cut.
     #
     # <https://github.com/nixos/nixpkgs/tree/nixos-unstable>
-    # nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=nixos-unstable";
-    nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=staging-next";
+    nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    # nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=staging-next";
     # nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=staging";
 
     mobile-nixos = {
@@ -92,36 +92,28 @@
         nixpkgs = nixpkgs-unpatched;
       };
 
-      nixpkgsCompiledBy = local: nixpkgs.legacyPackages."${local}";
+      nixpkgsCompiledBy = system: nixpkgs.legacyPackages."${system}";
 
-      evalHost = { name, local, target }:
-        let
-          # XXX: we'd prefer to use `nixosSystem = (nixpkgsCompiledBy target).nixos`
-          # but it doesn't propagate config to the underlying pkgs, meaning it doesn't let you use
-          # non-free packages even after setting nixpkgs.allowUnfree.
-          # XXX: patch using the target -- not local -- otherwise the target will
-          # need to emulate the host in order to rebuild!
-          nixosSystem = import ((nixpkgsCompiledBy target).path + "/nixos/lib/eval-config.nix");
-        in
-          (nixosSystem {
-            modules = [
-              (import ./hosts/instantiate.nix { localSystem = local; hostName = name; })
-              self.nixosModules.default
-              self.nixosModules.passthru
-              {
-                nixpkgs.overlays = [
-                  self.overlays.disable-flakey-tests
-                  self.overlays.passthru
-                  self.overlays.pins
-                  self.overlays.pkgs
-                  # self.overlays.optimizations
-                ];
-                nixpkgs.hostPlatform = target;
-                # nixpkgs.buildPlatform = local;  # set by instantiate.nix instead
-                # nixpkgs.config.replaceStdenv = { pkgs }: pkgs.ccacheStdenv;
-              }
+      evalHost = { name, local, target }: nixpkgs.lib.nixosSystem {
+        system = target;
+        modules = [
+          (import ./hosts/instantiate.nix { localSystem = local; hostName = name; })
+          self.nixosModules.default
+          self.nixosModules.passthru
+          {
+            nixpkgs.overlays = [
+              self.overlays.passthru
+              self.overlays.sane-all
             ];
-          });
+          }
+          ({ lib, ... }: {
+            # TODO: does the earlier `system` arg to nixosSystem make its way here?
+            nixpkgs.hostPlatform.system = target;
+            # nixpkgs.buildPlatform = local;  # set by instantiate.nix instead
+            # nixpkgs.config.replaceStdenv = { pkgs }: pkgs.ccacheStdenv;
+          })
+        ];
+      };
     in {
       nixosConfigurations =
         let
@@ -175,11 +167,13 @@
 
       # unofficial output
       host-pkgs = mapAttrValues (host: host.config.system.build.pkgs) self.nixosConfigurations;
+      host-programs = mapAttrValues (host: mapAttrValues (p: p.package) host.config.sane.programs) self.nixosConfigurations;
 
       overlays = {
         # N.B.: `nix flake check` requires every overlay to take `final: prev:` at defn site,
         #   hence the weird redundancy.
         default = final: prev: self.overlays.pkgs final prev;
+        sane-all = final: prev: import ./overlays/all.nix final prev;
         disable-flakey-tests = final: prev: import ./overlays/disable-flakey-tests.nix final prev;
         pkgs = final: prev: import ./overlays/pkgs.nix final prev;
         pins = final: prev: import ./overlays/pins.nix final prev;
@@ -241,9 +235,12 @@
             (! elem name [ "feeds" "pythonPackagesExtensions" ])
             && (allPkgs.lib.meta.availableOn allPkgs.stdenv.hostPlatform pkg)
           )
-          (allPkgs.sane // {
-            inherit (allPkgs) uninsane-dot-org;
-          })
+          (
+            # expose sane packages and chosen inputs (uninsane.org)
+            (import ./pkgs { pkgs = allPkgs; }) // {
+              inherit (allPkgs) uninsane-dot-org;
+            }
+          )
         )
         # self.legacyPackages;
         { inherit (self.legacyPackages) x86_64-linux; }
@@ -260,13 +257,13 @@
         in {
           update-feeds = {
             type = "app";
-            program = "${pkgs.feeds.passthru.updateScript}";
+            program = "${pkgs.feeds.updateScript}";
           };
 
           init-feed = {
             # use like `nix run '.#init-feed' uninsane.org`
             type = "app";
-            program = "${pkgs.feeds.passthru.initFeedScript}";
+            program = "${pkgs.feeds.initFeedScript}";
           };
 
           deploy-moby-test = {
@@ -302,6 +299,12 @@
           path = ./templates/pkgs/rust;
           description = "rust package fit to ship in nixpkgs";
         };
+        pkgs.make = {
+          # initialize with:
+          # - `nix flake init -t '/home/colin/dev/nixos/#pkgs.make'`
+          path = ./templates/pkgs/make;
+          description = "default Makefile-based derivation";
+        };
       };
     };
 }

hosts/README.md

@@ -0,0 +1,7 @@
+## directory structure
+- by-name/<hostname>: configuration which is evaluated _only_ for the given hostname
+- common/: configuration which applies to all hosts
+- modules/: nixpkgs-style modules which may be used by multiple hosts, but configured separately per host.
+    - ideally no module here has effect unless `enable`d
+        - however, `enable` may default to true
+        - and in practice some of these modules surely aren't fully "disableable"

hosts/by-name/desko/default.nix

@@ -4,12 +4,16 @@
     ./fs.nix
   ];
 
+  sops.secrets.colin-passwd.neededForUsers = true;
+
   sane.roles.build-machine.enable = true;
+  sane.roles.ac = true;
   sane.roles.client = true;
+  sane.roles.dev-machine = true;
   sane.services.wg-home.enable = true;
   sane.services.wg-home.ip = config.sane.hosts.by-name."desko".wg-home.ip;
   sane.services.duplicity.enable = true;
-  sane.services.nixserve.sopsFile = ../../../secrets/desko.yaml;
+  sane.services.nixserve.secretKeyFile = config.sops.secrets.nix_serve_privkey.path;
 
   sane.gui.sway.enable = true;
   sane.programs.iphoneUtils.enableFor.user.colin = true;
@@ -22,11 +26,6 @@
   # needed to use libimobiledevice/ifuse, for iphone sync
   services.usbmuxd.enable = true;
 
-  sops.secrets.colin-passwd = {
-    sopsFile = ../../../secrets/desko.yaml;
-    neededForUsers = true;
-  };
-
   # don't enable wifi by default: it messes with connectivity.
   systemd.services.iwd.enable = false;
 
@@ -37,15 +36,9 @@
   services.snapper.configs.nix = {
     # TODO: for the impermanent setup, we'd prefer to just do /nix/persist,
     # but that also requires setting up the persist dir as a subvol
-    subvolume = "/nix";
+    SUBVOLUME = "/nix";
     # TODO: ALLOW_USERS doesn't seem to work. still need `sudo snapper -c nix list`
-    extraConfig = ''
-      ALLOW_USERS = "colin";
-    '';
-  };
-
-  sops.secrets.duplicity_passphrase = {
-    sopsFile = ../../../secrets/desko.yaml;
+    ALLOW_USERS = [ "colin" ];
   };
 
   programs.steam = {

hosts/by-name/lappy/default.nix

@@ -2,11 +2,11 @@
 {
   imports = [
     ./fs.nix
+    ./polyfill.nix
   ];
 
-  sane.yggdrasil.enable = true;
-
   sane.roles.client = true;
+  sane.roles.dev-machine = true;
   sane.services.wg-home.enable = true;
   sane.services.wg-home.ip = config.sane.hosts.by-name."lappy".wg-home.ip;
 
@@ -19,12 +19,8 @@
     "desktopGuiApps"
     "stepmania"
   ];
-  sane.programs.mx-sanebot.enableFor.system = true;  # for the docs
 
-  sops.secrets.colin-passwd = {
-    sopsFile = ../../../secrets/lappy.yaml;
-    neededForUsers = true;
-  };
+  sops.secrets.colin-passwd.neededForUsers = true;
 
   # default config: https://man.archlinux.org/man/snapper-configs.5
   # defaults to something like:
@@ -33,7 +29,8 @@
   services.snapper.configs.nix = {
     # TODO: for the impermanent setup, we'd prefer to just do /nix/persist,
     # but that also requires setting up the persist dir as a subvol
-    subvolume = "/nix";
+    SUBVOLUME = "/nix";
+    ALLOW_USERS = [ "colin" ];
   };
 
   # TODO: only here for debugging

hosts/by-name/lappy/polyfill.nix

@@ -0,0 +1,32 @@
+# doesn't actually *enable* anything,
+# but sets up any modules such that if they *were* enabled, they'll act as expected.
+{ ... }:
+{
+  sane.gui.sxmo = {
+    greeter = "sway";
+    settings = {
+      # XXX: make sure the user is part of the `input` group!
+      SXMO_LISGD_INPUT_DEVICE = "/dev/input/by-id/usb-Wacom_Co._Ltd._Pen_and_multitouch_sensor-event-if00";
+      # these identifiers are from `swaymsg -t get_inputs`
+      SXMO_VOLUME_BUTTON = "1:1:AT_Translated_Set_2_keyboard";
+      # SXMO_VOLUME_BUTTON = "none";
+      SXMO_POWER_BUTTON = "0:1:Power_Button";
+      # SXMO_POWER_BUTTON = "none";
+      SXMO_DISABLE_LEDS = "1";
+      SXMO_UNLOCK_IDLE_TIME = "120";  # default
+      # sxmo tries to determine device type from /proc/device-tree/compatible,
+      # but that doesn't seem to exist on NixOS?  (or maybe it just doesn't exist
+      # on non-aarch64 builds).
+      # the device type informs (at least):
+      # - SXMO_WIFI_MODULE
+      # - SXMO_RTW_SCAN_INTERVAL
+      # - SXMO_SYS_FILES
+      # - SXMO_TOUCHSCREEN_ID
+      # - SXMO_MONITOR
+      # - SXMO_ALSA_CONTROL_NAME
+      # - SXMO_SWAY_SCALE
+      # see <repo:mil/sxmo-utils:scripts/deviceprofiles>
+      # SXMO_DEVICE_NAME = "pine64,pinephone-1.2";
+    };
+  };
+}

hosts/by-name/moby/default.nix

@@ -4,6 +4,7 @@
     ./firmware.nix
     ./fs.nix
     ./kernel.nix
+    ./polyfill.nix
   ];
 
   sane.roles.client = true;
@@ -15,12 +16,9 @@
   users.users.colin.initialPassword = "147147";
   services.getty.autologinUser = "root";  # allows for emergency maintenance?
 
-  sops.secrets.colin-passwd = {
-    sopsFile = ../../../secrets/moby.yaml;
-    neededForUsers = true;
-  };
+  sops.secrets.colin-passwd.neededForUsers = true;
 
-  sane.web-browser = {
+  sane.programs.web-browser.config = {
     # compromise impermanence for the sake of usability
     persistCache = "private";
     persistData = "private";
@@ -31,6 +29,7 @@
   };
 
   sane.user.persist.plaintext = [
+    # TODO: make this just generally conditional upon pulse being enabled?
     ".config/pulse"  # persist pulseaudio volume
   ];
 

hosts/by-name/moby/kernel.nix

@@ -44,68 +44,6 @@ let
       "sha256-6ywm3dQQ5JYl60CLKarxlSUukwi4QzqctCj3tVgzFbo="
     )
   ];
-
-  # pinephone uses the linux dtb at arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi
-  # - this includes sun50i-a64.dtsi
-  # - and sun50i-a64-cpu-opp.dtsi
-  # - no need to touch the allwinner-h6 stuff: that's the SBC pine product
-  # - i think it's safe to ignore sun9i stuff, but i don't know what it is
-  kernelConfig = with lib.kernel; {
-    # NB: nix adds the CONFIG_ prefix to each of these.
-    # if you add the prefix yourself nix will IGNORE YOUR CONFIG.
-    RTL8723CS = module;
-    BT_HCIUART_3WIRE = yes;
-    BT_HCIUART_RTL = yes;
-    RTL8XXXU_UNTESTED = yes;
-    BT_BNEP_MC_FILTER = yes;
-    BT_BNEP_PROTO_FILTER = yes;
-    BT_HS = yes;
-    BT_LE = yes;
-    # relevant configs inherited from nixos defaults (or above additions):
-    # CONFIG_BT=m
-    # CONFIG_BT_BREDR=y
-    # CONFIG_BT_RFCOMM=m
-    # CONFIG_BT_RFCOMM_TTY=y
-    # CONFIG_BT_BNEP=m
-    # CONFIG_BT_HIDP=m
-    # CONFIG_BT_RTL=m
-    # CONFIG_BT_HCIBTUSB=m
-    # CONFIG_BT_HCIBTUSB_BCM=y
-    # CONFIG_BT_HCIBTUSB_RTL=y
-    # CONFIG_BT_HCIUART=m
-    # CONFIG_BT_HCIUART_SERDEV=y
-    # CONFIG_BT_HCIUART_H4=y
-    # CONFIG_BT_HCIUART_LL=y
-    # CONFIG_RTL_CARDS=m
-    # CONFIG_RTLWIFI=m
-    # CONFIG_RTLWIFI_PCI=m
-    # CONFIG_RTLWIFI_USB=m
-    # CONFIG_RTLWIFI_DEBUG=y
-    # CONFIG_RTL8723_COMMON=m
-    # CONFIG_RTLBTCOEXIST=m
-    # CONFIG_RTL8XXXU=m
-    # CONFIG_RTLLIB=m
-    # consider adding (from mobile-nixos):
-    # maybe: CONFIG_BT_HCIUART_3WIRE=y
-    # maybe: CONFIG_BT_HCIUART_RTL=y
-    # maybe: CONFIG_RTL8XXXU_UNTESTED=y
-    # consider adding (from manjaro):
-    # CONFIG_BT_6LOWPAN=m  (not listed as option in nixos kernel)
-    # these are referenced in the rtl8723 source, but not known to config (and not in mobile-nixos config
-    # maybe: CONFIG_RTL_ODM_WLAN_DRIVER
-    # maybe: CONFIG_RTL_TRIBAND_SUPPORT
-    # maybe: CONFIG_SDIO_HCI
-    # maybe: CONFIG_USB_HCI
-  };
-
-  # create a kernelPatch which overrides nixos' defconfig with extra options
-  patchDefconfig = config: {
-    # defconfig options. this method comes from here:
-    # - https://discourse.nixos.org/t/the-correct-way-to-override-the-latest-kernel-config/533/9
-    name = "sane-moby-defconfig";
-    patch = null;
-    extraStructuredConfig = config;
-  };
 in
 {
   # use Megi's kernel:
@@ -116,22 +54,6 @@ in
   # - phosh greeter may not appear after wake from sleep
   boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux-megous;
 
-  boot.kernelPatches = [
-    (patchDefconfig (kernelConfig //
-      (with lib.kernel; {
-        # disabling the sun5i_eink driver avoids this compilation error:
-        # CC [M]  drivers/video/fbdev/sun5i-eink-neon.o
-        # aarch64-unknown-linux-gnu-gcc: error: unrecognized command line option '-mfloat-abi=softfp'
-        # aarch64-unknown-linux-gnu-gcc: error: unrecognized command line option '-mfpu=neon'
-        # make[3]: *** [../scripts/Makefile.build:289: drivers/video/fbdev/sun5i-eink-neon.o] Error 1
-        FB_SUN5I_EINK = no;
-        # used by the pinephone pro, but fails to compile with:
-        # ../drivers/media/i2c/ov8858.c:1834:27: error: implicit declaration of function 'compat_ptr'
-        VIDEO_OV8858 = no;
-      })
-    ))
-  ];
-
   # alternatively, use nixos' kernel and add the stuff we want:
   # # cross-compilation optimization:
   # boot.kernelPackages =
@@ -143,4 +65,19 @@ in
   # boot.kernelPatches = manjaroPatches ++ [
   #   (patchDefconfig kernelConfig)
   # ];
+
+  nixpkgs.hostPlatform.linux-kernel = {
+    # defaults:
+    name = "aarch64-multiplatform";
+    baseConfig = "defconfig";
+    DTB = true;
+    autoModules = true;
+    preferBuiltin = true;
+    # extraConfig = ...
+    # ^-- raspberry pi stuff: we don't need it.
+
+    # target = "Image";  # <-- default
+    target = "Image.gz";  # <-- compress the kernel image
+    # target = "zImage";  # <-- confuses other parts of nixos :-(
+  };
 }

hosts/by-name/moby/polyfill.nix

@@ -0,0 +1,23 @@
+{ sane-lib, ... }:
+{
+  sane.gui.sxmo = {
+    settings = {
+      # touch screen
+      SXMO_LISGD_INPUT_DEVICE = "/dev/input/by-path/platform-1c2ac00.i2c-event";
+      # vol and power are detected correctly by upstream
+    };
+  };
+  # TODO: only populate this if sxmo is enabled?
+  sane.user.fs.".config/sxmo/profile" = sane-lib.fs.wantedText ''
+    # sourced by sxmo_init.sh
+    . sxmo_common.sh
+
+    export SXMO_SWAY_SCALE=1.5
+    export SXMO_ROTATION_GRAVITY=12800
+
+    export DEFAULT_COUNTRY=US
+    export BROWSER=librewolf
+
+    export SXMO_BG_IMG="$(xdg_data_path sxmo/background.jpg)"
+  '';
+}

hosts/by-name/servo/default.nix

@@ -4,7 +4,6 @@
   imports = [
     ./fs.nix
     ./net.nix
-    ./secrets.nix
     ./services
   ];
 
@@ -15,11 +14,13 @@
     signaldctl.enableFor.user.colin = true;
   };
 
+  sane.roles.ac = true;
   sane.roles.build-machine.enable = true;
   sane.roles.build-machine.emulation = false;
   sane.zsh.showDeadlines = false;  # ~/knowledge doesn't always exist
   sane.services.dyn-dns.enable = true;
   sane.services.wg-home.enable = true;
+  sane.services.wg-home.enableWan = true;
   sane.services.wg-home.ip = config.sane.hosts.by-name."servo".wg-home.ip;
   # sane.services.duplicity.enable = true;  # TODO: re-enable after HW upgrade
 

hosts/by-name/servo/net.nix

@@ -3,6 +3,8 @@
 {
   networking.domain = "uninsane.org";
 
+  sane.services.wan-ports.openFirewall = true;
+
   # The global useDHCP flag is deprecated, therefore explicitly set to false here.
   # Per-interface useDHCP will be mandatory in the future, so this generated config
   # replicates the default behaviour.
@@ -11,9 +13,6 @@
   # XXX colin: probably don't need this. wlan0 won't be populated unless i touch a value in networking.interfaces.wlan0
   networking.wireless.enable = false;
 
-  # networking.firewall.enable = false;
-  networking.firewall.enable = true;
-
   # this is needed to forward packets from the VPN to the host
   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
 
@@ -33,6 +32,14 @@
   # - getent ahostsv4 www.google.com
   # - try fix: <https://serverfault.com/questions/765989/connect-to-3rd-party-vpn-server-but-dont-use-it-as-the-default-route/766290#766290>
   services.resolved.enable = true;
+  # without DNSSEC:
+  # - dig matrix.org => works
+  # - curl https://matrix.org => works
+  # with default DNSSEC:
+  # - dig matrix.org => works
+  # - curl https://matrix.org => fails
+  # i don't know why. this might somehow be interfering with the DNS run on this device (trust-dns)
+  services.resolved.dnssec = "false";
   networking.nameservers = [
     # use systemd-resolved resolver
     # full resolver (which understands /etc/hosts) lives on 127.0.0.53

hosts/by-name/servo/secrets.nix

@@ -1,42 +0,0 @@
-{ ... }:
-
-{
-  sops.secrets."ddns_afraid" = {
-    sopsFile = ../../../secrets/servo.yaml;
-  };
-  sops.secrets."ddns_he" = {
-    sopsFile = ../../../secrets/servo.yaml;
-  };
-
-  sops.secrets."dovecot_passwd" = {
-    sopsFile = ../../../secrets/servo.yaml;
-  };
-
-  sops.secrets."duplicity_passphrase" = {
-    sopsFile = ../../../secrets/servo.yaml;
-  };
-
-  sops.secrets."freshrss_passwd" = {
-    sopsFile = ../../../secrets/servo.yaml;
-  };
-
-  sops.secrets."matrix_synapse_secrets" = {
-    sopsFile = ../../../secrets/servo.yaml;
-  };
-  sops.secrets."mautrix_signal_env" = {
-    sopsFile = ../../../secrets/servo/mautrix_signal_env.bin;
-    format = "binary";
-  };
-
-  sops.secrets."mediawiki_pw" = {
-    sopsFile = ../../../secrets/servo.yaml;
-  };
-
-  sops.secrets."pleroma_secrets" = {
-    sopsFile = ../../../secrets/servo.yaml;
-  };
-
-  sops.secrets."wg_ovpns_privkey" = {
-    sopsFile = ../../../secrets/servo.yaml;
-  };
-}

hosts/by-name/servo/services/ddns-afraid.nix

@@ -6,7 +6,7 @@ lib.mkIf false
   systemd.services.ddns-afraid = {
     description = "update dynamic DNS entries for freedns.afraid.org";
     serviceConfig = {
-      EnvironmentFile = config.sops.secrets.ddns_afraid.path;
+      EnvironmentFile = config.sops.secrets."ddns_afraid.env".path;
       # TODO: ProtectSystem = "strict";
       # TODO: ProtectHome = "full";
       # TODO: PrivateTmp = true;

hosts/by-name/servo/services/ddns-he.nix

@@ -6,7 +6,7 @@ lib.mkIf false
   systemd.services.ddns-he = {
     description = "update dynamic DNS entries for HurricaneElectric";
     serviceConfig = {
-      EnvironmentFile = config.sops.secrets.ddns_he.path;
+      EnvironmentFile = config.sops.secrets."ddns_he.env".path;
       # TODO: ProtectSystem = "strict";
       # TODO: ProtectHome = "full";
       # TODO: PrivateTmp = true;

hosts/by-name/servo/services/default.nix

@@ -19,6 +19,7 @@
     ./navidrome.nix
     ./nixserve.nix
     ./nginx.nix
+    ./pict-rs.nix
     ./pleroma.nix
     ./postgres.nix
     ./prosody.nix

hosts/by-name/servo/services/ejabberd.nix

@@ -22,7 +22,7 @@
   sane.persist.sys.plaintext = [
     { user = "ejabberd"; group = "ejabberd"; directory = "/var/lib/ejabberd"; }
   ];
-  networking.firewall.allowedTCPPorts = [
+  sane.services.wan-ports.tcp = [
     3478  # STUN/TURN
     5222  # XMPP  client -> server
     5223  # XMPPS client -> server (XMPP over TLS)
@@ -33,9 +33,10 @@
     5349  # STUN/TURN (TLS)
     5443  # web services (file uploads, websockets, admin)
   ];
-  networking.firewall.allowedUDPPorts = [
+  sane.services.wan-ports.udp = [
     3478  # STUN/TURN
   ];
+  # TODO: forward these TURN ports!
   networking.firewall.allowedTCPPortRanges = [{
     from = 49152;  # TURN
     to = 49408;

hosts/by-name/servo/services/email/dovecot.nix

@@ -6,7 +6,7 @@
 
 { config, lib, pkgs, ... }:
 {
-  networking.firewall.allowedTCPPorts = [
+  sane.services.wan-ports.tcp = [
     # exposed over non-vpn imap.uninsane.org
     143  # IMAP
     993  # IMAPS

hosts/by-name/servo/services/email/postfix.nix

@@ -28,7 +28,7 @@ in
     # "/var/lib/dovecot"
   ];
 
-  networking.firewall.allowedTCPPorts = [
+  sane.services.wan-ports.tcp = [
     # exposed over vpn mx.uninsane.org
     25   # SMTP
     465  # SMTPS

hosts/by-name/servo/services/gitea.nix

@@ -1,3 +1,4 @@
+# config options: <https://docs.gitea.io/en-us/administration/config-cheat-sheet/>
 { config, pkgs, lib, ... }:
 
 {
@@ -10,9 +11,6 @@
   services.gitea.database.type = "postgres";
   services.gitea.database.user = "git";
   services.gitea.appName = "Perfectly Sane Git";
-  services.gitea.domain = "git.uninsane.org";
-  services.gitea.rootUrl = "https://git.uninsane.org/";
-  services.gitea.settings.session.COOKIE_SECURE = true;
   # services.gitea.disableRegistration = true;
 
   # gitea doesn't create the git user
@@ -27,9 +25,13 @@
   };
 
   services.gitea.settings = {
+    # options: "Trace", "Debug", "Info", "Warn", "Error", "Critical"
+    log.LEVEL = "Warn";
     server = {
       # options: "home", "explore", "organizations", "login" or URL fragment (or full URL)
       LANDING_PAGE = "explore";
+      DOMAIN = "git.uninsane.org";
+      ROOT_URL = "https://git.uninsane.org/";
     };
     service = {
       # timeout for email approval. 5760 = 4 days
@@ -44,6 +46,7 @@
       ENABLE_CAPTCHA = true;
       NOREPLY_ADDRESS = "noreply.anonymous.git@uninsane.org";
     };
+    session.COOKIE_SECURE = true;
     repository = {
       DEFAULT_BRANCH = "master";
     };
@@ -58,6 +61,8 @@
     };
     #"ui.meta" = ... to customize html author/description/etc
     mailer = {
+      # alternative is to use nixos-level config:
+      # services.gitea.mailerPasswordFile = ...
       ENABLED = true;
       MAILER_TYPE = "sendmail";
       FROM = "notify.git@uninsane.org";
@@ -69,8 +74,6 @@
       FORMAT = "RFC3339";
     };
   };
-  # options: "Trace", "Debug", "Info", "Warn", "Error", "Critical"
-  services.gitea.settings.log.LEVEL = "Warn";
 
   systemd.services.gitea.serviceConfig = {
     # nix default is AF_UNIX AF_INET AF_INET6.

hosts/by-name/servo/services/jellyfin.nix

@@ -18,6 +18,7 @@
 {
   # identical to:
   # services.jellyfin.openFirewall = true;
+  # N.B.: these are all for the LAN, so we don't go through `sane.services.wan-ports`.
   networking.firewall.allowedUDPPorts = [
     # https://jellyfin.org/docs/general/networking/index.html
     1900  # UPnP service discovery

hosts/by-name/servo/services/lemmy.nix

@@ -1,3 +1,8 @@
+# docs:
+# - <repo:LemmyNet/lemmy:docker/federation/nginx.conf>
+# - <repo:LemmyNet/lemmy:docker/nginx.conf>
+# - <repo:LemmyNet/lemmy-ansible:templates/nginx.conf>
+
 { config, lib, ... }:
 let
   inherit (builtins) toString;
@@ -9,11 +14,13 @@ in {
   services.lemmy = {
     enable = true;
     settings.hostname = "lemmy.uninsane.org";
-    settings.options.federation.enabled = true;
-    settings.options.port = backendPort;
-    # settings.database.host = "localhost";
+    settings.federation.enabled = true;
+    # federation.debug forces outbound federation queries to be run synchronously
+    # settings.federation.debug = true;
+    settings.port = backendPort;
     ui.port = uiPort;
     database.createLocally = true;
+    nginx.enable = true;
   };
 
   systemd.services.lemmy.serviceConfig = {
@@ -22,6 +29,20 @@ in {
     User = "lemmy";
     Group = "lemmy";
   };
+  systemd.services.lemmy.environment = {
+    RUST_BACKTRACE = "full";
+    # RUST_LOG = "debug";
+    # upstream defaults LEMMY_DATABASE_URL = "postgres:///lemmy?host=/run/postgresql";
+    # - Postgres complains that we didn't specify a user
+    # lemmy formats the url as:
+    # - postgres://{user}:{password}@{host}:{port}/{database}
+    # SO suggests (https://stackoverflow.com/questions/3582552/what-is-the-format-for-the-postgresql-connection-string-url):
+    # - postgresql://[user[:password]@][netloc][:port][/dbname][?param1=value1&...]
+    # LEMMY_DATABASE_URL = "postgres://lemmy@/run/postgresql";  # connection to server on socket "/run/postgresql/.s.PGSQL.5432" failed: FATAL:  database "run/postgresql" does not exist
+    # LEMMY_DATABASE_URL = "postgres://lemmy?host=/run/postgresql";  # no PostgreSQL user name specified in startup packet
+    # LEMMY_DATABASE_URL = mkForce "postgres://lemmy@?host=/run/postgresql";  # WORKS
+    LEMMY_DATABASE_URL = mkForce "postgres://lemmy@/lemmy?host=/run/postgresql";
+  };
   users.groups.lemmy = {};
   users.users.lemmy = {
     group = "lemmy";
@@ -31,28 +52,6 @@ in {
   services.nginx.virtualHosts."lemmy.uninsane.org" = {
     forceSSL = true;
     enableACME = true;
-    locations = let
-      ui = "http://127.0.0.1:${toString uiPort}";
-      backend = "http://127.0.0.1:${toString backendPort}";
-    in {
-      # see <LemmyNet/lemmy:docker/federation/nginx.conf>
-      "~ ^/(api|pictrs|feeds|nodeinfo|.well-known)" = {
-        extraConfig = ''
-          set $proxpass ${ui};
-          if ($http_accept = "application/activity+json") {
-            set $proxpass ${backend};
-          }
-          if ($http_accept = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"") {
-            set $proxpass ${backend};
-          }
-
-          # Cuts off the trailing slash on URLs to make them valid
-          rewrite ^(.+)/+$ $1 permanent;
-        '';
-        proxyPass = "$proxpass";
-      };
-      "/".proxyPass = ui;
-    };
   };
 
   sane.services.trust-dns.zones."uninsane.org".inet.CNAME."lemmy" = "native";

hosts/by-name/servo/services/matrix/default.nix

@@ -1,5 +1,6 @@
-# docs: https://nixos.wiki/wiki/Matrix
-# docs: https://nixos.org/manual/nixos/stable/index.html#module-services-matrix-synapse
+# docs: <https://nixos.wiki/wiki/Matrix>
+# docs: <https://nixos.org/manual/nixos/stable/index.html#module-services-matrix-synapse>
+# example config: <https://github.com/matrix-org/synapse/blob/develop/docs/sample_config.yaml>
 { config, lib, pkgs, ... }:
 
 {
@@ -41,11 +42,14 @@
     }
   ];
 
+  services.matrix-synapse.settings.x_forwarded = true;  # because we proxy matrix behind nginx
+  services.matrix-synapse.settings.max_upload_size = "100M";  # default is "50M"
+
   services.matrix-synapse.settings.admin_contact = "admin.matrix@uninsane.org";
   services.matrix-synapse.settings.registrations_require_3pid = [ "email" ];
 
   services.matrix-synapse.extraConfigFiles = [
-    config.sops.secrets.matrix_synapse_secrets.path
+    config.sops.secrets."matrix_synapse_secrets.yaml".path
   ];
 
   # services.matrix-synapse.extraConfigFiles = [builtins.toFile "matrix-synapse-extra-config" ''
@@ -94,6 +98,10 @@
 
     locations."/" = {
       proxyPass = "http://127.0.0.1:8008";
+      extraConfig = ''
+        # allow uploading large files (matrix enforces a separate limit, downstream)
+        client_max_body_size  512m;
+      '';
     };
     # redirect browsers to the web client.
     # i don't think native matrix clients ever fetch the root.
@@ -130,7 +138,7 @@
   };
 
 
-  sops.secrets."matrix_synapse_secrets" = {
+  sops.secrets."matrix_synapse_secrets.yaml" = {
     owner = config.users.users.matrix-synapse.name;
   };
 }

hosts/by-name/servo/services/matrix/discord-puppet.nix

@@ -1,4 +1,9 @@
 { lib, ... }:
+
+# XXX mx-discord-puppet uses nodejs_14 which is EOL
+# - mx-discord-puppet is abandoned upstream _and_ in nixpkgs
+# - recommended to use mautrix-discord: <https://github.com/NixOS/nixpkgs/pull/200462>
+lib.mkIf false
 {
   sane.persist.sys.plaintext = [
     { user = "matrix-synapse"; group = "matrix-synapse"; directory = "/var/lib/mx-puppet-discord"; }

hosts/by-name/servo/services/matrix/irc.nix

@@ -112,7 +112,6 @@ in
     "/var/lib/matrix-appservice-irc/registration.yml"  # auto-created by irc appservice
   ];
 
-  # Rizon supports CertFP for auth: https://wiki.rizon.net/index.php?title=CertFP
   services.matrix-appservice-irc.enable = true;
   services.matrix-appservice-irc.registrationUrl = "http://127.0.0.1:8009";
   services.matrix-appservice-irc.settings = {
@@ -127,12 +126,30 @@ in
 
     ircService = {
       servers = {
-        "irc.rizon.net" = ircServer { name = "Rizon"; };
+        "irc.esper.net" = ircServer {
+          name = "esper";
+          sasl = false;
+          # notable channels:
+          # - #merveilles
+        };
+        "irc.libera.chat" = ircServer {
+          name = "libera";
+          sasl = false;
+          # notable channels:
+          # - #hare
+        };
         "irc.myanonamouse.net" = ircServer {
           name = "MyAnonamouse";
           additionalAddresses = [ "irc2.myanonamouse.net" ];
           sasl = false;
         };
+        "irc.oftc.net" = ircServer {
+          name = "oftc";
+          # notable channels:
+          # - #sxmo
+          # - #sxmo-offtopic
+        };
+        "irc.rizon.net" = ircServer { name = "Rizon"; };
       };
     };
   };

hosts/by-name/servo/services/nginx.nix

@@ -13,7 +13,7 @@ let
 in
 {
 
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  sane.services.wan-ports.tcp = [ 80 443 ];
 
   services.nginx.enable = true;
   services.nginx.appendConfig = ''

hosts/by-name/servo/services/nixserve.nix

@@ -17,5 +17,5 @@
   sane.services.trust-dns.zones."uninsane.org".inet.CNAME."nixcache" = "native";
 
   sane.services.nixserve.enable = true;
-  sane.services.nixserve.sopsFile = ../../../../secrets/servo.yaml;
+  sane.services.nixserve.secretKeyFile = config.sops.secrets.nix_serve_privkey.path;
 }

hosts/by-name/servo/services/pict-rs.nix

@@ -0,0 +1,23 @@
+# pict-rs is an image database/store used by Lemmy.
+# i don't explicitly activate it here -- just adjust its defaults to be a bit friendlier
+{ config, lib, ... }:
+let
+  cfg = config.services.pict-rs;
+in
+{
+  sane.persist.sys.plaintext = lib.mkIf cfg.enable [
+    { user = "pict-rs"; group = "pict-rs"; directory = cfg.dataDir; }
+  ];
+
+  systemd.services.pict-rs.serviceConfig = {
+    # fix to use a normal user so we can configure perms correctly
+    DynamicUser = lib.mkForce false;
+    User = "pict-rs";
+    Group = "pict-rs";
+  };
+  users.groups.pict-rs = {};
+  users.users.pict-rs = {
+    group = "pict-rs";
+    isSystemUser = true;
+  };
+}

hosts/by-name/servo/services/prosody.nix

@@ -12,7 +12,7 @@ lib.mkIf false
   sane.persist.sys.plaintext = [
     { user = "prosody"; group = "prosody"; directory = "/var/lib/prosody"; }
   ];
-  networking.firewall.allowedTCPPorts = [
+  sane.services.wan-ports.tcp = [
     5222  # XMPP client -> server
     5269  # XMPP server -> server
     5280  # bosh

hosts/by-name/servo/services/transmission.nix

@@ -27,7 +27,7 @@
     # units in kBps
     speed-limit-down = 3000;
     speed-limit-down-enabled = true;
-    speed-limit-up = 300;
+    speed-limit-up = 600;
     speed-limit-up-enabled = true;
 
     # see: https://git.zknt.org/mirror/transmission/commit/cfce6e2e3a9b9d31a9dafedd0bdc8bf2cdb6e876?lang=bg-BG

hosts/common/default.nix

@@ -1,12 +1,10 @@
 { lib, pkgs, ... }:
 {
   imports = [
-    ./cross
     ./feeds.nix
     ./fs.nix
     ./hardware.nix
     ./home
-    ./i2p.nix
     ./ids.nix
     ./machine-id.nix
     ./net.nix
@@ -28,6 +26,7 @@
   sane.fs."/var/lib/private".dir.acl.mode = "0700";
 
   nixpkgs.config.allowUnfree = true;
+  nixpkgs.config.allowBroken = true;  # NIXPKGS_ALLOW_BROKEN
 
   # time.timeZone = "America/Los_Angeles";
   time.timeZone = "Etc/UTC";  # DST is too confusing for me => use a stable timezone

hosts/common/feeds.nix

@@ -65,7 +65,7 @@ let
     ## Maggie Killjoy -- referenced by Cory Doctorow
     (fromDb "omny.fm/shows/cool-people-who-did-cool-stuff" // pol)
     (fromDb "congressionaldish.libsyn.com" // pol)
-    (mkPod "https://podcasts.la.utexas.edu/this-is-democracy/feed/podcast/" // pol // weekly)
+    # (mkPod "https://podcasts.la.utexas.edu/this-is-democracy/feed/podcast/" // pol // weekly)
     ## Civboot -- https://anchor.fm/civboot
     (fromDb "anchor.fm/s/34c7232c/podcast/rss" // tech)
     ## Emerge: making sense of what's next -- <https://www.whatisemerging.com/emergepodcast>
@@ -125,7 +125,9 @@ let
     (fromDb "profectusmag.com" // uncat)
     (fromDb "semiaccurate.com" // tech)
     (mkText "https://linuxphoneapps.org/blog/atom.xml" // tech // infrequent)
+    (fromDb "tuxphones.com" // tech)
     (fromDb "spectrum.ieee.org" // tech)
+    (fromDb "theregister.com" // tech)
     (fromDb "thisweek.gnome.org" // tech)
     # more nixos stuff here, but unclear how to subscribe: <https://nixos.org/blog/categories.html>
     (mkText "https://nixos.org/blog/announcements-rss.xml" // tech // infrequent)
@@ -142,7 +144,7 @@ let
     (fromDb "ascii.textfiles.com" // tech)  # Jason Scott
     (fromDb "xn--gckvb8fzb.com" // tech)
     (fromDb "mg.lol" // tech)
-    (fromDb "drewdevault.com" // tech)
+    # (fromDb "drewdevault.com" // tech)
     ## Ken Shirriff
     (fromDb "righto.com" // tech)
     ## shared blog by a few NixOS devs, notably onny
@@ -189,6 +191,7 @@ let
     (fromDb "stpeter.im/atom.xml" // pol)
     ## Peter Saint-Andre -- side project of stpeter.im
     (fromDb "philosopher.coach" // rat)
+    (fromDb "morningbrew.com/feed" // pol)
 
     # RATIONALITY/PHILOSOPHY/ETC
     (mkSubstack "samkriss" // humor // infrequent)
@@ -207,6 +210,8 @@ let
     (fromDb "sideways-view.com" // rat)
     ## Sean Carroll
     (fromDb "preposterousuniverse.com" // rat)
+    (mkSubstack "eliqian" // rat // weekly)
+    (mkText "https://acoup.blog/feed" // rat // weekly)
 
     ## mostly dating topics. not advice, or humor, but looking through a social lens
     (fromDb "putanumonit.com" // rat)

hosts/common/hardware.nix

@@ -28,6 +28,11 @@
   # powertop will default to putting USB devices -- including HID -- to sleep after TWO SECONDS
   powerManagement.powertop.enable = false;
 
+  services.logind.extraConfig = ''
+    # don’t shutdown when power button is short-pressed
+    HandlePowerKey=ignore
+  '';
+
   # services.snapper.configs = {
   #   root = {
   #     subvolume = "/";

hosts/common/home/mime.nix

@@ -1,7 +1,7 @@
 { config, sane-lib, ...}:
 
 let
-  www = config.sane.web-browser.browser.desktop;
+  www = config.sane.programs.web-browser.config.browser.desktop;
   pdf = "org.gnome.Evince.desktop";
   md = "obsidian.desktop";
   thumb = "org.gnome.gThumb.desktop";
@@ -28,6 +28,7 @@ in
     # VIDEO
     "video/mp4" = video;
     "video/quicktime" = video;
+    "video/webm" = video;
     "video/x-matroska" = video;
     # HTML
     "text/html" = www;

hosts/common/i2p.nix

@@ -1,4 +0,0 @@
-{ ... }:
-{
-  services.i2p.enable = true;
-}

hosts/common/ids.nix

@@ -38,6 +38,8 @@
   sane.ids.komga.gid = 2407;
   sane.ids.lemmy.uid = 2408;
   sane.ids.lemmy.gid = 2408;
+  sane.ids.pict-rs.uid = 2409;
+  sane.ids.pict-rs.gid = 2409;
 
   sane.ids.colin.uid = 1000;
   sane.ids.guest.uid = 1100;
@@ -51,6 +53,7 @@
   sane.ids.nscd.gid = 2004;
   sane.ids.systemd-oom.uid = 2005;
   sane.ids.systemd-oom.gid = 2005;
+  sane.ids.wireshark.gid = 2006;
 
   # found on graphical hosts
   sane.ids.nm-iodine.uid = 2101;  # desko/moby/lappy

hosts/common/net.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ lib, ... }:
 
 {
   # the default backend is "wpa_supplicant".
@@ -20,4 +20,8 @@
     General.RoamThreshold = "-52";  # default -70
     General.RoamThreshold5G = "-52";  # default -76
   };
+
+  networking.firewall.allowedUDPPorts = [
+    1900  # to received UPnP advertisements. required by sane-ip-check-upnp
+  ];
 }

hosts/common/programs/aerc.nix

@@ -1,6 +1,6 @@
 # Terminal UI mail client
-{ config, sane-lib, ... }:
+{ ... }:
 
 {
-  sane.programs.aerc.secrets.".config/aerc/accounts.conf" = ../../../secrets/universal/aerc_accounts.conf.bin;
+  sane.programs.aerc.secrets.".config/aerc/accounts.conf" = ../../../secrets/common/aerc_accounts.conf.bin;
 }

hosts/common/programs/default.nix

@@ -42,6 +42,7 @@ let
       jq
       killall
       lsof
+      miniupnpc
       nano
       netcat
       nethogs
@@ -61,6 +62,7 @@ let
       tree
       usbutils
       wget
+      wirelesstools  # iwlist
     ;
   };
   sysadminExtraPkgs = {
@@ -102,7 +104,7 @@ let
       git  # needed as a user package, for config.
       gnupg
       gocryptfs
-      gopass
+      gopass  # TODO: shouldn't be needed here
       gopass-jsonapi
       imagemagick
       kitty  # TODO: move to GUI, but `ssh servo` from kitty sets `TERM=xterm-kitty` in the remove and breaks things
@@ -110,7 +112,7 @@ let
       lm_sensors  # for sensors-detect
       lshw
       ffmpeg
-      memtester
+      # memtester
       neovim
       # nettools
       # networkmanager
@@ -118,7 +120,7 @@ let
       # nixos-generators
       nmon
       # node2nix
-      oathToolkit  # for oathtool
+      # oathToolkit  # for oathtool
       # ponymix
       pulsemixer
       python3
@@ -131,7 +133,7 @@ let
       sops
       sox
       speedtest-cli
-      ssh-to-age
+      # ssh-to-age
       sudo
       # tageditor  # music tagging
       unar
@@ -146,7 +148,7 @@ let
 
   guiPkgs = {
     inherit (flattenedPkgs)
-      celluloid  # mpv frontend
+      # celluloid  # mpv frontend
       clinfo
       emote
       evince  # works on phosh
@@ -163,19 +165,19 @@ let
 
       # "gnome.cheese"
       "gnome.dconf-editor"
-      gnome-feeds  # RSS reader (with claimed mobile support)
+      # gnome-feeds  # RSS reader (with claimed mobile support)
       "gnome.file-roller"
       # "gnome.gnome-maps"  # works on phosh
       "gnome.nautilus"
       # gnome-podcasts
       "gnome.gnome-system-monitor"
       # "gnome.gnome-terminal"  # works on phosh
-      "gnome.gnome-weather"
-      gpodder-configured
+      # "gnome.gnome-weather"
+      gpodder
       gthumb
       jellyfin-media-player
       # lollypop
-      mpv
+      # mpv
       networkmanagerapplet
       # newsflash
       nheko
@@ -212,11 +214,12 @@ let
       kdenlive
       kid3  # audio tagging
       krita
-      libreoffice-fresh  # XXX colin: maybe don't want this on mobile
+      libreoffice-fresh
       mumble
       obsidian
       slic3r
       steam
+      wireshark  # could maybe ship the cli as sysadmin pkg
     ;
   };
   x86GuiPkgs = {
@@ -227,21 +230,21 @@ let
       # gnome.zenity # for kaiteki (it will use qarma, kdialog, or zenity)
       # gpt2tc  # XXX: unreliable mirror
 
-      logseq
+      # logseq  # Personal Knowledge Management
       losslesscut-bin
       makemkv
       monero-gui
       signal-desktop
       spotify
       tor-browser-bundle-bin
-      zeal-qt5  # programming docs viewer. TODO: switch to zeal-qt6
       zecwallet-lite
     ;
   };
 
-  # packages not part of any package set
+  # packages not part of any package set; not enabled by default
   otherPkgs = {
     inherit (pkgs)
+      lemmy-server
       mx-sanebot
       stepmania
     ;
@@ -271,6 +274,7 @@ in
     ./sublime-music.nix
     ./vlc.nix
     ./web-browser.nix
+    ./wireshark.nix
     ./zeal.nix
     ./zsh
   ];
@@ -299,6 +303,7 @@ in
         guiApps = {
           package = null;
           suggestedPrograms = (attrNames guiPkgs)
+            ++ [ "web-browser" ]
             ++ [ "tuiApps" ]
             ++ optional (pkgs.system == "x86_64-linux") "x86GuiApps";
         };
@@ -345,10 +350,6 @@ in
 
         ghostscript = {};  # used by imagemagick
 
-        # XXX: we preserve the whole thing because if we only preserve gPodder/Downloads
-        #   then startup is SLOW during feed import, and we might end up with zombie eps in the dl dir.
-        gpodder-configured.persist.plaintext = [ "gPodder" ];
-
         imagemagick = {
           package = pkgs.imagemagick.override {
             ghostscriptSupport = true;

hosts/common/programs/git.nix

@@ -1,18 +1,26 @@
-{ lib, pkgs, sane-lib, ... }:
+{ lib, pkgs, ... }:
 
 let
   mkCfg = lib.generators.toINI { };
 in
 {
-  sane.programs.git.fs.".config/git/config" = sane-lib.fs.wantedText (mkCfg {
+  sane.programs.git.fs.".config/git/config".symlink.text = mkCfg {
+    # top-level options documented:
+    # - <https://git-scm.com/docs/git-config#_variables>
+
     user.name = "Colin";
     user.email = "colin@uninsane.org";
+
     alias.co = "checkout";
+
     # difftastic docs:
     # - <https://difftastic.wilfred.me.uk/git.html>
     diff.tool = "difftastic";
     difftool.prompt = false;
     "difftool \"difftastic\"".cmd = ''${pkgs.difftastic}/bin/difft "$LOCAL" "$REMOTE"'';
     # now run `git difftool` to use difftastic git
-  });
+
+    # render dates as YYYY-MM-DD HH:MM:SS +TZ
+    log.date = "iso";
+  };
 }

hosts/common/programs/gnome-feeds.nix

@@ -6,37 +6,35 @@ let
   all-feeds = config.sane.feeds;
   wanted-feeds = feeds.filterByFormat ["text" "image"] all-feeds;
 in {
-  sane.programs.gnome-feeds.fs.".config/org.gabmus.gfeeds.json" = sane-lib.fs.wantedText (
-    builtins.toJSON {
-      # feed format is a map from URL to a dict,
-      #   with dict["tags"] a list of string tags.
-      feeds = sane-lib.mapToAttrs (feed: {
-        name = feed.url;
-        value.tags = [ feed.cat feed.freq ];
-      }) wanted-feeds;
-      dark_reader = false;
-      new_first = true;
-      # windowsize = {
-      #   width = 350;
-      #   height = 650;
-      # };
-      max_article_age_days = 90;
-      enable_js = false;
-      max_refresh_threads = 3;
-      # saved_items = {};
-      # read_items = [];
-      show_read_items = true;
-      full_article_title = true;
-      # views: "webview", "reader", "rsscont"
-      default_view = "rsscont";
-      open_links_externally = true;
-      full_feed_name = false;
-      refresh_on_startup = true;
-      tags = lib.unique (
-        (builtins.catAttrs "cat" wanted-feeds) ++ (builtins.catAttrs "freq" wanted-feeds)
-      );
-      open_youtube_externally = false;
-      media_player = "vlc";  # default: mpv
-    }
-  );
+  sane.programs.gnome-feeds.fs.".config/org.gabmus.gfeeds.json".symlink.text = builtins.toJSON {
+    # feed format is a map from URL to a dict,
+    #   with dict["tags"] a list of string tags.
+    feeds = sane-lib.mapToAttrs (feed: {
+      name = feed.url;
+      value.tags = [ feed.cat feed.freq ];
+    }) wanted-feeds;
+    dark_reader = false;
+    new_first = true;
+    # windowsize = {
+    #   width = 350;
+    #   height = 650;
+    # };
+    max_article_age_days = 90;
+    enable_js = false;
+    max_refresh_threads = 3;
+    # saved_items = {};
+    # read_items = [];
+    show_read_items = true;
+    full_article_title = true;
+    # views: "webview", "reader", "rsscont"
+    default_view = "rsscont";
+    open_links_externally = true;
+    full_feed_name = false;
+    refresh_on_startup = true;
+    tags = lib.unique (
+      (builtins.catAttrs "cat" wanted-feeds) ++ (builtins.catAttrs "freq" wanted-feeds)
+    );
+    open_youtube_externally = false;
+    media_player = "vlc";  # default: mpv
+  };
 }

hosts/common/programs/gpodder.nix

@@ -1,12 +1,17 @@
 # gnome feeds RSS viewer
-{ config, sane-lib, ... }:
+{ config, pkgs, sane-lib, ... }:
 
 let
   feeds = sane-lib.feeds;
   all-feeds = config.sane.feeds;
   wanted-feeds = feeds.filterByFormat ["podcast"] all-feeds;
 in {
-  sane.programs.gpodder.fs.".config/gpodderFeeds.opml" = sane-lib.fs.wantedText (
-    feeds.feedsToOpml wanted-feeds
-  );
+  sane.programs.gpodder = {
+    package = pkgs.gpodder-configured;
+    fs.".config/gpodderFeeds.opml".symlink.text = feeds.feedsToOpml wanted-feeds;
+
+    # XXX: we preserve the whole thing because if we only preserve gPodder/Downloads
+    #   then startup is SLOW during feed import, and we might end up with zombie eps in the dl dir.
+    persist.plaintext = [ "gPodder" ];
+  };
 }

hosts/common/programs/kitty/default.nix

@@ -1,7 +1,7 @@
-{ pkgs, sane-lib, ... }:
+{ ... }:
 
 {
-  sane.programs.kitty.fs.".config/kitty/kitty.conf" = sane-lib.fs.wantedText ''
+  sane.programs.kitty.fs.".config/kitty/kitty.conf".symlink.text = ''
     # docs: https://sw.kovidgoyal.net/kitty/conf/
     # disable terminal bell (when e.g. you backspace too many times)
     enable_audio_bell no

hosts/common/programs/libreoffice.nix

@@ -1,8 +1,8 @@
-{ sane-lib, ... }:
+{ ... }:
 
 {
   # libreoffice: disable first-run stuff
-  sane.programs.libreoffice-fresh.fs.".config/libreoffice/4/user/registrymodifications.xcu" = sane-lib.fs.wantedText ''
+  sane.programs.libreoffice-fresh.fs.".config/libreoffice/4/user/registrymodifications.xcu".symlink.text = ''
     <?xml version="1.0" encoding="UTF-8"?>
     <oor:items xmlns:oor="http://openoffice.org/2001/registry" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
       <item oor:path="/org.openoffice.Office.Common/Misc"><prop oor:name="FirstRun" oor:op="fuse"><value>false</value></prop></item>

hosts/common/programs/mpv.nix

@@ -1,10 +1,10 @@
-{ sane-lib, ... }:
+{ ... }:
 
 {
   sane.programs.mpv = {
     persist.plaintext = [ ".config/mpv/watch_later" ];
     # format is <key>=%<length>%<value>
-    fs.".config/mpv/mpv.conf" = sane-lib.fs.wantedText ''
+    fs.".config/mpv/mpv.conf".symlink.text = ''
       save-position-on-quit=%3%yes
       keep-open=%3%yes
     '';

hosts/common/programs/newsflash.nix

@@ -8,8 +8,8 @@ let
 in {
   sane.programs.newsflash = {
     persist.plaintext = [ ".local/share/news-flash" ];
-    fs.".config/newsflashFeeds.opml" = sane-lib.fs.wantedText (
+    fs.".config/newsflashFeeds.opml".symlink.text =
       feeds.feedsToOpml wanted-feeds
-    );
+    ;
   };
 }

hosts/common/programs/offlineimap.nix

@@ -7,6 +7,6 @@
 { ... }:
 
 {
-  sane.programs.offlineimap.secrets.".config/offlineimap/config" = ../../../secrets/universal/offlineimaprc.bin;
+  sane.programs.offlineimap.secrets.".config/offlineimap/config" = ../../../secrets/common/offlineimaprc.bin;
 }
 

hosts/common/programs/ripgrep.nix

@@ -1,9 +1,9 @@
-{ sane-lib, ... }:
+{ ... }:
 {
   # .ignore file is read by ripgrep (rg), silver searcher (ag), maybe others.
   # ignore translation files by default when searching, as they tend to have
   # a LOT of duplicate text.
-  sane.programs.ripgrep.fs.".ignore" = sane-lib.fs.wantedText ''
+  sane.programs.ripgrep.fs.".ignore".symlink.text = ''
     po/
   '';
 }

hosts/common/programs/splatmoji.nix

@@ -1,12 +1,12 @@
 # borrows from:
 # - default config: <https://github.com/cspeterson/splatmoji/blob/master/splatmoji.config>
 # - wayland: <https://github.com/cspeterson/splatmoji/issues/32#issuecomment-830862566>
-{ pkgs, sane-lib, ... }:
+{ pkgs, ... }:
 
 {
   sane.programs.splatmoji = {
     persist.plaintext = [ ".local/state/splatmoji" ];
-    fs.".config/splatmoji/splatmoji.config" = sane-lib.fs.wantedText ''
+    fs.".config/splatmoji/splatmoji.config".symlink.text = ''
       # XXX doesn't seem to understand ~ as shorthand for `$HOME`
       history_file=/home/colin/.local/state/splatmoji/history
       history_length=5

hosts/common/programs/sublime-music.nix

@@ -9,6 +9,6 @@
     #   possible to pass config as a CLI arg (sublime-music -c config.json)
     persist.plaintext = [ ".local/share/sublime-music" ];
 
-    secrets.".config/sublime-music/config.json" = ../../../secrets/universal/sublime_music_config.json.bin;
+    secrets.".config/sublime-music/config.json" = ../../../secrets/common/sublime_music_config.json.bin;
   };
 }

hosts/common/programs/vlc.nix

@@ -12,7 +12,7 @@ in
   sane.programs.vlc = {
     # vlc remembers play position in ~/.config/vlc/vlc-qt-interface.conf
     persist.plaintext = [ ".config/vlc" ];
-    fs.".config/vlc/vlcrc" = sane-lib.fs.wantedText ''
+    fs.".config/vlc/vlcrc".symlink.text = ''
       [podcast]
       podcast-urls=${podcast-urls}
       [core]

hosts/common/programs/web-browser.nix

@@ -6,10 +6,10 @@
 # many of the settings below won't have effect without those patches.
 # see: https://gitlab.com/librewolf-community/settings/-/blob/master/distribution/policies.json
 
-{ config, lib, pkgs, sane-lib, ...}:
+{ config, lib, pkgs, ...}:
 with lib;
 let
-  cfg = config.sane.web-browser;
+  cfg = config.sane.programs.web-browser.config;
   # allow easy switching between firefox and librewolf with `defaultSettings`, below
   librewolfSettings = {
     browser = pkgs.librewolf-unwrapped;
@@ -50,16 +50,32 @@ let
     inherit (pkgs.librewolf-unwrapped) extraPrefsFiles;
     inherit (cfg.browser) libName;
 
-    extraNativeMessagingHosts = [ pkgs.browserpass ];
+    extraNativeMessagingHosts = optional cfg.addons.browserpass-extension.enable pkgs.browserpass;
     # extraNativeMessagingHosts = [ pkgs.gopass-native-messaging-host ];
 
     nixExtensions = concatMap (ext: optional ext.enable ext.package) (attrValues cfg.addons);
 
     extraPolicies = {
+      FirefoxHome = {
+        Search = true;
+        Pocket = false;
+        Snippets = false;
+        TopSites = false;
+        Highlights = false;
+      };
       NoDefaultBookmarks = true;
+      OfferToSaveLogins = false;
+      OfferToSaveLoginsDefault = false;
+      PasswordManagerEnabled = false;
       SearchEngines = {
         Default = "DuckDuckGo";
       };
+      UserMessaging = {
+        ExtensionRecommendations = false;
+        SkipOnboarding = true;
+      };
+
+      # these were taken from Librewolf
       AppUpdateURL = "https://localhost";
       DisableAppUpdate = true;
       OverrideFirstRunPage = "";
@@ -88,6 +104,7 @@ let
       # };
       # NewTabPage = true;
     };
+    # extraPrefs = ...
   };
 
   addonOpts = types.submodule {
@@ -100,55 +117,78 @@ let
       };
     };
   };
-in
-{
-  options = {
-    sane.web-browser.browser = mkOption {
-      default = defaultSettings;
-      type = types.attrs;
-    };
-    sane.web-browser.persistData = mkOption {
-      description = "optional store name to which persist browsing data (like history)";
-      type = types.nullOr types.str;
-      default = null;
-    };
-    sane.web-browser.persistCache = mkOption {
-      description = "optional store name to which persist browser cache";
-      type = types.nullOr types.str;
-      default = "cryptClearOnBoot";
-    };
-    sane.web-browser.addons = mkOption {
-      type = types.attrsOf addonOpts;
-      default = {
-        # get names from:
-        # - ~/ref/nix-community/nur-combined/repos/rycee/pkgs/firefox-addons/generated-firefox-addons.nix
-        # `wget ...xpi`; `unar ...xpi`; `cat */manifest.json | jq '.browser_specific_settings.gecko.id'`
-        # browserpass-ce.package = addon "browserpass-ce" "browserpass@maximbaz.com" "sha256-sXgUBbRvMnRpeIW1MTkmTcoqtW/8RDXAkxAq1evFkpc=";
-        browserpass-extension.package = localAddon pkgs.browserpass-extension;
-        # TODO: build bypass-paywalls from source? it's mysteriously disappeared from the Mozilla store.
-        # bypass-paywalls-clean.package = addon "bypass-paywalls-clean" "{d133e097-46d9-4ecc-9903-fa6a722a6e0e}" "sha256-oUwdqdAwV3DezaTtOMx7A/s4lzIws+t2f08mwk+324k=";
-        ether-metamask.package = addon "ether-metamask" "webextension@metamask.io" "sha256-G+MwJDOcsaxYSUXjahHJmkWnjLeQ0Wven8DU/lGeMzA=";
-        i2p-in-private-browsing.package = addon "i2p-in-private-browsing" "i2ppb@eyedeekay.github.io" "sha256-dJcJ3jxeAeAkRvhODeIVrCflvX+S4E0wT/PyYzQBQWs=";
-        sidebery.package = addon "sidebery" "{3c078156-979c-498b-8990-85f7987dd929}" "sha256-YONfK/rIjlsrTgRHIt3km07Q7KnpIW89Z9r92ZSCc6w=";
-        sponsorblock.package = addon "sponsorblock" "sponsorBlocker@ajay.app" "sha256-hRsvLaAsVm3dALsTrJqHTNgRFAQcU7XSaGhr5G6+mFs=";
-        ublacklist.package = addon "ublacklist" "@ublacklist" "sha256-RqY5iHzbL2qizth7aguyOKWPyINXmrwOlf/OsfqAS48=";
-        ublock-origin.package = addon "ublock-origin" "uBlock0@raymondhill.net" "sha256-eHlQrU/b9X/6sTbHBpGAd+0VsLT7IrVCnd0AQ948lyA=";
 
-        browserpass-extension.enable = lib.mkDefault true;
-        # bypass-paywalls-clean.enable = lib.mkDefault true;
-        ether-metamask.enable = lib.mkDefault true;
-        i2p-in-private-browsing.enable = lib.mkDefault config.services.i2p.enable;
-        sidebery.enable = lib.mkDefault true;
-        sponsorblock.enable = lib.mkDefault true;
-        ublacklist.enable = lib.mkDefault true;
-        ublock-origin.enable = lib.mkDefault true;
+  configOpts = {
+    options = {
+      browser = mkOption {
+        default = defaultSettings;
+        type = types.anything;
+      };
+      persistData = mkOption {
+        description = "optional store name to which persist browsing data (like history)";
+        type = types.nullOr types.str;
+        default = null;
+      };
+      persistCache = mkOption {
+        description = "optional store name to which persist browser cache";
+        type = types.nullOr types.str;
+        default = "cryptClearOnBoot";
+      };
+      addons = mkOption {
+        type = types.attrsOf addonOpts;
+        default = {};
       };
     };
   };
-
+in
+{
   config = mkMerge [
     ({
-      sane.programs.guiApps.suggestedPrograms = [ "web-browser" ];
+      sane.programs.web-browser.configOption = mkOption {
+        type = types.submodule configOpts;
+        default = {};
+      };
+      sane.programs.web-browser.config.addons = {
+        # get names from:
+        # - ~/ref/nix-community/nur-combined/repos/rycee/pkgs/firefox-addons/generated-firefox-addons.nix
+        # `wget ...xpi`; `unar ...xpi`; `cat */manifest.json | jq '.browser_specific_settings.gecko.id'`
+        browserpass-extension = {
+          # package = addon "browserpass-ce" "browserpass@maximbaz.com" "sha256-sXgUBbRvMnRpeIW1MTkmTcoqtW/8RDXAkxAq1evFkpc=";
+          package = localAddon pkgs.browserpass-extension;
+          enable = lib.mkDefault true;
+        };
+
+        # TODO: build bypass-paywalls from source? it's mysteriously disappeared from the Mozilla store.
+        # bypass-paywalls-clean.package = addon "bypass-paywalls-clean" "{d133e097-46d9-4ecc-9903-fa6a722a6e0e}" "sha256-oUwdqdAwV3DezaTtOMx7A/s4lzIws+t2f08mwk+324k=";
+        # bypass-paywalls-clean.enable = lib.mkDefault true;
+
+        ether-metamask = {
+          package = addon "ether-metamask" "webextension@metamask.io" "sha256-G+MwJDOcsaxYSUXjahHJmkWnjLeQ0Wven8DU/lGeMzA=";
+          enable = lib.mkDefault true;
+        };
+        i2p-in-private-browsing = {
+          package = addon "i2p-in-private-browsing" "i2ppb@eyedeekay.github.io" "sha256-dJcJ3jxeAeAkRvhODeIVrCflvX+S4E0wT/PyYzQBQWs=";
+          enable = lib.mkDefault config.services.i2p.enable;
+        };
+        sidebery = {
+          package = addon "sidebery" "{3c078156-979c-498b-8990-85f7987dd929}" "sha256-YONfK/rIjlsrTgRHIt3km07Q7KnpIW89Z9r92ZSCc6w=";
+          enable = lib.mkDefault true;
+        };
+        sponsorblock = {
+          package = addon "sponsorblock" "sponsorBlocker@ajay.app" "sha256-hRsvLaAsVm3dALsTrJqHTNgRFAQcU7XSaGhr5G6+mFs=";
+          enable = lib.mkDefault true;
+        };
+        ublacklist = {
+          package = addon "ublacklist" "@ublacklist" "sha256-RqY5iHzbL2qizth7aguyOKWPyINXmrwOlf/OsfqAS48=";
+          enable = lib.mkDefault true;
+        };
+        ublock-origin = {
+          package = addon "ublock-origin" "uBlock0@raymondhill.net" "sha256-eHlQrU/b9X/6sTbHBpGAd+0VsLT7IrVCnd0AQ948lyA=";
+          enable = lib.mkDefault true;
+        };
+      };
+    })
+    ({
       sane.programs.web-browser = {
         inherit package;
 
@@ -160,7 +200,7 @@ in
         # the specific attribute path is found via scraping ublock code here:
         # - <https://github.com/gorhill/uBlock/blob/master/src/js/storage.js>
         # - <https://github.com/gorhill/uBlock/blob/master/assets/assets.json>
-        fs."${cfg.browser.dotDir}/managed-storage/uBlock0@raymondhill.net.json" = sane-lib.fs.wantedText ''
+        fs."${cfg.browser.dotDir}/managed-storage/uBlock0@raymondhill.net.json".symlink.text = ''
           {
            "name": "uBlock0@raymondhill.net",
            "description": "ignored",
@@ -170,16 +210,16 @@ in
            }
           }
         '';
-        fs."${cfg.browser.dotDir}/${cfg.browser.libName}.overrides.cfg" = sane-lib.fs.wantedText ''
+        fs."${cfg.browser.dotDir}/${cfg.browser.libName}.overrides.cfg".symlink.text = ''
           // if we can't query the revocation status of a SSL cert because the issuer is offline,
           // treat it as unrevoked.
           // see: <https://librewolf.net/docs/faq/#im-getting-sec_error_ocsp_server_error-what-can-i-do>
           defaultPref("security.OCSP.require", false);
         '';
-        fs."${cfg.browser.dotDir}/default" = sane-lib.fs.wantedDir;
+        fs."${cfg.browser.dotDir}/default".dir = {};
         # instruct Firefox to put the profile in a predictable directory (so we can do things like persist just it).
         # XXX: the directory *must* exist, even if empty; Firefox will not create the directory itself.
-        fs."${cfg.browser.dotDir}/profiles.ini" = sane-lib.fs.wantedText ''
+        fs."${cfg.browser.dotDir}/profiles.ini".symlink.text = ''
           [Profile0]
           Name=default
           IsRelative=1

hosts/common/programs/wireshark.nix

@@ -0,0 +1,5 @@
+{ config, ... }:
+{
+  sane.programs.wireshark = {};
+  programs.wireshark.enable = config.sane.programs.wireshark.enabled;
+}

hosts/common/programs/zeal.nix

@@ -1,16 +1,55 @@
-{ config, lib, sane-lib, ... }:
+{ config, lib, pkgs, ... }:
 let
-  inherit (lib) mkIf;
+  inherit (builtins) map;
+  inherit (lib) mkIf mkOption optionalString types;
+  cfg = config.sane.programs.docsets.config;
+  configOpts = types.submodule {
+    options = {
+      rustPkgs = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+      };
+    };
+  };
 in {
-  sane.programs.zeal-qt5 = {
+  sane.programs.zeal = {
+    package = pkgs.zeal-qt5;
     persist.plaintext = [
       ".cache/Zeal"
       ".local/share/Zeal"
     ];
-    fs.".local/share/Zeal/Zeal/system" = sane-lib.fs.wantedSymlinkTo "/run/current-system/sw/share/docset";
+    fs.".local/share/Zeal/Zeal/docsets/system".symlink.target = "/run/current-system/sw/share/docset";
+    suggestedPrograms = [ "docsets" ];
   };
 
-  environment.pathsToLink = mkIf config.sane.programs.zeal-qt5.enabled [
+  sane.programs.docsets = {
+    configOption = mkOption {
+      type = configOpts;
+      default = {};
+    };
+    package = pkgs.symlinkJoin {
+      name = "docsets";
+      # build each package with rust docs
+      paths = map (name:
+        let
+          orig = pkgs."${name}";
+          withDocs = orig.overrideAttrs (upstream: {
+            nativeBuildInputs = upstream.nativeBuildInputs or [] ++ [
+              pkgs.cargoDocsetHook
+            ];
+          });
+        in
+        "${toString withDocs}/share/docset"
+      ) cfg.rustPkgs;
+      # link only the docs (not any binaries)
+      postBuild = optionalString (cfg.rustPkgs != []) ''
+        mkdir -p $out/share/docset
+        mv $out/*.docset $out/share/docset
+      '';
+    };
+  };
+
+  environment.pathsToLink = mkIf config.sane.programs.zeal.enabled [
     "/share/docset"
   ];
 }

hosts/common/programs/zsh/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, sane-lib, ... }:
+{ config, lib, pkgs, ... }:
 
 let
   inherit (lib) mkIf mkMerge mkOption types;
@@ -51,12 +51,12 @@ in
         ];
 
         # zsh/prezto complains if zshrc doesn't exist; but it does allow an "empty" file.
-        fs.".config/zsh/.zshrc" = sane-lib.fs.wantedText "# ";
+        fs.".config/zsh/.zshrc".symlink.text = "# ";
 
         # prezto = oh-my-zsh fork; controls prompt, auto-completion, etc.
         # see: https://github.com/sorin-ionescu/prezto
         # i believe this file is auto-sourced by the prezto init.zsh script.
-        fs.".config/zsh/.zpreztorc" = sane-lib.fs.wantedText ''
+        fs.".config/zsh/.zpreztorc".symlink.text = ''
           zstyle ':prezto:*:*' color 'yes'
 
           # modules (they ship with prezto):

hosts/common/secrets.nix

@@ -1,38 +1,49 @@
-{ config, ... }:
+# SOPS configuration:
+#   docs: https://github.com/Mic92/sops-nix
+#
+# for each new user you want to edit sops files:
+# create a private age key from ssh key:
+#   $ mkdir -p ~/.config/sops/age; ssh-to-age -private-key -i ~/.ssh/id_ed25519 > ~/.config/sops/age/keys.txt; chmod 600 ~/.config/sops/age/keys.txt
+#   if the private key was password protected, then first decrypt it:
+#     $ cp ~/.ssh/id_ed25519 /tmp/id_ed25519
+#     $ ssh-keygen -p -N "" -f /tmp/id_ed25519
+#
+# for each user you want to decrypt secrets:
+#   $ cat ~/.ssh/id_ed25519.pub | ssh-to-age
+#   add the result to .sops.yaml
+#   since we specify ssh pubkeys in the nix config, you can just grep for `ssh-ed25519` here and use those instead
+#
+# for each host you want to decrypt secrets:
+#   $ cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
+#   add the result to .sops.yaml
+#   $ sops updatekeys secrets/example.yaml
+#
+# to create a new secret:
+#   $ sops secrets/example.yaml
+#   control access below (sops.secret.<x>.owner = ...)
+#
+# to read a secret:
+#   $ cat /run/secrets/example_key
 
+{ config, lib, sane-lib, ... }:
+
+let
+  inherit (lib.strings) hasSuffix removeSuffix;
+  secretsForHost = host: sane-lib.joinAttrsets (
+    map
+      (path: lib.optionalAttrs (hasSuffix ".bin" path) (sane-lib.nameValueToAttrs {
+        name = removeSuffix ".bin" path;
+        value = {
+          sopsFile = ../../secrets/${host}/${path};
+          format = "binary";
+        };
+      }))
+      (sane-lib.enumerateFilePaths ../../secrets/${host})
+  );
+in
 {
-  # SOPS configuration:
-  #   docs: https://github.com/Mic92/sops-nix
-  #
-  # for each new user you want to edit sops files:
-  # create a private age key from ssh key:
-  #   $ mkdir -p ~/.config/sops/age; ssh-to-age -private-key -i ~/.ssh/id_ed25519 > ~/.config/sops/age/keys.txt; chmod 600 ~/.config/sops/age/keys.txt
-  #   if the private key was password protected, then first decrypt it:
-  #     $ cp ~/.ssh/id_ed25519 /tmp/id_ed25519
-  #     $ ssh-keygen -p -N "" -f /tmp/id_ed25519
-  #
-  # for each user you want to decrypt secrets:
-  #   $ cat ~/.ssh/id_ed25519.pub | ssh-to-age
-  #   add the result to .sops.yaml
-  #   since we specify ssh pubkeys in the nix config, you can just grep for `ssh-ed25519` here and use those instead
-  #
-  # for each host you want to decrypt secrets:
-  #   $ cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
-  #   add the result to .sops.yaml
-  #   $ sops updatekeys secrets/example.yaml
-  #
-  # to create a new secret:
-  #   $ sops secrets/example.yaml
-  #   control access below (sops.secret.<x>.owner = ...)
-  #
-  # to read a secret:
-  #   $ cat /run/secrets/example_key
 
   # sops.age.sshKeyPaths = [ "/home/colin/.ssh/id_ed25519_dec" ];
-  # This will add secrets.yaml to the nix store
-  # You can avoid this by adding a string to the full path instead, i.e.
-  # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
-  sops.defaultSopsFile = ../../secrets/universal.yaml;
   sops.gnupg.sshKeyPaths = [];  # disable RSA key import
   # This is using an age key that is expected to already be in the filesystem
   # sops.age.keyFile = "/home/colin/.ssh/age.pub";
@@ -45,96 +56,15 @@
   # };
   # sops.secrets."myservice/my_subdir/my_secret" = {};
 
-  ## universal secrets
-  # TODO: glob these?
-
-  sops.secrets."jackett_apikey" = {
-    sopsFile = ../../secrets/universal.yaml;
-    owner = config.users.users.colin.name;
-  };
-  sops.secrets."mx-sanebot-env" = {
-    sopsFile = ../../secrets/universal/mx-sanebot-env.bin;
-    format = "binary";
-    owner = config.users.users.colin.name;
-  };
-  sops.secrets."router_passwd" = {
-    sopsFile = ../../secrets/universal.yaml;
-  };
-  sops.secrets."transmission_passwd" = {
-    sopsFile = ../../secrets/universal.yaml;
-  };
-  sops.secrets."wg_ovpnd_us_privkey" = {
-    sopsFile = ../../secrets/universal.yaml;
-  };
-  sops.secrets."wg_ovpnd_us-atl_privkey" = {
-    sopsFile = ../../secrets/universal.yaml;
-  };
-  sops.secrets."wg_ovpnd_us-mi_privkey" = {
-    sopsFile = ../../secrets/universal.yaml;
-  };
-  sops.secrets."wg_ovpnd_ukr_privkey" = {
-    sopsFile = ../../secrets/universal.yaml;
-  };
-
-  sops.secrets."snippets" = {
-    sopsFile = ../../secrets/universal/snippets.bin;
-    format = "binary";
-    owner = config.users.users.colin.name;
-  };
-
-  sops.secrets."bt/car" = {
-    sopsFile = ../../secrets/universal/bt/car.bin;
-    format = "binary";
-  };
-  sops.secrets."bt/earbuds" = {
-    sopsFile = ../../secrets/universal/bt/earbuds.bin;
-    format = "binary";
-  };
-  sops.secrets."bt/portable-speaker" = {
-    sopsFile = ../../secrets/universal/bt/portable-speaker.bin;
-    format = "binary";
-  };
-
-  sops.secrets."iwd/community-university.psk" = {
-    sopsFile = ../../secrets/universal/net/community-university.psk.bin;
-    format = "binary";
-  };
-  sops.secrets."iwd/friend-libertarian-dod.psk" = {
-    sopsFile = ../../secrets/universal/net/friend-libertarian-dod.psk.bin;
-    format = "binary";
-  };
-  sops.secrets."iwd/friend-rationalist-empathist.psk" = {
-    sopsFile = ../../secrets/universal/net/friend-rationalist-empathist.psk.bin;
-    format = "binary";
-  };
-  sops.secrets."iwd/home-shared.psk" = {
-    sopsFile = ../../secrets/universal/net/home-shared.psk.bin;
-    format = "binary";
-  };
-  sops.secrets."iwd/makespace-south.psk" = {
-    sopsFile = ../../secrets/universal/net/makespace-south.psk.bin;
-    format = "binary";
-  };
-  sops.secrets."iwd/archive-2023-02-home-bedroom.psk" = {
-    sopsFile = ../../secrets/universal/net/archive/2023-02-home-bedroom.psk.bin;
-    format = "binary";
-  };
-  sops.secrets."iwd/archive-2023-02-home-shared-24G.psk" = {
-    sopsFile = ../../secrets/universal/net/archive/2023-02-home-shared-24G.psk.bin;
-    format = "binary";
-  };
-  sops.secrets."iwd/archive-2023-02-home-shared.psk" = {
-    sopsFile = ../../secrets/universal/net/archive/2023-02-home-shared.psk.bin;
-    format = "binary";
-  };
-  sops.secrets."iwd/iphone" = {
-    sopsFile = ../../secrets/universal/net/iphone.psk.bin;
-    format = "binary";
-  };
-  sops.secrets."iwd/parents" = {
-    sopsFile = ../../secrets/universal/net/parents.psk.bin;
-    format = "binary";
-  };
+  sops.secrets = lib.mkMerge [
+    (secretsForHost "common")
+    (secretsForHost config.networking.hostName)
+    {
+      "jackett_apikey".owner = config.users.users.colin.name;
+      "mx-sanebot-env".owner = config.users.users.colin.name;
+      "snippets".owner = config.users.users.colin.name;
+    }
+  ];
 }
 
 

hosts/common/users.nix

@@ -33,13 +33,14 @@ in
       ];
       group = "users";
       extraGroups = [
-        "wheel"
-        "nixbuild"
-        "networkmanager"
-        # phosh/mobile. XXX colin: unsure if necessary
-        "video"
+        "dialout"  # required for modem access (moby)
         "feedbackd"
-        "dialout" # required for modem access
+        "input"  # for /dev/input/<xyz>: sxmo
+        "networkmanager"
+        "nixbuild"
+        "video"  # phosh/mobile. XXX colin: unsure if necessary
+        "wheel"
+        "wireshark"
       ];
 
       # initial password is empty, in case anything goes wrong.

hosts/common/vpn.nix

@@ -11,7 +11,7 @@ let
   def-ovpn = name: { endpoint, publicKey, address }: {
     networking.wg-quick.interfaces."ovpnd-${name}" = {
       inherit address;
-      privateKeyFile = config.sops.secrets."wg_ovpnd_${name}_privkey".path;
+      privateKeyFile = config.sops.secrets."wg/ovpnd_${name}_privkey".path;
       dns = [
         "46.227.67.134"
         "192.165.9.158"

hosts/instantiate.nix

@@ -4,7 +4,7 @@
 { hostName, localSystem }:
 
 # module args
-{ config, lib, ... }:
+{ lib, ... }:
 
 {
   imports = [
@@ -15,15 +15,4 @@
 
   networking.hostName = hostName;
   nixpkgs.buildPlatform = lib.mkIf (localSystem != null) localSystem;
-  sane.cross.enablePatches = localSystem != null;
-
-  # nixpkgs.overlays = [
-  #   (next: prev: {
-  #     # for local != target we by default just emulate the target while building.
-  #     # provide a `pkgs.cross.<pkg>` alias that consumers can use instead of `pkgs.<foo>`
-  #     # to explicitly opt into non-emulated cross compilation for any specific package.
-  #     # this is most beneficial for large packages with few pre-requisites -- like Linux.
-  #     cross = prev.crossFrom."${localSystem}";
-  #   })
-  # ];
 }

hosts/modules/gui/default.nix

@@ -10,6 +10,7 @@ in
     ./phosh.nix
     ./plasma.nix
     ./plasma-mobile.nix
-    ./sway.nix
+    ./sway
+    ./sxmo.nix
   ];
 }

hosts/modules/gui/phosh.nix

@@ -59,6 +59,8 @@ in
       # qt.style = "gtk2";
 
       # docs: https://github.com/NixOS/nixpkgs/blob/nixos-22.05/nixos/modules/services/x11/desktop-managers/phosh.nix
+      # docs: <repo:gnome/phosh:src/phoc.ini.example>
+      # docs: <repo:gnome/phosh:src/settings.c#config_ini_handler>
       services.xserver.desktopManager.phosh = {
         enable = true;
         user = "colin";
@@ -113,6 +115,18 @@ in
         NIXOS_OZONE_WL = "1";
       };
 
+      systemd.services.phosh.environment = {
+        # PHOC_DEBUG: comma-separated list of:
+        # - ``auto-maximize``: Maximize toplevels
+        # - ``damage-tracking``: Debug damage tracking
+        # - ``no-quit``: Don't quit when session ends
+        # - ``touch-points``: Debug touch points
+        # - ``layer-shell``: Debug layer shell
+        # - ``cutouts``: Debug display cutouts and notches
+        PHOC_DEBUG = "layer-shell";
+        # G_DEBUG, G_MESSAGE_DEBUG for glib debugging: <https://docs.gtk.org/glib/running.html>
+      };
+
       programs.dconf.packages = [
         # org.kde.konsole.desktop
         (pkgs.writeTextFile {
@@ -142,7 +156,11 @@ in
       services.xserver.displayManager.job.preStart = ''
         ${pkgs.systemd}/bin/busctl call org.freedesktop.Accounts /org/freedesktop/Accounts org.freedesktop.Accounts CacheUser s colin
       '';
-      # services.xserver.displayManager.defaultSession = "sm.puri.Phosh";  # XXX: not sure why this doesn't propagate correctly.
+      # XXX for some reason specifying defaultSession = "sm.puri.Phosh" breaks cross-compiled display-manager startup
+      # - causes an attempt to load x86-64 glib-2.76.2/lib/libglib-2.0.so.0
+      # - likely <repo:nixpkgs:nixos/modules/services/x11/display-managers/account-service-util.nix>
+      # - but i believe some variant of this issue existed even during emulated compilation
+      # services.xserver.displayManager.defaultSession = "sm.puri.Phosh";
       services.xserver.displayManager.lightdm.extraSeatDefaults = ''
         user-session = phosh
       '';

hosts/modules/gui/snippets.txt

@@ -10,4 +10,6 @@ https://jackett.uninsane.org/UI/Dashboard#search=
 https://fed.uninsane.org
 https://bt.uninsane.org
 https://sci-hub.se
+https://archive.is
 https://news.ycombinator.com
+https://192.168.15.1:60481  # Router/Firewall

hosts/modules/gui/sway.nix

@@ -1,666 +0,0 @@
-{ config, lib, pkgs, sane-lib, ... }:
- 
-# docs: https://nixos.wiki/wiki/Sway
-with lib;
-let
-  cfg = config.sane.gui.sway;
-  # docs: https://github.com/Alexays/Waybar/wiki/Configuration
-  # format specifiers: https://fmt.dev/latest/syntax.html#syntax
-  waybar-config = [
-    { # TOP BAR
-      layer = "top";
-      height = 40;
-      modules-left = ["sway/workspaces" "sway/mode"];
-      modules-center = ["sway/window"];
-      modules-right = ["custom/mediaplayer" "clock" "battery" "cpu" "network"];
-      "sway/window" = {
-        max-length = 50;
-      };
-      # include song artist/title. source: https://www.reddit.com/r/swaywm/comments/ni0vso/waybar_spotify_tracktitle/
-      "custom/mediaplayer" = {
-        exec = pkgs.writeShellScript "waybar-mediaplayer" ''
-          player_status=$(${pkgs.playerctl}/bin/playerctl status 2> /dev/null)
-          if [ "$player_status" = "Playing" ]; then
-            echo "$(${pkgs.playerctl}/bin/playerctl metadata artist) - $(${pkgs.playerctl}/bin/playerctl metadata title)"
-          elif [ "$player_status" = "Paused" ]; then
-            echo " $(${pkgs.playerctl}/bin/playerctl metadata artist) - $(${pkgs.playerctl}/bin/playerctl metadata title)"
-          fi
-        '';
-        interval = 2;
-        format = "{}  ";
-        # return-type = "json";
-        on-click = "${pkgs.playerctl}/bin/playerctl play-pause";
-        on-scroll-up = "${pkgs.playerctl}/bin/playerctl next";
-        on-scroll-down = "${pkgs.playerctl}/bin/playerctl previous";
-      };
-      network = {
-        # docs: https://github.com/Alexays/Waybar/blob/master/man/waybar-network.5.scd
-        interval = 2;
-        max-length = 40;
-        # custom :> format specifier explained here: https://github.com/Alexays/Waybar/pull/472
-        format-ethernet = "  {bandwidthUpBits:>}▲ {bandwidthDownBits:>}▼";
-        tooltip-format-ethernet = "{ifname} {bandwidthUpBits:>}▲ {bandwidthDownBits:>}▼";
-
-        format-wifi = "{ifname} ({signalStrength}%) {bandwidthUpBits:>}▲ {bandwidthDownBits:>}▼";
-        tooltip-format-wifi = "{essid} ({signalStrength}%) {bandwidthUpBits:>}▲ {bandwidthDownBits:>}▼";
-
-        format-disconnected = "";
-      };
-      cpu = {
-        format = " {usage:2}%";
-        tooltip = false;
-      };
-      battery = {
-        states = {
-          good = 95;
-          warning = 30;
-          critical = 10;
-        };
-        format = "{icon} {capacity}%";
-        format-icons = [
-          ""
-          ""
-          ""
-          ""
-          ""
-        ];
-      };
-      clock = {
-        format-alt = "{:%a, %d. %b  %H:%M}";
-      };
-    }
-  ];
-  # waybar-config-text = lib.generators.toJSON {} waybar-config;
-  waybar-config-text = (pkgs.formats.json {}).generate "waybar-config.json" waybar-config;
-
-  # bare sway launcher
-  sway-launcher = pkgs.writeShellScriptBin "sway-launcher" ''
-    ${pkgs.sway}/bin/sway --debug > /tmp/sway.log 2>&1
-  '';
-  # start sway and have it construct the gtkgreeter
-  sway-as-greeter = pkgs.writeShellScriptBin "sway-as-greeter" ''
-    ${pkgs.sway}/bin/sway --debug --config ${sway-config-into-gtkgreet} > /tmp/sway-as-greeter.log 2>&1
-  '';
-  # (config file for the above)
-  sway-config-into-gtkgreet = pkgs.writeText "greetd-sway-config" ''
-    exec "${gtkgreet-launcher}"
-  '';
-  # gtkgreet which launches a layered sway instance
-  gtkgreet-launcher = pkgs.writeShellScript "gtkgreet-launcher" ''
-    # NB: the "command" field here is run in the user's shell.
-    # so that command must exist on the specific user's path who is logging in. it doesn't need to exist system-wide.
-    ${pkgs.greetd.gtkgreet}/bin/gtkgreet --layer-shell --command sway-launcher
-  '';
-  greeter-session = {
-    # greeter session config
-    command = "${sway-as-greeter}/bin/sway-as-greeter";
-    # alternatives:
-    # - TTY: `command = "${pkgs.greetd.greetd}/bin/agreety --cmd ${pkgs.sway}/bin/sway";`
-    # - autologin: `command = "${pkgs.sway}/bin/sway"; user = "colin";`
-    # - Dumb Login (doesn't work)": `command = "${pkgs.greetd.dlm}/bin/dlm";`
-  };
-  greeterless-session = {
-    # no greeter
-    command = "${sway-launcher}/bin/sway-launcher";
-    user = "colin";
-  };
-in
-{
-  options = {
-    sane.gui.sway.enable = mkOption {
-      default = false;
-      type = types.bool;
-    };
-    sane.gui.sway.useGreeter = mkOption {
-      description = ''
-        launch sway via a greeter (like greetd's gtkgreet).
-        sway is usable without a greeter, but skipping the greeter means no PAM session.
-      '';
-      default = true;
-      type = types.bool;
-    };
-  };
-  config = mkMerge [
-    {
-      sane.programs.swayApps = {
-        package = null;
-        suggestedPrograms = [
-          "guiApps"
-          "splatmoji"  # used by us, but 'enabling' it gets us persistence & cfg
-          "swaylock"
-          "swayidle"
-          "wl-clipboard"
-          "mako"  # notification daemon
-          # # "pavucontrol"
-          "gnome.gnome-bluetooth"
-          "gnome.gnome-control-center"
-          "sway-contrib.grimshot"
-        ];
-      };
-    }
-    {
-      sane.programs = {
-        inherit (pkgs // {
-          "gnome.gnome-bluetooth" = pkgs.gnome.gnome-bluetooth;
-          "gnome.gnome-control-center" = pkgs.gnome.gnome-control-center;
-          "sway-contrib.grimshot" = pkgs.sway-contrib.grimshot;
-        })
-          swaylock
-          swayidle
-          wl-clipboard
-          mako
-          "gnome.gnome-bluetooth"
-          "gnome.gnome-control-center"
-          "sway-contrib.grimshot"
-        ;
-      };
-    }
-
-    (mkIf cfg.enable {
-      sane.programs.swayApps.enableFor.user.colin = true;
-
-      # swap in these lines to use SDDM instead of `services.greetd`.
-      # services.xserver.displayManager.sddm.enable = true;
-      # services.xserver.enable = true;
-      services.greetd = {
-        # greetd source/docs:
-        # - <https://git.sr.ht/~kennylevinsen/greetd>
-        enable = true;
-        settings = {
-          default_session = if cfg.useGreeter then greeter-session else greeterless-session;
-        };
-      };
-      # we need the greeter's command to be on our PATH
-      users.users.colin.packages = [ sway-launcher ];
-
-      # some programs (e.g. fractal) **require** a "Secret Service Provider"
-      services.gnome.gnome-keyring.enable = true;
-
-      # unlike other DEs, sway configures no audio stack
-      # administer with pw-cli, pw-mon, pw-top commands
-      services.pipewire = {
-        enable = true;
-        alsa.enable = true;
-        alsa.support32Bit = true;  # ??
-        pulse.enable = true;
-      };
-
-      networking.useDHCP = false;
-      networking.networkmanager.enable = true;
-      networking.wireless.enable = lib.mkForce false;
-
-      hardware.bluetooth.enable = true;
-      services.blueman.enable = true;
-      # gsd provides Rfkill, which is required for the bluetooth pane in gnome-control-center to work
-      services.gnome.gnome-settings-daemon.enable = true;
-      # start the components of gsd we need at login
-      systemd.user.targets."org.gnome.SettingsDaemon.Rfkill".wantedBy = [ "graphical-session.target" ];
-      # go ahead and `systemctl --user cat gnome-session-initialized.target`. i dare you.
-      # the only way i can figure out how to get Rfkill to actually load is to just disable all the shit it depends on.
-      # it doesn't actually seem to need ANY of them in the first place T_T
-      systemd.user.targets."gnome-session-initialized".enable = false;
-      # bluez can't connect to audio devices unless pipewire is running.
-      # a system service can't depend on a user service, so just launch it at graphical-session
-      systemd.user.services."pipewire".wantedBy = [ "graphical-session.target" ];
-
-      programs.sway = {
-        enable = true;
-        wrapperFeatures.gtk = true;
-      };
-      sane.user.fs.".config/sway/config" =
-        let
-          fuzzel = "${pkgs.fuzzel}/bin/fuzzel";
-          sed = "${pkgs.gnused}/bin/sed";
-          wtype = "${pkgs.wtype}/bin/wtype";
-          kitty = "${pkgs.kitty}/bin/kitty";
-          launcher-cmd = fuzzel;
-          terminal-cmd = kitty;
-          lock-cmd = "${pkgs.swaylock}/bin/swaylock --indicator-idle-visible --indicator-radius 100 --indicator-thickness 30";
-          vol-up-cmd = "${pkgs.pulsemixer}/bin/pulsemixer --change-volume +5";
-          vol-down-cmd = "${pkgs.pulsemixer}/bin/pulsemixer --change-volume -5";
-          mute-cmd = "${pkgs.pulsemixer}/bin/pulsemixer --toggle-mute";
-          brightness-up-cmd = "${pkgs.brightnessctl}/bin/brightnessctl set +2%";
-          brightness-down-cmd = "${pkgs.brightnessctl}/bin/brightnessctl set 2%-";
-          screenshot-cmd = "${pkgs.sway-contrib.grimshot}/bin/grimshot copy area";
-          # "bookmarking"/snippets inspired by Luke Smith:
-          # - <https://www.youtube.com/watch?v=d_11QaTlf1I>
-          snip-file = ./snippets.txt;
-          # TODO: querying sops here breaks encapsulation
-          list-snips = "cat ${snip-file} ${config.sops.secrets.snippets.path}";
-          strip-comments = "${sed} 's/ #.*$//'";
-          snip-cmd = "${wtype} $(${list-snips} | ${fuzzel} -d -i -w 60 | ${strip-comments})";
-          # TODO: next splatmoji release should allow `-s none` to disable skin tones
-          emoji-cmd = "${pkgs.splatmoji}/bin/splatmoji -s medium-light type";
-        in sane-lib.fs.wantedText ''
-          ### default font
-          font pango:monospace 8
-
-          ### pixel boundary between windows
-          default_border pixel 3
-          default_floating_border pixel 2
-          hide_edge_borders smart
-
-          ### defaults
-          focus_wrapping no
-          focus_follows_mouse yes
-          focus_on_window_activation smart
-          mouse_warping output
-          workspace_layout default
-          workspace_auto_back_and_forth no
-
-          ### default colors (#border #background #text #indicator #childBorder)
-          client.focused #4c7899 #285577 #ffffff #2e9ef4 #285577
-          client.focused_inactive #333333 #5f676a #ffffff #484e50 #5f676a
-          client.unfocused #333333 #222222 #888888 #292d2e #222222
-          client.urgent #2f343a #900000 #ffffff #900000 #900000
-          client.placeholder #000000 #0c0c0c #ffffff #000000 #0c0c0c
-          client.background #ffffff
-
-          ### key bindings
-          floating_modifier Mod1
-          ## media keys
-          bindsym XF86AudioRaiseVolume exec ${vol-up-cmd}
-          bindsym XF86AudioLowerVolume exec ${vol-down-cmd}
-          bindsym Mod1+Page_Up exec ${vol-up-cmd}
-          bindsym Mod1+Page_Down exec ${vol-down-cmd}
-          bindsym XF86AudioMute exec ${mute-cmd}
-          bindsym XF86MonBrightnessUp exec ${brightness-up-cmd}
-          bindsym XF86MonBrightnessDown exec ${brightness-down-cmd}
-          ## special functions
-          bindsym Mod1+Print exec ${screenshot-cmd}
-          bindsym Mod1+l exec ${lock-cmd}
-          bindsym Mod1+s exec ${snip-cmd}
-          bindsym Mod1+slash exec ${emoji-cmd}
-          bindsym Mod1+d exec ${launcher-cmd}
-          bindsym Mod1+Return exec ${terminal-cmd}
-          bindsym Mod1+Shift+q kill
-          bindsym Mod1+Shift+e exec swaynag -t warning -m 'You pressed the exit shortcut. Do you really want to exit sway? This will end your Wayland session.' -b 'Yes, exit sway' 'swaymsg exit'
-          bindsym Mod1+Shift+c reload
-          ## layout
-          bindsym Mod1+b splith
-          bindsym Mod1+v splitv
-          bindsym Mod1+f fullscreen toggle
-          bindsym Mod1+a focus parent
-          bindsym Mod1+w layout tabbed
-          bindsym Mod1+e layout toggle split
-          bindsym Mod1+Shift+space floating toggle
-          bindsym Mod1+space focus mode_toggle
-          bindsym Mod1+r mode resize
-          ## movement
-          bindsym Mod1+Up focus up
-          bindsym Mod1+Down focus down
-          bindsym Mod1+Left focus left
-          bindsym Mod1+Right focus right
-          bindsym Mod1+Shift+Up move up
-          bindsym Mod1+Shift+Down move down
-          bindsym Mod1+Shift+Left move left
-          bindsym Mod1+Shift+Right move right
-          ## workspaces
-          bindsym Mod1+1 workspace number 1
-          bindsym Mod1+2 workspace number 2
-          bindsym Mod1+3 workspace number 3
-          bindsym Mod1+4 workspace number 4
-          bindsym Mod1+5 workspace number 5
-          bindsym Mod1+6 workspace number 6
-          bindsym Mod1+7 workspace number 7
-          bindsym Mod1+8 workspace number 8
-          bindsym Mod1+9 workspace number 9
-          bindsym Mod1+Shift+1 move container to workspace number 1
-          bindsym Mod1+Shift+2 move container to workspace number 2
-          bindsym Mod1+Shift+3 move container to workspace number 3
-          bindsym Mod1+Shift+4 move container to workspace number 4
-          bindsym Mod1+Shift+5 move container to workspace number 5
-          bindsym Mod1+Shift+6 move container to workspace number 6
-          bindsym Mod1+Shift+7 move container to workspace number 7
-          bindsym Mod1+Shift+8 move container to workspace number 8
-          bindsym Mod1+Shift+9 move container to workspace number 9
-          ## "scratchpad" = ??
-          bindsym Mod1+Shift+minus move scratchpad
-          bindsym Mod1+minus scratchpad show
-
-          ### defaults
-          mode "resize" {
-            bindsym Down resize grow height 10 px
-            bindsym Escape mode default
-            bindsym Left resize shrink width 10 px
-            bindsym Return mode default
-            bindsym Right resize grow width 10 px
-            bindsym Up resize shrink height 10 px
-            bindsym h resize shrink width 10 px
-            bindsym j resize grow height 10 px
-            bindsym k resize shrink height 10 px
-            bindsym l resize grow width 10 px
-          }
-
-          ### lightly modified bars
-          bar {
-            # TODO: fonts was:
-            #   config.fonts.fontconfig.defaultFonts; (monospace ++ emoji)
-            font pango:Hack, Font Awesome 6 Free, Twitter Color Emoji 24.000000
-            mode dock
-            hidden_state hide
-            position top
-            status_command ${pkgs.i3status}/bin/i3status
-            swaybar_command ${pkgs.waybar}/bin/waybar
-            workspace_buttons yes
-            strip_workspace_numbers no
-            tray_output primary
-            colors {
-              background #000000
-              statusline #ffffff
-              separator #666666
-              #  #border #background #text
-              focused_workspace #4c7899 #285577 #ffffff
-              active_workspace #333333 #5f676a #ffffff
-              inactive_workspace #333333 #222222 #888888
-              urgent_workspace #2f343a #900000 #ffffff
-              binding_mode #2f343a #900000 #ffffff
-          }
-          }
-
-          ### displays
-          ## DESKTOP
-          output "Samsung Electric Company S22C300 0x00007F35" {
-          pos 0,0
-          res 1920x1080
-          }
-          output "Goldstar Company Ltd LG ULTRAWIDE 0x00004E94" {
-          pos 1920,0
-          res 3440x1440
-          }
-
-          ## LAPTOP
-          # sh/en TV
-          output "Pioneer Electronic Corporation VSX-524 0x00000101" {
-          pos 0,0
-          res 1920x1080
-          }
-          # internal display
-          output "Unknown 0x0637 0x00000000" {
-          pos 1920,0
-          res 1920x1080
-          }
-        '';
-
-      sane.user.fs.".config/waybar/config" = sane-lib.fs.wantedSymlinkTo waybar-config-text;
-
-      # style docs: https://github.com/Alexays/Waybar/wiki/Styling
-      sane.user.fs.".config/waybar/style.css" = sane-lib.fs.wantedText ''
-        * {
-          font-family: monospace;
-        }
-
-        /* defaults below: https://github.com/Alexays/Waybar/blob/master/resources/style.css */
-        window#waybar {
-          background-color: rgba(43, 48, 59, 0.5);
-          border-bottom: 3px solid rgba(100, 114, 125, 0.5);
-          color: #ffffff;
-          transition-property: background-color;
-          transition-duration: .5s;
-        }
-
-        window#waybar.hidden {
-          opacity: 0.2;
-        }
-
-        /*
-        window#waybar.empty {
-          background-color: transparent;
-        }
-        window#waybar.solo {
-          background-color: #FFFFFF;
-        }
-        */
-
-        window#waybar.termite {
-          background-color: #3F3F3F;
-        }
-
-        window#waybar.chromium {
-          background-color: #000000;
-          border: none;
-        }
-
-        #workspaces button {
-          padding: 0 5px;
-          background-color: transparent;
-          color: #ffffff;
-          /* Use box-shadow instead of border so the text isn't offset */
-          box-shadow: inset 0 -3px transparent;
-          /* Avoid rounded borders under each workspace name */
-          border: none;
-          border-radius: 0;
-        }
-
-        /* https://github.com/Alexays/Waybar/wiki/FAQ#the-workspace-buttons-have-a-strange-hover-effect */
-        #workspaces button:hover {
-          background: rgba(0, 0, 0, 0.2);
-          box-shadow: inset 0 -3px #ffffff;
-        }
-
-        #workspaces button.focused {
-          background-color: #64727D;
-          box-shadow: inset 0 -3px #ffffff;
-        }
-
-        #workspaces button.urgent {
-          background-color: #eb4d4b;
-        }
-
-        #mode {
-          background-color: #64727D;
-          border-bottom: 3px solid #ffffff;
-        }
-
-        #clock,
-        #battery,
-        #cpu,
-        #memory,
-        #disk,
-        #temperature,
-        #backlight,
-        #network,
-        #pulseaudio,
-        #custom-media,
-        #tray,
-        #mode,
-        #idle_inhibitor,
-        #mpd {
-          padding: 0 10px;
-          color: #ffffff;
-        }
-
-        #window,
-        #workspaces {
-          margin: 0 4px;
-        }
-
-        /* If workspaces is the leftmost module, omit left margin */
-        .modules-left > widget:first-child > #workspaces {
-          margin-left: 0;
-        }
-
-        /* If workspaces is the rightmost module, omit right margin */
-        .modules-right > widget:last-child > #workspaces {
-          margin-right: 0;
-        }
-
-        #clock {
-          background-color: #64727D;
-        }
-
-        #battery {
-          background-color: #ffffff;
-          color: #000000;
-        }
-
-        #battery.charging, #battery.plugged {
-          color: #ffffff;
-          background-color: #26A65B;
-        }
-
-        @keyframes blink {
-          to {
-            background-color: #ffffff;
-            color: #000000;
-          }
-        }
-
-        #battery.critical:not(.charging) {
-          background-color: #f53c3c;
-          color: #ffffff;
-          animation-name: blink;
-          animation-duration: 0.5s;
-          animation-timing-function: linear;
-          animation-iteration-count: infinite;
-          animation-direction: alternate;
-        }
-
-        label:focus {
-          background-color: #000000;
-        }
-
-        #cpu {
-          background-color: #2ecc71;
-          color: #000000;
-        }
-
-        #memory {
-          background-color: #9b59b6;
-        }
-
-        #disk {
-          background-color: #964B00;
-        }
-
-        #backlight {
-          background-color: #90b1b1;
-        }
-
-        #network {
-          background-color: #2980b9;
-        }
-
-        #network.disconnected {
-          background-color: #f53c3c;
-        }
-
-        #pulseaudio {
-          background-color: #f1c40f;
-          color: #000000;
-        }
-
-        #pulseaudio.muted {
-          background-color: #90b1b1;
-          color: #2a5c45;
-        }
-
-        #custom-media {
-          background-color: #66cc99;
-          color: #2a5c45;
-          min-width: 100px;
-        }
-
-        #custom-media.custom-spotify {
-          background-color: #66cc99;
-        }
-
-        #custom-media.custom-vlc {
-          background-color: #ffa000;
-        }
-
-        #temperature {
-          background-color: #f0932b;
-        }
-
-        #temperature.critical {
-          background-color: #eb4d4b;
-        }
-
-        #tray {
-          background-color: #2980b9;
-        }
-
-        #tray > .passive {
-          -gtk-icon-effect: dim;
-        }
-
-        #tray > .needs-attention {
-          -gtk-icon-effect: highlight;
-          background-color: #eb4d4b;
-        }
-
-        #idle_inhibitor {
-          background-color: #2d3436;
-        }
-
-        #idle_inhibitor.activated {
-          background-color: #ecf0f1;
-          color: #2d3436;
-        }
-
-        #mpd {
-          background-color: #66cc99;
-          color: #2a5c45;
-        }
-
-        #mpd.disconnected {
-          background-color: #f53c3c;
-        }
-
-        #mpd.stopped {
-          background-color: #90b1b1;
-        }
-
-        #mpd.paused {
-          background-color: #51a37a;
-        }
-
-        #language {
-          background: #00b093;
-          color: #740864;
-          padding: 0 5px;
-          margin: 0 5px;
-          min-width: 16px;
-        }
-
-        #keyboard-state {
-          background: #97e1ad;
-          color: #000000;
-          padding: 0 0px;
-          margin: 0 5px;
-          min-width: 16px;
-        }
-
-        #keyboard-state > label {
-          padding: 0 5px;
-        }
-
-        #keyboard-state > label.locked {
-          background: rgba(0, 0, 0, 0.2);
-        }
-      '';
-      # style = ''
-      #   * {
-      #     border: none;
-      #     border-radius: 0;
-      #     font-family: Source Code Pro;
-      #   }
-      #   window#waybar {
-      #     background: #16191C;
-      #     color: #AAB2BF;
-      #   }
-      #   #workspaces button {
-      #     padding: 0 5px;
-      #   }
-      #   .custom-spotify {
-      #     padding: 0 10px;
-      #     margin: 0 4px;
-      #     background-color: #1DB954;
-      #     color: black;
-      #   }
-      # '';
-    })
-  ];
-}
-

hosts/modules/gui/sway/default.nix

@@ -0,0 +1,164 @@
+{ config, lib, pkgs, sane-lib, ... }:
+ 
+# docs: https://nixos.wiki/wiki/Sway
+with lib;
+let
+  cfg = config.sane.gui.sway;
+
+  # bare sway launcher
+  sway-launcher = pkgs.writeShellScriptBin "sway-launcher" ''
+    ${pkgs.sway}/bin/sway --debug > /var/log/sway/sway.log 2>&1
+  '';
+  # start sway and have it construct the gtkgreeter
+  sway-as-greeter = pkgs.writeShellScriptBin "sway-as-greeter" ''
+    ${pkgs.sway}/bin/sway --debug --config ${sway-config-into-gtkgreet} > /var/log/sway/sway-as-greeter.log 2>&1
+  '';
+  # (config file for the above)
+  sway-config-into-gtkgreet = pkgs.writeText "greetd-sway-config" ''
+    exec "${gtkgreet-launcher}"
+  '';
+  # gtkgreet which launches a layered sway instance
+  gtkgreet-launcher = pkgs.writeShellScript "gtkgreet-launcher" ''
+    # NB: the "command" field here is run in the user's shell.
+    # so that command must exist on the specific user's path who is logging in. it doesn't need to exist system-wide.
+    ${pkgs.greetd.gtkgreet}/bin/gtkgreet --layer-shell --command sway-launcher
+  '';
+  greeter-session = {
+    # greeter session config
+    command = "${sway-as-greeter}/bin/sway-as-greeter";
+    # alternatives:
+    # - TTY: `command = "${pkgs.greetd.greetd}/bin/agreety --cmd ${pkgs.sway}/bin/sway";`
+    # - autologin: `command = "${pkgs.sway}/bin/sway"; user = "colin";`
+    # - Dumb Login (doesn't work)": `command = "${pkgs.greetd.dlm}/bin/dlm";`
+  };
+  greeterless-session = {
+    # no greeter
+    command = "${sway-launcher}/bin/sway-launcher";
+    user = "colin";
+  };
+in
+{
+  options = {
+    sane.gui.sway.enable = mkOption {
+      default = false;
+      type = types.bool;
+    };
+    sane.gui.sway.useGreeter = mkOption {
+      description = ''
+        launch sway via a greeter (like greetd's gtkgreet).
+        sway is usable without a greeter, but skipping the greeter means no PAM session.
+      '';
+      default = true;
+      type = types.bool;
+    };
+  };
+  config = mkMerge [
+    {
+      sane.programs.swayApps = {
+        package = null;
+        suggestedPrograms = [
+          "guiApps"
+          "splatmoji"  # used by us, but 'enabling' it gets us persistence & cfg
+          "swaylock"
+          "swayidle"
+          "wl-clipboard"
+          "blueberry"  # GUI bluetooth manager
+          "mako"  # notification daemon
+          # # "pavucontrol"
+          # "gnome.gnome-bluetooth"  # XXX(2023/05/14): broken
+          "gnome.gnome-control-center"
+          "sway-contrib.grimshot"
+        ];
+      };
+    }
+    {
+      sane.programs = {
+        inherit (pkgs // {
+          "gnome.gnome-bluetooth" = pkgs.gnome.gnome-bluetooth;
+          "gnome.gnome-control-center" = pkgs.gnome.gnome-control-center;
+          "sway-contrib.grimshot" = pkgs.sway-contrib.grimshot;
+        })
+          swaylock
+          swayidle
+          wl-clipboard
+          blueberry
+          mako
+          "gnome.gnome-bluetooth"
+          "gnome.gnome-control-center"
+          "sway-contrib.grimshot"
+        ;
+      };
+    }
+
+    (mkIf cfg.enable {
+      sane.programs.swayApps.enableFor.user.colin = true;
+
+      # swap in these lines to use SDDM instead of `services.greetd`.
+      # services.xserver.displayManager.sddm.enable = true;
+      # services.xserver.enable = true;
+      services.greetd = {
+        # greetd source/docs:
+        # - <https://git.sr.ht/~kennylevinsen/greetd>
+        enable = true;
+        settings = {
+          default_session = if cfg.useGreeter then greeter-session else greeterless-session;
+        };
+      };
+      # we need the greeter's command to be on our PATH
+      users.users.colin.packages = [ sway-launcher ];
+
+      # some programs (e.g. fractal) **require** a "Secret Service Provider"
+      services.gnome.gnome-keyring.enable = true;
+
+      # unlike other DEs, sway configures no audio stack
+      # administer with pw-cli, pw-mon, pw-top commands
+      services.pipewire = {
+        enable = true;
+        alsa.enable = true;
+        alsa.support32Bit = true;  # ??
+        pulse.enable = true;
+      };
+
+      networking.useDHCP = false;
+      networking.networkmanager.enable = true;
+      networking.wireless.enable = lib.mkForce false;
+
+      hardware.bluetooth.enable = true;
+      services.blueman.enable = true;
+      # gsd provides Rfkill, which is required for the bluetooth pane in gnome-control-center to work
+      services.gnome.gnome-settings-daemon.enable = true;
+      # start the components of gsd we need at login
+      systemd.user.targets."org.gnome.SettingsDaemon.Rfkill".wantedBy = [ "graphical-session.target" ];
+      # go ahead and `systemctl --user cat gnome-session-initialized.target`. i dare you.
+      # the only way i can figure out how to get Rfkill to actually load is to just disable all the shit it depends on.
+      # it doesn't actually seem to need ANY of them in the first place T_T
+      systemd.user.targets."gnome-session-initialized".enable = false;
+      # bluez can't connect to audio devices unless pipewire is running.
+      # a system service can't depend on a user service, so just launch it at graphical-session
+      systemd.user.services."pipewire".wantedBy = [ "graphical-session.target" ];
+
+      sane.fs."/var/log/sway" = {
+        dir.acl.mode = "0777";
+        wantedBeforeBy = [ "greetd.service" "display-manager.service" ];
+      };
+
+      programs.sway = {
+        enable = true;
+        wrapperFeatures.gtk = true;
+      };
+      sane.user.fs.".config/sway/config" = sane-lib.fs.wantedText
+        (import ./sway-config.nix { inherit config pkgs; });
+
+      sane.user.fs.".config/waybar/config" =
+        let
+          waybar-config = import ./waybar-config.nix { inherit pkgs; };
+        in sane-lib.fs.wantedSymlinkTo (
+          (pkgs.formats.json {}).generate "waybar-config.json" waybar-config
+        );
+
+      sane.user.fs.".config/waybar/style.css" = sane-lib.fs.wantedText
+        (builtins.readFile ./waybar-style.css);
+    })
+  ];
+}
+

hosts/modules/gui/sway/sway-config.nix

@@ -0,0 +1,174 @@
+{ pkgs, config }:
+let
+  fuzzel = "${pkgs.fuzzel}/bin/fuzzel";
+  sed = "${pkgs.gnused}/bin/sed";
+  wtype = "${pkgs.wtype}/bin/wtype";
+  kitty = "${pkgs.kitty}/bin/kitty";
+  launcher-cmd = fuzzel;
+  terminal-cmd = kitty;
+  lock-cmd = "${pkgs.swaylock}/bin/swaylock --indicator-idle-visible --indicator-radius 100 --indicator-thickness 30";
+  vol-up-cmd = "${pkgs.pulsemixer}/bin/pulsemixer --change-volume +5";
+  vol-down-cmd = "${pkgs.pulsemixer}/bin/pulsemixer --change-volume -5";
+  mute-cmd = "${pkgs.pulsemixer}/bin/pulsemixer --toggle-mute";
+  brightness-up-cmd = "${pkgs.brightnessctl}/bin/brightnessctl set +2%";
+  brightness-down-cmd = "${pkgs.brightnessctl}/bin/brightnessctl set 2%-";
+  screenshot-cmd = "${pkgs.sway-contrib.grimshot}/bin/grimshot copy area";
+  # "bookmarking"/snippets inspired by Luke Smith:
+  # - <https://www.youtube.com/watch?v=d_11QaTlf1I>
+  snip-file = ../snippets.txt;
+  # TODO: querying sops here breaks encapsulation
+  list-snips = "cat ${snip-file} ${config.sops.secrets.snippets.path}";
+  strip-comments = "${sed} 's/ #.*$//'";
+  snip-cmd = "${wtype} $(${list-snips} | ${fuzzel} -d -i -w 60 | ${strip-comments})";
+  # TODO: next splatmoji release should allow `-s none` to disable skin tones
+  emoji-cmd = "${pkgs.splatmoji}/bin/splatmoji -s medium-light type";
+in ''
+  ### default font
+  font pango:monospace 8
+
+  ### pixel boundary between windows
+  default_border pixel 3
+  default_floating_border pixel 2
+  hide_edge_borders smart
+
+  ### defaults
+  focus_wrapping no
+  focus_follows_mouse yes
+  focus_on_window_activation smart
+  mouse_warping output
+  workspace_layout default
+  workspace_auto_back_and_forth no
+
+  ### default colors (#border #background #text #indicator #childBorder)
+  client.focused #4c7899 #285577 #ffffff #2e9ef4 #285577
+  client.focused_inactive #333333 #5f676a #ffffff #484e50 #5f676a
+  client.unfocused #333333 #222222 #888888 #292d2e #222222
+  client.urgent #2f343a #900000 #ffffff #900000 #900000
+  client.placeholder #000000 #0c0c0c #ffffff #000000 #0c0c0c
+  client.background #ffffff
+
+  ### key bindings
+  floating_modifier Mod1
+  ## media keys
+  bindsym XF86AudioRaiseVolume exec ${vol-up-cmd}
+  bindsym XF86AudioLowerVolume exec ${vol-down-cmd}
+  bindsym Mod1+Page_Up exec ${vol-up-cmd}
+  bindsym Mod1+Page_Down exec ${vol-down-cmd}
+  bindsym XF86AudioMute exec ${mute-cmd}
+  bindsym XF86MonBrightnessUp exec ${brightness-up-cmd}
+  bindsym XF86MonBrightnessDown exec ${brightness-down-cmd}
+  ## special functions
+  bindsym Mod1+Print exec ${screenshot-cmd}
+  bindsym Mod1+l exec ${lock-cmd}
+  bindsym Mod1+s exec ${snip-cmd}
+  bindsym Mod1+slash exec ${emoji-cmd}
+  bindsym Mod1+d exec ${launcher-cmd}
+  bindsym Mod1+Return exec ${terminal-cmd}
+  bindsym Mod1+Shift+q kill
+  bindsym Mod1+Shift+e exec swaynag -t warning -m 'You pressed the exit shortcut. Do you really want to exit sway? This will end your Wayland session.' -b 'Yes, exit sway' 'swaymsg exit'
+  bindsym Mod1+Shift+c reload
+  ## layout
+  bindsym Mod1+b splith
+  bindsym Mod1+v splitv
+  bindsym Mod1+f fullscreen toggle
+  bindsym Mod1+a focus parent
+  bindsym Mod1+w layout tabbed
+  bindsym Mod1+e layout toggle split
+  bindsym Mod1+Shift+space floating toggle
+  bindsym Mod1+space focus mode_toggle
+  bindsym Mod1+r mode resize
+  ## movement
+  bindsym Mod1+Up focus up
+  bindsym Mod1+Down focus down
+  bindsym Mod1+Left focus left
+  bindsym Mod1+Right focus right
+  bindsym Mod1+Shift+Up move up
+  bindsym Mod1+Shift+Down move down
+  bindsym Mod1+Shift+Left move left
+  bindsym Mod1+Shift+Right move right
+  ## workspaces
+  bindsym Mod1+1 workspace number 1
+  bindsym Mod1+2 workspace number 2
+  bindsym Mod1+3 workspace number 3
+  bindsym Mod1+4 workspace number 4
+  bindsym Mod1+5 workspace number 5
+  bindsym Mod1+6 workspace number 6
+  bindsym Mod1+7 workspace number 7
+  bindsym Mod1+8 workspace number 8
+  bindsym Mod1+9 workspace number 9
+  bindsym Mod1+Shift+1 move container to workspace number 1
+  bindsym Mod1+Shift+2 move container to workspace number 2
+  bindsym Mod1+Shift+3 move container to workspace number 3
+  bindsym Mod1+Shift+4 move container to workspace number 4
+  bindsym Mod1+Shift+5 move container to workspace number 5
+  bindsym Mod1+Shift+6 move container to workspace number 6
+  bindsym Mod1+Shift+7 move container to workspace number 7
+  bindsym Mod1+Shift+8 move container to workspace number 8
+  bindsym Mod1+Shift+9 move container to workspace number 9
+  ## "scratchpad" = ??
+  bindsym Mod1+Shift+minus move scratchpad
+  bindsym Mod1+minus scratchpad show
+
+  ### defaults
+  mode "resize" {
+    bindsym Down resize grow height 10 px
+    bindsym Escape mode default
+    bindsym Left resize shrink width 10 px
+    bindsym Return mode default
+    bindsym Right resize grow width 10 px
+    bindsym Up resize shrink height 10 px
+    bindsym h resize shrink width 10 px
+    bindsym j resize grow height 10 px
+    bindsym k resize shrink height 10 px
+    bindsym l resize grow width 10 px
+  }
+
+  ### lightly modified bars
+  bar {
+    # TODO: fonts was:
+    #   config.fonts.fontconfig.defaultFonts; (monospace ++ emoji)
+    font pango:Hack, Font Awesome 6 Free, Twitter Color Emoji 24.000000
+    mode dock
+    hidden_state hide
+    position top
+    status_command ${pkgs.i3status}/bin/i3status
+    swaybar_command ${pkgs.waybar}/bin/waybar
+    workspace_buttons yes
+    strip_workspace_numbers no
+    tray_output primary
+    colors {
+      background #000000
+      statusline #ffffff
+      separator #666666
+      #  #border #background #text
+      focused_workspace #4c7899 #285577 #ffffff
+      active_workspace #333333 #5f676a #ffffff
+      inactive_workspace #333333 #222222 #888888
+      urgent_workspace #2f343a #900000 #ffffff
+      binding_mode #2f343a #900000 #ffffff
+  }
+  }
+
+  ### displays
+  ## DESKTOP
+  output "Samsung Electric Company S22C300 0x00007F35" {
+  pos 0,0
+  res 1920x1080
+  }
+  output "Goldstar Company Ltd LG ULTRAWIDE 0x00004E94" {
+  pos 1920,0
+  res 3440x1440
+  }
+
+  ## LAPTOP
+  # sh/en TV
+  output "Pioneer Electronic Corporation VSX-524 0x00000101" {
+  pos 0,0
+  res 1920x1080
+  }
+  # internal display
+  output "Unknown 0x0637 0x00000000" {
+  pos 1920,0
+  res 1920x1080
+  }
+''

hosts/modules/gui/sway/waybar-config.nix

@@ -0,0 +1,67 @@
+# docs: https://github.com/Alexays/Waybar/wiki/Configuration
+# format specifiers: https://fmt.dev/latest/syntax.html#syntax
+{ pkgs }:
+[
+  { # TOP BAR
+    layer = "top";
+    height = 40;
+    modules-left = ["sway/workspaces" "sway/mode"];
+    modules-center = ["sway/window"];
+    modules-right = ["custom/mediaplayer" "clock" "battery" "cpu" "network"];
+    "sway/window" = {
+      max-length = 50;
+    };
+    # include song artist/title. source: https://www.reddit.com/r/swaywm/comments/ni0vso/waybar_spotify_tracktitle/
+    "custom/mediaplayer" = {
+      exec = pkgs.writeShellScript "waybar-mediaplayer" ''
+        player_status=$(${pkgs.playerctl}/bin/playerctl status 2> /dev/null)
+        if [ "$player_status" = "Playing" ]; then
+          echo "$(${pkgs.playerctl}/bin/playerctl metadata artist) - $(${pkgs.playerctl}/bin/playerctl metadata title)"
+        elif [ "$player_status" = "Paused" ]; then
+          echo " $(${pkgs.playerctl}/bin/playerctl metadata artist) - $(${pkgs.playerctl}/bin/playerctl metadata title)"
+        fi
+      '';
+      interval = 2;
+      format = "{}  ";
+      # return-type = "json";
+      on-click = "${pkgs.playerctl}/bin/playerctl play-pause";
+      on-scroll-up = "${pkgs.playerctl}/bin/playerctl next";
+      on-scroll-down = "${pkgs.playerctl}/bin/playerctl previous";
+    };
+    network = {
+      # docs: https://github.com/Alexays/Waybar/blob/master/man/waybar-network.5.scd
+      interval = 2;
+      max-length = 40;
+      # custom :> format specifier explained here: https://github.com/Alexays/Waybar/pull/472
+      format-ethernet = "  {bandwidthUpBits:>}▲ {bandwidthDownBits:>}▼";
+      tooltip-format-ethernet = "{ifname} {bandwidthUpBits:>}▲ {bandwidthDownBits:>}▼";
+
+      format-wifi = "{ifname} ({signalStrength}%) {bandwidthUpBits:>}▲ {bandwidthDownBits:>}▼";
+      tooltip-format-wifi = "{essid} ({signalStrength}%) {bandwidthUpBits:>}▲ {bandwidthDownBits:>}▼";
+
+      format-disconnected = "";
+    };
+    cpu = {
+      format = " {usage:2}%";
+      tooltip = false;
+    };
+    battery = {
+      states = {
+        good = 95;
+        warning = 30;
+        critical = 10;
+      };
+      format = "{icon} {capacity}%";
+      format-icons = [
+        ""
+        ""
+        ""
+        ""
+        ""
+      ];
+    };
+    clock = {
+      format-alt = "{:%a, %d. %b  %H:%M}";
+    };
+  }
+]

hosts/modules/gui/sway/waybar-style.css

@@ -0,0 +1,256 @@
+/* style docs: https://github.com/Alexays/Waybar/wiki/Styling */
+
+* {
+  font-family: monospace;
+}
+
+/* defaults below: https://github.com/Alexays/Waybar/blob/master/resources/style.css */
+window#waybar {
+  background-color: rgba(43, 48, 59, 0.5);
+  border-bottom: 3px solid rgba(100, 114, 125, 0.5);
+  color: #ffffff;
+  transition-property: background-color;
+  transition-duration: .5s;
+}
+
+window#waybar.hidden {
+  opacity: 0.2;
+}
+
+/*
+window#waybar.empty {
+  background-color: transparent;
+}
+window#waybar.solo {
+  background-color: #FFFFFF;
+}
+*/
+
+window#waybar.termite {
+  background-color: #3F3F3F;
+}
+
+window#waybar.chromium {
+  background-color: #000000;
+  border: none;
+}
+
+#workspaces button {
+  padding: 0 5px;
+  background-color: transparent;
+  color: #ffffff;
+  /* Use box-shadow instead of border so the text isn't offset */
+  box-shadow: inset 0 -3px transparent;
+  /* Avoid rounded borders under each workspace name */
+  border: none;
+  border-radius: 0;
+}
+
+/* https://github.com/Alexays/Waybar/wiki/FAQ#the-workspace-buttons-have-a-strange-hover-effect */
+#workspaces button:hover {
+  background: rgba(0, 0, 0, 0.2);
+  box-shadow: inset 0 -3px #ffffff;
+}
+
+#workspaces button.focused {
+  background-color: #64727D;
+  box-shadow: inset 0 -3px #ffffff;
+}
+
+#workspaces button.urgent {
+  background-color: #eb4d4b;
+}
+
+#mode {
+  background-color: #64727D;
+  border-bottom: 3px solid #ffffff;
+}
+
+#clock,
+#battery,
+#cpu,
+#memory,
+#disk,
+#temperature,
+#backlight,
+#network,
+#pulseaudio,
+#custom-media,
+#tray,
+#mode,
+#idle_inhibitor,
+#mpd {
+  padding: 0 10px;
+  color: #ffffff;
+}
+
+#window,
+#workspaces {
+  margin: 0 4px;
+}
+
+/* If workspaces is the leftmost module, omit left margin */
+.modules-left > widget:first-child > #workspaces {
+  margin-left: 0;
+}
+
+/* If workspaces is the rightmost module, omit right margin */
+.modules-right > widget:last-child > #workspaces {
+  margin-right: 0;
+}
+
+#clock {
+  background-color: #64727D;
+}
+
+#battery {
+  background-color: #ffffff;
+  color: #000000;
+}
+
+#battery.charging, #battery.plugged {
+  color: #ffffff;
+  background-color: #26A65B;
+}
+
+@keyframes blink {
+  to {
+    background-color: #ffffff;
+    color: #000000;
+  }
+}
+
+#battery.critical:not(.charging) {
+  background-color: #f53c3c;
+  color: #ffffff;
+  animation-name: blink;
+  animation-duration: 0.5s;
+  animation-timing-function: linear;
+  animation-iteration-count: infinite;
+  animation-direction: alternate;
+}
+
+label:focus {
+  background-color: #000000;
+}
+
+#cpu {
+  background-color: #2ecc71;
+  color: #000000;
+}
+
+#memory {
+  background-color: #9b59b6;
+}
+
+#disk {
+  background-color: #964B00;
+}
+
+#backlight {
+  background-color: #90b1b1;
+}
+
+#network {
+  background-color: #2980b9;
+}
+
+#network.disconnected {
+  background-color: #f53c3c;
+}
+
+#pulseaudio {
+  background-color: #f1c40f;
+  color: #000000;
+}
+
+#pulseaudio.muted {
+  background-color: #90b1b1;
+  color: #2a5c45;
+}
+
+#custom-media {
+  background-color: #66cc99;
+  color: #2a5c45;
+  min-width: 100px;
+}
+
+#custom-media.custom-spotify {
+  background-color: #66cc99;
+}
+
+#custom-media.custom-vlc {
+  background-color: #ffa000;
+}
+
+#temperature {
+  background-color: #f0932b;
+}
+
+#temperature.critical {
+  background-color: #eb4d4b;
+}
+
+#tray {
+  background-color: #2980b9;
+}
+
+#tray > .passive {
+  -gtk-icon-effect: dim;
+}
+
+#tray > .needs-attention {
+  -gtk-icon-effect: highlight;
+  background-color: #eb4d4b;
+}
+
+#idle_inhibitor {
+  background-color: #2d3436;
+}
+
+#idle_inhibitor.activated {
+  background-color: #ecf0f1;
+  color: #2d3436;
+}
+
+#mpd {
+  background-color: #66cc99;
+  color: #2a5c45;
+}
+
+#mpd.disconnected {
+  background-color: #f53c3c;
+}
+
+#mpd.stopped {
+  background-color: #90b1b1;
+}
+
+#mpd.paused {
+  background-color: #51a37a;
+}
+
+#language {
+  background: #00b093;
+  color: #740864;
+  padding: 0 5px;
+  margin: 0 5px;
+  min-width: 16px;
+}
+
+#keyboard-state {
+  background: #97e1ad;
+  color: #000000;
+  padding: 0 0px;
+  margin: 0 5px;
+  min-width: 16px;
+}
+
+#keyboard-state > label {
+  padding: 0 5px;
+}
+
+#keyboard-state > label.locked {
+  background: rgba(0, 0, 0, 0.2);
+}
+

hosts/modules/gui/sxmo.nix

@@ -0,0 +1,280 @@
+# this work derives from noneucat's sxmo service/packages, found via NUR
+# - <repo:nix-community/nur-combined:repos/noneucat/modules/pinephone/sxmo.nix>
+# other nix works:
+# - <https://github.com/wentam/sxmo-nix>
+#   - implements sxmo atop tinydm (also packaged by wentam)
+#   - wentam cleans up sxmo-utils to be sealed. also patches to use systemd poweroff, etc
+#   - packages a handful of anjan and proycon utilities
+#   - packages <https://gitlab.com/kop316/mmsd/>
+#   - packages <https://gitlab.com/kop316/vvmd/>
+# - <https://github.com/chuangzhu/nixpkgs-sxmo>
+#   - implements sxmo as a direct systemd service -- apparently no DM
+#   - packages sxmo-utils
+#     - injects PATH into each script
+# - perhaps sxmo-utils is best packaged via the `resholve` shell solver?
+#
+# sxmo documentation:
+# - <repo:anjan/sxmo-docs-next>
+#
+# sxmo technical overview:
+# - inputs
+#   - dwm: handles vol/power buttons; hardcoded in config.h
+#   - lisgd: handles gestures
+# - startup
+#   - daemon based (lisgsd, idle_locker, statusbar_periodics)
+#   - auto-started at login
+#   - managable by `sxmo_daemons.sh`
+#     - list available daemons: `sxmo_daemons.sh list`
+#     - query if a daemon is active: `sxmo_daemons.sh running <my-daemon>`
+#     - start daemon: `sxmo_daemons.sh start <my-daemon>`
+#   - managable by `superctl`
+#     - `superctl status`
+# - user hooks:
+#   - live in ~/.config/sxmo/hooks/
+# - logs:
+#   - live in ~/.local/state/sxmo.log
+#   - ~/.local/state/superd.log
+#   - ~/.local/state/superd/logs/<daemon>.log
+#   - `journalctl --user --boot`  (lightm redirects the sxmo session stdout => systemd)
+#
+# - default components:
+#   - DE:                  sway (if wayland), dwm (if X)
+#   - menus:               bemenu (if wayland), dmenu (if X)
+#   - gestures:            lisgd
+#   - on-screen keyboard:  wvkbd (if wayland), svkbd (if X)
+#
+{ lib, config, pkgs, sane-lib, ... }:
+
+let
+  cfg = config.sane.gui.sxmo;
+in
+{
+  options = with lib; {
+    sane.gui.sxmo.enable = mkOption {
+      default = false;
+      type = types.bool;
+    };
+    sane.gui.sxmo.greeter = mkOption {
+      type = types.enum [ "lightdm-mobile" "sway" ];
+      default = "lightdm-mobile";
+      description = ''
+        which greeter to use.
+        "lightdm-mobile" => keypad style greeter. can only enter digits 0-9 as password.
+        "sway" => layered sway greeter. behaves as if you booted to swaylock.
+      '';
+    };
+    sane.gui.sxmo.hooks = mkOption {
+      type = types.package;
+      default = pkgs.runCommand "sxmo-hooks" { } ''
+        mkdir -p $out
+        ln -s ${pkgs.sxmo-utils}/share/sxmo/default_hooks $out/bin
+      '';
+      description = ''
+        hooks to make visible to sxmo.
+        a hook is a script generally of the name sxmo_hook_<thing>.sh
+        which is called by sxmo at key moments to proide user programmability.
+      '';
+    };
+    sane.gui.sxmo.deviceHooks = mkOption {
+      type = types.package;
+      default = pkgs.runCommand "sxmo-device-hooks" { } ''
+        mkdir -p $out
+        ln -s ${pkgs.sxmo-utils}/share/sxmo/default_hooks/unknown $out/bin
+      '';
+      description = ''
+        device-specific hooks to make visible to sxmo.
+        this package supplies things like `sxmo_hook_inputhandler.sh`.
+        a hook is a script generally of the name sxmo_hook_<thing>.sh
+        which is called by sxmo at key moments to proide user programmability.
+      '';
+    };
+    sane.gui.sxmo.terminal = mkOption {
+      # type = types.nullOr (types.enum [ "foot" "st" "vte" ]);
+      type = types.nullOr types.string;
+      default = "foot";
+      description = ''
+        name of terminal to use for sxmo_terminal.sh.
+        foot, st, and vte have special integrations in sxmo, but any will work.
+      '';
+    };
+    sane.gui.sxmo.keyboard = mkOption {
+      # type = types.nullOr (types.enum ["wvkbd"])
+      type = types.nullOr types.string;
+      default = "wvkbd";
+      description = ''
+        name of on-screen-keyboard to use for sxmo_keyboard.sh.
+        this sets the KEYBOARD environment variable.
+        see also: KEYBOARD_ARGS.
+      '';
+    };
+    sane.gui.sxmo.settings = mkOption {
+      type = types.attrsOf types.string;
+      default = {};
+      description = ''
+        environment variables used to configure sxmo.
+        e.g. SXMO_UNLOCK_IDLE_TIME or SXMO_VOLUME_BUTTON.
+      '';
+    };
+  };
+
+  config = lib.mkMerge [
+    {
+      sane.programs.sxmoApps = {
+        package = null;
+        suggestedPrograms = [
+          "guiApps"
+        ];
+      };
+    }
+
+    (lib.mkIf cfg.enable {
+      sane.programs.sxmoApps.enableFor.user.colin = true;
+
+      # some programs (e.g. fractal/nheko) **require** a "Secret Service Provider"
+      services.gnome.gnome-keyring.enable = true;
+
+      # TODO: probably need to enable pipewire
+
+      networking.useDHCP = false;
+      networking.networkmanager.enable = true;
+      networking.wireless.enable = lib.mkForce false;
+
+      hardware.bluetooth.enable = true;
+      services.blueman.enable = true;
+
+      # sxmo internally uses doas instead of sudo
+      security.doas.enable = true;
+      security.doas.wheelNeedsPassword = false;
+
+      # TODO: not all of these fonts seem to be mapped to the correct icon
+      fonts.fonts = [ pkgs.nerdfonts ];
+
+      # i believe sxmo recomments a different audio stack
+      # administer with pw-cli, pw-mon, pw-top commands
+      services.pipewire = {
+        enable = true;
+        alsa.enable = true;
+        alsa.support32Bit = true;  # ??
+        pulse.enable = true;
+      };
+      systemd.user.services."pipewire".wantedBy = [ "graphical-session.target" ];
+
+      # TODO: could use `displayManager.sessionPackages`?
+      environment.systemPackages = with pkgs; [
+        bc
+        bemenu
+        bonsai
+        conky
+        gojq
+        inotify-tools
+        jq
+        libnotify
+        lisgd
+        mako
+        superd
+        sway
+        swayidle
+        sxmo-utils
+        wob
+        wvkbd
+        xdg-user-dirs
+
+        # X11 only?
+        xdotool
+
+        cfg.deviceHooks
+        cfg.hooks
+      ] ++ lib.optionals (cfg.terminal != null) [ pkgs."${cfg.terminal}" ]
+        ++ lib.optionals (cfg.keyboard != null) [ pkgs."${cfg.keyboard}" ];
+
+      environment.sessionVariables = {
+        XDG_DATA_DIRS = [
+          # TODO: only need the share/sxmo directly linked
+          "${pkgs.sxmo-utils}/share"
+        ];
+      } // lib.optionalAttrs (cfg.terminal != null) {
+        TERMCMD = lib.mkDefault (if cfg.terminal == "vte" then "vte-2.91" else cfg.terminal);
+      } // lib.optionalAttrs (cfg.keyboard != null) {
+        KEYBOARD = lib.mkDefault (if cfg.keyboard == "wvkbd" then "wvkbd-mobintl" else cfg.keyboard);
+      } // cfg.settings;
+
+      sane.user.fs.".cache/sxmo/sxmo.noidle" = sane-lib.fs.wantedText "";
+
+
+      ## greeter
+
+      services.xserver = lib.mkIf (cfg.greeter == "lightdm-mobile") {
+        enable = true;
+
+        displayManager.lightdm.enable = true;
+        displayManager.lightdm.greeters.mobile.enable = true;
+        displayManager.lightdm.extraSeatDefaults = ''
+          user-session = swmo
+        '';
+
+        displayManager.sessionPackages = with pkgs; [
+          sxmo-utils  # this gets share/wayland-sessions/swmo.desktop linked
+        ];
+
+        # taken from gui/phosh:
+        # NB: setting defaultSession has the critical side-effect that it lets org.freedesktop.AccountsService
+        # know that our user exists. this ensures lightdm succeeds when calling /org/freedesktop/AccountsServices ListCachedUsers
+        # lightdm greeters get the login users from lightdm which gets it from org.freedesktop.Accounts.ListCachedUsers.
+        # this requires the user we want to login as to be cached.
+        displayManager.job.preStart = ''
+          ${pkgs.systemd}/bin/busctl call org.freedesktop.Accounts /org/freedesktop/Accounts org.freedesktop.Accounts CacheUser s colin
+        '';
+      };
+
+      services.greetd = lib.mkIf (cfg.greeter == "sway") {
+        enable = true;
+        # borrowed from gui/sway
+        settings.default_session.command =
+        let
+          # start sway and have it construct the gtkgreeter
+          sway-as-greeter = pkgs.writeShellScriptBin "sway-as-greeter" ''
+            ${pkgs.sway}/bin/sway --debug --config ${sway-config-into-gtkgreet} > /var/log/sway/sway-as-greeter.log 2>&1
+          '';
+          # (config file for the above)
+          sway-config-into-gtkgreet = pkgs.writeText "greetd-sway-config" ''
+            exec "${gtkgreet-launcher}"
+          '';
+          # gtkgreet which launches a layered sway instance
+          gtkgreet-launcher = pkgs.writeShellScript "gtkgreet-launcher" ''
+            # NB: the "command" field here is run in the user's shell.
+            # so that command must exist on the specific user's path who is logging in. it doesn't need to exist system-wide.
+            ${pkgs.greetd.gtkgreet}/bin/gtkgreet --layer-shell --command sxmo_winit.sh
+          '';
+        in "${sway-as-greeter}/bin/sway-as-greeter";
+      };
+
+      sane.fs."/var/log/sway" = lib.mkIf (cfg.greeter == "sway") {
+        dir.acl.mode = "0777";
+        wantedBeforeBy = [ "greetd.service" "display-manager.service" ];
+      };
+
+      # lightdm-mobile-greeter: "The name org.a11y.Bus was not provided by any .service files"
+      services.gnome.at-spi2-core.enable = true;
+
+      # services.xserver.windowManager.session = [{
+      #   name = "sxmo";
+      #   desktopNames = [ "sxmo" ];
+      #   start = ''
+      #     ${pkgs.sxmo-utils}/bin/sxmo_xinit.sh &
+      #     waitPID=$!
+      #   '';
+      # }];
+      # services.xserver.enable = true;
+
+      # services.greetd = {
+      #   enable = true;
+      #   settings = {
+      #     default_session = {
+      #       command = "${pkgs.sxmo-utils}/bin/sxmo_winit.sh";
+      #       user = "colin";
+      #     };
+      #   };
+      # };
+    })
+  ];
+}

hosts/modules/hosts.nix

@@ -69,7 +69,7 @@ in
       ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFw9NoRaYrM6LbDd3aFBc4yyBlxGQn8HjeHd/dZ3CfHk";
       wg-home.pubkey = "17PMZssYi0D4t2d0vbmhjBKe1sGsE8kT8/dod0Q2CXc=";
       wg-home.ip = "10.0.10.22";
-      lan-ip = "192.168.15.25";
+      lan-ip = "10.78.79.52";
     };
 
     sane.hosts.by-name."lappy" = {
@@ -77,7 +77,7 @@ in
       ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSJnqmVl9/SYQ0btvGb0REwwWY8wkdkGXQZfn/1geEc";
       wg-home.pubkey = "FTUWGw2p4/cEcrrIE86PWVnqctbv8OYpw8Gt3+dC/lk=";
       wg-home.ip = "10.0.10.20";
-      lan-ip = "192.168.15.13";
+      lan-ip = "10.78.79.53";
     };
 
     sane.hosts.by-name."moby" = {
@@ -85,7 +85,7 @@ in
       ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1N/IT3nQYUD+dBlU1sTEEVMxfOyMkrrDeyHcYgnJvw";
       wg-home.pubkey = "I7XIR1hm8bIzAtcAvbhWOwIAabGkuEvbWH/3kyIB1yA=";
       wg-home.ip = "10.0.10.48";
-      lan-ip = "192.168.15.28";
+      lan-ip = "10.78.79.54";
     };
 
     sane.hosts.by-name."servo" = {
@@ -94,7 +94,7 @@ in
       wg-home.pubkey = "roAw+IUFVtdpCcqa4khB385Qcv9l5JAB//730tyK4Wk=";
       wg-home.ip = "10.0.10.5";
       wg-home.endpoint = "uninsane.org:51820";
-      lan-ip = "192.168.15.24";
+      lan-ip = "10.78.79.51";
     };
   };
 }

hosts/modules/roles/ac.nix

@@ -0,0 +1,16 @@
+{ config, lib, ... }:
+{
+  options.sane.roles.ac = with lib; mkOption {
+    type = types.bool;
+    default = false;
+    description = ''
+      services which you probably only want to use with AC power.
+      specifically because they drain resources like power or bandwidth.
+    '';
+  };
+
+  config = lib.mkIf config.sane.roles.ac {
+    # sane.yggdrasil.enable = true;
+    # services.i2p.enable = true;
+  };
+}

hosts/modules/roles/client/wifi-pairings.nix

@@ -1,15 +1,23 @@
 { config, lib, pkgs, ... }:
 
+let
+  install-iwd = pkgs.static-nix-shell.mkBash {
+    pname = "install-iwd";
+    src = ../../../../scripts;
+    pkgs = [ "gnused" ];
+  };
+in
 {
   config = lib.mkIf config.sane.roles.client {
     sane.fs."/var/lib/iwd/.secrets.psk.stamp" = {
       wantedBeforeBy = [ "iwd.service" ];
       generated.acl.mode = "0600";
       # XXX: install-iwd uses sed, but that's part of the default systemd unit path, it seems
-      generated.script.script = builtins.readFile ../../../../scripts/install-iwd + ''
+      generated.script.script = ''
+        ${install-iwd}/bin/install-iwd $@
         touch "/var/lib/iwd/.secrets.psk.stamp"
       '';
-      generated.script.scriptArgs = [ "/run/secrets/iwd" "/var/lib/iwd" ];
+      generated.script.scriptArgs = [ "/run/secrets/net" "/var/lib/iwd" ];
     };
   };
 }

hosts/modules/roles/default.nix

@@ -1,7 +1,9 @@
 { ... }:
 {
   imports = [
+    ./ac.nix
     ./build-machine.nix
     ./client
+    ./dev-machine.nix
   ];
 }

hosts/modules/roles/dev-machine.nix

@@ -0,0 +1,30 @@
+{ config, lib, ... }:
+
+let
+  inherit (lib) mkIf mkMerge mkOption types;
+  cfg = config.sane.roles.dev-machine;
+in
+{
+  options.sane.roles.dev-machine = mkOption {
+    type = types.bool;
+    default = false;
+    description = ''
+      enable if this machine is used generally for "development"
+      and you want tools to support that (e.g. docs).
+    '';
+  };
+
+  config = mkMerge [
+    ({
+      sane.programs.docsets.config.rustPkgs = [
+        "lemmy-server"
+        "mx-sanebot"
+      ];
+    })
+    (mkIf cfg {
+      sane.programs.docsets.enableFor.system = true;
+      # TODO: migrate this to `sane.user.programs.zeal.enable = true`
+      sane.programs.zeal.enableFor.user.colin = true;
+    })
+  ];
+}

hosts/modules/services/duplicity.nix

@@ -29,7 +29,7 @@ in
     #   web-created keys are allowed to delete files, which you probably don't want for an incremental backup program
     #   you need to create a new application key from the web in order to first get a key which can create new keys (use env vars in the above command)
     # TODO: s/duplicity_passphrase/duplicity_env/
-    services.duplicity.secretFile = config.sops.secrets.duplicity_passphrase.path;
+    services.duplicity.secretFile = config.sops.secrets."duplicity_passphrase.env".path;
     # NB: manually trigger with `systemctl start duplicity`
     services.duplicity.frequency = "daily";
 

hosts/modules/wg-home.nix

@@ -33,6 +33,11 @@ in
       type = types.bool;
       default = false;
     };
+    sane.services.wg-home.enableWan = mkOption {
+      type = types.bool;
+      default = false;
+      description = "whether to make this port visible on the WAN";
+    };
     sane.services.wg-home.ip = mkOption {
       type = types.str;
     };
@@ -51,6 +56,7 @@ in
 
     # for convenience, have both the server and client use the same port for their wireguard connections.
     networking.firewall.allowedUDPPorts = [ 51820 ];
+    sane.services.wan-ports.udp = lib.mkIf cfg.enableWan [ 51820 ];
     networking.wireguard.interfaces.wg-home = {
       listenPort = 51820;
       privateKeyFile = "/run/wg-home.priv";

hosts/modules/yggdrasil.nix

@@ -18,7 +18,7 @@ in
     services.yggdrasil = {
       enable = true;
       persistentKeys = true;
-      config = {
+      settings = {
         IFName = "ygg0";
         Peers = [
           "tls://longseason.1200bps.xyz:13122"

integrations/nur/default.nix

@@ -0,0 +1,39 @@
+# Nix User Repository (NUR)
+# - <https://github.com/nix-community/NUR>
+#
+# this file is not reachable from the top-level of my nixos configs (i.e. toplevel flake.nix)
+# nor is it intended for anyone who wants to reference my config directly
+#   (consider the toplevel flake.nix outputs instead).
+#
+# rather, this is the entrypoint through which NUR finds my packages, modules, overlays.
+# it's reachable only from those using this repo via NUR.
+#
+# to manually query available packages, modules, etc, try:
+# - nix eval --impure --expr 'builtins.attrNames (import ./. {})'
+#
+# to validate this before a push that would propagate to NUR:
+#   NIX_PATH= NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM=1 nix-env -f . -qa \* --meta --xml \
+#     --allowed-uris https://static.rust-lang.org \
+#     --option restrict-eval true \
+#     --option allow-import-from-derivation true \
+#     --drv-path --show-trace \
+#     -I nixpkgs=$(nix-instantiate --find-file nixpkgs) \
+#     -I ../../
+# ^ source: <https://github.com/nix-community/nur-packages-template/blob/master/.github/workflows/build.yml#L63>
+#   N.B.: nur eval allows only PATH (inherited) and NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM="1" (forced),
+#   hence the erasing of NIX_PATH above (to remove external overlays)
+#
+# if it validates here but not upstream, likely to do with different `nixpkgs` inputs.
+# - CI logs: <https://github.com/nix-community/NUR/actions/workflows/update.yml>
+
+{ pkgs ? import <nixpkgs> {} }:
+let
+  sanePkgs = import ../../pkgs { inherit pkgs; };
+in
+({
+  overlays.pkgs = import ../../overlays/pkgs.nix;
+  pkgs = sanePkgs;
+
+  modules = import ../../modules { inherit (pkgs) lib; };
+  lib = import ../../modules/lib { inherit (pkgs) lib; };
+} // sanePkgs)

modules/data/feeds/default.nix

@@ -1,8 +1,9 @@
-{ lib, ... }:
+{ lib, sane-lib, ... }:
 
 let
   inherit (builtins) concatLists concatStringsSep foldl' fromJSON map readDir readFile;
   inherit (lib) hasSuffix listToAttrs mapAttrsToList removeSuffix splitString;
+  inherit (sane-lib) enumerateFilePaths;
 
   # given a path to a .json file relative to sources, construct the best feed object we can.
   # the .json file could be empty, in which case we make assumptions about the feed based
@@ -32,20 +33,5 @@ let
         fromJSON as-str;
 
   sources = enumerateFilePaths ./sources;
-
-  # like `lib.listFilesRecursive` but does not mangle paths.
-  # Type: enumerateFilePaths :: path -> [String]
-  enumerateFilePaths = base:
-    concatLists (
-      mapAttrsToList
-        (name: type:
-          if type == "directory" then
-            # enumerate this directory and then prefix each result with the directory's name
-            map (e: "${name}/${e}") (enumerateFilePaths (base + "/${name}"))
-          else
-            [ name ]
-        )
-        (readDir base)
-    );
 in
   listToAttrs (map feedFromSourcePath sources)

modules/data/feeds/sources/morningbrew.com/feed/default.json

@@ -0,0 +1,21 @@
+{
+  "bozo": 0,
+  "content_length": 151072,
+  "content_type": "text/xml; charset=utf-8",
+  "description": "The daily email newsletter covering the latest news from Wall St. to Silicon Valley. Informative, witty, and everything you need to start your day.",
+  "favicon": "",
+  "favicon_data_uri": "",
+  "hubs": [],
+  "is_podcast": false,
+  "is_push": false,
+  "item_count": 40,
+  "last_updated": "2023-05-08T19:26:29+00:00",
+  "score": 23,
+  "self_url": "https://www.morningbrew.com/feed.xml",
+  "site_name": "Morning Brew",
+  "site_url": "https://www.morningbrew.com",
+  "title": "Morning Brew",
+  "url": "https://www.morningbrew.com/feed.xml",
+  "velocity": 3.931,
+  "version": "rss20"
+}

modules/default.nix

@@ -1,4 +1,4 @@
-{ lib, utils, ... }:
+{ lib, ... }:
 
 {
   imports = [
@@ -14,8 +14,8 @@
     ./users.nix
   ];
 
-  _module.args =  {
-    sane-lib = import ./lib { inherit lib utils; };
-    sane-data = import ./data { inherit lib; };
+  _module.args =  rec {
+    sane-lib = import ./lib { inherit lib; };
+    sane-data = import ./data { inherit lib sane-lib; };
   };
 }

modules/fs/default.nix

@@ -341,6 +341,8 @@ in {
   options = {
     sane.fs = mkOption {
       # type = types.attrsOf fsEntry;
+      # TODO: can we use `types.lazyAttrsOf fsEntry`??
+      # - this exists specifically to let attrs reference eachother
       type = fsTree;
       default = {};
     };

modules/lib/default.nix

@@ -1,12 +1,12 @@
-{ lib, ... }@moduleArgs:
+{ lib, ... }:
 
 let
 sane-lib = rec {
-  feeds = import ./feeds.nix moduleArgs;
-  fs = import ./fs.nix moduleArgs;
-  merge = import ./merge.nix ({ inherit sane-lib; } // moduleArgs);
-  path = import ./path.nix moduleArgs;
-  types = import ./types.nix moduleArgs;
+  feeds = import ./feeds.nix { inherit lib; };
+  fs = import ./fs.nix { inherit lib; };
+  merge = import ./merge.nix { inherit lib sane-lib; };
+  path = import ./path.nix { inherit lib; };
+  types = import ./types.nix { inherit lib; };
 
   # re-exports
   inherit (merge) mkTypedMerge;
@@ -72,5 +72,22 @@ sane-lib = rec {
       inherit path value;
     }
   ];
+
+
+  # like `lib.listFilesRecursive` but does not mangle paths.
+  #
+  # Type: enumerateFilePaths :: path -> [String]
+  enumerateFilePaths = base:
+    builtins.concatLists (
+      lib.mapAttrsToList
+        (name: type:
+          if type == "directory" then
+            # enumerate this directory and then prefix each result with the directory's name
+            builtins.map (e: "${name}/${e}") (enumerateFilePaths (base + "/${name}"))
+          else
+            [ name ]
+        )
+        (builtins.readDir base)
+    );
 };
 in sane-lib

modules/lib/path.nix

@@ -1,4 +1,4 @@
-{ lib, utils, ... }:
+{ lib, ... }:
 
 let path = rec {
 

modules/programs.nix

@@ -104,6 +104,19 @@ let
           the secret will have same owner as the user under which the program is enabled.
         '';
       };
+      configOption = mkOption {
+        type = types.raw;
+        default = mkOption {
+          type = types.submodule {};
+          default = {};
+        };
+        description = ''
+          declare any other options the program may be configured with.
+          you probably want this to be a submodule.
+          the option *definitions* can be set with `sane.programs."foo".config = ...`.
+        '';
+      };
+      config = config.configOption;
     };
 
     config = {
@@ -132,9 +145,10 @@ let
     sane.users = mapAttrs (user: en: optionalAttrs en {
       inherit (p) persist;
       fs = mkMerge [
-        p.fs
+        # make every fs entry wanted by system boot:
+        (mapAttrs (_path: sane-lib.fs.wanted) p.fs)
+        # link every secret into the fs:
         (mapAttrs
-          # link every secret into the fs
           # TODO: user the user's *actual* home directory, don't guess.
           (homePath: _src: sane-lib.fs.wantedSymlinkTo "/run/secrets/home/${user}/${homePath}")
           p.secrets

modules/services/default.nix

@@ -6,5 +6,6 @@
     ./mautrix-signal.nix
     ./nixserve.nix
     ./trust-dns.nix
+    ./wan-ports.nix
   ];
 }

modules/services/dyn-dns.nix

@@ -5,7 +5,8 @@ let
   cfg = config.sane.services.dyn-dns;
   getIp = pkgs.writeShellScript "dyn-dns-query-wan" ''
     # preferred method and fallback
-    ${pkgs.sane-scripts}/bin/sane-ip-check-router-wan || \
+    # OPNsense router broadcasts its UPnP endpoint every 30s
+    timeout 60 ${pkgs.sane-scripts}/bin/sane-ip-check-upnp || \
       ${pkgs.sane-scripts}/bin/sane-ip-check
   '';
 in

modules/services/nixserve.nix

@@ -13,21 +13,17 @@ in
       default = false;
       type = types.bool;
     };
-    sane.services.nixserve.sopsFile = mkOption {
+    sane.services.nixserve.secretKeyFile = mkOption {
       type = types.path;
-      description = "path to file that contains the nix_serv_privkey secret (can be in VCS)";
+      description = "path to file that contains the nix_serve_privkey secret (should not be in the store)";
     };
   };
 
   config = mkIf cfg.enable {
     services.nix-serve = {
       enable = true;
-      secretKeyFile = config.sops.secrets.nix_serve_privkey.path;
+      inherit (cfg) secretKeyFile;
       openFirewall = true;  # not needed for servo; only desko
     };
-
-    sops.secrets.nix_serve_privkey = {
-      sopsFile = cfg.sopsFile;
-    };
   };
 }

modules/services/trust-dns.nix

@@ -171,8 +171,8 @@ in
 
   config = mkIf cfg.enable {
     sane.services.trust-dns.generatedZones = mapAttrs (zone: zcfg: genZone zcfg) cfg.zones;
-    networking.firewall.allowedTCPPorts = [ 53 ];
-    networking.firewall.allowedUDPPorts = [ 53 ];
+    sane.services.wan-ports.tcp = [ 53 ];
+    sane.services.wan-ports.udp = [ 53 ];
 
     systemd.services.trust-dns = {
       description = "trust-dns DNS server";

modules/services/wan-ports.nix

@@ -0,0 +1,35 @@
+{ config, lib, ... }:
+let
+  cfg = config.sane.services.wan-ports;
+in
+{
+  options = with lib; {
+    sane.services.wan-ports = {
+      openFirewall = mkOption {
+        default = false;
+        type = types.bool;
+      };
+
+      # TODO: openUpnp option
+
+      # TODO: rework this to look like:
+      # ports.53 = {
+      #   protocol = [ "udp" "tcp" ];  # have this be default
+      #   visibility = "wan";  # or "lan"
+      # }
+      tcp = mkOption {
+        type = types.listOf types.int;
+        default = [];
+      };
+      udp = mkOption {
+        type = types.listOf types.int;
+        default = [];
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.openFirewall {
+    networking.firewall.allowedTCPPorts = cfg.tcp;
+    networking.firewall.allowedUDPPorts = cfg.udp;
+  };
+}

nixpatches/10-flutter-arm64.patch

@@ -1,40 +0,0 @@
-diff --git a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
-index 565c44f72e9..f20a3d4e9be 100644
---- a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
-+++ b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
-@@ -4,13 +4,19 @@
- , olm
- , imagemagick
- , makeDesktopItem
-+, stdenv
- }:
- 
-+let vendorHashes = {
-+  x86_64-linux = "sha256-p5EJP2zSvWyRV1uyTHw0EpFsEwAGtX5B9WVjpLmnVew=";
-+  aarch64-linux = "sha256-Ps0HmDI6BFxHrLRq3KWNk4hw0qneq5hqB/Mp99f+hO4=";
-+};
-+in
- flutter.mkFlutterApp rec {
-   pname = "fluffychat";
-   version = "1.6.1";
- 
--  vendorHash = "sha256-SelMRETFYZgTStV90gRoKhazu1NPbcSMO9mYebSQskQ=";
-+  vendorHash = vendorHashes."${stdenv.hostPlatform.system}" or (throw "unsupported system: ${stdenv.hostPlatform.system}");
- 
-   src = fetchFromGitLab {
-     owner = "famedly";
-diff --git a/pkgs/development/compilers/flutter/default.nix b/pkgs/development/compilers/flutter/default.nix
-index 9eba6773448..e9d352169b2 100644
---- a/pkgs/development/compilers/flutter/default.nix
-+++ b/pkgs/development/compilers/flutter/default.nix
-@@ -19,6 +19,10 @@ let
-         url = "${dartSourceBase}/stable/release/${dartVersion}/sdk/dartsdk-linux-x64-release.zip";
-         sha256 = "sha256-PMY6DCFQC8XrlnFzOEPcwgBAs5/cAvNd78969Z+I1Fk=";
-       };
-+      "${dartVersion}-aarch64-linux" = fetchurl {
-+        url = "${dartSourceBase}/stable/release/${dartVersion}/sdk/dartsdk-linux-arm64-release.zip";
-+        sha256 = "sha256-BIK6kUx+m+/GfR/wBXv8rjVNbP6w1HFvH/RGIwiaJog=";
-+      };
-     };
-   };
- in {

nixpatches/2023-04-29-lemmy.patch

@@ -0,0 +1,15 @@
+diff --git a/pkgs/servers/web-apps/lemmy/pin.json b/pkgs/servers/web-apps/lemmy/pin.json
+index b2a1f1923ce..621b5945b6b 100644
+--- a/pkgs/servers/web-apps/lemmy/pin.json
++++ b/pkgs/servers/web-apps/lemmy/pin.json
+@@ -1,7 +1,7 @@
+ {
+-  "version": "0.17.2",
+-  "serverSha256": "sha256-fkpMVm52XLyrk9RfzJpthT8fctIilawAIgfK+4TXHvU=",
+-  "serverCargoSha256": "sha256-AC6EP612uaeGfqHbrHrz89h0tsNlMceEg6GxEsm1QMA=",
++  "version": "88a0d2feec3f9b4a06f2d8d090894111afcbd9e2",
++  "serverSha256": "sha256-jVa7SckpH21TG+i1yjJOkhEgjnZ0Zgk2IUP7sCdtv1Y=",
++  "serverCargoSha256": "sha256-trp/TCGtAtZlKdZk2CaJ3E9Lj95cq797PLWUF/DD6/M=",
+   "uiSha256": "sha256-0Zhm6Jgc6rlN4c7ryRnR45+fZEdzQhuOXSwU8Wz0D5g=",
+   "uiYarnDepsSha256": "sha256-aZAclSaFZJvuK+FpCBWboGaVEOEJTxq2jnWk0A6iAFw="
+ }

nixpatches/flake.nix

@@ -1,5 +1,6 @@
 {
   inputs = {
+    # user is expected to define this from their flake via `inputs.nixpkgs.follows = ...`
     nixpkgs = {};
   };
   outputs = { self, nixpkgs }@inputs:
@@ -16,6 +17,8 @@
         (patchedFlakeFor system).outputs { inherit self; };
     in
     {
+      lib.nixosSystem = args: (patchedFlakeOutputsFor args.system).lib.nixosSystem args;
+
       legacyPackages = builtins.mapAttrs
         (system: _:
           (patchedFlakeOutputsFor system).legacyPackages."${system}"

nixpatches/list.nix

@@ -1,10 +1,30 @@
-{ fetchpatch, fetchurl }: [
+{ fetchpatch, fetchurl }:
+let
+  fetchpatch' = {
+    saneCommit ? null,
+    prUrl ? null,
+    hash ? null,
+    title ? null,
+  }:
+    let
+      url = if prUrl != null then
+        # prUrl takes precedence over any specific commit
+        "${prUrl}.diff"
+      else
+        "https://git.uninsane.org/colin/nixpkgs/commit/${saneCommit}.diff"
+      ;
+    in fetchpatch (
+      { inherit url; }
+      // (if hash != null then { inherit hash; } else {})
+      // (if title != null then { name = title; } else {})
+    );
+in [
 
   # splatmoji: init at 1.2.0
-  (fetchpatch {
-    # https://github.com/NixOS/nixpkgs/pull/211874
-    url = "https://git.uninsane.org/colin/nixpkgs/commit/75149039b6eaf57d8a92164e90aab20eb5d89196.diff";
-    hash = "sha256-IvsIcd2wPdz4b/7FMrDrcVlIZjFecCQ9uiL0Umprbx0=";
+  (fetchpatch' {
+    saneCommit = "75149039b6eaf57d8a92164e90aab20eb5d89196";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/211874";
+    hash = "sha256-fftctCx1N/P7yLTRxsHYLHbX+gV/lFpWrWCTtZ2L1Cw=";
   })
 
   # (fetchpatch {
@@ -33,33 +53,102 @@
   # ./2023-03-04-ccache-cross-fix.patch
 
   # 2023-04-11: bambu-studio: init at unstable-2023-01-11
-  (fetchpatch {
-    url = "https://github.com/NixOS/nixpkgs/pull/206495.diff";
+  (fetchpatch' {
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/206495";
     hash = "sha256-RbQzAtFTr7Nrk2YBcHpKQMYoPlFMVSXNl96B/lkKluQ=";
   })
 
+  # update to newer lemmy-server.
+  # should be removable when > 0.17.2 releases?
+  # removing this now causes:
+  #   INFO lemmy_server::code_migrations: No Local Site found, creating it.
+  #   Error: LemmyError { message: None, inner: duplicate key value violates unique constraint "local_site_site_id_key", context: "SpanTrace" }
+  # though perhaps this error doesn't occur on fresh databases (idk).
+  ./2023-04-29-lemmy.patch
+
+  (fetchpatch' {
+    title = "cargo-docset: init at 0.3.1";
+    saneCommit = "5a09e84c6159ce545029483384580708bc04c08f";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/231188";
+    hash = "sha256-Z1HOps3w/WvxAiyUAHWszKqwS9EwA6rf4XfgPGp+2sQ=";
+  })
+
+  (fetchpatch' {
+    title = "nixos/lemmy: support nginx";
+    saneCommit = "4c86db6dcb78795ac9bb514d9c779fd591070b23";
+    hash = "sha256-G7jGhSPUp9BMxh2yTzo0KUUVabMJeZ28YTA+0iPldRI=";
+  })
+
+  (fetchpatch' {
+    title = "feedbackd: 0.1.0 -> 0.2.0";
+    saneCommit = "a0186a5782708a640cd6eaad6e9742b9cccebe9d";
+    hash = "sha256-f8he7pQow4fZkTVVqU/A5KgovZA7m7MccRQNTnDxw5o=";
+  })
+  # (fetchpatch' {
+  #   # phoc: 0.25.0 -> 0.27.0
+  #   # TODO: move wayland-scanner & glib to nativeBuildInputs
+  #   # TODO: once i press power button to screen blank, power doesn't reactivate phoc
+  #   # sus commits:
+  #   # - all lie between 0.25.0 .. 0.26.0
+  #   # - 25d65b9e6ebde26087be6414e41cf516599c3469  2023/03/12 phosh-private: Forward key release as well
+  #   # idle inhibit 2023/03/14
+  #   #   - 20e7b26af16e9d9c22cba4550f922b90b80b6df6
+  #   #   - b081ef963154c7c94a6ab33376a712b3efe17545
+  #   # screen blank fix  (NOPE: this one is OK)
+  #   #   - 37542bb80be8a7746d2ccda0c02048dd92fac7af  2023/03/11
+  #   saneCommit = "12e89c9d26b7a1a79f6b8b2f11fce0dd8f4d5197";
+  #   hash = "sha256-IJNBVr2xAwQW4SAJvq4XQYW4D5tevvd9zRrgXYmm38g=";
+  # })
+  # (fetchpatch' {
+  #   # phosh: 0.25.1 -> 0.27.0
+  #   # TODO: fix Calls:
+  #   # > Failed to get emergency contacts: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.gnome.Calls was not provided by any .service files
+  #   saneCommit = "c8fa213c7cb357c0ca0d5bea66278362a47caeb8";
+  #   hash = "sha256-I8IZ8fjJstmcIXEN622/A1w2uHDACwXFl1WbXTWOyi4=";
+  # })
+
+  # (fetchpatch' {
+  #   # phosh-mobile-settings: 0.23.1 -> 0.27.0
+  #   # branch: pr/sane/phosh-mobile-settings-0.27.0
+  #   # TODO: fix feedback section
+  #   # > Settings schema 'org.gtk.gtk4.Settings.FileChooser' is not installed
+  #   # ^ is that provided by nautilus?
+  #   saneCommit = "8952f79699d3b0d72d9f6efb022e826175b143a6";
+  #   hash = "sha256-myKKMt5cZhC0mfPhEsNjwKjaIYICj5LBJqV01HghYUg=";
+  # })
+
   # 2023-04-20: perl: fix modules for compatibility with miniperl
   # (fetchpatch {
   #   url = "https://github.com/NixOS/nixpkgs/pull/225640.diff";
   #   hash = "sha256-MNG8C0OgdPnFQ8SF2loiEhXJuP2z4n9pkXr8Zh4X7QU=";
   # })
 
-  # # kaiteki: init at 2022-09-03
-  # vendorHash changes too frequently (might not be reproducible).
-  # using local package defn until stabilized
-  # (fetchpatch {
-  #   url = "https://git.uninsane.org/colin/nixpkgs/commit/e2c7f5f4870fcb0e5405e9001b39a64c516852d4.diff";
-  #   # url = "https://github.com/NixOS/nixpkgs/pull/193169.diff";
-  #   sha256 = "sha256-UWnfS+stVpUZ3Sfaym9XtVBlwvHWJVMaW7cYIcf3M5Q=";
-  # })
+  (fetchpatch' {
+    title = "conky: 1.13.1 -> 1.18.0";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/217224";
+    hash = "sha256-+g3XhmBt/udhbBDiVyfWnfXKvZTvDurlvPblQ9HYp3s=";
+  })
 
-
-  # Fix mk flutter app
-  # closed (not merged). updates fluffychat 1.2.0 -> 1.6.1, but unstable hashing
-  # (fetchpatch {
-  #   url = "https://github.com/NixOS/nixpkgs/pull/186839.diff";
-  #   sha256 = "sha256-NdIfie+eTy4V1vgqiiRPtWdnxZ5ZHsvCMfkEDUv9SC8=";
+  # (fetchpatch' {
+  #   title = "hare-json: init at unstable-2023-01-31";
+  #   saneCommit = "260f9c6ac4e3564acbceb46aa4b65fbb652f8e23";
+  #   hash = "sha256-bjLKANo0+zaxugJlEk1ObPqRHWOKptD7dXB+/xzsYqA=";
   # })
+  # (fetchpatch' {
+  #   title = "hare-ev: init at unstable-2022-12-29";
+  #   saneCommit = "4058200a407c86c5d963bc49b608aa1a881cbbf2";
+  #   hash = "sha256-wm1aavbCfxBhcOXh4EhFO4u0LrA9tNr0mSczHUK8mQU=";
+  # })
+  # (fetchpatch' {
+  #   title = "bonsai: init at 1.0.0";
+  #   saneCommit = "65d37294d939384e8db400ea82d25ce8b4ad6897";
+  #   hash = "sha256-2easgOtJfzvVcz/3nt3lo1GKLLotrM4CkBRyTgIAhHU=";
+  # })
+  (fetchpatch' {
+    title = "bonsai: init at 1.0.0";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/233892";
+    hash = "sha256-9XKPNg7TewicfbMgiASpYysTs5aduIVP+4onz+noc/0=";
+  })
 
   # for raspberry pi: allow building u-boot for rpi 4{,00}
   # TODO: remove after upstreamed: https://github.com/NixOS/nixpkgs/pull/176018
@@ -67,7 +156,4 @@
   ./02-rpi4-uboot.patch
 
   # ./07-duplicity-rich-url.patch
-
-  # enable aarch64 support for flutter's dart package
-  # ./10-flutter-arm64.patch
 ]

overlays/all.nix

@@ -0,0 +1,26 @@
+# this overlay exists specifically to control the order in which other overlays are applied.
+# for example, `pkgs` *must* be added before `cross`, as the latter applies overrides
+# to the packages defined in the former.
+
+final: prev:
+let
+  pins = import ./pins.nix;
+  pkgs = import ./pkgs.nix;
+  disable-flakey-tests = import ./disable-flakey-tests.nix;
+  optimizations = import ./optimizations.nix;
+  cross = import ./cross.nix;
+
+  isCross = prev.stdenv.hostPlatform != prev.stdenv.buildPlatform;
+  ifCross = overlay: if isCross then overlay else (_: _: {});
+  renderOverlays = overlays: builtins.foldl'
+    (acc: thisOverlay: acc // (thisOverlay final acc))
+    prev
+    overlays;
+in
+  renderOverlays [
+    pins
+    pkgs
+    disable-flakey-tests
+    (ifCross optimizations)
+    (ifCross cross)
+  ]