moby: fix lightdm-mobile-greeter config to work again

browser: temporarily switch back to firefox
recompiling librewolf is not practical -- until the addon signing is upstreamed
2022-11-02 04:59:36 -07:00 · 2022-11-02 04:21:55 -07:00 · 2022-11-02 04:14:00 -07:00 · 2022-11-02 02:39:56 -07:00 · 2022-11-01 22:20:05 -07:00 · 2022-11-01 19:29:33 -07:00
74 changed files with 1598 additions and 869 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -23,6 +23,7 @@ creation_rules:
    key_groups:
    - age:
      - *user_desko_colin
+      - *user_lappy_colin
      - *user_servo_colin
      - *host_servo
  - path_regex: secrets/desko.yaml$
@@ -31,3 +32,16 @@ creation_rules:
      - *user_desko_colin
      - *user_lappy_colin
      - *host_desko
+  - path_regex: secrets/lappy.yaml$
+    key_groups:
+    - age:
+      - *user_lappy_colin
+      - *user_desko_colin
+      - *host_lappy
+  - path_regex: secrets/moby.yaml$
+    key_groups:
+    - age:
+      - *user_desko_colin
+      - *user_lappy_colin
+      - *user_moby_colin
+      - *host_moby
--- a/TODO.md
+++ b/TODO.md
@@ -1,16 +0,0 @@
-# features/tweaks
- emoji picker application
- find a Masto/Pleroma app which works on mobile
- remove hardcoded uid/gids outside of allocations.nix (used in impermanence code -- replace with username/groupname)
-
-
-# speed up cross compiling
- <https://nixos.wiki/wiki/Cross_Compiling>
- <https://nixos.wiki/wiki/NixOS_on_ARM>
-```nix
-   overlays = [{ ... }: {
-     nixpkgs.crossSystem.system = "aarch64-linux";
-   }];
-```
- <https://github.com/nix-community/aarch64-build-box>
-	- apply for access to the community arm build box
--- a/flake.lock
+++ b/flake.lock
@@ -22,11 +22,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1665475263,
-        "narHash": "sha256-T4at7d+KsQNWh5rfjvOtQCaIMWjSDlSgQZKvxb+LcEY=",
+        "lastModified": 1667299227,
+        "narHash": "sha256-vAJPFSDYUq3DdCL8OzTg4xObRNW+yA1Pt+NzbhGu1f8=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "17208be516fc36e2ab0ceb064d931e90eb88b2a3",
+        "rev": "f0ecd4b1db5e15103e955b18cb94bea4296e5c45",
        "type": "github"
      },
      "original": {
@@ -54,11 +54,11 @@
    "mobile-nixos": {
      "flake": false,
      "locked": {
-        "lastModified": 1665711470,
-        "narHash": "sha256-9cjKbTkxyWjswVExtIpglpvlR+iDY9/DWmXpZyzk5cY=",
+        "lastModified": 1667160126,
+        "narHash": "sha256-YRgxMHdvMuLsuXCaKs5YNMD6NKgvcATSjfi9YkUOOLk=",
        "owner": "nixos",
        "repo": "mobile-nixos",
-        "rev": "e4b6f680b2a4f29f087a7c1299c11499d1a367b6",
+        "rev": "da56c338a2b00c868697b75bdbd388f60d50c820",
        "type": "github"
      },
      "original": {
@@ -69,11 +69,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1665732960,
-        "narHash": "sha256-WBZ+uSHKFyjvd0w4inbm0cNExYTn8lpYFcHEes8tmec=",
+        "lastModified": 1667231093,
+        "narHash": "sha256-RERXruzBEBuf0c7OfZeX1hxEKB+PTCUNxWeB6C1jd8Y=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "4428e23312933a196724da2df7ab78eb5e67a88e",
+        "rev": "d40fea9aeb8840fea0d377baa4b38e39b9582458",
        "type": "github"
      },
      "original": {
@@ -84,11 +84,11 @@
    },
    "nixpkgs-22_05": {
      "locked": {
-        "lastModified": 1665279158,
-        "narHash": "sha256-TpbWNzoJ5RaZ302dzvjY2o//WxtOJuYT3CnDj5N69Hs=",
+        "lastModified": 1667091951,
+        "narHash": "sha256-62sz0fn06Nq8OaeBYrYSR3Y6hUcp8/PC4dJ7HeGaOhU=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "b3783bcfb8ec54e0de26feccfc6cc36b8e202ed5",
+        "rev": "6440d13df2327d2db13d3b17e419784020b71d22",
        "type": "github"
      },
      "original": {
@@ -100,11 +100,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1665613119,
-        "narHash": "sha256-VTutbv5YKeBGWou6ladtgfx11h6et+Wlkdyh4jPJ3p0=",
+        "lastModified": 1667254466,
+        "narHash": "sha256-YrMQzDVOo+uz5gg1REj2q/uVhJE3WcpkqGiMzh3Da3o=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e06bd4b64bbfda91d74f13cb5eca89485d47528f",
+        "rev": "1b4722674c315de0e191d0d79790b4eac51570a1",
        "type": "github"
      },
      "original": {
@@ -132,11 +132,11 @@
        "nixpkgs-22_05": "nixpkgs-22_05"
      },
      "locked": {
-        "lastModified": 1665289655,
-        "narHash": "sha256-j1Q9mNBhbzeJykhObiXwEGres9qvP4vH7gxdJ+ihkLI=",
+        "lastModified": 1667102919,
+        "narHash": "sha256-DP5j4TwXe96eZf0PLgYSj1Hdyt7SPUoQ003iNBQSKpQ=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "0ce0449e6404c4ff9d1b7bd657794ae5ca54deb3",
+        "rev": "448ec3e7eb7c7e4563cc2471db748a71baaf9698",
        "type": "github"
      },
      "original": {
@@ -153,11 +153,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1665758541,
-        "narHash": "sha256-ibR8bPwHlDjavri5cNVnoo5FmFk1IfNMmQXxat5biqs=",
+        "lastModified": 1666870107,
+        "narHash": "sha256-b9eXZxSwhzdJI5uQgfrMhu4SY2POrPkinUg7F5gQVYo=",
        "ref": "refs/heads/master",
-        "rev": "4ad1801f6cecd678bbeae5dfe5933448dd7b3360",
-        "revCount": 163,
+        "rev": "80c6ec95bd430e29d231cf745f19279bb76fb382",
+        "revCount": 164,
        "type": "git",
        "url": "https://git.uninsane.org/colin/uninsane"
      },
--- a/flake.nix
+++ b/flake.nix
@@ -25,8 +25,16 @@
    };
  };

-  outputs = { self, nixpkgs, nixpkgs-stable, mobile-nixos, home-manager, sops-nix, impermanence, uninsane }:
-  let
+  outputs = {
+    self,
+    nixpkgs,
+    nixpkgs-stable,
+    mobile-nixos,
+    home-manager,
+    sops-nix,
+    impermanence,
+    uninsane
+  }: let
    patchedPkgs = system: nixpkgs.legacyPackages.${system}.applyPatches {
      name = "nixpkgs-patched-uninsane";
      src = nixpkgs;
@@ -46,13 +54,11 @@
      specialArgs = { inherit mobile-nixos home-manager impermanence; };
      modules = [
        ./modules
-        ./machines/${name}
-        (import ./helpers/set-hostname.nix name)
+        (import ./machines/instantiate.nix name)
        home-manager.nixosModule
        impermanence.nixosModule
        sops-nix.nixosModules.sops
        {
-          nixpkgs.config.allowUnfree = true;
          nixpkgs.overlays = [
            (import "${mobile-nixos}/overlay/overlay.nix")
            uninsane.overlay
@@ -66,6 +72,8 @@
              # pinned packages:
              electrum = stable.electrum;  # 2022-10-10: build break
              sequoia = stable.sequoia;    # 2022-10-13: build break
+              # cross-compatible packages
+              gocryptfs = cross.gocryptfs;
            })
          ];
        }
@@ -103,19 +111,13 @@
    nixosConfigurations = builtins.mapAttrs (name: value: value.nixosConfiguration) machines;
    imgs = builtins.mapAttrs (name: value: value.img) machines;
    packages = let
-      custom-x86_64 = customPackagesFor "x86_64-linux" "x86_64-linux";
-      custom-aarch64 = customPackagesFor "aarch64-linux" "aarch64-linux";
-      nixpkgs-x86_64 = nixpkgsFor "x86_64-linux" "x86_64-linux";
-      nixpkgs-aarch64 = nixpkgsFor "aarch64-linux" "aarch64-linux";
+      allPkgsFor = sys: (customPackagesFor sys sys) // {
+        nixpkgs = nixpkgsFor sys sys;
+        uninsane = uninsane.packages."${sys}";
+      };
    in {
-      x86_64-linux = custom-x86_64 // {
-        nixpkgs = nixpkgs-x86_64;
-        uninsane = uninsane.packages.x86_64-linux;
-      };
-      aarch64-linux = custom-aarch64 // {
-        nixpkgs = nixpkgs-aarch64;
-        uninsane = uninsane.packages.aarch64-linux;
-      };
+      x86_64-linux = allPkgsFor "x86_64-linux";
+      aarch64-linux = allPkgsFor "aarch64-linux";
    };
  };
 }
--- a/helpers/set-hostname.nix
+++ b/helpers/set-hostname.nix
@@ -1,4 +0,0 @@
-hostName: { ... }:
-{
-  networking.hostName = hostName;
-}
--- a/machines/desko/default.nix
+++ b/machines/desko/default.nix
@@ -4,6 +4,8 @@
    ./fs.nix
  ];

+  # sane.home-packages.enableDevPkgs = true;
+
  sane.gui.sway.enable = true;
  sane.services.duplicity.enable = true;
  sane.services.nixserve.enable = true;
@@ -18,6 +20,11 @@
  users.users.usbmux.uid = config.sane.allocations.usbmux-uid;
  users.groups.usbmux.gid = config.sane.allocations.usbmux-gid;

+  sops.secrets.colin-passwd = {
+    sopsFile = ../../secrets/desko.yaml;
+    neededForUsers = true;
+  };
+
  # default config: https://man.archlinux.org/man/snapper-configs.5
  # defaults to something like:
  #   - hourly snapshots
--- a/machines/instantiate.nix
+++ b/machines/instantiate.nix
@@ -0,0 +1,11 @@
+# trampoline from flake.nix into the specific machine definition, while doing a tiny bit of common setup
+
+hostName: { ... }: {
+  imports = [
+    ./${hostName}
+  ];
+
+  networking.hostName = hostName;
+
+  nixpkgs.config.allowUnfree = true;
+}
--- a/machines/lappy/default.nix
+++ b/machines/lappy/default.nix
@@ -4,6 +4,8 @@
    ./fs.nix
  ];

+  # sane.home-packages.enableDevPkgs = true;
+
  # sane.users.guest.enable = true;
  sane.gui.sway.enable = true;
  sane.impermanence.enable = true;
@@ -11,7 +13,10 @@
  boot.loader.efi.canTouchEfiVariables = false;
  sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];

-  users.users.colin.initialPassword = "147147";
+  sops.secrets.colin-passwd = {
+    sopsFile = ../../secrets/lappy.yaml;
+    neededForUsers = true;
+  };

  # default config: https://man.archlinux.org/man/snapper-configs.5
  # defaults to something like:
--- a/machines/moby/default.nix
+++ b/machines/moby/default.nix
@@ -13,13 +13,19 @@
  # TODO: we could *maybe* inject pkgs.buildPackages.xyz = cross.buildPackages.xyz?
  documentation.nixos.enable = false;

-  # XXX colin: phosh doesn't work well with passwordless login
+  # XXX colin: phosh doesn't work well with passwordless login,
+  # so set this more reliable default password should anything go wrong
  users.users.colin.initialPassword = "147147";
  services.getty.autologinUser = "root";  # allows for emergency maintenance?

+  sops.secrets.colin-passwd = {
+    sopsFile = ../../secrets/moby.yaml;
+    neededForUsers = true;
+  };
+
  # usability compromises
  sane.impermanence.home-dirs = [
-    ".librewolf"
+    config.sane.web-browser.dotDir
  ];

  # sane.home-packages.enableGuiPkgs = false;  # XXX faster builds/imaging for debugging
--- a/machines/servo/default.nix
+++ b/machines/servo/default.nix
@@ -9,11 +9,11 @@
    ./services
  ];

-  sane.home-manager.enable = true;
  sane.home-manager.extraPackages = [
    # for administering services
    pkgs.matrix-synapse
    pkgs.freshrss
+    pkgs.goaccess
  ];
  sane.impermanence.enable = true;
  sane.services.duplicity.enable = true;
--- a/machines/servo/services/default.nix
+++ b/machines/servo/services/default.nix
@@ -4,6 +4,7 @@
    ./ddns-he.nix
    ./freshrss.nix
    ./gitea.nix
+    ./goaccess.nix
    ./ipfs.nix
    ./jackett.nix
    ./jellyfin.nix
--- a/machines/servo/services/freshrss.nix
+++ b/machines/servo/services/freshrss.nix
@@ -30,7 +30,7 @@
  systemd.services.freshrss-import-feeds =
  let
    fresh = config.systemd.services.freshrss-config;
-    feeds = import ../../../modules/universal/env/feeds.nix { inherit lib; };
+    feeds = import ../../../modules/universal/home-manager/feeds.nix { inherit lib; };
    opml = pkgs.writeText "sane-freshrss.opml" (feeds.feedsToOpml feeds.all);
  in {
    inherit (fresh) wantedBy environment;
--- a/machines/servo/services/goaccess.nix
+++ b/machines/servo/services/goaccess.nix
@@ -0,0 +1,44 @@
+{ pkgs, ... }:
+{
+  # based on <https://bytes.fyi/real-time-goaccess-reports-with-nginx/>
+  # log-format setting can be derived with this tool if custom:
+  # - <https://github.com/stockrt/nginx2goaccess>
+  # config options:
+  # - <https://github.com/allinurl/goaccess/blob/master/config/goaccess.conf>
+
+  systemd.services.goaccess = {
+    description = "GoAccess server monitoring";
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.goaccess}/bin/goaccess \
+          -f /var/log/nginx/public.log \
+          --log-format=VCOMBINED \
+          --real-time-html \
+          --no-query-string \
+          --anonymize-ip \
+          --ignore-panel=HOSTS \
+          --ws-url=wss://sink.uninsane.org:443/ws \
+          --port=7890 \
+          -o /var/lib/uninsane/sink/index.html
+      '';
+      ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+      Type = "simple";
+      Restart = "on-failure";
+
+      # hardening
+      WorkingDirectory = "/tmp";
+      NoNewPrivileges = true;
+      PrivateTmp = true;
+      ProtectHome = "read-only";
+      ProtectSystem = "strict";
+      SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @privileged @reboot @resources @setuid @swap @raw-io";
+      ReadOnlyPaths = "/";
+      ReadWritePaths = [ "/proc/self" "/var/lib/uninsane/sink" ];
+      PrivateDevices = "yes";
+      ProtectKernelModules = "yes";
+      ProtectKernelTunables = "yes";
+    };
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+  };
+}
--- a/machines/servo/services/nginx.nix
+++ b/machines/servo/services/nginx.nix
@@ -1,11 +1,29 @@
 # docs: https://nixos.wiki/wiki/Nginx
 { config, pkgs, ... }:

+let
+  # make the logs for this host "public" so that they show up in e.g. metrics
+  publog = vhost: vhost // {
+    extraConfig = (vhost.extraConfig or "") + ''
+      access_log /var/log/nginx/public.log vcombined;
+    '';
+  };
+in
 {
  services.nginx.enable = true;

+  # this is the standard `combined` log format, with the addition of $host
+  # so that we have the virtualHost in the log.
+  # KEEP IN SYNC WITH GOACCESS
+  # goaccess calls this VCOMBINED:
+  # - <https://gist.github.com/jyap808/10570005>
+  services.nginx.commonHttpConfig = ''
+    log_format vcombined '$host:$server_port $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referrer" "$http_user_agent"';
+    access_log /var/log/nginx/private.log vcombined;
+  '';
+
  # web blog/personal site
-  services.nginx.virtualHosts."uninsane.org" = {
+  services.nginx.virtualHosts."uninsane.org" = publog {
    root = "${pkgs.uninsane-dot-org}/share/uninsane-dot-org";
    # a lot of places hardcode https://uninsane.org,
    # and then when we mix http + non-https, we get CORS violations
@@ -57,8 +75,28 @@
    # };
  };

+  # server statistics
+  services.nginx.virtualHosts."sink.uninsane.org" = {
+    addSSL = true;
+    enableACME = true;
+    root = "/var/lib/uninsane/sink";
+
+    locations."/ws" = {
+      proxyPass = "http://127.0.0.1:7890";
+      # XXX not sure how much of this is necessary
+      extraConfig = ''
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_buffering off;
+        proxy_read_timeout 7d;
+      '';
+    };
+
+  };
+
  # Pleroma server and web interface
-  services.nginx.virtualHosts."fed.uninsane.org" = {
+  services.nginx.virtualHosts."fed.uninsane.org" = publog {
    addSSL = true;
    enableACME = true;
    locations."/" = {
@@ -119,7 +157,7 @@
  };

  # matrix chat server
-  services.nginx.virtualHosts."matrix.uninsane.org" = {
+  services.nginx.virtualHosts."matrix.uninsane.org" = publog {
    addSSL = true;
    enableACME = true;

@@ -160,7 +198,7 @@
  };

  # hosted git (web view and for `git <cmd>` use
-  services.nginx.virtualHosts."git.uninsane.org" = {
+  services.nginx.virtualHosts."git.uninsane.org" = publog {
    addSSL = true;
    enableACME = true;

@@ -276,6 +314,7 @@
  sane.impermanence.service-dirs = [
    # TODO: mode?
    { user = "acme"; group = "acme"; directory = "/var/lib/acme"; }
+    # TODO: this is overly broad; only need media and share directories to be persisted
    { user = "colin"; group = "users"; directory = "/var/lib/uninsane"; }
  ];
 }
--- a/machines/servo/services/pleroma.nix
+++ b/machines/servo/services/pleroma.nix
@@ -74,9 +74,10 @@
    config :pleroma, configurable_from_database: false

    # strip metadata from uploaded images
-    config :pleroma, Pleroma.Upload, filters: [Pleroma.Upload.Filter.Exiftool]
+    config :pleroma, Pleroma.Upload, filters: [Pleroma.Upload.Filter.Exiftool.StripLocation]

    # TODO: GET /api/pleroma/captcha is broken
+    # there was a nixpkgs PR to fix this around 2022/10 though.
    config :pleroma, Pleroma.Captcha,
      enabled: false,
      method: Pleroma.Captcha.Native
--- a/machines/servo/services/postfix.nix
+++ b/machines/servo/services/postfix.nix
@@ -20,6 +20,10 @@ in
    # TODO: mode? could be more granular
    { user = "opendkim"; group = "opendkim"; directory = "/var/lib/opendkim"; }
    { user = "root"; group = "root"; directory = "/var/lib/postfix"; }
+    { user = "root"; group = "root"; directory = "/var/spool/mail"; }
+    # *probably* don't need these dirs:
+    # "/var/lib/dhparams"          # https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/security/dhparams.nix
+    # "/var/lib/dovecot"
  ];
  services.postfix.enable = true;
  services.postfix.hostname = "mx.uninsane.org";
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -7,8 +7,7 @@
    ./image.nix
    ./impermanence.nix
    ./nixcache.nix
-    ./services/duplicity.nix
-    ./services/nixserve.nix
+    ./services
    ./universal
  ];
 }
--- a/modules/gui/default.nix
+++ b/modules/gui/default.nix
@@ -22,7 +22,6 @@ in

  config = lib.mkIf cfg.enable {
    sane.home-packages.enableGuiPkgs = lib.mkDefault true;
-    sane.home-manager.enable = lib.mkDefault true;
    # all GUIs use network manager?
    users.users.nm-iodine.uid = config.sane.allocations.nm-iodine-uid;
  };
--- a/modules/gui/phosh.nix
+++ b/modules/gui/phosh.nix
@@ -89,19 +89,16 @@ in
      services.xserver.displayManager.lightdm.extraSeatDefaults = ''
        user-session = phosh
      '';
-      services.xserver.displayManager.lightdm.greeters.gtk.enable = false;  # gtk greeter overrides our own?
-      services.xserver.displayManager.lightdm.greeter = {
-        enable = true;
-        package = pkgs.lightdm-mobile-greeter.xgreeters;
-        name = "lightdm-mobile-greeter";
-      };
-      # services.xserver.displayManager.lightdm.enable = true;
-      # # services.xserver.displayManager.lightdm.greeters.enso.enable = true;  # tried (with reboot); got a mouse then died. next time was black
-      # # services.xserver.displayManager.lightdm.greeters.gtk.enable = true;  # tried (with reboot); unusable without OSK
-      # # services.xserver.displayManager.lightdm.greeters.mini.enable = true;  # tried (with reboot); unusable without OSK
-      # # services.xserver.displayManager.lightdm.greeters.pantheon.enable = true; # tried (no reboot); unusable without OSK
-      # services.xserver.displayManager.lightdm.greeters.slick.enable = true;  # tried; unusable without OSK (a11y -> OSK doesn't work)
-      # # services.xserver.displayManager.lightdm.greeters.tiny.enable = true;  # tried; block screen
+      # services.xserver.displayManager.lightdm.greeters.gtk.enable = false;  # gtk greeter overrides our own?
+      # services.xserver.displayManager.lightdm.greeter = {
+      #   enable = true;
+      #   package = pkgs.lightdm-mobile-greeter.xgreeters;
+      #   name = "lightdm-mobile-greeter";
+      # };
+      # # services.xserver.displayManager.lightdm.enable = true;
+
+      services.xserver.displayManager.lightdm.enable = true;
+      services.xserver.displayManager.lightdm.greeters.mobile.enable = true;

      systemd.services.phosh.wantedBy = lib.mkForce [];  # disable auto-start
    })
--- a/modules/gui/sway.nix
+++ b/modules/gui/sway.nix
@@ -11,6 +11,14 @@ in
      default = false;
      type = types.bool;
    };
+    sane.gui.sway.useGreeter = mkOption {
+      description = ''
+        launch sway via a greeter (like greetd's gtkgreet).
+        sway is usable without a greeter, but skipping the greeter means no PAM session.
+      '';
+      default = true;
+      type = types.bool;
+    };
  };
  config = mkIf cfg.enable {
    sane.gui.enable = true;
@@ -23,22 +31,31 @@ in

    # alternatively, could use SDDM
    services.greetd = let
-      swayConfig = pkgs.writeText "greetd-sway-config" ''
+      swayConfig-greeter = pkgs.writeText "greetd-sway-config" ''
        # `-l` activates layer-shell mode.
        exec "${pkgs.greetd.gtkgreet}/bin/gtkgreet -l -c sway"
      '';
-    in {
-      # greetd source/docs:
-      # - <https://git.sr.ht/~kennylevinsen/greetd>
-      enable = true;
-      settings = {
-        default_session = {
-          command = "${pkgs.sway}/bin/sway --config ${swayConfig}";
+      default_session = {
+        "01" = {
+          # greeter session config
+          command = "${pkgs.sway}/bin/sway --config ${swayConfig-greeter}";
          # alternatives:
          # - TTY: `command = "${pkgs.greetd.greetd}/bin/agreety --cmd ${pkgs.sway}/bin/sway";`
          # - autologin: `command = "${pkgs.sway}/bin/sway"; user = "colin";`
          # - Dumb Login (doesn't work)": `command = "${pkgs.greetd.dlm}/bin/dlm";`
        };
+        "0" = {
+          # no greeter
+          command = "${pkgs.sway}/bin/sway";
+          user = "colin";
+        };
+      };
+    in {
+      # greetd source/docs:
+      # - <https://git.sr.ht/~kennylevinsen/greetd>
+      enable = true;
+      settings = {
+        default_session = default_session."0${builtins.toString cfg.useGreeter}";
      };
    };

--- a/modules/impermanence.nix
+++ b/modules/impermanence.nix
@@ -7,6 +7,8 @@
 with lib;
 let
  cfg = config.sane.impermanence;
+  # taken from sops-nix code: checks if any secrets are needed to create /etc/shadow
+  secretsForUsers = (lib.filterAttrs (_: v: v.neededForUsers) config.sops.secrets) != {};
 in
 {
  options = {
@@ -14,10 +16,6 @@ in
      default = false;
      type = types.bool;
    };
-    sane.impermanence.home-files = mkOption {
-      default = [];
-      type = types.listOf types.str;
-    };
    sane.impermanence.home-dirs = mkOption {
      default = [];
      type = types.listOf (types.either types.str (types.attrsOf types.str));
@@ -38,38 +36,17 @@ in

    map-home-dirs = map-dirs { user = "colin"; group = "users"; mode = "0755"; directory = "/home/colin/"; };
    map-sys-dirs = map-dirs { user = "root"; group = "root"; mode = "0755"; directory = ""; };
-    map-service-dirs = map-dirs { user = "root"; group = "root"; mode = "0755"; directory = ""; };

-    map-home-files = files: builtins.map (f: {
-      parentDirectory = {
-        user = "colin";
-        group = "users";
-        mode = "0755";
-      };
-      file = "/home/colin/${f}";
-    }) files;
  in mkIf cfg.enable {
    sane.image.extraDirectories = [ "/nix/persist/var/log" ];
    environment.persistence."/nix/persist" = {
-      directories = (map-home-dirs ([
-        # cache is probably too big to fit on the tmpfs
-        # TODO: we could bind-mount it to something which gets cleared per boot, though.
-        ".cache"
-        ".cargo"
-        ".rustup"
-        ".ssh"
-        ".local/share/keyrings"
-        # intentionally omitted:
-        # ".config"  # managed by home-manager
-        # ".local"   # nothing useful in here
-      ] ++ cfg.home-dirs)) ++ (map-sys-dirs [
-        # TODO: this `0700` here clobbers the perms for /persist/etc, breaking boot on freshly-deployed devices
+      directories = (map-home-dirs cfg.home-dirs) ++ (map-sys-dirs [
+        # NB: this `0700` here clobbers the perms for /persist/etc, breaking boot on freshly-deployed devices
        # { mode = "0700"; directory = "/etc/NetworkManager/system-connections"; }
        # "/etc/nixos"
        # "/etc/ssh"  # persist only the specific files we want, instead
        "/var/log"
        "/var/backup"  # for e.g. postgres dumps
-      ]) ++ (map-service-dirs ([
        # "/var/lib/AccountsService"   # not sure what this is, but it's empty
        "/var/lib/alsa"                # preserve output levels, default devices
        # "/var/lib/blueman"           # files aren't human readable
@@ -93,37 +70,25 @@ in
        # "/var/lib/upower"            # historic charge data. unnecessary, but maybe used somewhere?
        #
        # servo additions:
-        # "/var/lib/dhparams"          # https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/security/dhparams.nix
-        # "/var/lib/dovecot"
-        # "/var/lib/duplicity"
-      ] ++ cfg.service-dirs));
-      files = [
-        "/etc/machine-id"
-        "/etc/ssh/ssh_host_ed25519_key"
-        "/etc/ssh/ssh_host_ed25519_key.pub"
-        "/etc/ssh/ssh_host_rsa_key"
-        "/etc/ssh/ssh_host_rsa_key.pub"
-        "/home/colin/.zsh_history"
-        # # XXX these only need persistence because i have mutableUsers = true, i think
-        # "/etc/group"
-        # "/etc/passwd"
-        # "/etc/shadow"
-      ] ++ map-home-files cfg.home-files;
+      ] ++ cfg.service-dirs);
+      # /etc/machine-id is a globally unique identifier used for:
+      # - systemd-networkd: DHCP lease renewal (instead of keying by the MAC address)
+      # - systemd-journald: to filter logs by host
+      # - chromium (potentially to track re-installations)
+      # - gdbus; system services that might upgrade to AF_LOCAL if both services can confirm they're on the same machine
+      # of these, systemd-networkd is the only legitimate case to persist the machine-id.
+      # depersisting it should be "safe"; edge-cases like systemd-networkd can be directed to use some other ID if necessary.
+      # nixos-impermanence shows binding the host ssh priv key to this; i could probably hash the host key into /etc/machine-id if necessary.
+      # files = [ "/etc/machine-id" ];
    };

-    systemd.services.sane-sops = {
-      # TODO: it would be better if we could inject the right dependency into setupSecrets instead of patching like this.
-      # /run/current-system/activate contains the precise ordering logic.
-      # it's largely unaware of systemd.
-      # maybe we could insert some activation script which simply waits for /etc/ssh to appear?
-      description = "sops relies on /etc/ssh being available, so re-run its activation AFTER fs-local";
-      script = ''
-      ${config.system.activationScripts.setupSecrets.text}
-      ${config.system.activationScripts.linkIwdKeys.text}
-      '';
-      after = [ "fs-local.target" ];
-      wantedBy = [ "multi-user.target" ];
+    # secret decoding depends on /etc/ssh keys, which may be persisted
+    system.activationScripts.setupSecrets.deps = [ "persist-ssh-host-keys" ];
+    system.activationScripts.setupSecretsForUsers = lib.mkIf secretsForUsers {
+      deps = [ "persist-ssh-host-keys" ];
    };
+    # populated by ssh.nix, which persists /etc/ssh/host_keys
+    system.activationScripts.persist-ssh-host-keys.text = lib.mkDefault "";
  };
 }

--- a/modules/nixcache.nix
+++ b/modules/nixcache.nix
@@ -1,3 +1,13 @@
+# speed up builds from e.g. moby or lappy by having them query desko and servo first.
+# if one of these hosts is offline, instead manually specify just cachix:
+# - `nixos-rebuild --option substituters https://cache.nixos.org/`
+#
+# future improvements:
+# - apply for community arm build box:
+#   - <https://github.com/nix-community/aarch64-build-box>
+# - don't require all substituters to be online:
+#   - <https://github.com/NixOS/nix/pull/7188>
+
 { lib, config, ... }:

 with lib;
--- a/modules/services/default.nix
+++ b/modules/services/default.nix
@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./duplicity.nix
+    ./nixserve.nix
+  ];
+}
--- a/modules/universal/default.nix
+++ b/modules/universal/default.nix
@@ -3,16 +3,26 @@
 {
  imports = [
    ./allocations.nix
-    ./env
    ./fs.nix
+    ./home-manager
+    ./home-packages.nix
    ./net.nix
+    ./machine-id.nix
    ./secrets.nix
+    ./ssh.nix
+    ./system-packages.nix
    ./users.nix
    ./vpn.nix
  ];

  time.timeZone = "America/Los_Angeles";

+  # allow `nix flake ...` command
+  nix.extraOptions = ''
+    experimental-features = nix-command flakes
+  '';
+
+  # TODO: move this into home-manager?
  fonts = {
    enableDefaultFonts = true;
    fonts = with pkgs; [ font-awesome twitter-color-emoji hack-font ];
@@ -25,9 +35,30 @@
    };
  };

-  # allow `nix flake ...` command
-  nix.extraOptions = ''
-    experimental-features = nix-command flakes
-  '';
+  # programs.vim.defaultEditor = true;
+  environment.variables = {
+    EDITOR = "vim";
+    # git claims it should use EDITOR, but it doesn't!
+    GIT_EDITOR = "vim";
+    # TODO: these should be moved to `home.sessionVariables` (home-manager)
+    # Electron apps should use native wayland backend:
+    #   https://nixos.wiki/wiki/Slack#Wayland
+    # Discord under sway crashes with this.
+    # NIXOS_OZONE_WL = "1";
+    # LIBGL_ALWAYS_SOFTWARE = "1";
+  };
+  # enable zsh completions
+  environment.pathsToLink = [ "/share/zsh" ];
+  environment.systemPackages = with pkgs; [
+    # required for pam_mount
+    gocryptfs
+  ];
+
+  security.pam.mount.enable = true;
+  # security.pam.mount.debugLevel = 1;
+  # security.pam.enableSSHAgentAuth = true; # ??
+  # needed for `allow_other` in e.g. gocryptfs mounts
+  # or i guess going through mount.fuse sets suid so that's not necessary?
+  # programs.fuse.userAllowOther = true;
 }

--- a/modules/universal/env/default.nix
+++ b/modules/universal/env/default.nix
@@ -1,36 +0,0 @@
-{ pkgs, ... }:
-
-{
-  imports = [
-    ./home-manager.nix
-    ./home-packages.nix
-    ./system-packages.nix
-  ];
-
-  # programs.vim.defaultEditor = true;
-  environment.variables = {
-    EDITOR = "vim";
-    # git claims it should use EDITOR, but it doesn't!
-    GIT_EDITOR = "vim";
-    # TODO: these should be moved to `home.sessionVariables` (home-manager)
-    # Electron apps should use native wayland backend:
-    #   https://nixos.wiki/wiki/Slack#Wayland
-    # Discord under sway crashes with this.
-    # NIXOS_OZONE_WL = "1";
-    # LIBGL_ALWAYS_SOFTWARE = "1";
-  };
-  # enable zsh completions
-  environment.pathsToLink = [ "/share/zsh" ];
-  environment.systemPackages = with pkgs; [
-    # required for pam_mount
-    gocryptfs
-  ];
-
-  security.pam.mount.enable = true;
-  # security.pam.mount.debugLevel = 1;
-  # security.pam.enableSSHAgentAuth = true; # ??
-  # needed for `allow_other` in e.g. gocryptfs mounts
-  # or i guess going through mount.fuse sets suid so that's not necessary?
-  # programs.fuse.userAllowOther = true;
-}
-
--- a/modules/universal/env/home-manager.nix
+++ b/modules/universal/env/home-manager.nix
@@ -1,527 +0,0 @@
-# docs:
-#   https://rycee.gitlab.io/home-manager/
-#   https://rycee.gitlab.io/home-manager/options.html
-#   man home-configuration.nix
-#
-
-{ lib, config, pkgs, ... }:
-
-with lib;
-let
-  cfg = config.sane.home-manager;
-  vim-swap-dir = ".cache/vim-swap";
-  # extract package from `extraPackages`
-  pkglist = pkgspec: builtins.map (e: e.pkg or e) pkgspec;
-  # extract `dir` from `extraPackages`
-  dirlist = pkgspec: builtins.concatLists (builtins.map (e: if e ? "dir" then [ e.dir ] else []) pkgspec);
-  # extract `persist-files` from `extraPackages`
-  persistfileslist = pkgspec: builtins.concatLists (builtins.map (e: if e ? "persist-files" then e.persist-files else []) pkgspec);
-  # TODO: dirlist and persistfileslist should be folded
-  feeds = import ./feeds.nix { inherit lib; };
-in
-{
-  options = {
-    sane.home-manager.enable = mkOption {
-      default = false;
-      type = types.bool;
-    };
-
-    # packages to deploy to the user's home
-    sane.home-manager.extraPackages = mkOption {
-      default = [ ];
-      # each entry can be either a package, or attrs:
-      #   { pkg = package; dir = optional string;
-      type = types.listOf (types.either types.package types.attrs);
-    };
-
-    # attributes to copy directly to home-manager's `wayland.windowManager` option
-    sane.home-manager.windowManager = mkOption {
-      default = {};
-      type = types.attrs;
-    };
-
-    # extra attributes to include in home-manager's `programs` option
-    sane.home-manager.programs = mkOption {
-      default = {};
-      type = types.attrs;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    sops.secrets."aerc_accounts" = {
-      owner = config.users.users.colin.name;
-      sopsFile = ../../../secrets/universal/aerc_accounts.conf;
-      format = "binary";
-    };
-    sops.secrets."sublime_music_config" = {
-      owner = config.users.users.colin.name;
-      sopsFile = ../../../secrets/universal/sublime_music_config.json.bin;
-      format = "binary";
-    };
-
-    sane.impermanence.home-dirs = [
-      "archive"
-      "dev"
-      "records"
-      "ref"
-      "tmp"
-      "use"
-      "Music"
-      "Pictures"
-      "Videos"
-      vim-swap-dir
-    ] ++ (dirlist cfg.extraPackages);
-    sane.impermanence.home-files = persistfileslist cfg.extraPackages;
-
-    home-manager.useGlobalPkgs = true;
-    home-manager.useUserPackages = true;
-
-    # XXX this weird rename + closure is to get home-manager's `config.lib.file` to exist.
-    # see: https://github.com/nix-community/home-manager/issues/589#issuecomment-950474105
-    home-manager.users.colin = let sysconfig = config; in { config, ... }: {
-
-      # run `home-manager-help` to access manpages
-      # or `man home-configuration.nix`
-      manual.html.enable = true;
-
-      home.packages = pkglist cfg.extraPackages;
-      wayland.windowManager = cfg.windowManager;
-
-      home.stateVersion = "21.11";
-      home.username = "colin";
-      home.homeDirectory = "/home/colin";
-
-      home.activation = {
-        initKeyring = {
-          after = ["writeBoundary"];
-          before = [];
-          data = "${../../../scripts/init-keyring}";
-        };
-      };
-
-      # XDG defines things like ~/Desktop, ~/Downloads, etc.
-      # these clutter the home, so i mostly don't use them.
-      xdg.userDirs = {
-        enable = true;
-        createDirectories = false;  # on headless systems, most xdg dirs are noise
-        desktop = "$HOME/.xdg/Desktop";
-        documents = "$HOME/dev";
-        download = "$HOME/tmp";
-        music = "$HOME/Music";
-        pictures = "$HOME/Pictures";
-        publicShare = "$HOME/.xdg/Public";
-        templates = "$HOME/.xdg/Templates";
-        videos = "$HOME/Videos";
-      };
-
-      # the xdg mime type for a file can be found with:
-      # - `xdg-mime query filetype path/to/thing.ext`
-      xdg.mimeApps.enable = true;
-      xdg.mimeApps.defaultApplications = let
-        www = "librewolf.desktop";
-        pdf = "org.gnome.Evince.desktop";
-        md = "obsidian.desktop";
-        thumb = "org.gnome.gThumb.desktop";
-        video = "vlc.desktop";
-        # audio = "mpv.desktop";
-        audio = "vlc.desktop";
-      in {
-        # HTML
-        "text/html" = [ www ];
-        "x-scheme-handler/http" = [ www ];
-        "x-scheme-handler/https" = [ www ];
-        "x-scheme-handler/about" = [ www ];
-        "x-scheme-handler/unknown" = [ www ];
-        # RICH-TEXT DOCUMENTS
-        "application/pdf" = [ pdf ];
-        "text/markdown" = [ md ];
-        # IMAGES
-        "image/heif" = [ thumb ];  # apple codec
-        "image/png" = [ thumb ];
-        "image/jpeg" = [ thumb ];
-        # VIDEO
-        "video/mp4" = [ video ];
-        "video/quicktime" = [ video ];
-        "video/x-matroska" = [ video ];
-        # AUDIO
-        "audio/flac" = [ audio ];
-        "audio/mpeg" = [ audio ];
-        "audio/x-vorbis+ogg" = [ audio ];
-      };
-
-      # convenience
-      home.file."knowledge".source = config.lib.file.mkOutOfStoreSymlink "/home/colin/dev/knowledge";
-      home.file."nixos".source = config.lib.file.mkOutOfStoreSymlink "/home/colin/dev/nixos";
-      home.file."Videos/servo".source = config.lib.file.mkOutOfStoreSymlink "/mnt/servo-media/Videos";
-      home.file."Videos/servo-incomplete".source = config.lib.file.mkOutOfStoreSymlink "/mnt/servo-media/incomplete";
-      home.file."Music/servo".source = config.lib.file.mkOutOfStoreSymlink "/mnt/servo-media/Music";
-
-      # nb markdown/personal knowledge manager
-      home.file.".nb/knowledge".source = config.lib.file.mkOutOfStoreSymlink "/home/colin/dev/knowledge";
-      home.file.".nb/.current".text = "knowledge";
-      home.file.".nbrc".text = ''
-        # manage with `nb settings`
-        export NB_AUTO_SYNC=0
-      '';
-
-      # uBlock filter list configuration.
-      # specifically, enable the GDPR cookie prompt blocker.
-      # data.toOverwrite.filterLists is additive (i.e. it supplements the default filters)
-      # this configuration method is documented here:
-      # - <https://github.com/gorhill/uBlock/issues/2986#issuecomment-364035002>
-      # the specific attribute path is found via scraping ublock code here:
-      # - <https://github.com/gorhill/uBlock/blob/master/src/js/storage.js>
-      # - <https://github.com/gorhill/uBlock/blob/master/assets/assets.json>
-      home.file.".librewolf/managed-storage/uBlock0@raymondhill.net.json".text = ''
-        {
-         "name": "uBlock0@raymondhill.net",
-         "description": "ignored",
-         "type": "storage",
-         "data": {
-            "toOverwrite": "{\"filterLists\": [\"fanboy-cookiemonster\"]}"
-         }
-        }
-      '';
-      home.file.".librewolf/librewolf.overrides.cfg".text = ''
-        // if we can't query the revocation status of a SSL cert because the issuer is offline,
-        // treat it as unrevoked.
-        // see: <https://librewolf.net/docs/faq/#im-getting-sec_error_ocsp_server_error-what-can-i-do>
-        defaultPref("security.OCSP.require", false);
-      '';
-
-      # aerc TUI mail client
-      xdg.configFile."aerc/accounts.conf".source =
-        config.lib.file.mkOutOfStoreSymlink sysconfig.sops.secrets.aerc_accounts.path;
-
-      # make Discord usable even when client is "outdated"
-      xdg.configFile."discord/settings.json".text = ''
-      {
-        "SKIP_HOST_UPDATE": true
-      }
-      '';
-
-      # sublime music player
-      xdg.configFile."sublime-music/config.json".source =
-        config.lib.file.mkOutOfStoreSymlink sysconfig.sops.secrets.sublime_music_config.path;
-
-      xdg.configFile."vlc/vlcrc".text =
-      let
-        podcastUrls = lib.strings.concatStringsSep "|" (
-          builtins.map (feed: feed.url) feeds.podcasts
-        );
-      in ''
-        [podcast]
-        podcast-urls=${podcastUrls}
-        [core]
-        metadata-network-access=0
-        [qt]
-        qt-privacy-ask=0
-      '';
-
-      xdg.configFile."gpodderFeeds.opml".text = with feeds;
-        feedsToOpml feeds.podcasts;
-
-      # news-flash RSS viewer
-      xdg.configFile."newsflashFeeds.opml".text = with feeds;
-        feedsToOpml (feeds.texts ++ feeds.images);
-
-      # gnome feeds RSS viewer
-      xdg.configFile."org.gabmus.gfeeds.json".text =
-      let
-        myFeeds = feeds.texts ++ feeds.images;
-      in builtins.toJSON {
-        # feed format is a map from URL to a dict,
-        #   with dict["tags"] a list of string tags.
-        feeds = builtins.foldl' (acc: feed: acc // {
-          "${feed.url}".tags = [ feed.cat feed.freq ];
-        }) {} myFeeds;
-        dark_reader = false;
-        new_first = true;
-        # windowsize = {
-        #   width = 350;
-        #   height = 650;
-        # };
-        max_article_age_days = 90;
-        enable_js = false;
-        max_refresh_threads = 3;
-        # saved_items = {};
-        # read_items = [];
-        show_read_items = true;
-        full_article_title = true;
-        # views: "webview", "reader", "rsscont"
-        default_view = "rsscont";
-        open_links_externally = true;
-        full_feed_name = false;
-        refresh_on_startup = true;
-        tags = lib.lists.unique (
-          (builtins.catAttrs "cat" myFeeds) ++ (builtins.catAttrs "freq" myFeeds)
-        );
-        open_youtube_externally = false;
-        media_player = "vlc";  # default: mpv
-      };
-
-      programs = {
-        home-manager.enable = true;  # this lets home-manager manage dot-files in user dirs, i think
-
-        zsh = {
-          enable = true;
-          enableSyntaxHighlighting = true;
-          enableVteIntegration = true;
-          history.ignorePatterns = [ "rm *" ];
-          # history.path = TODO
-          dotDir = ".config/zsh";
-
-          initExtraBeforeCompInit = ''
-            # p10k instant prompt
-            # run p10k configure to configure, but it can't write out its file :-(
-            POWERLEVEL9K_DISABLE_CONFIGURATION_WIZARD=true
-          '';
-          initExtra = ''
-            # zmv is a way to do rich moves/renames, with pattern matching/substitution.
-            # see for an example: <https://filipe.kiss.ink/zmv-zsh-rename/>
-            autoload -Uz zmv
-          '';
-
-          # prezto = oh-my-zsh fork; controls prompt, auto-completion, etc.
-          # see: https://github.com/sorin-ionescu/prezto
-          prezto = {
-            enable = true;
-            pmodules = [
-              "environment"
-              "terminal"
-              "editor"
-              "history"
-              "directory"
-              "spectrum"
-              "utility"
-              "completion"
-              "prompt"
-              "git"
-            ];
-            prompt = {
-              theme = "powerlevel10k";
-            };
-          };
-        };
-
-        kitty = {
-          enable = true;
-          # docs: https://sw.kovidgoyal.net/kitty/conf/
-          settings = {
-            # disable terminal bell (when e.g. you backspace too many times)
-            enable_audio_bell = false;
-          };
-          keybindings = {
-            "ctrl+n" = "new_os_window_with_cwd";
-          };
-          # docs: https://github.com/kovidgoyal/kitty-themes
-          # theme = "1984 Light";  # dislike: awful, harsh blues/teals
-          # theme = "Adventure Time";  # dislike: harsh (dark)
-          # theme = "Atom One Light";  # GOOD: light theme. all color combos readable. not a huge fan of the blue.
-          # theme = "Belafonte Day";  # dislike: too low contrast for text colors
-          # theme = "Belafonte Night";  # better: dark theme that's easy on the eyes. all combos readable. low contrast.
-          # theme = "Catppuccin";  # dislike: a bit pale/low-contrast (dark)
-          # theme = "Desert";  # mediocre: colors are harsh
-          # theme = "Earthsong";  # BEST: dark theme. readable, good contrast. unique, but decent colors.
-          # theme = "Espresso Libre";  # better: dark theme. readable, but meh colors
-          # theme = "Forest Night";  # decent: very pastel. it's workable, but unconventional and muted/flat.
-          # theme = "Gruvbox Material Light Hard";  # mediocre light theme.
-          # theme = "kanagawabones";  # better: dark theme. colors are too background-y
-          # theme = "Kaolin Dark";  # dislike: too dark
-          # theme = "Kaolin Breeze";  # mediocre: not-too-harsh light theme, but some parts are poor contrast
-          # theme = "Later This Evening";  # mediocre: not-too-harsh dark theme, but cursor is poor contrast
-          # theme = "Material"; # decent: light theme, few colors.
-          # theme = "Mayukai";  # decent: not-too-harsh dark theme. the teal is a bit straining
-          # theme = "Nord";  # mediocre: pale background, low contrast
-          # theme = "One Half Light";  # better: not-too-harsh light theme. contrast could be better
-          theme = "PaperColor Dark";  # BEST: dark theme, very readable still the colors are background-y
-          # theme = "Parasio Dark";  # dislike: too low contrast
-          # theme = "Pencil Light";  # better: not-too-harsh light theme. decent contrast.
-          # theme = "Pnevma";  # dislike: too low contrast
-          # theme = "Piatto Light";  # better: readable light theme. pleasing colors. powerline prompt is hard to read.
-          # theme = "Rosé Pine Dawn";  # GOOD: light theme. all color combinations are readable. it is very mild -- may need to manually tweak contrast. tasteful colors
-          # theme = "Rosé Pine Moon";  # GOOD: dark theme. tasteful colors. but background is a bit intense
-          # theme = "Sea Shells";  # mediocre. not all color combos are readable
-          # theme = "Solarized Light";  # mediocre: not-too-harsh light theme; GREAT background; but some colors are low contrast
-          # theme = "Solarized Dark Higher Contrast";  # better: dark theme, decent colors
-          # theme = "Sourcerer";  # mediocre: ugly colors
-          # theme = "Space Gray";  # mediocre: too muted
-          # theme = "Space Gray Eighties";  # better: all readable, decent colors
-          # theme = "Spacemacs";  # mediocre: too muted
-          # theme = "Spring";  # mediocre: readable light theme, but the teal is ugly.
-          # theme = "Srcery";  # better: highly readable. colors are ehhh
-          # theme = "Substrata";  # decent: nice colors, but a bit flat.
-          # theme = "Sundried";  # mediocre: the solar text makes me squint
-          # theme = "Symfonic";  # mediocre: the dark purple has low contrast to the black bg.
-          # theme = "Tango Light";  # dislike: teal is too grating
-          # theme = "Tokyo Night Day";  # medicore: too muted
-          # theme = "Tokyo Night";  # better: tasteful. a bit flat
-          # theme = "Tomorrow";  # GOOD: all color combinations are readable. contrast is slightly better than Rose. on the blander side
-          # theme = "Treehouse";  # dislike: the orange is harsh on my eyes.
-          # theme = "Urple";  # dislike: weird palette
-          # theme = "Warm Neon";  # decent: not-too-harsh dark theme. the green is a bit unattractive
-          # theme = "Wild Cherry";  # GOOD: dark theme: nice colors. a bit flat
-          # theme = "Xcodedark";  # dislike: bad palette
-          # theme = "citylights";  # decent: dark theme. some parts have just a bit low contrast
-          # theme = "neobones_light"; # better light theme. the background is maybe too muted
-          # theme = "vimbones";
-          # theme = "zenbones_dark";  # mediocre: readable, but meh colors
-          # theme = "zenbones_light";  # decent: light theme. all colors are readable. contrast is passable but not excellent. highlight color is BAD
-          # theme = "zenwritten_dark";  # mediocre: looks same as zenbones_dark
-          # extraConfig = "";
-        };
-
-        git = {
-          enable = true;
-          userName = "colin";
-          userEmail = "colin@uninsane.org";
-
-          aliases = { co = "checkout"; };
-          extraConfig = {
-            # difftastic docs:
-            # - <https://difftastic.wilfred.me.uk/git.html>
-            diff.tool = "difftastic";
-            difftool.prompt = false;
-            "difftool \"difftastic\"".cmd = ''${pkgs.difftastic}/bin/difft "$LOCAL" "$REMOTE"'';
-            # now run `git difftool` to use difftastic git
-          };
-        };
-
-        neovim = {
-          # neovim: https://github.com/neovim/neovim
-          enable = true;
-          viAlias = true;
-          vimAlias = true;
-          plugins = with pkgs.vimPlugins; [
-            # docs: surround-nvim: https://github.com/ur4ltz/surround.nvim/
-            # docs: vim-surround: https://github.com/tpope/vim-surround
-            vim-surround
-            # docs: fzf-vim (fuzzy finder): https://github.com/junegunn/fzf.vim
-            fzf-vim
-            # docs: https://github.com/KeitaNakamura/tex-conceal.vim/
-            ({
-              plugin = tex-conceal-vim;
-              type = "viml";
-              config = ''
-                " present prettier fractions
-                let g:tex_conceal_frac=1
-              '';
-            })
-            ({
-              plugin = vim-SyntaxRange;
-              type = "viml";
-              config = ''
-                " enable markdown-style codeblock highlighting for tex code
-                autocmd BufEnter * call SyntaxRange#Include('```tex', '```', 'tex', 'NonText')
-                " autocmd Syntax tex set conceallevel=2
-              '';
-            })
-            # nabla renders inline math in any document, but it's buggy.
-            #   https://github.com/jbyuki/nabla.nvim
-            # ({
-            #   plugin = pkgs.nabla;
-            #   type = "lua";
-            #   config = ''
-            #     require'nabla'.enable_virt()
-            #   '';
-            # })
-            # treesitter syntax highlighting: https://nixos.wiki/wiki/Tree_sitters
-            # docs: https://github.com/nvim-treesitter/nvim-treesitter
-            # config taken from: https://github.com/i077/system/blob/master/modules/home/neovim/default.nix
-            # this is required for tree-sitter to even highlight
-            ({
-              plugin = (nvim-treesitter.withPlugins (_: pkgs.tree-sitter.allGrammars));
-              type = "lua";
-              config = ''
-                require'nvim-treesitter.configs'.setup {
-                  highlight = {
-                    enable = true,
-                    -- disable treesitter on Rust so that we can use SyntaxRange
-                    -- and leverage TeX rendering in rust projects
-                    disable = { "rust", "tex", "latex" },
-                    -- disable = { "tex", "latex" },
-                    -- true to also use builtin vim syntax highlighting when treesitter fails
-                    additional_vim_regex_highlighting = false
-                  },
-                  incremental_selection = {
-                    enable = true,
-                    keymaps = {
-                      init_selection = "gnn",
-                      node_incremental = "grn",
-                      mcope_incremental = "grc",
-                      node_decremental = "grm"
-                    }
-                  },
-                  indent = {
-                    enable = true,
-                    disable = {}
-                  }
-                }
-
-                vim.o.foldmethod = 'expr'
-                vim.o.foldexpr = 'nvim_treesitter#foldexpr()'
-              '';
-            })
-          ];
-          extraConfig = ''
-            " let the terminal handle mouse events, that way i get OS-level ctrl+shift+c/etc
-            " this used to be default, until <https://github.com/neovim/neovim/pull/19290>
-            set mouse=
-
-            " copy/paste to system clipboard
-            set clipboard=unnamedplus
-
-            " screw tabs; always expand them into spaces
-            set expandtab
-
-            " at least don't open files with sections folded by default
-            set nofoldenable
-
-            " allow text substitutions for certain glyphs.
-            " higher number = more aggressive substitution (0, 1, 2, 3)
-            " i only make use of this for tex, but it's unclear how to
-            " apply that *just* to tex and retain the SyntaxRange stuff.
-            set conceallevel=2
-
-            " horizontal rule under the active line
-            " set cursorline
-
-            " highlight trailing space & related syntax errors (doesn't seem to work??)
-            " let c_space_errors=1
-            " let python_space_errors=1
-
-            " enable highlighting of leading/trailing spaces,
-            " and especially tabs
-            " source: https://www.reddit.com/r/neovim/comments/chlmfk/highlight_trailing_whitespaces_in_neovim/
-            set list
-            set listchars=tab:▷\·,trail:·,extends:◣,precedes:◢,nbsp:○
-          '';
-        };
-
-        # XXX: although home-manager calls this option `firefox`, we can use other browsers and it still mostly works.
-        firefox = lib.mkIf (sysconfig.sane.gui.enable) {
-          enable = true;
-          package = import ./web-browser.nix pkgs;
-        };
-
-        mpv = {
-          enable = true;
-          config = {
-            save-position-on-quit = true;
-            keep-open = "yes";
-          };
-        };
-
-        # "command not found" will cause the command to be searched in nixpkgs
-        nix-index.enable = true;
-      } // cfg.programs;
-
-      home.shellAliases = {
-        ":q" = "exit";
-        # common typos
-        "cd.." = "cd ..";
-        "cd../" = "cd ../";
-      };
-    };
-  };
-}
--- a/modules/universal/env/web-browser.nix
+++ b/modules/universal/env/web-browser.nix
@@ -1,55 +0,0 @@
-pkgs:
-
-# common settings to toggle (at runtime, in about:config):
-#   > security.ssl.require_safe_negotiation
-
-# librewolf is a forked firefox which patches firefox to allow more things
-# (like default search engines) to be configurable at runtime.
-# many of the settings below won't have effect without those patches.
-# see: https://gitlab.com/librewolf-community/settings/-/blob/master/distribution/policies.json
-pkgs.wrapFirefox pkgs.librewolf-unwrapped {
-  # inherit the default librewolf.cfg
-  # it can be further customized via ~/.librewolf/librewolf.overrides.cfg
-  inherit (pkgs.librewolf-unwrapped) extraPrefsFiles;
-  libName = "librewolf";
-  extraPolicies = {
-    NoDefaultBookmarks = true;
-    SearchEngines = {
-      Default = "DuckDuckGo";
-    };
-    AppUpdateURL = "https://localhost";
-    DisableAppUpdate = true;
-    OverrideFirstRunPage = "";
-    OverridePostUpdatePage = "";
-    DisableSystemAddonUpdate = true;
-    DisableFirefoxStudies = true;
-    DisableTelemetry = true;
-    DisableFeedbackCommands = true;
-    DisablePocket = true;
-    DisableSetDesktopBackground = false;
-    Extensions = {
-      Install = [
-        "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
-        "https://addons.mozilla.org/firefox/downloads/latest/sponsorblock/latest.xpi"
-        "https://addons.mozilla.org/firefox/downloads/latest/bypass-paywalls-clean/latest.xpi"
-        "https://addons.mozilla.org/firefox/downloads/latest/sidebery/latest.xpi"
-        "https://addons.mozilla.org/firefox/downloads/latest/ether-metamask/latest.xpi"
-      ];
-      # remove many default search providers
-      Uninstall = [
-        "google@search.mozilla.org"
-        "bing@search.mozilla.org"
-        "amazondotcom@search.mozilla.org"
-        "ebay@search.mozilla.org"
-        "twitter@search.mozilla.org"
-      ];
-    };
-    # XXX doesn't seem to have any effect...
-    # docs: https://github.com/mozilla/policy-templates#homepage
-    # Homepage = {
-    #   HomepageURL = "https://uninsane.org/";
-    #   StartPage = "homepage";
-    # };
-    # NewTabPage = true;
-  };
-}
--- a/modules/universal/home-manager/aerc.nix
+++ b/modules/universal/home-manager/aerc.nix
@@ -0,0 +1,14 @@
+# Terminal UI mail client
+{ config, ... }:
+{
+  sops.secrets."aerc_accounts" = {
+    owner = config.users.users.colin.name;
+    sopsFile = ../../../secrets/universal/aerc_accounts.conf;
+    format = "binary";
+  };
+  home-manager.users.colin = let sysconfig = config; in { config, ... }: {
+    # aerc TUI mail client
+    xdg.configFile."aerc/accounts.conf".source =
+      config.lib.file.mkOutOfStoreSymlink sysconfig.sops.secrets.aerc_accounts.path;
+  };
+}
--- a/modules/universal/home-manager/default.nix
+++ b/modules/universal/home-manager/default.nix
@@ -0,0 +1,218 @@
+# docs:
+#   https://rycee.gitlab.io/home-manager/
+#   https://rycee.gitlab.io/home-manager/options.html
+#   man home-configuration.nix
+#
+
+{ lib, config, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.sane.home-manager;
+  # extract package from `extraPackages`
+  pkg-list = pkgspec: builtins.map (e: e.pkg or e) pkgspec;
+  # extract `dir` from `extraPackages`
+  dir-list = pkgspec: builtins.concatLists (builtins.map (e: if e ? "dir" then [ e.dir ] else []) pkgspec);
+  private-list = pkgspec: builtins.concatLists (builtins.map (e: if e ? "private" then [ e.private ] else []) pkgspec);
+  feeds = import ./feeds.nix { inherit lib; };
+in
+{
+  imports = [
+    ./aerc.nix
+    ./discord.nix
+    ./firefox.nix
+    ./git.nix
+    ./kitty.nix
+    ./mpv.nix
+    ./nb.nix
+    ./neovim.nix
+    ./ssh.nix
+    ./sublime-music.nix
+    ./vlc.nix
+    ./zsh.nix
+  ];
+
+  options = {
+    # packages to deploy to the user's home
+    sane.home-manager.extraPackages = mkOption {
+      default = [ ];
+      # each entry can be either a package, or attrs:
+      #   { pkg = package; dir = optional string;
+      type = types.listOf (types.either types.package types.attrs);
+    };
+
+    # attributes to copy directly to home-manager's `wayland.windowManager` option
+    sane.home-manager.windowManager = mkOption {
+      default = {};
+      type = types.attrs;
+    };
+
+    # extra attributes to include in home-manager's `programs` option
+    sane.home-manager.programs = mkOption {
+      default = {};
+      type = types.attrs;
+    };
+  };
+
+  config = {
+    sane.impermanence.home-dirs = [
+      "archive"
+      "dev"
+      "records"
+      "ref"
+      "tmp"
+      "use"
+      "Music"
+      "Pictures"
+      "Videos"
+    ] ++ (dir-list cfg.extraPackages);
+
+    home-manager.useGlobalPkgs = true;
+    home-manager.useUserPackages = true;
+
+    # XXX this weird rename + closure is to get home-manager's `config.lib.file` to exist.
+    # see: https://github.com/nix-community/home-manager/issues/589#issuecomment-950474105
+    home-manager.users.colin = let sysconfig = config; in { config, ... }: {
+
+      # run `home-manager-help` to access manpages
+      # or `man home-configuration.nix`
+      manual.html.enable = false;  # TODO: set to true later (build failure)
+      manual.manpages.enable = false;  # TODO: enable after https://github.com/nix-community/home-manager/issues/3344
+
+      home.packages = pkg-list cfg.extraPackages;
+      wayland.windowManager = cfg.windowManager;
+
+      home.stateVersion = "21.11";
+      home.username = "colin";
+      home.homeDirectory = "/home/colin";
+
+      home.activation = {
+        initKeyring = {
+          after = ["writeBoundary"];
+          before = [];
+          data = "${../../../scripts/init-keyring}";
+        };
+      };
+
+
+      home.file = let
+        privates = builtins.listToAttrs (
+          builtins.map (path: {
+            name = path;
+            value = { source = config.lib.file.mkOutOfStoreSymlink "/home/colin/private/${path}"; };
+          })
+          (private-list cfg.extraPackages)
+        );
+      in {
+        # convenience
+        "knowledge".source = config.lib.file.mkOutOfStoreSymlink "/home/colin/dev/knowledge";
+        "nixos".source = config.lib.file.mkOutOfStoreSymlink "/home/colin/dev/nixos";
+        "Videos/servo".source = config.lib.file.mkOutOfStoreSymlink "/mnt/servo-media/Videos";
+        "Videos/servo-incomplete".source = config.lib.file.mkOutOfStoreSymlink "/mnt/servo-media/incomplete";
+        "Music/servo".source = config.lib.file.mkOutOfStoreSymlink "/mnt/servo-media/Music";
+
+        # used by password managers, e.g. unix `pass`
+        ".password-store".source = config.lib.file.mkOutOfStoreSymlink "/home/colin/dev/knowledge/secrets/accounts";
+      } // privates;
+
+      # XDG defines things like ~/Desktop, ~/Downloads, etc.
+      # these clutter the home, so i mostly don't use them.
+      xdg.userDirs = {
+        enable = true;
+        createDirectories = false;  # on headless systems, most xdg dirs are noise
+        desktop = "$HOME/.xdg/Desktop";
+        documents = "$HOME/dev";
+        download = "$HOME/tmp";
+        music = "$HOME/Music";
+        pictures = "$HOME/Pictures";
+        publicShare = "$HOME/.xdg/Public";
+        templates = "$HOME/.xdg/Templates";
+        videos = "$HOME/Videos";
+      };
+
+      # the xdg mime type for a file can be found with:
+      # - `xdg-mime query filetype path/to/thing.ext`
+      xdg.mimeApps.enable = true;
+      xdg.mimeApps.defaultApplications = let
+        www = sysconfig.sane.web-browser.desktop;
+        pdf = "org.gnome.Evince.desktop";
+        md = "obsidian.desktop";
+        thumb = "org.gnome.gThumb.desktop";
+        video = "vlc.desktop";
+        # audio = "mpv.desktop";
+        audio = "vlc.desktop";
+      in {
+        # HTML
+        "text/html" = [ www ];
+        "x-scheme-handler/http" = [ www ];
+        "x-scheme-handler/https" = [ www ];
+        "x-scheme-handler/about" = [ www ];
+        "x-scheme-handler/unknown" = [ www ];
+        # RICH-TEXT DOCUMENTS
+        "application/pdf" = [ pdf ];
+        "text/markdown" = [ md ];
+        # IMAGES
+        "image/heif" = [ thumb ];  # apple codec
+        "image/png" = [ thumb ];
+        "image/jpeg" = [ thumb ];
+        # VIDEO
+        "video/mp4" = [ video ];
+        "video/quicktime" = [ video ];
+        "video/x-matroska" = [ video ];
+        # AUDIO
+        "audio/flac" = [ audio ];
+        "audio/mpeg" = [ audio ];
+        "audio/x-vorbis+ogg" = [ audio ];
+      };
+
+
+      xdg.configFile."gpodderFeeds.opml".text = with feeds;
+        feedsToOpml feeds.podcasts;
+
+      # news-flash RSS viewer
+      xdg.configFile."newsflashFeeds.opml".text = with feeds;
+        feedsToOpml (feeds.texts ++ feeds.images);
+
+      # gnome feeds RSS viewer
+      xdg.configFile."org.gabmus.gfeeds.json".text =
+      let
+        myFeeds = feeds.texts ++ feeds.images;
+      in builtins.toJSON {
+        # feed format is a map from URL to a dict,
+        #   with dict["tags"] a list of string tags.
+        feeds = builtins.foldl' (acc: feed: acc // {
+          "${feed.url}".tags = [ feed.cat feed.freq ];
+        }) {} myFeeds;
+        dark_reader = false;
+        new_first = true;
+        # windowsize = {
+        #   width = 350;
+        #   height = 650;
+        # };
+        max_article_age_days = 90;
+        enable_js = false;
+        max_refresh_threads = 3;
+        # saved_items = {};
+        # read_items = [];
+        show_read_items = true;
+        full_article_title = true;
+        # views: "webview", "reader", "rsscont"
+        default_view = "rsscont";
+        open_links_externally = true;
+        full_feed_name = false;
+        refresh_on_startup = true;
+        tags = lib.lists.unique (
+          (builtins.catAttrs "cat" myFeeds) ++ (builtins.catAttrs "freq" myFeeds)
+        );
+        open_youtube_externally = false;
+        media_player = "vlc";  # default: mpv
+      };
+
+      programs = {
+        home-manager.enable = true;  # this lets home-manager manage dot-files in user dirs, i think
+        # "command not found" will cause the command to be searched in nixpkgs
+        nix-index.enable = true;
+      } // cfg.programs;
+    };
+  };
+}
--- a/modules/universal/home-manager/discord.nix
+++ b/modules/universal/home-manager/discord.nix
@@ -0,0 +1,10 @@
+{ ... }:
+{
+  # TODO: this should only be enabled on gui devices
+  # make Discord usable even when client is "outdated"
+  home-manager.users.colin.xdg.configFile."discord/settings.json".text = ''
+    {
+      "SKIP_HOST_UPDATE": true
+    }
+  '';
+}
--- a/modules/universal/home-manager/feeds.nix
+++ b/modules/universal/home-manager/feeds.nix
@@ -18,10 +18,14 @@ let
  podcast = { format = "podcast"; };

  mkRss = format: url: { inherit url format; } // uncat // infrequent;
+  # format-specific helpers
  mkText = mkRss text;
  mkImg = mkRss image;
  mkPod = mkRss podcast;

+  # host-specific helpers
+  mkSubstack = subdomain: mkText "https://${subdomain}.substack.com/feed";
+
  # merge the attrs `new` into each value of the attrs `addTo`
  addAttrs = new: addTo: builtins.mapAttrs (k: v: v // new) addTo;
  # for each value in `attrs`, add a value to the child attrs which holds its key within the parent attrs.
@@ -75,6 +79,7 @@ in rec {
    (mkText "https://www.rifters.com/crawl/?feed=rss2" // uncat // weekly)

    # DEVELOPERS
+    (mkText "https://uninsane.org/atom.xml" // infrequent // tech)
    (mkText "https://mg.lol/blog/rss/" // infrequent // tech)
    ## Ken Shirriff
    (mkText "https://www.righto.com/feeds/posts/default" // tech // infrequent)
@@ -88,8 +93,10 @@ in rec {
    (mkText "https://ianthehenry.com/feed.xml" // tech // infrequent)
    (mkText "https://bitbashing.io/feed.xml" // tech // infrequent)
    (mkText "https://idiomdrottning.org/feed.xml" // uncat // daily)
+    (mkText "https://anish.lakhwara.com/home.html" // tech // weekly)

    # (TECH; POL) COMMENTATORS
+    (mkSubstack "edwardsnowden" // pol // infrequent)
    (mkText "http://benjaminrosshoffman.com/feed" // pol // weekly)
    ## Ben Thompson
    (mkText "https://www.stratechery.com/rss" // pol // weekly)
@@ -98,15 +105,15 @@ in rec {
    (mkText "https://www.ben-evans.com/benedictevans/rss.xml" // pol // weekly)
    (mkText "https://www.lynalden.com/feed" // pol // infrequent)
    (mkText "https://austinvernon.site/rss.xml" // tech // infrequent)
-    (mkText "https://oversharing.substack.com/feed" // pol // daily)
-    (mkText "https://doomberg.substack.com/feed" // tech // weekly)
+    (mkSubstack "oversharing" // pol // daily)
+    (mkSubstack "doomberg" // tech // weekly)
    ## David Rosenthal
    (mkText "https://blog.dshr.org/rss.xml" // pol // weekly)
    ## Matt Levine
    (mkText "https://www.bloomberg.com/opinion/authors/ARbTQlRLRjE/matthew-s-levine.rss" // pol // weekly)

    # RATIONALITY/PHILOSOPHY/ETC
-    (mkText "https://samkriss.substack.com/feed" // humor // infrequent)
+    (mkSubstack "samkriss" // humor // infrequent)
    (mkText "https://unintendedconsequenc.es/feed" // rat // infrequent)
    (mkText "https://applieddivinitystudies.com/atom.xml" // rat // weekly)
    (mkText "https://slimemoldtimemold.com/feed.xml" // rat // weekly)
@@ -117,7 +124,7 @@ in rec {
    ## Robin Hanson
    (mkText "https://www.overcomingbias.com/feed" // rat // daily)
    ## Scott Alexander
-    (mkText "https://astralcodexten.substack.com/feed.xml" // rat // daily)
+    (mkSubstack "astralcodexten" // rat // daily)
    ## Paul Christiano
    (mkText "https://sideways-view.com/feed" // rat // infrequent)
    ## Sean Carroll
--- a/modules/universal/home-manager/firefox.nix
+++ b/modules/universal/home-manager/firefox.nix
@@ -0,0 +1,139 @@
+# common settings to toggle (at runtime, in about:config):
+#   > security.ssl.require_safe_negotiation
+
+# librewolf is a forked firefox which patches firefox to allow more things
+# (like default search engines) to be configurable at runtime.
+# many of the settings below won't have effect without those patches.
+# see: https://gitlab.com/librewolf-community/settings/-/blob/master/distribution/policies.json
+
+{ config, lib, pkgs, ...}:
+with lib;
+let
+  cfg = config.sane.web-browser;
+  # allow easy switching between firefox and librewolf with `defaultSettings`, below
+  librewolfSettings = {
+    browser = pkgs.librewolf-unwrapped;
+    # browser = pkgs.librewolf-unwrapped.overrideAttrs (drv: {
+    #   # this allows side-loading unsigned addons
+    #   MOZ_REQUIRE_SIGNING = false;
+    # });
+    libName = "librewolf";
+    dotDir = ".librewolf";
+    desktop = "librewolf.desktop";
+  };
+  firefoxSettings = {
+    browser = pkgs.firefox-esr-unwrapped;
+    libName = "firefox";
+    dotDir = ".mozilla/firefox";
+    desktop = "firefox.desktop";
+  };
+  defaultSettings = firefoxSettings;
+  # defaultSettings = librewolfSettings;
+
+  package = pkgs.wrapFirefox cfg.browser {
+    # inherit the default librewolf.cfg
+    # it can be further customized via ~/.librewolf/librewolf.overrides.cfg
+    inherit (pkgs.librewolf-unwrapped) extraPrefsFiles;
+    inherit (cfg) libName;
+
+    extraNativeMessagingHosts = [ pkgs.browserpass ];
+    # extraNativeMessagingHosts = [ pkgs.gopass-native-messaging-host ];
+
+    nixExtensions = let
+      addon = name: extid: hash: pkgs.fetchFirefoxAddon {
+        inherit name hash;
+        url = "https://addons.mozilla.org/firefox/downloads/latest/${name}/latest.xpi";
+        fixedExtid = extid;
+      };
+      localAddon = pkg: pkgs.fetchFirefoxAddon {
+        inherit (pkg) name;
+        src = "${pkg}/share/mozilla/extensions/\\{ec8030f7-c20a-464f-9b0e-13a3a9e97384\\}/${pkg.extid}.xpi";
+        fixedExtid = pkg.extid;
+      };
+    in [
+      (addon "ublock-origin" "uBlock0@raymondhill.net" "sha256-C+VQyaJ8BA0ErXGVTdnppJZ6J9SP+izf6RFxdS4VJoU=")
+      (addon "sponsorblock" "sponsorBlocker@ajay.app" "sha256-au5GGn22n4i6VrdOKqNMOrWdMoVCcpLdjO2wwRvyx7E=")
+      (addon "bypass-paywalls-clean" "{d133e097-46d9-4ecc-9903-fa6a722a6e0e}" "sha256-m14onUlnpLDPHezA/soKygcc76tF1fLG52tM/LkbAXQ=")
+      (addon "sidebery" "{3c078156-979c-498b-8990-85f7987dd929}" "sha256-YONfK/rIjlsrTgRHIt3km07Q7KnpIW89Z9r92ZSCc6w=")
+      (addon "ether-metamask" "webextension@metamask.io" "sha256-dnpwKpNF0KgHMAlz5btkkZySjMsnrXECS35ClkD2XHc=")
+      # (addon "browserpass-ce" "browserpass@maximbaz.com" "sha256-sXgUBbRvMnRpeIW1MTkmTcoqtW/8RDXAkxAq1evFkpc=")
+      (localAddon pkgs.browserpass-extension)
+    ];
+
+    extraPolicies = {
+      NoDefaultBookmarks = true;
+      SearchEngines = {
+        Default = "DuckDuckGo";
+      };
+      AppUpdateURL = "https://localhost";
+      DisableAppUpdate = true;
+      OverrideFirstRunPage = "";
+      OverridePostUpdatePage = "";
+      DisableSystemAddonUpdate = true;
+      DisableFirefoxStudies = true;
+      DisableTelemetry = true;
+      DisableFeedbackCommands = true;
+      DisablePocket = true;
+      DisableSetDesktopBackground = false;
+
+      # remove many default search providers
+      # XXX this seems to prevent the `nixExtensions` from taking effect
+      # Extensions.Uninstall = [
+      #   "google@search.mozilla.org"
+      #   "bing@search.mozilla.org"
+      #   "amazondotcom@search.mozilla.org"
+      #   "ebay@search.mozilla.org"
+      #   "twitter@search.mozilla.org"
+      # ];
+      # XXX doesn't seem to have any effect...
+      # docs: https://github.com/mozilla/policy-templates#homepage
+      # Homepage = {
+      #   HomepageURL = "https://uninsane.org/";
+      #   StartPage = "homepage";
+      # };
+      # NewTabPage = true;
+    };
+  };
+in
+{
+  options = {
+    sane.web-browser = mkOption {
+      default = defaultSettings;
+      type = types.attrs;
+    };
+  };
+  config = {
+    # XXX: although home-manager calls this option `firefox`, we can use other browsers and it still mostly works.
+    home-manager.users.colin = lib.mkIf (config.sane.gui.enable) {
+      programs.firefox = {
+        enable = true;
+        inherit package;
+      };
+
+      # uBlock filter list configuration.
+      # specifically, enable the GDPR cookie prompt blocker.
+      # data.toOverwrite.filterLists is additive (i.e. it supplements the default filters)
+      # this configuration method is documented here:
+      # - <https://github.com/gorhill/uBlock/issues/2986#issuecomment-364035002>
+      # the specific attribute path is found via scraping ublock code here:
+      # - <https://github.com/gorhill/uBlock/blob/master/src/js/storage.js>
+      # - <https://github.com/gorhill/uBlock/blob/master/assets/assets.json>
+      home.file."${cfg.dotDir}/managed-storage/uBlock0@raymondhill.net.json".text = ''
+        {
+         "name": "uBlock0@raymondhill.net",
+         "description": "ignored",
+         "type": "storage",
+         "data": {
+            "toOverwrite": "{\"filterLists\": [\"fanboy-cookiemonster\"]}"
+         }
+        }
+      '';
+      home.file."${cfg.dotDir}/${cfg.libName}.overrides.cfg".text = ''
+        // if we can't query the revocation status of a SSL cert because the issuer is offline,
+        // treat it as unrevoked.
+        // see: <https://librewolf.net/docs/faq/#im-getting-sec_error_ocsp_server_error-what-can-i-do>
+        defaultPref("security.OCSP.require", false);
+      '';
+    };
+  };
+}
--- a/modules/universal/home-manager/git.nix
+++ b/modules/universal/home-manager/git.nix
@@ -0,0 +1,18 @@
+{ pkgs, ... }:
+{
+  home-manager.users.colin.programs.git = {
+    enable = true;
+    userName = "colin";
+    userEmail = "colin@uninsane.org";
+
+    aliases = { co = "checkout"; };
+    extraConfig = {
+      # difftastic docs:
+      # - <https://difftastic.wilfred.me.uk/git.html>
+      diff.tool = "difftastic";
+      difftool.prompt = false;
+      "difftool \"difftastic\"".cmd = ''${pkgs.difftastic}/bin/difft "$LOCAL" "$REMOTE"'';
+      # now run `git difftool` to use difftastic git
+    };
+  };
+}
--- a/modules/universal/home-manager/kitty.nix
+++ b/modules/universal/home-manager/kitty.nix
@@ -0,0 +1,69 @@
+{ ... }:
+{
+  home-manager.users.colin.programs.kitty = {
+    enable = true;
+    # docs: https://sw.kovidgoyal.net/kitty/conf/
+    settings = {
+      # disable terminal bell (when e.g. you backspace too many times)
+      enable_audio_bell = false;
+    };
+    keybindings = {
+      "ctrl+n" = "new_os_window_with_cwd";
+    };
+    # docs: https://github.com/kovidgoyal/kitty-themes
+    # theme = "1984 Light";  # dislike: awful, harsh blues/teals
+    # theme = "Adventure Time";  # dislike: harsh (dark)
+    # theme = "Atom One Light";  # GOOD: light theme. all color combos readable. not a huge fan of the blue.
+    # theme = "Belafonte Day";  # dislike: too low contrast for text colors
+    # theme = "Belafonte Night";  # better: dark theme that's easy on the eyes. all combos readable. low contrast.
+    # theme = "Catppuccin";  # dislike: a bit pale/low-contrast (dark)
+    # theme = "Desert";  # mediocre: colors are harsh
+    # theme = "Earthsong";  # BEST: dark theme. readable, good contrast. unique, but decent colors.
+    # theme = "Espresso Libre";  # better: dark theme. readable, but meh colors
+    # theme = "Forest Night";  # decent: very pastel. it's workable, but unconventional and muted/flat.
+    # theme = "Gruvbox Material Light Hard";  # mediocre light theme.
+    # theme = "kanagawabones";  # better: dark theme. colors are too background-y
+    # theme = "Kaolin Dark";  # dislike: too dark
+    # theme = "Kaolin Breeze";  # mediocre: not-too-harsh light theme, but some parts are poor contrast
+    # theme = "Later This Evening";  # mediocre: not-too-harsh dark theme, but cursor is poor contrast
+    # theme = "Material"; # decent: light theme, few colors.
+    # theme = "Mayukai";  # decent: not-too-harsh dark theme. the teal is a bit straining
+    # theme = "Nord";  # mediocre: pale background, low contrast
+    # theme = "One Half Light";  # better: not-too-harsh light theme. contrast could be better
+    theme = "PaperColor Dark";  # BEST: dark theme, very readable still the colors are background-y
+    # theme = "Parasio Dark";  # dislike: too low contrast
+    # theme = "Pencil Light";  # better: not-too-harsh light theme. decent contrast.
+    # theme = "Pnevma";  # dislike: too low contrast
+    # theme = "Piatto Light";  # better: readable light theme. pleasing colors. powerline prompt is hard to read.
+    # theme = "Rosé Pine Dawn";  # GOOD: light theme. all color combinations are readable. it is very mild -- may need to manually tweak contrast. tasteful colors
+    # theme = "Rosé Pine Moon";  # GOOD: dark theme. tasteful colors. but background is a bit intense
+    # theme = "Sea Shells";  # mediocre. not all color combos are readable
+    # theme = "Solarized Light";  # mediocre: not-too-harsh light theme; GREAT background; but some colors are low contrast
+    # theme = "Solarized Dark Higher Contrast";  # better: dark theme, decent colors
+    # theme = "Sourcerer";  # mediocre: ugly colors
+    # theme = "Space Gray";  # mediocre: too muted
+    # theme = "Space Gray Eighties";  # better: all readable, decent colors
+    # theme = "Spacemacs";  # mediocre: too muted
+    # theme = "Spring";  # mediocre: readable light theme, but the teal is ugly.
+    # theme = "Srcery";  # better: highly readable. colors are ehhh
+    # theme = "Substrata";  # decent: nice colors, but a bit flat.
+    # theme = "Sundried";  # mediocre: the solar text makes me squint
+    # theme = "Symfonic";  # mediocre: the dark purple has low contrast to the black bg.
+    # theme = "Tango Light";  # dislike: teal is too grating
+    # theme = "Tokyo Night Day";  # medicore: too muted
+    # theme = "Tokyo Night";  # better: tasteful. a bit flat
+    # theme = "Tomorrow";  # GOOD: all color combinations are readable. contrast is slightly better than Rose. on the blander side
+    # theme = "Treehouse";  # dislike: the orange is harsh on my eyes.
+    # theme = "Urple";  # dislike: weird palette
+    # theme = "Warm Neon";  # decent: not-too-harsh dark theme. the green is a bit unattractive
+    # theme = "Wild Cherry";  # GOOD: dark theme: nice colors. a bit flat
+    # theme = "Xcodedark";  # dislike: bad palette
+    # theme = "citylights";  # decent: dark theme. some parts have just a bit low contrast
+    # theme = "neobones_light"; # better light theme. the background is maybe too muted
+    # theme = "vimbones";
+    # theme = "zenbones_dark";  # mediocre: readable, but meh colors
+    # theme = "zenbones_light";  # decent: light theme. all colors are readable. contrast is passable but not excellent. highlight color is BAD
+    # theme = "zenwritten_dark";  # mediocre: looks same as zenbones_dark
+    # extraConfig = "";
+  };
+}
--- a/modules/universal/home-manager/mpv.nix
+++ b/modules/universal/home-manager/mpv.nix
@@ -0,0 +1,11 @@
+{ ... }:
+{
+  home-manager.users.colin.programs.mpv = {
+    enable = true;
+    config = {
+      save-position-on-quit = true;
+      keep-open = "yes";
+    };
+  };
+}
+
--- a/modules/universal/home-manager/nb.nix
+++ b/modules/universal/home-manager/nb.nix
@@ -0,0 +1,24 @@
+# nb is a CLI-drive Personal Knowledge Manager
+# - <https://xwmx.github.io/nb/>
+#
+# it's pretty opinionated:
+# - autocommits (to git) excessively (disable-able)
+# - inserts its own index files to give deterministic names to files
+#
+# it offers a primitive web-server
+# and it offers some CLI query tools
+
+{ lib, pkgs, ... }: lib.mkIf false  # XXX disabled!
+{
+  sane.home-manager.extraPackages = [ pkgs.nb ];
+
+  home-manager.users.colin = { config, ... }: {
+    # nb markdown/personal knowledge manager
+    home.file.".nb/knowledge".source = config.lib.file.mkOutOfStoreSymlink "/home/colin/dev/knowledge";
+    home.file.".nb/.current".text = "knowledge";
+    home.file.".nbrc".text = ''
+      # manage with `nb settings`
+      export NB_AUTO_SYNC=0
+    '';
+  };
+}
--- a/modules/universal/home-manager/neovim.nix
+++ b/modules/universal/home-manager/neovim.nix
@@ -0,0 +1,115 @@
+{ pkgs, ... }:
+{
+  sane.impermanence.home-dirs = [ ".cache/vim-swap" ];
+
+  home-manager.users.colin.programs.neovim = {
+    # neovim: https://github.com/neovim/neovim
+    enable = true;
+    viAlias = true;
+    vimAlias = true;
+    plugins = with pkgs.vimPlugins; [
+      # docs: surround-nvim: https://github.com/ur4ltz/surround.nvim/
+      # docs: vim-surround: https://github.com/tpope/vim-surround
+      vim-surround
+      # docs: fzf-vim (fuzzy finder): https://github.com/junegunn/fzf.vim
+      fzf-vim
+      # docs: https://github.com/KeitaNakamura/tex-conceal.vim/
+      ({
+        plugin = tex-conceal-vim;
+        type = "viml";
+        config = ''
+          " present prettier fractions
+          let g:tex_conceal_frac=1
+        '';
+      })
+      ({
+        plugin = vim-SyntaxRange;
+        type = "viml";
+        config = ''
+          " enable markdown-style codeblock highlighting for tex code
+          autocmd BufEnter * call SyntaxRange#Include('```tex', '```', 'tex', 'NonText')
+          " autocmd Syntax tex set conceallevel=2
+        '';
+      })
+      # nabla renders inline math in any document, but it's buggy.
+      #   https://github.com/jbyuki/nabla.nvim
+      # ({
+      #   plugin = pkgs.nabla;
+      #   type = "lua";
+      #   config = ''
+      #     require'nabla'.enable_virt()
+      #   '';
+      # })
+      # treesitter syntax highlighting: https://nixos.wiki/wiki/Tree_sitters
+      # docs: https://github.com/nvim-treesitter/nvim-treesitter
+      # config taken from: https://github.com/i077/system/blob/master/modules/home/neovim/default.nix
+      # this is required for tree-sitter to even highlight
+      ({
+        plugin = nvim-treesitter.withAllGrammars;
+        type = "lua";
+        config = ''
+          require'nvim-treesitter.configs'.setup {
+            highlight = {
+              enable = true,
+              -- disable treesitter on Rust so that we can use SyntaxRange
+              -- and leverage TeX rendering in rust projects
+              disable = { "rust", "tex", "latex" },
+              -- disable = { "tex", "latex" },
+              -- true to also use builtin vim syntax highlighting when treesitter fails
+              additional_vim_regex_highlighting = false
+            },
+            incremental_selection = {
+              enable = true,
+              keymaps = {
+                init_selection = "gnn",
+                node_incremental = "grn",
+                mcope_incremental = "grc",
+                node_decremental = "grm"
+              }
+            },
+            indent = {
+              enable = true,
+              disable = {}
+            }
+          }
+
+          vim.o.foldmethod = 'expr'
+          vim.o.foldexpr = 'nvim_treesitter#foldexpr()'
+        '';
+      })
+    ];
+    extraConfig = ''
+      " let the terminal handle mouse events, that way i get OS-level ctrl+shift+c/etc
+      " this used to be default, until <https://github.com/neovim/neovim/pull/19290>
+      set mouse=
+
+      " copy/paste to system clipboard
+      set clipboard=unnamedplus
+
+      " screw tabs; always expand them into spaces
+      set expandtab
+
+      " at least don't open files with sections folded by default
+      set nofoldenable
+
+      " allow text substitutions for certain glyphs.
+      " higher number = more aggressive substitution (0, 1, 2, 3)
+      " i only make use of this for tex, but it's unclear how to
+      " apply that *just* to tex and retain the SyntaxRange stuff.
+      set conceallevel=2
+
+      " horizontal rule under the active line
+      " set cursorline
+
+      " highlight trailing space & related syntax errors (doesn't seem to work??)
+      " let c_space_errors=1
+      " let python_space_errors=1
+
+      " enable highlighting of leading/trailing spaces,
+      " and especially tabs
+      " source: https://www.reddit.com/r/neovim/comments/chlmfk/highlight_trailing_whitespaces_in_neovim/
+      set list
+      set listchars=tab:▷\·,trail:·,extends:◣,precedes:◢,nbsp:○
+    '';
+  };
+}
--- a/modules/universal/home-manager/ssh.nix
+++ b/modules/universal/home-manager/ssh.nix
@@ -0,0 +1,18 @@
+{ config, pkgs, ... }:
+{
+  home-manager.users.colin = let
+    host = config.networking.hostName;
+    user_pubkey = (import ../pubkeys.nix).users."${host}";
+    known_hosts_text = builtins.concatStringsSep
+      "\n"
+      (builtins.attrValues (import ../pubkeys.nix).hosts);
+  in { config, ...}: {
+    # ssh key is stored in private storage
+    home.file.".ssh/id_ed25519".source = config.lib.file.mkOutOfStoreSymlink "/home/colin/private/.ssh/id_ed25519";
+    home.file.".ssh/id_ed25519.pub".text = user_pubkey;
+
+    programs.ssh.enable = true;
+    # this optionally accepts multiple known_hosts paths, separated by space.
+    programs.ssh.userKnownHostsFile = builtins.toString (pkgs.writeText "known_hosts" known_hosts_text);
+  };
+}
--- a/modules/universal/home-manager/sublime-music.nix
+++ b/modules/universal/home-manager/sublime-music.nix
@@ -0,0 +1,14 @@
+{ config, ... }:
+{
+  # TODO: this should only be shipped on gui platforms
+  sops.secrets."sublime_music_config" = {
+    owner = config.users.users.colin.name;
+    sopsFile = ../../../secrets/universal/sublime_music_config.json.bin;
+    format = "binary";
+  };
+  home-manager.users.colin = let sysconfig = config; in { config, ... }: {
+    # sublime music player
+    xdg.configFile."sublime-music/config.json".source =
+      config.lib.file.mkOutOfStoreSymlink sysconfig.sops.secrets.sublime_music_config.path;
+  };
+}
--- a/modules/universal/home-manager/vlc.nix
+++ b/modules/universal/home-manager/vlc.nix
@@ -0,0 +1,17 @@
+{ lib, ... }:
+{
+  home-manager.users.colin.xdg.configFile."vlc/vlcrc".text =
+  let
+    feeds = import ./feeds.nix { inherit lib; };
+    podcastUrls = lib.strings.concatStringsSep "|" (
+      builtins.map (feed: feed.url) feeds.podcasts
+    );
+  in ''
+    [podcast]
+    podcast-urls=${podcastUrls}
+    [core]
+    metadata-network-access=0
+    [qt]
+    qt-privacy-ask=0
+  '';
+}
--- a/modules/universal/home-manager/zsh.nix
+++ b/modules/universal/home-manager/zsh.nix
@@ -0,0 +1,61 @@
+{ ... }:
+{
+  # we don't need to full zsh dir -- just the history file --
+  # but zsh will sometimes backup the history file and we get fewer errors if we do proper mounts instead of symlinks.
+  sane.impermanence.home-dirs = [ ".local/share/zsh" ];
+
+  home-manager.users.colin.programs.zsh = {
+    enable = true;
+    enableSyntaxHighlighting = true;
+    enableVteIntegration = true;
+    history.ignorePatterns = [ "rm *" ];
+    dotDir = ".config/zsh";
+    history.path = "/home/colin/.local/share/zsh/history";
+
+    initExtraBeforeCompInit = ''
+      # p10k instant prompt
+      # run p10k configure to configure, but it can't write out its file :-(
+      POWERLEVEL9K_DISABLE_CONFIGURATION_WIZARD=true
+    '';
+    initExtra = ''
+      # zmv is a way to do rich moves/renames, with pattern matching/substitution.
+      # see for an example: <https://filipe.kiss.ink/zmv-zsh-rename/>
+      autoload -Uz zmv
+
+      # disable `rm *` confirmations
+      setopt rmstarsilent
+
+      function nd() {
+        mkdir -p "$1";
+        pushd "$1";
+      }
+    '';
+
+    # prezto = oh-my-zsh fork; controls prompt, auto-completion, etc.
+    # see: https://github.com/sorin-ionescu/prezto
+    prezto = {
+      enable = true;
+      pmodules = [
+        "environment"
+        "terminal"
+        "editor"
+        "history"
+        "directory"
+        "spectrum"
+        "utility"
+        "completion"
+        "prompt"
+        "git"
+      ];
+      prompt.theme = "powerlevel10k";
+      utility.safeOps = false;  # disable `mv` confirmation (and supposedly `rm`, too)
+    };
+  };
+
+  home-manager.users.colin.home.shellAliases = {
+    ":q" = "exit";
+    # common typos
+    "cd.." = "cd ..";
+    "cd../" = "cd ../";
+  };
+}
--- a/modules/universal/env/home-packages.nix
+++ b/modules/universal/env/home-packages.nix
@@ -10,6 +10,8 @@ let
    duplicity
    gnupg
    gocryptfs
+    gopass
+    gopass-jsonapi
    ifuse
    ipfs
    libimobiledevice
@@ -17,7 +19,6 @@ let
    lm_sensors  # for sensors-detect
    lshw
    ffmpeg
-    nb
    networkmanager
    nixpkgs-review
    # nixos-generators
@@ -49,12 +50,13 @@ let
    # GUI only
    aerc  # email client
    audacity
+    celluloid  # mpv frontend
    chromium
    clinfo
    electrum

    # creds/session keys, etc
-    { pkg = element-desktop; dir = ".config/Element"; }
+    { pkg = element-desktop; private = ".config/Element"; }

    emote  # TODO: package [smile](https://github.com/mijorus/smile) for probably a better mobile experience.
    evince  # works on phosh
@@ -67,7 +69,7 @@ let
    # XXX by default fractal stores its state in ~/.local/share/<UUID>.
    # after logging in, manually change ~/.local/share/keyrings/... to point it to some predictable subdir.
    # then reboot (so that libsecret daemon re-loads the keyring...?)
-    { pkg = fractal-next; dir = ".local/share/fractal"; }
+    { pkg = fractal-next; private = ".local/share/fractal"; }

    gimp  # broken on phosh
    gnome.cheese
@@ -85,6 +87,7 @@ let
    { pkg = gpodder-configured; dir = "gPodder/Downloads"; }

    gthumb
+    handbrake
    inkscape

    kid3  # audio tagging
@@ -115,7 +118,7 @@ let
    tdesktop  # broken on phosh

    # vlc remembers play position in ~/.config/vlc/vlc-qt-interface.conf
-    { pkg = vlc; persist-files = [ ".config/vlc/vlc-qt-interface.conf" ]; }
+    { pkg = vlc; dir = ".config/vlc"; }

    whalebird # pleroma client. input is broken on phosh
    xdg-utils  # for xdg-open
@@ -132,8 +135,8 @@ let
      nss = pkgs.nss_latest;
    }); in { pkg = discord; dir = ".config/discord"; })

-    kaiteki  # Pleroma client
-    gnome.zenity # for kaiteki (it will use qarma, kdialog, or zenity)
+    # kaiteki  # Pleroma client
+    # gnome.zenity # for kaiteki (it will use qarma, kdialog, or zenity)

    logseq
    losslesscut-bin
@@ -161,9 +164,11 @@ let
    dtc
    flex
    gcc
+    gdb
    # gcc-arm-embedded
    # gcc_multi
    gnumake
+    mercurial
    mix2nix
    rustup
    swig
--- a/modules/universal/machine-id.nix
+++ b/modules/universal/machine-id.nix
@@ -0,0 +1,11 @@
+{ ... }:
+{
+  # we wan't an /etc/machine-id which is consistent across boot so that `journalctl` will actually show us
+  # logs from previous boots.
+  # maybe there's a config option for this (since persistent machine-id is bad for reasons listed in impermanence.nix),
+  # but for now generate it from ssh keys.
+  system.activationScripts.machine-id = {
+    deps = [ "persist-ssh-host-keys" ];
+    text = "sha256sum /etc/ssh/host_keys/ssh_host_ed25519_key | cut -c 1-32 > /etc/machine-id";
+  };
+}
--- a/modules/universal/net.nix
+++ b/modules/universal/net.nix
@@ -18,10 +18,20 @@
  # docs:
  # - <https://nixos.wiki/wiki/Iwd>
  # - <https://iwd.wiki.kernel.org/networkmanager>
+  # - `man iwd.config`  for global config
+  # - `man iwd.network` for per-SSID config
  # use `iwctl` to control
-  networking.wireless.iwd.enable = true;
  networking.networkmanager.wifi.backend = "iwd";
+  networking.wireless.iwd.enable = true;
+  networking.wireless.iwd.settings = {
+    # auto-connect to a stronger network if signal drops below this value
+    # bedroom -> bedroom connection is -35 to -40 dBm
+    # bedroom -> living room connection is -60 dBm
+    General.RoamThreshold = "-52";  # default -70
+    General.RoamThreshold5G = "-52";  # default -76
+  };

+  # TODO: don't need to depend on binsh if we were to use a nix-style shebang
  system.activationScripts.linkIwdKeys = let
    unwrapped = ../../scripts/install-iwd;
    install-iwd = pkgs.writeShellApplication {
@@ -30,7 +40,7 @@
      text = ''${unwrapped} "$@"'';
    };
  in (lib.stringAfter
-    [ "setupSecrets" ]
+    [ "setupSecrets" "binsh" ]
    ''
    mkdir -p /var/lib/iwd
    ${install-iwd}/bin/install-iwd /run/secrets/iwd /var/lib/iwd
--- a/modules/universal/pubkeys.nix
+++ b/modules/universal/pubkeys.nix
@@ -0,0 +1,34 @@
+# create ssh key by running:
+# - `ssh-keygen -t ed25519`
+let
+  withHost = host: key: "${host} ${key}";
+  withUser = user: key: "${key} ${user}";
+
+  keys = rec {
+    lappy = {
+      host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSJnqmVl9/SYQ0btvGb0REwwWY8wkdkGXQZfn/1geEc";
+      users.colin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDpmFdNSVPRol5hkbbCivRhyeENzb9HVyf9KutGLP2Zu";
+    };
+    desko = {
+      host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFw9NoRaYrM6LbDd3aFBc4yyBlxGQn8HjeHd/dZ3CfHk";
+      users.colin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPU5GlsSfbaarMvDA20bxpSZGWviEzXGD8gtrIowc1pX";
+    };
+    servo = {
+      host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfdSmFkrVT6DhpgvFeQKm3Fh9VKZ9DbLYOPOJWYQ0E8";
+      users.colin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPS1qFzKurAdB9blkWomq8gI1g0T3sTs9LsmFOj5VtqX";
+    };
+    moby = {
+      host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1N/IT3nQYUD+dBlU1sTEEVMxfOyMkrrDeyHcYgnJvw";
+      users.colin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrR+gePnl0nV/vy7I5BzrGeyVL+9eOuXHU1yNE3uCwU";
+    };
+
+    "uninsane.org" = servo;
+    "git.uninsane.org" = servo;
+  };
+in {
+  # map hostname -> something suitable for known_keys
+  hosts = builtins.mapAttrs (machine: keys: withHost machine keys.host) keys;
+  # map hostname -> something suitable for authorized_keys to allow access to colin@<hostname>
+  users = builtins.mapAttrs (machine: keys: withUser "colin@${machine}" keys.users.colin) keys;
+}
+
--- a/modules/universal/secrets.nix
+++ b/modules/universal/secrets.nix
@@ -35,9 +35,9 @@
  sops.defaultSopsFile = ./../../secrets/universal.yaml;
  # This will automatically import SSH keys as age keys
  sops.age.sshKeyPaths = [
-    "/etc/ssh/ssh_host_ed25519_key"
-    # "/home/colin/.ssh/id_ed25519_dec"
+    "/etc/ssh/host_keys/ssh_host_ed25519_key"
  ];
+  sops.gnupg.sshKeyPaths = [];  # disable RSA key import
  # This is using an age key that is expected to already be in the filesystem
  # sops.age.keyFile = "/home/colin/.ssh/age.pub";
  # sops.age.keyFile = "/var/lib/sops-nix/key.txt";
--- a/modules/universal/ssh.nix
+++ b/modules/universal/ssh.nix
@@ -0,0 +1,21 @@
+{ ... }:
+{
+  # we place the host keys (which we want to be persisted) into their own directory so that we can
+  # bind mount that whole directory instead of doing it per-file.
+  # otherwise, this is identical to nixos defaults
+  sane.impermanence.service-dirs = [ "/etc/ssh/host_keys" ];
+
+  # we can't naively `mount /etc/ssh/host_keys` directly,
+  # as /etc/fstab may not be populated yet (since that file depends on e.g. activationScripts.users)
+  # we can't even depend on impermanence's `createPersistentStorageDirs` to create the source/target directories
+  # since that also depends on `users`.
+  system.activationScripts.persist-ssh-host-keys.text = ''
+    mkdir -p /etc/ssh/host_keys
+    mount --bind /nix/persist/etc/ssh/host_keys /etc/ssh/host_keys
+  '';
+
+  services.openssh.hostKeys = [
+    { type = "rsa"; bits = 4096; path = "/etc/ssh/host_keys/ssh_host_rsa_key"; }
+    { type = "ed25519"; path = "/etc/ssh/host_keys/ssh_host_ed25519_key"; }
+  ];
+}
--- a/modules/universal/env/system-packages.nix
+++ b/modules/universal/env/system-packages.nix
--- a/modules/universal/users.nix
+++ b/modules/universal/users.nix
@@ -43,17 +43,14 @@ in
        "feedbackd"
        "dialout" # required for modem access
      ];
+
+      # initial password is empty, in case anything goes wrong.
+      # if `colin-passwd` (a password hash) is successfully found/decrypted, that becomes the password at boot.
      initialPassword = lib.mkDefault "";
+      passwordFile = lib.mkIf (config.sops.secrets ? "colin-passwd") config.sops.secrets.colin-passwd.path;
+
      shell = pkgs.zsh;
-      # shell = pkgs.bashInteractive;
-      # XXX colin: create ssh key for THIS user by logging in and running:
-      #   ssh-keygen -t ed25519
-      openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDpmFdNSVPRol5hkbbCivRhyeENzb9HVyf9KutGLP2Zu colin@lappy"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPU5GlsSfbaarMvDA20bxpSZGWviEzXGD8gtrIowc1pX colin@desko"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPS1qFzKurAdB9blkWomq8gI1g0T3sTs9LsmFOj5VtqX colin@servo"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrR+gePnl0nV/vy7I5BzrGeyVL+9eOuXHU1yNE3uCwU colin@moby"
-      ];
+      openssh.authorizedKeys.keys = builtins.attrValues (import ./pubkeys.nix).users;

      pamMount = {
        # mount encrypted stuff at login
@@ -67,6 +64,15 @@ in
      };
    };

+    sane.impermanence.home-dirs = [
+      # cache is probably too big to fit on the tmpfs
+      # TODO: we could bind-mount it to something which gets cleared per boot, though.
+      ".cache"
+      ".cargo"
+      ".rustup"
+      ".local/share/keyrings"
+    ];
+
    sane.impermanence.service-dirs = mkIf cfg.guest.enable [
      { user = "guest"; group = "users"; directory = "/home/guest"; }
    ];
--- a/nixpatches/list.nix
+++ b/nixpatches/list.nix
@@ -1,11 +1,29 @@
 fetchpatch: [
  # phosh-mobile-settings: init at 0.21.1
  (fetchpatch {
-    url = "http://git.uninsane.org/colin/nixpkgs/commit/0c1a7e8504291eb0076bbee3f8ebf693f4641112.diff";
+    url = "https://git.uninsane.org/colin/nixpkgs/commit/0c1a7e8504291eb0076bbee3f8ebf693f4641112.diff";
    # url = "https://github.com/NixOS/nixpkgs/pull/193845.diff";
    sha256 = "sha256-OczjlQcG7sTM/V9Y9VL/qdwaWPKfjAJsh3czqqhRQig=";
  })

+  # librewolf: build with `MOZ_REQUIRE_SIGNING=false`
+  (fetchpatch {
+    url = "https://github.com/NixOS/nixpkgs/pull/199134.diff";
+    # url = "https://git.uninsane.org/colin/nixpkgs/commit/99b82e07fee4d194520d6e8d51bc45c80a4d3c7e.diff";
+    sha256 = "sha256-FOAZYaMpSPMYwU26xYD+V/f+df0JjlbuVtqjlcBFW5Q=";
+  })
+
+  # lightdm-mobile-greeter: init at 2022-10-30
+  (fetchpatch {
+    url = "https://git.uninsane.org/colin/nixpkgs/commit/0a9018c8879d8fe871ee03bc386f8d148e4f88b8.diff";
+    sha256 = "sha256-h1+K8UO4+G6yvl6JFd8xBGitPgOCIY7BunW49eGkXQQ=";
+  })
+  # lightdm: add `greeters.mobile` config option
+  (fetchpatch {
+    url = "https://git.uninsane.org/colin/nixpkgs/commit/1144d6cfe976e7bcfb9611b1d0a66071e17cd569.diff";
+    sha256 = "sha256-ZEvLPqrkpr79yXrsBxgxELR2Awtqk3675jkYZqx2AfY=";
+  })
+
  # # kaiteki: init at 2022-09-03
  # vendorHash changes too frequently (might not be reproducible).
  # using local package defn until stabilized
@@ -15,24 +33,6 @@ fetchpatch: [
  #   sha256 = "sha256-UWnfS+stVpUZ3Sfaym9XtVBlwvHWJVMaW7cYIcf3M5Q=";
  # })

-  # freshrss: patchShebangs instead of specifying interpreter in the service
-  (fetchpatch {
-    # url = "https://git.uninsane.org/colin/nixpkgs/commit/9443d83e6fee728c1926a783647b45011bd3b514.diff";
-    url = "https://github.com/NixOS/nixpkgs/pull/196140.diff";
-    sha256 = "sha256-Lngle5YTE7ymQyUarKbebMjiaTlY5cJBoaeZk7AgbXE=";
-  })
-
-  # nautilus: look for the gtk4 FileChooser settings instead of the gtk4 one
-  (fetchpatch {
-    # original version (include the patch in nixpkgs)
-    # url = "https://git.uninsane.org/colin/nixpkgs/commit/4636a04c1c4982a0e71ae77d3aa6f52d1a3170f1.diff";
-    # sha256 = "sha256-XKfXStdcveYuk58rlORVJOv0a9Q5aRj1bYT5k79rL0g=";
-
-    # v2 (fetchpatch from upstream PR)
-    # url = "https://git.uninsane.org/colin/nixpkgs/commit/730a802808c549220144e4e62aa419bb07c5ae29.diff";
-    url = "https://github.com/NixOS/nixpkgs/pull/195985.diff";
-    sha256 = "sha256-zd7WGOTm3ygh0Wk3uiA+1S+RqD9yWDSXvo7veHs0K00=";
-  })

  # Fix mk flutter app
  # closed (not merged). updates fluffychat 1.2.0 -> 1.6.1, but unstable hashing
@@ -47,6 +47,7 @@ fetchpatch: [
  ./02-rpi4-uboot.patch

  # TODO: upstream
+  # maybe convert this patch to add a `targetUrlExpr` instead of doing the `escapeShellArgs` hack
  ./07-duplicity-rich-url.patch

  # enable aarch64 support for flutter's dart package
--- a/pkgs/browserpass-extension/default.nix
+++ b/pkgs/browserpass-extension/default.nix
@@ -0,0 +1,57 @@
+{ stdenv
+, fetchFromGitHub
+, gnused
+, jq
+, mkYarnModules
+, zip
+}:
+
+let
+  pname = "browserpass-extension";
+  version = "3.7.2";
+  src = fetchFromGitHub {
+    owner = "browserpass";
+    repo = "browserpass-extension";
+    rev = version;
+    sha256 = "sha256-uDJ0ID8mD+5WLQK40+OfzRNIOOhZWsLYIi6QgcdIDvc=";
+  };
+  browserpass-extension-yarn-modules = mkYarnModules {
+    inherit pname version;
+    packageJSON = "${src}/src/package.json";
+    yarnLock = "${src}/src/yarn.lock";
+  };
+  extid = "browserpass@maximbaz.com";
+in stdenv.mkDerivation {
+  inherit pname version src;
+
+  patchPhase = ''
+    # dependencies are built separately: skip the yarn install
+    ${gnused}/bin/sed -i /yarn\ install/d src/Makefile
+  '';
+
+  preBuild = ''
+    ln -s ${browserpass-extension-yarn-modules}/node_modules src/node_modules
+  '';
+
+  installPhase = ''
+    BASE=$out/share/mozilla/extensions/\{ec8030f7-c20a-464f-9b0e-13a3a9e97384\}
+    mkdir -p $BASE
+
+    pushd firefox
+
+    # firefox requires addons to have an id field when sideloading:
+    # - <https://extensionworkshop.com/documentation/publish/distribute-sideloading/>
+    cat manifest.json \
+      | ${jq}/bin/jq '. + { applications: {gecko: {id: "${extid}" }}, browser_specific_settings: {gecko: {id: "${extid}"}} }' \
+      > manifest.patched.json
+    mv manifest{.patched,}.json
+
+    ${zip}/bin/zip -r $BASE/browserpass@maximbaz.com.xpi ./*
+
+    popd
+  '';
+
+  passthru = {
+    inherit extid;
+  };
+}
--- a/pkgs/browserpass/default.nix
+++ b/pkgs/browserpass/default.nix
@@ -0,0 +1,47 @@
+{ pkgs
+, bash
+, fetchFromGitea
+, gnused
+, lib
+, sane-scripts
+, sops
+, stdenv
+, substituteAll
+}:
+
+let
+  sane-browserpass-gpg = stdenv.mkDerivation {
+    pname = "sane-browserpass-gpg";
+    version = "0.1.0";
+    src = ./.;
+
+    inherit bash gnused sops;
+    sane_scripts = sane-scripts;
+    installPhase = ''
+      mkdir -p $out/bin
+      substituteAll ${./sops-gpg-adapter} $out/bin/gpg
+      chmod +x $out/bin/gpg
+      ln -s $out/bin/gpg $out/bin/gpg2
+    '';
+
+  };
+in
+(pkgs.browserpass.overrideAttrs (upstream: {
+  src = fetchFromGitea {
+    domain = "git.uninsane.org";
+    owner = "colin";
+    repo = "browserpass-native";
+    rev = "8de7959fa5772aca406bf29bb17707119c64b81e";
+    hash = "sha256-ewB1YdWqfZpt8d4p9LGisiGUsHzRW8RiSO/+NZRiQpk=";
+  };
+  installPhase = ''
+    make install
+
+    wrapProgram $out/bin/browserpass \
+      --prefix PATH : ${lib.makeBinPath [ sane-browserpass-gpg ]}
+
+    # This path is used by our firefox wrapper for finding native messaging hosts
+    mkdir -p $out/lib/mozilla/native-messaging-hosts
+    ln -s $out/lib/browserpass/hosts/firefox/*.json $out/lib/mozilla/native-messaging-hosts
+  '';
+}))
--- a/pkgs/browserpass/sops-gpg-adapter
+++ b/pkgs/browserpass/sops-gpg-adapter
@@ -0,0 +1,19 @@
+#! @bash@/bin/sh
+
+# browserpass "validates" the gpg binary by invoking it with --version
+if [ "$1" = "--version" ]
+then
+  echo "sane-browserpass-gpg @version@";
+  exit 0
+fi
+
+# ensure the secret store is unlocked
+@sane_scripts@/bin/sane-secrets-unlock
+
+# using exec here forwards our stdin
+# browserpass parses the response in
+# <browserpass-extension/src/background.js#parseFields>
+# it cares about `key:value`, and ignores whatever doesn't fit that (or has an unknown key)
+# browserpass understands the `totp` field to hold either secret tokens, or full URLs.
+# i use totp-b32 for the base-32-encoded secrets. renaming that field works OOTB.
+exec @sops@/bin/sops --input-type yaml -d --output-type yaml --config /dev/null /dev/stdin | @gnused@/bin/sed s/\^totp-b32:/totp:/
--- a/pkgs/gopass-native-messaging-host/com.justwatch.gopass.json
+++ b/pkgs/gopass-native-messaging-host/com.justwatch.gopass.json
@@ -0,0 +1,10 @@
+{
+    "name": "com.justwatch.gopass",
+    "description": "Gopass wrapper to search and return passwords",
+    "path": "@out@/bin/gopass-wrapper",
+    "type": "stdio",
+    "allowed_extensions": [
+        "{eec37db0-22ad-4bf1-9068-5ae08df8c7e9}"
+    ]
+}
+
--- a/pkgs/gopass-native-messaging-host/default.nix
+++ b/pkgs/gopass-native-messaging-host/default.nix
@@ -0,0 +1,22 @@
+{ stdenv
+, bash
+, gopass-jsonapi
+, substituteAll
+}:
+
+stdenv.mkDerivation {
+  pname = "gopass-native-messaging-host";
+  version = "1.0";
+  src = ./.;
+
+  inherit bash;
+  # substituteAll doesn't work with hyphenated vars ??
+  gopassJsonapi = gopass-jsonapi;
+
+  installPhase = ''
+    mkdir -p $out/bin $out/lib/mozilla/native-messaging-hosts
+    substituteAll ${./gopass-wrapper.sh} $out/bin/gopass-wrapper
+    chmod +x $out/bin/gopass-wrapper
+    substituteAll ${./com.justwatch.gopass.json} $out/lib/mozilla/native-messaging-hosts/com.justwatch.gopass.json
+  '';
+}
--- a/pkgs/gopass-native-messaging-host/gopass-wrapper.sh
+++ b/pkgs/gopass-native-messaging-host/gopass-wrapper.sh
@@ -0,0 +1,2 @@
+#! @bash@/bin/sh
+exec @gopassJsonapi@/bin/gopass-jsonapi listen
--- a/pkgs/lightdm-mobile-greeter/default.nix
+++ b/pkgs/lightdm-mobile-greeter/default.nix
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "lightdm-mobile-greeter";
-  version = "0.1.2";
+  version = "2022-10-30";

  src = fetchFromGitea {
-    domain = "git.uninsane.org";
-    owner = "colin";
+    domain = "git.raatty.club";
+    owner = "raatty";
    repo = "lightdm-mobile-greeter";
-    rev = "v${version}";
-    hash = "sha256-x7tpaHYDg6BPIc3k3zzPvZma0RYuGAMQ/z6vAP0wbWs=";
+    rev = "8c8d6dfce62799307320c8c5a1f0dd5c8c18e4d3";
+    hash = "sha256-SrAR2+An3BN/doFl/s8PcYZMUHLfVPXKZOo6ndO60nY=";
  };
-  cargoHash = "sha256-5WJGnLdZd4acKPEkkTS71n4gfxhlujHWnwiMsomTYck=";
+  cargoHash = "sha256-NZ0jOkEBNa5oOydfyKm0XQB/vkAvBv9wHBbnM9egQFQ=";

  buildInputs = [
    gtk3
@@ -45,7 +45,7 @@ rustPlatform.buildRustPackage rec {

  meta = with lib; {
    description = "A simple log in screen for use on touch screens.";
-    homepage = "https://git.uninsane.org/colin/lightdm-mobile-greeter";
+    homepage = "https://git.raatty.club/raatty/lightdm-mobile-greeter";
    maintainers = with maintainers; [ colinsane ];
    platforms = platforms.linux;
    license = licenses.mit;
--- a/pkgs/linux-megous/default.nix
+++ b/pkgs/linux-megous/default.nix
@@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "6.0.0";
+  version = "6.0.2";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -15,7 +15,7 @@ buildLinux (args // rec {
    owner = "megous";
    repo = "linux";
    # branch: orange-pi-6.0
-    rev = "b16232c6156de17e1dfdb63fdaea8e317baa07a7";
-    sha256 = "sha256-Tb05IQKFdX/T7elGNnXTLVmgGLvXoeBFBq/8Q7jQhX0=";
+    rev = "2683672a2052ffda995bb987fa62a1abe8424ef4";
+    hash = "sha256-hL/SbLgaTk/CqFLFrAK/OV9/OS20O42zJvSScsvWBQk=";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/overlay.nix
+++ b/pkgs/overlay.nix
@@ -37,9 +37,13 @@

  gocryptfs = prev.callPackage ./gocryptfs { pkgs = prev; };

+  browserpass = prev.callPackage ./browserpass { pkgs = prev; inherit sane-scripts; };
+
  #### TEMPORARY: PACKAGES WAITING TO BE UPSTREAMED
  kaiteki = prev.callPackage ./kaiteki { };
-  lightdm-mobile-greeter = prev.callPackage ./lightdm-mobile-greeter { pkgs = next; };
+  # lightdm-mobile-greeter = prev.callPackage ./lightdm-mobile-greeter { pkgs = next; };
+  browserpass-extension = prev.callPackage ./browserpass-extension { };
+  gopass-native-messaging-host = prev.callPackage ./gopass-native-messaging-host { };
  # kaiteki = prev.kaiteki;
  # TODO: upstream, or delete nabla
  nabla = prev.callPackage ./nabla { };
--- a/pkgs/pleroma/default.nix
+++ b/pkgs/pleroma/default.nix
@@ -1,6 +1,7 @@
 { lib, beamPackages
 , fetchFromGitHub, fetchFromGitLab
 , file, cmake, bash
+, libxcrypt
 , nixosTests, writeText
 , cookieFile ? "/var/lib/pleroma/.cookie"
 , ...
@@ -14,11 +15,10 @@ beamPackages.mixRelease rec {
    domain = "git.pleroma.social";
    owner = "pleroma";
    repo = "pleroma";
-    rev = "4605efe272016a5ba8ba6e96a9bec9a6e40c1591";
+    rev = "7a519b6a6607bc1dd22e6a3450aebf0f1ff11fb8";
    # to update: uncomment the null hash, run nixos-rebuild and
    # compute the new hash with `nix to-sri sha256:<output from failed nix build>`
-    # sha256 = "sha256-0000000000000000000000000000000000000000000=";
-    sha256 = "sha256-Dp1kTUDfNC7EDoK9WToXkUvsj7v66eKuD15le5IZgiY=";
+    sha256 = "sha256-6NglBcEGEvRlYMnVNB8kr4i/fccrzO6mnyp3X+O0m74=";
  };

  preFixup = if (cookieFile != null) then ''
@@ -72,29 +72,49 @@ beamPackages.mixRelease rec {
        name = "crypt";
        version = "0.4.3";

-        src = fetchFromGitHub {
-          owner = "msantos";
+        # src = fetchFromGitHub {
+        #   owner = "msantos";
+        #   repo = "crypt";
+        #   rev = "f75cd55325e33cbea198fb41fe41871392f8fb76";
+        #   sha256 = "sha256-ZYhZTe7cTITkl8DZ4z2IOlxTX5gnbJImu/lVJ2ZjR1o=";
+        # };
+
+        # this is the old crypt, from before 2021/09/21.
+        # nixpkgs still uses this as of 2022-10-24 and it works.
+        src = fetchFromGitLab {
+          domain = "git.pleroma.social";
+          group = "pleroma";
+          owner = "elixir-libraries";
          repo = "crypt";
-          rev = "f75cd55325e33cbea198fb41fe41871392f8fb76";
-          sha256 = "sha256-ZYhZTe7cTITkl8DZ4z2IOlxTX5gnbJImu/lVJ2ZjR1o=";
+          rev = "cf2aa3f11632e8b0634810a15b3e612c7526f6a3";
+          sha256 = "sha256-48QIsgyEaDzvnihdsFy7pYURLFcb9G8DXIrf5Luk3zo=";
        };

        postInstall = "mv $out/lib/erlang/lib/crypt-${version}/priv/{source,crypt}.so";

        beamDeps = with final; [ elixir_make ];
+        buildInputs = [ libxcrypt ];
      };
      prometheus_ex = beamPackages.buildMix rec {
        name = "prometheus_ex";
        version = "3.0.5";

-        src = fetchFromGitLab {
-          domain = "git.pleroma.social";
-          group = "pleroma";
-          owner = "elixir-libraries";
+        src = fetchFromGitHub {
+          owner = "lanodan";
          repo = "prometheus.ex";
-          rev = "a4e9beb3c1c479d14b352fd9d6dd7b1f6d7deee5";
-          sha256 = "1v0q4bi7sb253i8q016l7gwlv5562wk5zy3l2sa446csvsacnpjk";
+          # branch = "fix/elixir-1.14";
+          rev = "31f7fbe4b71b79ba27efc2a5085746c4011ceb8f";
+          sha256 = "sha256-2PZP+YnwnHt69HtIAQvjMBqBbfdbkRSoMzb1AL2Zsyc=";
        };
+
+        # src = fetchFromGitLab {
+        #   domain = "git.pleroma.social";
+        #   group = "pleroma";
+        #   owner = "elixir-libraries";
+        #   repo = "prometheus.ex";
+        #   rev = "a4e9beb3c1c479d14b352fd9d6dd7b1f6d7deee5";
+        #   sha256 = "1v0q4bi7sb253i8q016l7gwlv5562wk5zy3l2sa446csvsacnpjk";
+        # };
        beamDeps = with final; [ prometheus ];
      };
      prometheus_phx = beamPackages.buildMix rec {
@@ -109,8 +129,8 @@ beamPackages.mixRelease rec {
          group = "pleroma";
          owner = "elixir-libraries";
          repo = "prometheus-phx";
-          rev = "9cd8f248c9381ffedc799905050abce194a97514";
-          sha256 = "0211z4bxb0bc0zcrhnph9kbbvvi1f2v95madpr96pqzr60y21cam";
+          rev = "0c950ac2d145b1ee3fc8ee5c3290ccb9ef2331e9";
+          sha256 = "sha256-HjN0ku1q5aNtrhHopch0wpp4Z+dMCGj5GxHroiz5u/w=";
        };
        beamDeps = with final; [ prometheus_ex ];
      };
--- a/pkgs/pleroma/mix.nix
+++ b/pkgs/pleroma/mix.nix
@@ -34,7 +34,6 @@ let
      beamDeps = [ custom_base ];
    };

-    # base64url = buildMix rec {
    base64url = buildRebar3 rec {
      name = "base64url";
      version = "0.0.1";
@@ -362,12 +361,12 @@ let

    eblurhash = buildRebar3 rec {
      name = "eblurhash";
-      version = "1.1.0";
+      version = "1.2.2";

      src = fetchHex {
        pkg = "${name}";
        version = "${version}";
-        sha256 = "07dmkbyafpxffh8ar6af4riqfxiqc547rias7i73gpgx16fqhsrf";
+        sha256 = "0k040pj8hlm8mwy0ra459hk35v9gfsvvgp596nl27q2dj00cl84c";
      };

      beamDeps = [];
@@ -1646,5 +1645,19 @@ let

      beamDeps = [ httpoison jose ];
    };
+
+    websockex = buildMix rec {
+      name = "websockex";
+      version = "0.4.3";
+
+      src = fetchHex {
+        pkg = "${name}";
+        version = "${version}";
+        sha256 = "1r2kmi2pcmdzvgbd08ci9avy0g5p2lhx80jn736a98w55c3ygwlm";
+      };
+
+      beamDeps = [];
+    };
  };
 in self
+
--- a/pkgs/pleroma/updating.txt
+++ b/pkgs/pleroma/updating.txt
@@ -1,10 +1,16 @@
+in pleroma checkout:
+- grab version: `rg 'version: ' mix.exs`
+
 in default.nix:
-  update `rev` and recompute sha256.
-    use nix to-sri sha256:<expected>
+- update `rev` and recompute sha256.

-run mix2nix inside the pleroma git root and pipe the output into mix.nix
-  inside default.nix, update all git mix deps
-  inside mix.nix, change base64url to use buildRebar3 instead of buildMix
+in pleroma checkout:
+- `mix2nix > mix.nix`

-move majic from mix.nix -> default.nix and add:
-  buildInputs = [ file ];
+in nix repo:
+- cp the new mix.nix here.
+- move majic from mix.nix -> default.nix and add:
+        - buildInputs = [ file ];
+- update `mixNixDeps` in default.nix:
+        - grab the version from pleroma/mix.exs or mix.lock
+- redundant?: inside mix.nix, change base64url to use buildRebar3 instead of buildMix
--- a/pkgs/sane-scripts/default.nix
+++ b/pkgs/sane-scripts/default.nix
@@ -49,8 +49,9 @@ resholve.mkDerivation {
          "umount"
          "sudo"

-          # this is actually internal; probably a better fix
+          # these are used internally; probably a better fix
          "sane-mount-servo"
+          "sane-private-unlock"
        ];
      };

--- a/pkgs/sane-scripts/src/sane-private-change-passwd
+++ b/pkgs/sane-scripts/src/sane-private-change-passwd
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+set -ex
+
+new_plain=/home/colin/private-new
+new_cipher="/nix/persist${new_plain}"
+dest_plain=/home/colin/private
+dest_cipher="/nix/persist${dest_plain}"
+
+# initialize the new store
+sudo mkdir -p "${new_cipher}" && sudo chown colin:users "${new_cipher}"
+mkdir -p "${new_plain}"
+gocryptfs -init "${new_cipher}"
+
+# mount the new and old store
+gocryptfs "${new_cipher}" "${new_plain}"
+sane-private-unlock
+
+# transfer to the new store
+rsync -arv /home/colin/private/ "${new_plain}"/
+
+# unmount both stores
+sudo umount "${new_plain}"
+sudo umount /home/colin/private
+
+# swap the stores
+sudo mv "${dest_cipher}" "${dest_cipher}-old"
+sudo mv "${new_cipher}" "${dest_cipher}"
+
+sane-private-unlock
+
+echo "if things look well, rm ${dest_cipher}-old"
--- a/pkgs/sane-scripts/src/sane-private-lock
+++ b/pkgs/sane-scripts/src/sane-private-lock
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+sudo umount /home/colin/private
--- a/pkgs/sane-scripts/src/sane-private-unlock
+++ b/pkgs/sane-scripts/src/sane-private-unlock
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+set -ex
+
+# configure persistent, encrypted storage that is auto-mounted on login.
+# this is a one-time setup and user should log out/back in after running it.
+
+mount=/home/colin/private
+cipher="/nix/persist$mount"
+mkdir -p "$mount"
+if [ ! -f "$mount/init" ]
+then
+  gocryptfs "$cipher" "$mount"
+fi
--- a/pkgs/sane-scripts/src/sane-rcp
+++ b/pkgs/sane-scripts/src/sane-rcp
@@ -0,0 +1,3 @@
+#!/usr/bin/env sh
+# copy some remote file(s) to the working directory, with sane defaults
+rsync -arv --progress "$@" .
--- a/pkgs/sane-scripts/src/sane-sudo-redirect
+++ b/pkgs/sane-scripts/src/sane-sudo-redirect
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+# redirects to $1, when writing to $1 requires sudo permissions.
+# i.e. convert a failing command:
+#
+# ```
+# $ sudo do_thing > /into/file
+# ```
+#
+# to
+#
+# ```
+# $ sudo do_thing | sane-sudo-redirect /into/file
+# ```
+
+exec sudo tee $@ > /dev/null
--- a/pkgs/sane-scripts/src/sane-sync-from-iphone
+++ b/pkgs/sane-scripts/src/sane-sync-from-iphone
@@ -5,8 +5,13 @@ set -ex
 # make sure the mountpoint exists
 if ! (test -e /mnt/iphone)
 then
-  sudo mkdir /mnt/iphone
-  sudo chown colin:users /mnt/iphone
+  sudo umount /mnt/iphone || true  # maybe the mount hung
+
+  if ! (test -e /mnt/iphone)
+  then
+    sudo mkdir /mnt/iphone
+    sudo chown colin:users /mnt/iphone
+  fi
 fi

 # make sure the device is mounted
--- a/scripts/ensure-perms
+++ b/scripts/ensure-perms
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+# ensures perms on a newly-built distribution are good.
+# usage: sudo ensure-perms /path/to/nix
+
+nix_path=$1
+chown root:root -R $nix_path
+chown root:nixbld $nix_path/store
--- a/secrets/desko.yaml
+++ b/secrets/desko.yaml
@@ -1,6 +1,7 @@
 duplicity_passphrase: ENC[AES256_GCM,data:rzUfcxe5YPloOrqgVwdCjsccexWc5RvmFf1i3Xs459iVTfWHlVJeT/IqReY6ZqdAkPJteTtrUZzak2GXyRUkE13+W0kE8isnDjPX/YDQwoK2sa+dwc4xGTekboc0gf6HH3vQpF1aiJDBfb3GtGyDVLH9MVIRPJGXSztZBduUDezA2wAx2wI=,iv:EHJg8kE/07v+ySSFDtW4FA4y1y/+fcGxfNCWoainwBI=,tag:S3ecM4DbDl8jqXLRKipZmQ==,type:str]
 #ENC[AES256_GCM,data:yU9cr6MXjS4m69BeIUjUw477wt4c1djYof3Qlfr4Dytv8hWqCuqThDwQTMY5jfHdv5ipS0aEjf7GWu2M2t9W88fYdxnTN2m8IfYZp76YcjxO4fup5BXiLGIjnm+qI0g=,iv:nPo8FyGiyLRQozE4kZ6Rei6CObvbVynOs3jdMvdkpZw=,tag:+4esxPiewSsjwao6ZhAMxA==,type:comment]
 nix_serve_privkey: ENC[AES256_GCM,data:/Ph9J00cV7PcfpJw/NWcBpkQR+a0SQyHv1jmF4CkH+Uj8l+cRcXWynAc2APenMSfHdighXMqjsXuwRbGo0S57YuMXQjFbI8jhbXEhhAWlmET1q7uRaaZRSgq34qABw==,iv:LLYgLauPsD+3mx1GTjEUkiXgdWsnqixCJl4UfSdS5Ac=,tag:S7V6GKezS/JsbZVfq9DjjA==,type:str]
+colin-passwd: ENC[AES256_GCM,data:/b+l5zTlOhdoiFaMVG5HB98AOGfGZtwkH+IS/mhDgHNZ4J+t3OiEBAFPl/KPctg6ZM55QiAjNnnJ8zAsKL85om6amvrWF/Qz17qC9+pZF+6Ef8xvTQr3VPlFEYq4rGb74jQ7uyvtCjn0Ow==,iv:Z0qUimlPQMu6rsjn5b/Xfw99NzbXGS8B/hNWE+f+GoM=,tag:uGB1DZzHiLCkOtlAA58mmg==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -34,8 +35,8 @@ sops:
            Si9kT0ZMUnJJWlhUZ3FFakZFaDlPdEEKXtWfh6wdGPin1h/UUs21cdspddpW1YDq
            rCKS2DI2KWdgciih9FnmWGAwGUhB3uhimUr6hgho4z+dZfLrpoP1PA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2022-09-14T21:34:55Z"
-    mac: ENC[AES256_GCM,data:Zex69KG2a2Rxyodyci40azr9qGbA5XwH4Qhip0BDbrJymHjZzqCeRDKjdHjAWXPdPyglvUY0kADfm7xxlE1zU84oOahI9FldADtQrGUWS0elU+a3F93LVNGlhlKc+g8JGzUyBvPr6Toi52L2hI18K5bmWFPesczWedL07r85s9M=,iv:W+SMAX0HY5GbAqqgXWbSxm4wbzXZt5PEsLhwWcxkRWY=,tag:VPnw2X+6i0EyiFB3rkon8Q==,type:str]
+    lastmodified: "2022-10-24T08:49:49Z"
+    mac: ENC[AES256_GCM,data:dvxYlU/btzzH9Qor8z02kdv3S4gFUGHnEjV/XBM99+IFuAD6vuE8zFL4peGW1GiXqM2QQY0Qc9wZ+nC5/ak9ROMC8uZPXF417gs6U9yyT92FRlMSdC0AMsUhNGWjJlM733hI4YATnR+1XuwHewzzW1R3TvrouBZqSv+2rBsiZCw=,iv:A+D7IG4U+EQ6nP4xKOK1ExeZLeERpiSPzj/g87R1SdM=,tag:jSVGDO9kNxXdDSSixDrkDQ==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.7.3
--- a/secrets/lappy.yaml
+++ b/secrets/lappy.yaml
@@ -0,0 +1,42 @@
+#ENC[AES256_GCM,data:s512crIo2ylwy1pWPDs6324+NpP3dHvW0QmuZzvOOyrepTQvmB4NW07NFXYzY/UUPn7E4HrB7mzhvQYxVYDBlZKAMr9llT80Nnpt0AqrxnLiqnnY79EvP+aXvNmi0yWsTGqh6k36BWNTUyPSzgjGtvjQgTLSvr9uRzfy9e4C6NVWBm5sTEbYg9y3ZslToVSsEyGHYMVT6fSKM7ewH8wV,iv:sbBWcHYP5Ak4h7gWbdu8JyL2SEeUgrvkjji11Sp2GoA=,tag:yQTWlrrcBxotdKBbB54x5g==,type:comment]
+#ENC[AES256_GCM,data:XcQaEDhsAG2kY0Rdw2AKOwaHQIm3/zrWMjpQlU8pWlifNY9eoPqndzIbCNDKhbEJqrzeAuxGYFRBgohRcHQz2O/cbgr8GwTZ3Uo+NHsX6qcoUhzUKd1xlUnIKLjNcV7vlxofrmXikQ==,iv:OKSw1bw2TiPweUJeqCqwr8V+A+ovIT+meygH9l9m4cI=,tag:aTROLuGpTgoxF1JV/w2Cpw==,type:comment]
+#ENC[AES256_GCM,data:GFdHTjsr2DJtg/BIyOSeM6EQw92Q/8JFdqXLwpg/FWn9olTws2KDchSWRDlkrEbgoXSMP3Atd33YgckUebDYMIK8ctJai2SUxLJK5fW8LX1JbKUAC5PHUygAIkWYsHlNse7Qbgrw1rtBuR43L6NbMw==,iv:5beGhtM2wja2GgrLCzizsqamfakDIBlZ74ZJhNr33lg=,tag:Ej1za572vRpPcvcHXliQDA==,type:comment]
+colin-passwd: ENC[AES256_GCM,data:+vPsqF9XiY9USDQuTt6n7K9f4/+/Sdgp6J8LnWvhYdlTTltz8a4/RYdg0JHC4o/pNae3k7KwYGMJI+vY25mgvLGj+kL23Fc9j1EYJgJk5uTz8MlmKOlKxKcSfmI3v+zOUOlQm/warktksQ==,iv:cZEFjTvHCXogXEh+xQG++aJCUFp/NtT6t7qjPIjUtAU=,tag:fnzz6uYwU9j4RZXj9MV6jg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4bzFLUFloMU1uUWRmdkZu
+            TllhSGxvNzBJQTZRaE9EbTA3R3JLNGpVT25nCmd0SG1BWEJWL1JlKzhmSFdFS3Fk
+            SnRGbUFqdzVFTy95eVhiZGN6a3VMOGcKLS0tIHFJQUtEYVhGWWlTRlQrbEpoQ2h1
+            VXJ5SXNlS1ZNNjhuVDFrMnlrVHp2NlUKwD3ZznQVcz1ZLb/weULpXET9uZb4aj/U
+            FnY9ktEEtKeSl10jzU3/sUla6Ap6K6b9KLmmqd5Rnp0ZhbxVOR8rkg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOa1dpZHVoY2tTWVJ2bG1J
+            Z0xjVGplMGZqajFlcWtPL0YwUXcxWThNOWcwCmQvZllaZ1JSK3N1WmIvV2F6YjZv
+            U1ZtMVVSSU1LZ3M4SWExSm9yRzRTR3MKLS0tIFU1dERKdko1SVZLcmVXQXMydExm
+            OWVEdDJsbENOYkJNSzc5MzlEanVSL0EKbKVgN0/LUiC92N9/MvoXJouiIRHE5aWO
+            R7xPtxYG91vC+HVj8ThHbu0fcUIqD7LTX82XCrWoYMwkplbTC/F2cw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3SGk4YzhEaldpcTBRSG1T
+            Nkpla0s3d2ZRU2RsK2ZDRlhEdVY0NkRYUVU0CjYrTjhxZDVyYUlmbnRQQXBQZVhD
+            OTcrbmV0YjdyeEhEaHVRUm03Z2hTNTQKLS0tIGVrTjhCL3RlZ2dIOFduVVdSbnJ3
+            L2JhVWhmQk9qZzdnYkYrQTBCZnI3eE0KHju7x28mP5jLt4u6T6CnQ3ThiEYFhG5P
+            D7c0h2YhqeqdewuwQWjqJMbUc308N5f0Hz/BsUgYZNanl9qqQRXkrA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-10-24T07:43:11Z"
+    mac: ENC[AES256_GCM,data:1n1iOEJPnVbvvlVp9Cw9wY+HB6KYLwZDcr5UkbXbQUZMm+LQS8Pib/0R8AeQLnNrfyJMnsvoNpmYWLQ6i4BZFJp4rsdjpHb4/FqIAEOwTb5SP5FC8rFpn9UeduUs9tq+fyvezywqaoLPBsXXqb092XZvHv6w1osgyfbLepiyJ2s=,iv:qM2d9smvsRwhuJ/MyD8bqVfD4IJM7T6Hu4wy/2/COiM=,tag:TlcJX1USn3TgPSMWy5hZPg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
--- a/secrets/moby.yaml
+++ b/secrets/moby.yaml
@@ -0,0 +1,51 @@
+#ENC[AES256_GCM,data:akcgE1j3wiKoyB9Uara51P/DPVcKyzt5lZ0kTuxqotjBvVtsGdPVHaeMPMi5blNyPIuiWxo9Jn0MJGyknCs9AL+g96G/yDvvD7or44sK1v8ED+2glfdMi0cjDm80anh7SMchyA6tmtgJhMW1EtkhZ/b/xpysNBzsn5e+zb9jXS4a7LF23jJr7d6tbJo9jks7vVJ7/p33cONglhO573TD,iv:M+S7WCO3V6pQg0UuzWF2y9IgH7p/P4at+qm2Y38To1o=,tag:DPlXsDSYySaHNgSzywiJRQ==,type:comment]
+#ENC[AES256_GCM,data:De/BSe24Uf4Ch+JBzJMOEc7W+E72vYrqQWG4LeEk8vVHa/3eGHyKylHIgkMTr5CvwhX7/uCkjm8fgz1QHuRb8jLru8n2u/AxoY9kLUTZ/7VyYes3t9tawZ7tTFzbcqMxjV0Xy5eTzw==,iv:q3bDj1iYv3JBPzSoRU2ANCpfwWtLyCzyn81r5kl2tcw=,tag:f+d6+cWQEb83qK8I/oOCkw==,type:comment]
+#ENC[AES256_GCM,data:tYLNlC3Ov2RRnaEH0QAALmMYRc4fyDDM5A7J2sfJbMvoDmkgKoP0HYWy3diJMEcLsw3ZoDGibcU03QduisxjP0eWfEHkzE4R2+tWY+yWYy7TFx7Qg3BfSTtnMt5V9vSWcVLMAgoYaRUMqykIRMRaCQ==,iv:81HzxZyAJvXa5fQDOIIqRTL3dhKA4S2TftE3yfw6VIk=,tag:9+3stfyHrrmkfZpLGpmMOA==,type:comment]
+colin-passwd: ENC[AES256_GCM,data:+2uEyJX6FUbOSoJpJpjF+TmwWu3eJlrN5S9J1kRtTbS84c23E4AKTHojk5zEcPZZ9RG3vYjH6C37dRj4/SK/Z1/G31B31RgzwkLnmf11JXK+HSQZHZATgSvH07ANEYIg5VR78IQUz6qbGg==,iv:jyF/QzLyrQU+ebRfBrWRcu5/dmwY9LB4D1FxHVo8+TQ=,tag:3u7HO1VYzenIqvq0iZwuRw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpck5EWDVkWjdIU2YzQ2Mx
+            VUpJbW96dXIvM0pPK2Vnd3ZZU3lmSlVheEdRCmVXNFZWV0FjT2p6b3FZOW1vaFNO
+            MCtubi9QL1Jtd2FQL05vZmd5SjQxelEKLS0tICtaa3VRQ2JJZXpnd3pRd1lndUQ3
+            d1JCZ3JtZENsSGR4SkVrNHIvTEhndTQK6pQqmcq7xmhZ9E099rBy9MtCdZghBTmU
+            UCVWxq8zWanK11GLyh6cvs8hHSLIyvpbODnBYA1WM0AeIJoxtRRWEw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0OWl2dlcyU0VoRW90Q3ZR
+            eURXS1hPSG0reFFhUmxyTGRFNVdIZVJHYVJ3Cm0rcFpjQjQzVGVEcjhNR2RldkVL
+            WnA4U3N1ZUFUTTBkSEdCbHZCeGxNNFkKLS0tIHY3RFdxUC9SaFhVTFBLemVEQytZ
+            R01wWFBYR1dYNWlNUkw5M2VNK04yWE0KBPcJduySzwhAnx4BshPX/7QVdeN+L3fH
+            4sZqC4gYFj3KXZhIOkUcCtwS/dObBoy02EhPsUtSKRheacFVs46w8A==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZVBzNG5pOGlXZzI0c3J4
+            YnFsTDdsQjFwZ3czenlUVkJYcWxJbDAxNkFjCjYyK3VDOS8xRkhBSVRFYTRFSTZ5
+            Y0htSE13Q1NFNDg3czVuZ3dPOUFlekUKLS0tIDJpRHBWdU9hMnpUSWV0cSsvNjF5
+            cHVGRXdla0NGZ2lOMVQ3Ym43dDMvaVUKmx7p/TMj5uu/RJjRe4yCKt87brs7E7s0
+            F88swQCwY41lCdFwISM0jRbY/MymTtbtP+2gcSYlq/S619ytQqf7SQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmbWlCZW1VR2FXNHZ3VjZP
+            R3UrbGgvZEdYdWhBcFJnV0FZZkJWZ3pxcVJNCjR5bzE3M3dHQWZSbWhqS0MrTURp
+            NnBPQS9xeE1nZFV1VFd5MW9NaFFlM1kKLS0tICsrUkpOaEFFMVExUHhJNSs4eHdB
+            SlMyTGQ5SWVCU3NLeVcvWmhUc3VSVGsKHJSSl1QFrHq6iefNEL7kpM+XYQ5abz8H
+            aL6KiK6wvPOWB2RAT5DDicPYSEPXWGpHYTzNT+/hVFk5fXk/zqzOhQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-10-24T15:24:12Z"
+    mac: ENC[AES256_GCM,data:cYWayG+pAQv1wTsx4ozbx33cl5QwuR+a480zQVl2RVJF028NlVR3yuYdndvwIT9QY79UVcix0pYtK3pm/zTpPLMz59oLIv1TNUdE4/10o3RGw+6fllKdxNftNBcos/1n6ENZRw6K7lviuG4ZKEZMDO3tvPC+XPoPofROyu9WMQE=,iv:Kddn/71vylvLkK7gT4p5juW2nI/qWB3Q+oCQ5hN4Zqk=,tag:AOrjSII1zWXPB0VPpol6Zw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
--- a/secrets/servo.yaml
+++ b/secrets/servo.yaml
@@ -23,29 +23,38 @@ sops:
        - recipient: age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyTWJwNXplSnJQTzUxVjBt
-            TzZ2aUZ4RUkyejVUQnpOdnpKajcxa0l3WWlrCmkwZVJuenhpN0R2OUxFV1pXUkVa
-            dk8ydnlnU1JvOElvNVovVlBjKzZVYlkKLS0tIHlVbkRRYllJR2J5UWhKeGg5SWJj
-            VExDaHc3amdTcWdUU3ZRUDNGREtxelEKXHuDfNM3uc3UBiPCAveG/u5b7C8zPzTi
-            GGCx0R+6swS9yVSAJ//nUvu1zFuFfGgm3mKaSqfqWKfDSMFvAp0Pyg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1TUlOMTlaemdpa2RxWDVL
+            MFVPM254czF1VWh2MTljZTcwekpiVzZCTlNFCkJGeTVCRE1zMERJclRwU3JzbW5m
+            WEdOSGxtUzJSS3JhS3NPK2Q4MXc3bG8KLS0tIGdBWEdYVXJNYitzTFVlUzkzekpJ
+            enFjWnhIVGR3WWVMMFRGSldhRWZPKzgKHp6QWSNQBy8a6odEiELsr+FV05kGiby7
+            4Wc+AyGTvuvIpoN4SQlYlUslHCHGd+Yk0hVutNVozLCY1//IpH8Dmw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHZmU5OUVQNkRSL0ZRKzNU
+            R3RIMERDV1NRdi81TkV0OVdGQlFIRG0vekFvCjg3dHI3WWJic3h5cTQrdjFINDdr
+            bndHSEc4dWk5WGM4K29FRXh2WCs5ZDgKLS0tIFY5UlNrQ0dtNW5IYXlUNnltelJX
+            Y0xFNFFtek5hZFZMWXhWQy9GWlBneEEKZqsFgGGCIMH58kaZJoO8yn8KlrJooDvp
+            iGO4qMjjgM5WvJjZbfk7trO1dNAhpKzjiJyirw9+lToqWPNnRw2Zwg==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDY3NCbCtjY2ZHNkE2dWxN
-            Vk5nQ0Z2M1pQOXUzMVYyS3MxT252T1lhKzFJCm5NZ25DSlpZbnhTV0JMbVBvbm9j
-            SEtzdDJWS3gxby8rVlpzZ20yY3hRK2MKLS0tIGVqNUFZeGYxRnVSd3E1eitNUGFW
-            dEszSTFicTZRUzZxbFF5YWF1RmtwSkkKPle5Xw5gyd5YCPIAABaABNdgbpialJTV
-            hUOVdYCsmqd+spCA0Q9f0D3S5ud59iFq8moBh97BZQuLcc2qUeyJ2g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCNEl5K3dGQWVFRFI4SVlt
+            NFpvSFZaMGs0ZzYrWW4vbldaOWVpa3ZWV0c0CmxqOFR3RkdKNWUvQWtnSWZSUVlL
+            SUlHbWIvWGpsN1Vsclk4VWo1dUR2OGsKLS0tIFhRVU9NUzlnQkhDelEzalVFOHFM
+            UW9YZG9DUSt2OU03Sll5d1RZYlcySzAK9LneAD2s+me3ZkRGC098nhUlcVgRwMt9
+            yVgTCleC9groGaUq0J4rwhVQ4CuUHV2GL188QtmqVTBGLEftfHIDmQ==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4UGdCMjRpRUFMdXJRQVgx
-            aklIY1dkOXRXNmliVjIyNHlUN1B1ZmZZbTB3CnFxQjZLbWkwWHRTN2lycEx4K3RL
-            UGdFVktETXJCSXhKSWFsbnNyU25tRzgKLS0tIDVsdmdxRDFnQU9XeHpibm00bm1C
-            U0ZlOUljcE9BL1lhcmIrVVl6eFdTUmMKBHmv96FmkL/oQw9//ATfem6HtORRjcce
-            xJNwnsdrEqrBS3sG6xDkmJYOjaFrg1pwxYZRG87zeLShgkXkMNvz2A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpMlNZZGpVU1h3NkUyNkND
+            RnVpSWxrRmNxMjJ6dUJ5RkdaTWx0SHZMQlRNCjQzUFI5ejhuZ0RDcHNYQnZ5eFN4
+            Z3djZ2g3ajRxQXNEcUMzQWl0QzYyV0UKLS0tIFlDYXlhNFB5ekVKblJudmM3TEU0
+            cWplOHBNWjlJdGI3ZWtJc0t4Mk9URG8KE+9IPGYZsIs2PaDJ2AUE4gB4QEj5zo6P
+            aZVbubu6Tbg+tD/98RkfWAkNvoVeDYuLNPDNgqOL0UgCQiTrPPaTjw==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2022-10-14T00:37:52Z"
    mac: ENC[AES256_GCM,data:qKr1aKWxuJWwjUYX+JWAdwHFAwApHm9hOYBgZxAIXbXHhOo04K1MFBDTsAvtvN1a11QtCJYDNuVNpuRu3bf/5Ji5ROTaKfQCgPk+ZScJuWpLsxchYV+TnlREwQI+qgvogyMKMlPInozgd7RNnsePdg7DtYFfGMAvUtX9OidxAXI=,iv:EAkNQkIqoXtRy+uSb7ccl9T5b6hiyRll/m76nhir9AI=,tag:kCDEBJDW34VgLQPd4V+uYA==,type:str]
Author	SHA1	Message	Date
colin	730fa8ba4b	moby: fix lightdm-mobile-greeter config to work again	2022-11-02 04:59:36 -07:00
colin	8817f661ac	browser: temporarily switch back to firefox recompiling librewolf is not practical -- until the addon signing is upstreamed	2022-11-02 04:21:55 -07:00
colin	3b0f505864	moby: move lightdm-mobile-greeter stuff into nixpkgs	2022-11-02 04:14:00 -07:00
colin	b559d334c3	librewolf: work toward upstreaming the MOZ_REQUIRE_SIGNING patch	2022-11-02 02:39:56 -07:00
colin	f6e4c0058c	add `mercurial` to dev packages	2022-11-01 22:20:05 -07:00
colin	775fc979fc	browser: fix `Extensions.Uninstall` + refactor nits	2022-11-01 19:29:33 -07:00
colin	ad6daa4e5b	librewolf: allow sideloading unsigned addons still defaulting to firefox, because this requires a recompilation of the browser -- particularly expensive for moby.	2022-11-01 19:17:49 -07:00
colin	3ecfea158a	browser: make more easily swappable between firefox and librewolf	2022-11-01 16:23:50 -07:00
colin	5ff47b3719	remove unused `rycee` flake input it was previously used for browser addons: i've since moved those in-house for technical reasons.	2022-11-01 16:07:57 -07:00
colin	03ea7e7fa5	flake update: `nixpkgs 2022-10-30 -> 2022-10-31` and stable home-manager ``` • Updated input 'home-manager': 'github:nix-community/home-manager/d8b233ad03dd3d82424561512b40971569b2e5d2' (2022-10-31) → 'github:nix-community/home-manager/f0ecd4b1db5e15103e955b18cb94bea4296e5c45' (2022-11-01) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/412b9917cea092f3d39f9cd5dead4effd5bc4053' (2022-10-30) → 'github:NixOS/nixpkgs/d40fea9aeb8840fea0d377baa4b38e39b9582458' (2022-10-31) • Updated input 'nixpkgs-stable': 'github:NixOS/nixpkgs/26eb67abc9a7370a51fcb86ece18eaf19ae9207f' (2022-10-30) → 'github:NixOS/nixpkgs/1b4722674c315de0e191d0d79790b4eac51570a1' (2022-10-31) ```	2022-11-01 05:09:04 -07:00
colin	ca93518dda	browser: switch from librewolf to firefox-esr librewolf doesn't allow unsigned addons. i believe this is a bug, as the nixpkg build file looks like it meant to allow addons (and maybe at some point did)	2022-11-01 04:58:45 -07:00
colin	7f7041351b	browserpass-extension: init at 3.7.2 bringing this in-tree instead of fetching it from the mozilla addons webpage because i plan to develop on it.	2022-11-01 04:57:34 -07:00
colin	1c62bcd50c	lightdm-mobile-greeter: update git rev & remove the Cargo.lock patch Raatty was kind enough to upstream the Cargo.lock fix.	2022-11-01 01:15:36 -07:00
colin	bad4fe0e76	browserpass: add support for totp, and auto-unlock the secrets store on first run note that one needs to manually enable the TOTP setting in the browserpass settings for this to work -- TOTP parsing is disabled by default	2022-10-31 23:57:47 -07:00
colin	8b473ff88f	neovim: fix python tree-sitter plugin which was otherwise yielding parsing errors.	2022-10-31 23:05:27 -07:00
colin	ad54b9c5fb	flake update: `rycee: 2022-10-29 -> 2022-11-01` ``` • Updated input 'rycee': 'gitlab:rycee/nur-expressions/5fb3c4733c00a7e7be69877d057f6760d85cecb8' (2022-10-29) → 'gitlab:rycee/nur-expressions/f4bf327807f86c85e85050101467835a65754b51' (2022-11-01) ```	2022-10-31 23:04:39 -07:00
colin	b805a101ba	flake update: nixpkgs 2022-10-29 -> 2022-10-30; home-manager wouldn't ordinarily update so regularly, but on the lookout for that openssl CVE... ``` • Updated input 'home-manager': 'github:nix-community/home-manager/b81e128fc053ab3159d7b464d9b7dedc9d6a6891' (2022-10-17) → 'github:nix-community/home-manager/d8b233ad03dd3d82424561512b40971569b2e5d2' (2022-10-31) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/fdebb81f45a1ba2c4afca5fd9f526e1653ad0949' (2022-10-29) → 'github:NixOS/nixpkgs/412b9917cea092f3d39f9cd5dead4effd5bc4053' (2022-10-30) ```	2022-10-31 20:54:11 -07:00
colin	69a3aaa086	new script: `sane-private-lock` this is handy esp for `servo`, where i don't want my keys to be accessible after i logout. longterm, i suppose i could run this automatically on session close (pam-umount or something i think exists for that?)	2022-10-31 04:21:25 -07:00
colin	9acf2dfde1	gocryptfs: cross-compile for aarch64	2022-10-31 03:05:24 -07:00
colin	4b5accac88	flake update: `nixpkgs: 2022-10-22 -> 2022-10-29` and others ``` • Updated input 'mobile-nixos': 'github:nixos/mobile-nixos/1351091d2537040454fa232d8b94e745ab0eb5a3' (2022-10-24) → 'github:nixos/mobile-nixos/da56c338a2b00c868697b75bdbd388f60d50c820' (2022-10-30) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/95aeaf83c247b8f5aa561684317ecd860476fcd6' (2022-10-22) → 'github:NixOS/nixpkgs/fdebb81f45a1ba2c4afca5fd9f526e1653ad0949' (2022-10-29) • Updated input 'nixpkgs-stable': 'github:NixOS/nixpkgs/3933d8bb9120573c0d8d49dc5e890cb211681490' (2022-10-22) → 'github:NixOS/nixpkgs/26eb67abc9a7370a51fcb86ece18eaf19ae9207f' (2022-10-30) • Updated input 'rycee': 'gitlab:rycee/nur-expressions/43d3a363c126968db46585b88b8eb97dd32634ad' (2022-10-27) → 'gitlab:rycee/nur-expressions/5fb3c4733c00a7e7be69877d057f6760d85cecb8' (2022-10-29) • Updated input 'sops-nix': 'github:Mic92/sops-nix/1b5f9512a265f0c9687dbff47893180f777f4809' (2022-10-23) → 'github:Mic92/sops-nix/448ec3e7eb7c7e4563cc2471db748a71baaf9698' (2022-10-30) • Updated input 'sops-nix/nixpkgs-22_05': 'github:NixOS/nixpkgs/f9115594149ebcb409a42e303bec4956814a8419' (2022-10-23) → 'github:NixOS/nixpkgs/6440d13df2327d2db13d3b17e419784020b71d22' (2022-10-30) • Updated input 'uninsane': 'git+https://git.uninsane.org/colin/uninsane?ref=refs%2fheads%2fmaster&rev=4ad1801f6cecd678bbeae5dfe5933448dd7b3360' (2022-10-14) → 'git+https://git.uninsane.org/colin/uninsane?ref=refs%2fheads%2fmaster&rev=80c6ec95bd430e29d231cf745f19279bb76fb382' (2022-10-27) ```	2022-10-30 23:47:29 -07:00
colin	cb00ae4f92	update nautilus gtk4 patch SHA it's been merged into nixpkgs; manual patch will likely go away after next nixpkgs update	2022-10-30 21:33:58 -07:00
colin	7c38c1dbe9	de-persist /etc/machine-id, and generate it from the ssh key instead note that /etc/machine-id now contains a different value than before, meaning `journalctl` will not show logs from before the time of this change.	2022-10-30 21:02:41 -07:00
colin	b3b45ec0f2	fix host ssh key persistence	2022-10-30 20:03:00 -07:00
colin	34d77542e7	impermanence: ensure /etc/ssh is populated before we decode machine secrets during activation the impermanence activation scripts don't appear to mount folders -- only files. rather, the impermanence module creates fstab entries for each bind mount folder, and something (systemd?) mounts these after /run/current-system/activate is run. therefore, if we want access to a bind-mounted directory during activateion, we have to manually mount it. i.e. `mount /etc/ssh/host_keys`.	2022-10-30 05:59:55 -07:00
colin	6236c14def	vendor librewolf addons instead of fetching them on first run this obviously speeds up startup, it's hopefully also less likely to break surprisingly, and i hope it's the path to me shipping forks of official extensions.	2022-10-27 03:20:29 -07:00
colin	0c0f8c44bd	Merge branch 'master' of git.uninsane.org:colin/nix-files	2022-10-26 07:18:41 -07:00
colin	7f97786a88	librewolf: use `browserpass` password store this is working -- forked to support sops as a backend -- without totp support yet. it's possible in theory: i might just need to write some adapter logic. upstream discussion about genericizing backend support: - <https://github.com/browserpass/browserpass-native/issues/127>	2022-10-26 07:13:55 -07:00
colin	db2e156f15	home: enable celluloid mpv frontend i want to test this on mobile	2022-10-26 05:31:11 -07:00
colin	43efec495e	librewolf: integrate with gopass it's able to list passwords, but not decrypt them: i think i can solve this on the store side?	2022-10-26 00:10:54 -07:00
colin	279f9ce614	lightdm-mobile-greeter: point directly to upstream, with a patch for their Cargo.lock	2022-10-25 22:05:49 -07:00
colin	7d02652e08	servo: freshrss: fix ExecStart path	2022-10-25 06:31:18 -07:00
colin	10e224be0d	ssh: set known hosts via `~/.ssh/config` this prevents the ssh agent from updating the known_hosts file and confusing home-manager.	2022-10-25 05:17:28 -07:00
colin	e25c92794f	refactor: split ssh settings out of home-manager/default.nix	2022-10-25 05:06:33 -07:00
colin	a8d2b7196d	statically populate ssh known_hosts	2022-10-25 05:01:32 -07:00
colin	a6cbecbc74	Merge branch 'staging/pleroma-update'	2022-10-25 04:18:25 -07:00
colin	518d2f60c0	pleroma: port ExifTool config the old path is deprecated, if my syslog is to be believed.	2022-10-25 04:11:47 -07:00
colin	70e5ccc968	upgrade pleroma, thereby fixing servo build	2022-10-25 03:44:45 -07:00
colin	c44cad9c16	fractal: persist data in ~/private	2022-10-25 02:12:55 -07:00
colin	e3bf585382	persist ssh host keys in a subdirectory	2022-10-25 02:09:27 -07:00
colin	1fea9618ba	zsh: remove rm and mv confirmations	2022-10-25 01:42:46 -07:00
colin	8d89f828b6	new sane script: `sane-rcp` i guess this could just be an alias? 🤷	2022-10-25 01:19:05 -07:00
colin	e2985ef018	sane-scripts: new helper to redirect stdout to some permissioned file	2022-10-24 23:43:32 -07:00
colin	d54b595e45	RSS: subscribe to Edward Snowden	2022-10-24 20:23:14 -07:00
colin	ad75ed352c	RSS: clean up the substack subs	2022-10-24 20:14:36 -07:00
colin	306836042c	RSS: add my own feed :-)	2022-10-24 19:52:39 -07:00
colin	965181c8b0	moby: change password	2022-10-24 08:33:51 -07:00
colin	b344c38bfb	provide a script for changing the ~/private dir secrets gocryptfs doesn't (i think?) ship a tool for changing the password: you just create a new fs and rsync/mv the data	2022-10-24 08:21:53 -07:00
colin	174bc539bc	moby: enable a statically-assigned but encrypted password	2022-10-24 07:39:50 -07:00
colin	9ef457c0dd	secrets/servo: grant access to lappy	2022-10-24 06:56:16 -07:00
colin	939278b970	home: migrate Element directory to private storage	2022-10-24 06:42:51 -07:00
colin	3d0bd0fbf4	remove `TODO` file some of these had been done. the ones not done are documented elsewhere (either in this repo or in my own PKM).	2022-10-24 06:20:22 -07:00
colin	36d8a711ac	modules/services: abstract behind `default.nix`	2022-10-24 06:13:04 -07:00
colin	4c4b73f693	refactor: `helpers/set-hostname.nix` becomes `machines/instantiate.nix`	2022-10-24 06:06:11 -07:00
colin	9151f58b37	desko: set a password	2022-10-24 01:59:36 -07:00
colin	b2c55ed98a	sane-private-unlock: make ~/private if it doesn't exist	2022-10-24 01:53:41 -07:00
colin	1721546410	store ssh keys in ~/private, where they're encrypted	2022-10-24 01:33:14 -07:00
colin	c833c68d83	move ssh pubkeys into their own file for future reuse	2022-10-24 01:33:01 -07:00
colin	9a4c2613c1	lappy: update passwd	2022-10-24 00:47:09 -07:00
colin	8de5b0a79d	iwd: switch APs more aggressively unclear how much of a difference this makes yet: will hopefully test/tune it over time.	2022-10-24 00:25:19 -07:00
colin	ced64e63ef	Merge remote-tracking branch 'remotes/origin/staging/nixpkgs-2022-10-22'	2022-10-24 00:22:41 -07:00
colin	8dd267db30	servo: goaccess: anonymize IPs and hide the 'HOSTS' panel	2022-10-24 00:16:42 -07:00
colin	10541698a7	flake update: `nixpkgs 2022-10-19 -> 2022-10-22` & others ``` • Updated input 'mobile-nixos': 'github:nixos/mobile-nixos/2a4d4a71e1dfa6d9001249fd57229e949dac0908' (2022-10-21) → 'github:nixos/mobile-nixos/1351091d2537040454fa232d8b94e745ab0eb5a3' (2022-10-24) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/db25c4da285c5989b39e4ce13dea651a88b7a9d4' (2022-10-19) → 'github:NixOS/nixpkgs/95aeaf83c247b8f5aa561684317ecd860476fcd6' (2022-10-22) • Updated input 'nixpkgs-stable': 'github:NixOS/nixpkgs/44fc3cb097324c9f9f93313dd3f103e78d722968' (2022-10-20) → 'github:NixOS/nixpkgs/3933d8bb9120573c0d8d49dc5e890cb211681490' (2022-10-22) • Updated input 'sops-nix': 'github:Mic92/sops-nix/8e470d4eac115aa793437e52e84e7f9abdce236b' (2022-10-18) → 'github:Mic92/sops-nix/1b5f9512a265f0c9687dbff47893180f777f4809' (2022-10-23) • Updated input 'sops-nix/nixpkgs-22_05': 'github:NixOS/nixpkgs/945a85cb7ee31f5f8c49432d77b610b777662d4f' (2022-10-15) → 'github:NixOS/nixpkgs/f9115594149ebcb409a42e303bec4956814a8419' (2022-10-23) ```	2022-10-23 21:47:03 -07:00
colin	b658b93c64	lappy: store the hashed user passwd in git and decrypt it into /etc/passwd on boot this approach lets me persist the password. persisting /etc/shadow directly wasn't so feasible. populating /etc/shadow at activation time is something nix already does and is easy to plug into. so we store the passwd hash in this repo, but encrypt it to the destination machine's ssh pubkey to add enough entropy that it's not brute-forceable through the public git repo.	2022-10-23 06:53:06 -07:00
colin	f68bc342e8	fix activationScript ordering to remove sops double-decrypt hack	2022-10-23 06:53:05 -07:00
colin	e3221bf8b9	home: add handbrake program	2022-10-23 03:02:31 -07:00
colin	3cfe236e90	sane-sync-from-iphone: handle the case where /mnt/iphone is hung	2022-10-22 23:35:00 -07:00
colin	2b14648587	servo: persist the maildir this way i don't lose my mail on every reboot... wow i can't believe it took me this long to make the connection.	2022-10-22 07:00:56 -07:00
colin	0753aa59e9	refactor: move default home impermanence dirs to `modules/universal/users.nix`	2022-10-22 06:09:53 -07:00
colin	55cbce17c2	refactor: impermanence: remove duplicate function `map-service-dirs`	2022-10-22 06:03:04 -07:00
colin	ebf3152ced	refactor: purge `impermanence.home-files` option persisting individual files doesn't work super well. we can do without it and things are simpler.	2022-10-22 05:56:04 -07:00
colin	8345375bc4	zsh: fix history path to be fully-qualified it's implicitly a relative path to where the shell is initialized.	2022-10-22 05:52:05 -07:00
colin	cc63cacf28	new script to unlock ~/private	2022-10-22 05:47:17 -07:00
colin	8f61ba6085	zsh: move .zsh_history to ~/.local/share/zsh this works better with impermanence (see code comment)	2022-10-22 04:08:37 -07:00
colin	b43103a024	refactor: move .zsh_history impermanence definition into zsh.nix	2022-10-22 04:02:40 -07:00
colin	187a52527b	refactor: squash `env` directory	2022-10-22 03:56:50 -07:00
colin	b26e826b3b	sway: add a config option to disable the greeter (and auto-login instead) i need this now as a way to keep gtk3 packages (in greetd) out of the environment, so i can test the Nautilus gtk3-not-present bug.	2022-10-22 01:31:51 -07:00
colin	3851136398	nginx/goaccess: opt-in specific hosts for public logs the other hosts are by default private. mostly because they're just internal services where i'm the primary user.	2022-10-21 22:38:38 -07:00
colin	635fee1bda	nginx: include hostname in log so goaccess can group on it	2022-10-21 22:00:49 -07:00
colin	5048ee1ce5	servo: fix RSS feeds.nix invalid reference (fix build)	2022-10-21 21:59:17 -07:00
colin	e787dc29c6	servo: enable `goaccess` for metrics/monitoring TODO: change the nginx log format to include virtualhost and enable goaccess to group by host	2022-10-21 09:55:49 -07:00
colin	7cc44f9455	feeds: follow Anish Lakhwara supposedly. we'll see if my RSS client actually understands that feed...	2022-10-21 09:30:54 -07:00
colin	419ababe6f	home-manager: split `discord.nix` out of `default.nix`	2022-10-21 09:27:04 -07:00
colin	e4c0a0d468	home-manager: split `aerc.nix` out of `default.nix`	2022-10-21 09:15:08 -07:00
colin	0e63cd4e11	home-manager: split `sublime-music.nix` out of `default.nix`	2022-10-21 09:10:55 -07:00
colin	9328e5ff32	home: disable `nb`	2022-10-21 09:01:06 -07:00
colin	87dda0ad11	home: nb: move package inclusion to nb.nix	2022-10-21 08:59:04 -07:00
colin	46783cd0e2	home-manager: split `nb` out of `default.nix`	2022-10-21 08:53:08 -07:00
colin	f7d3b8128e	home-manager: split `vlc` config out of `default.nix`	2022-10-21 08:47:21 -07:00
colin	9119f0b092	home-manager: split `mpv` config out of `default.nix`	2022-10-21 08:44:25 -07:00
colin	17189b22e9	home-manager: split `git` config out of `default.nix`	2022-10-21 08:41:28 -07:00
colin	7db3816511	home-manager: move `librewolf` out of `default.nix`	2022-10-21 08:38:20 -07:00
colin	8c20017544	home-manager: split `neovim` out of `default.nix`	2022-10-21 08:30:35 -07:00
colin	4c1f68f82f	home-manager: split `kitty` out of default.nix	2022-10-21 08:24:07 -07:00
colin	289745f41a	split zsh config out of home-manager.nix monolith	2022-10-21 08:20:30 -07:00
colin	d9caf70c6c	home-manager: remove 'enable' option	2022-10-21 07:43:20 -07:00
colin	cf95a6e321	env: alias to mkdir + pushd	2022-10-21 07:06:55 -07:00
colin	155c095be8	moby: bump kernel 6.0.0 -> 6.0.2	2022-10-21 05:57:36 -07:00
colin	bafe7aa3c7	Merge branch 'staging/nixpkgs-2022-10-20'	2022-10-21 02:08:33 -07:00
colin	c9d57f2995	commit `ensure-perms` script for image post-processing this was created weeks ago and not committed	2022-10-21 02:04:30 -07:00
colin	a8227bbcbc	nix flake update (nixpkgs 2022-10-14 -> 2022-10-19 and others) ``` • Updated input 'home-manager': 'github:nix-community/home-manager/17208be516fc36e2ab0ceb064d931e90eb88b2a3' (2022-10-11) → 'github:nix-community/home-manager/b81e128fc053ab3159d7b464d9b7dedc9d6a6891' (2022-10-17) • Updated input 'mobile-nixos': 'github:nixos/mobile-nixos/e4b6f680b2a4f29f087a7c1299c11499d1a367b6' (2022-10-14) → 'github:nixos/mobile-nixos/2a4d4a71e1dfa6d9001249fd57229e949dac0908' (2022-10-21) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/4428e23312933a196724da2df7ab78eb5e67a88e' (2022-10-14) → 'github:NixOS/nixpkgs/db25c4da285c5989b39e4ce13dea651a88b7a9d4' (2022-10-19) • Updated input 'nixpkgs-stable': 'github:NixOS/nixpkgs/e06bd4b64bbfda91d74f13cb5eca89485d47528f' (2022-10-12) → 'github:NixOS/nixpkgs/44fc3cb097324c9f9f93313dd3f103e78d722968' (2022-10-20) • Updated input 'sops-nix': 'github:Mic92/sops-nix/0ce0449e6404c4ff9d1b7bd657794ae5ca54deb3' (2022-10-09) → 'github:Mic92/sops-nix/8e470d4eac115aa793437e52e84e7f9abdce236b' (2022-10-18) • Updated input 'sops-nix/nixpkgs-22_05': 'github:NixOS/nixpkgs/b3783bcfb8ec54e0de26feccfc6cc36b8e202ed5' (2022-10-09) → 'github:NixOS/nixpkgs/945a85cb7ee31f5f8c49432d77b610b777662d4f' (2022-10-15) ```	2022-10-21 00:42:30 -07:00
colin	1623367b13	commit `ensure-perms` script for image post-processing this was created weeks ago and not committed	2022-10-21 00:03:57 -07:00
colin	90b0535c56	env: add gdb to `enableDevPkgs` this is especially useful for `coredumpctl`. maybe useful enough that it should be in `environment.systemPackages`...	2022-10-20 23:55:50 -07:00
colin	760d69efc0	Merge branch 'staging/phosh-lightdm'	2022-10-20 23:55:24 -07:00
colin	06dcd8883a	home-packages: create a new option to enable devPkgs	2022-10-20 18:03:01 -07:00