justfile: fix nom use condition.

turns out just will plumb the stdout of its running processes, so we detect ttys on stderr instead
shell.nix: wrap nixos-rebuild with nix-output-monitor
2025-05-31 20:43:16 +02:00 · 2025-05-31 19:45:05 +02:00
12 changed files with 40 additions and 371 deletions
--- a/base/nix.nix
+++ b/base/nix.nix
@ -1,4 +1,4 @@
-{ lib, config, inputs, ... }:
+{ inputs, ... }:
 {
  nix = {
    gc = {
@ -21,16 +21,11 @@
    ** use the same channel the system
    ** was built with
    */
-    registry = lib.mkMerge [
-      {
-        "nixpkgs".flake = inputs.nixpkgs;
-        "nixpkgs-unstable".flake = inputs.nixpkgs-unstable;
-      }
-      # We avoid the reference to self in vmVariant to get a stable system .outPath for equivalence testing
-      (lib.mkIf (!config.virtualisation.isVmVariant) {
-        "pvv-nix".flake = inputs.self;
-      })
-    ];
+    registry = {
+      "nixpkgs".flake = inputs.nixpkgs;
+      "nixpkgs-unstable".flake = inputs.nixpkgs-unstable;
+      "pvv-nix".flake = inputs.self;
+    };
    nixPath = [
      "nixpkgs=${inputs.nixpkgs}"
      "unstable=${inputs.nixpkgs-unstable}"
--- a/base/services/auto-upgrade.nix
+++ b/base/services/auto-upgrade.nix
@ -1,4 +1,4 @@
-{ config, inputs, pkgs, lib, ... }:
+{ inputs, pkgs, lib, ... }:

 let
  inputUrls = lib.mapAttrs (input: value: value.url) (import "${inputs.self}/flake.nix").inputs;
@ -26,14 +26,12 @@ in

  # workaround for https://github.com/NixOS/nix/issues/6895
  # via https://git.lix.systems/lix-project/lix/issues/400
-  environment.etc = lib.mkIf (!config.virtualisation.isVmVariant) {
-    "current-system-flake-inputs.json".source
-      = pkgs.writers.writeJSON "flake-inputs.json" (
-        lib.flip lib.mapAttrs inputs (name: input:
-          # inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
-          lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
-            // { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
-        )
-      );
-  };
+  environment.etc."current-system-flake-inputs.json".source
+    = pkgs.writers.writeJSON "flake-inputs.json" (
+      lib.flip lib.mapAttrs inputs (name: input:
+        # inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
+        lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
+          // { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
+      )
+    );
 }
--- a/flake.nix
+++ b/flake.nix
@ -92,13 +92,9 @@
          inputs.matrix-next.nixosModules.default
          inputs.pvv-calendar-bot.nixosModules.default
          self.nixosModules.gickup
-          self.nixosModules.matrix-ooye
        ];
        overlays = [
          inputs.pvv-calendar-bot.overlays.x86_64-linux.default
-          (final: prev: {
-            inherit (self.packages.${prev.system}) out-of-your-element;
-          })
        ];
      };
      bekkalokk = stableNixosConfig "bekkalokk" {
@ -170,13 +166,12 @@
      snappymail = ./modules/snappymail.nix;
      robots-txt = ./modules/robots-txt.nix;
      gickup = ./modules/gickup;
-      matrix-ooye = ./modules/matrix-ooye.nix;
    };

    devShells = forAllSystems (system: {
-      default = nixpkgs-unstable.legacyPackages.${system}.callPackage ./shell.nix { };
+      default = nixpkgs.legacyPackages.${system}.callPackage ./shell.nix { };
      cuda = let
-        cuda-pkgs = import nixpkgs-unstable {
+        cuda-pkgs = import nixpkgs {
          inherit system;
          config = {
            allowUnfree = true;
@ -198,7 +193,6 @@

        simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };

-        out-of-your-element = pkgs.callPackage ./packages/out-of-your-element.nix { };
      } //
      (lib.pipe null [
        (_: pkgs.callPackage ./packages/mediawiki-extensions { })
--- a/hosts/bicep/services/matrix/default.nix
+++ b/hosts/bicep/services/matrix/default.nix
@ -9,8 +9,7 @@
    ./coturn.nix
    ./mjolnir.nix

-    # ./discord.nix
-    ./out-of-your-element.nix
+    ./discord.nix
    ./hookshot
  ];

--- a/hosts/bicep/services/matrix/discord.nix
+++ b/hosts/bicep/services/matrix/discord.nix
@ -45,7 +45,7 @@ in
  };


-  services.mx-puppet-discord.enable = false;
+  services.mx-puppet-discord.enable = true;
  services.mx-puppet-discord.settings = {
    bridge = {
      bindAddress = "localhost";
--- a/hosts/bicep/services/matrix/out-of-your-element.nix
+++ b/hosts/bicep/services/matrix/out-of-your-element.nix
@ -1,66 +0,0 @@
-{ config, pkgs, fp, ... }:
-let
-  cfg = config.services.matrix-ooye;
-in
-{
-  users.groups.keys-matrix-registrations = { };
-
-  sops.secrets = {
-    "matrix/ooye/as_token" = {
-      sopsFile = fp /secrets/bicep/matrix.yaml;
-      key = "ooye/as_token";
-    };
-    "matrix/ooye/hs_token" = {
-      sopsFile = fp /secrets/bicep/matrix.yaml;
-      key = "ooye/hs_token";
-    };
-    "matrix/ooye/discord_token" = {
-      sopsFile = fp /secrets/bicep/matrix.yaml;
-      key = "ooye/discord_token";
-    };
-    "matrix/ooye/discord_client_secret" = {
-      sopsFile = fp /secrets/bicep/matrix.yaml;
-      key = "ooye/discord_client_secret";
-    };
-  };
-
-  services.matrix-ooye = {
-    enable = true;
-    homeserver = "https://matrix.pvv.ntnu.no";
-    homeserverName = "pvv.ntnu.no";
-    discordTokenPath = config.sops.secrets."matrix/ooye/discord_token".path;
-    discordClientSecretPath = config.sops.secrets."matrix/ooye/discord_client_secret".path;
-    bridgeOrigin = "https://ooye.pvv.ntnu.no";
-
-    enableSynapseIntegration = false;
-  };
-
-  systemd.services."matrix-synapse" = {
-    after = [
-      "matrix-ooye-pre-start.service"
-      "network-online.target"
-    ];
-    requires = [ "matrix-ooye-pre-start.service" ];
-    serviceConfig = {
-      LoadCredential = [
-        "matrix-ooye-registration:/var/lib/matrix-ooye/registration.yaml"
-      ];
-      ExecStartPre = [
-        "+${pkgs.coreutils}/bin/cp /run/credentials/matrix-synapse.service/matrix-ooye-registration ${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
-        "+${pkgs.coreutils}/bin/chown matrix-synapse:keys-matrix-registrations ${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
-      ];
-    };
-  };
-
-  services.matrix-synapse-next.settings = {
-    app_service_config_files = [
-      "${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
-    ];
-  };
-
-  services.nginx.virtualHosts."ooye.pvv.ntnu.no" = {
-    forceSSL = true;
-    enableACME = true;
-    locations."/".proxyPass = "http://localhost:${cfg.socket}";
-  };
-}
--- a/4
+++ b/4
@ -1,6 +1,6 @@
 set positional-arguments # makes variables accesible as $1 $2 $@
 export GUM_FILTER_HEIGHT := "15"
-nom := `if [[ -t 1 ]] && command -v nom >/dev/null; then echo nom; else echo nix; fi`
+nom := `if [[ -t 2 ]] && command -v nom >/dev/null; then echo nom; else echo nix; fi`
 nix_eval_opts := "--log-format raw --option warn-dirty false"

@_default:
@ -26,7 +26,7 @@ run-vm machine=`just _a_machine` *_:
    | xargs -d'\n' nix flake update "$@"

@repl $machine=`just _a_machine` *_:
-  set -v; nixos-rebuild --flake .#"$machine" repl "${@:2}"
+  set -v; NIX_NO_NOM=1 nixos-rebuild --flake .#"$machine" repl "${@:2}"

@eval $machine=`just _a_machine` $attrpath="system.build.toplevel.outPath" *_:
  set -v; nix eval {{nix_eval_opts}} ".#nixosConfigurations.\"$machine\".config.$attrpath" --show-trace "${@:3}"
--- a/modules/grzegorz.nix
+++ b/modules/grzegorz.nix
@ -46,15 +46,6 @@ in {
        allow 2001:700:300:1900::/64;
        deny all;
      '';
-
-      locations."/docs" = {
-        proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
-      };
-
-      locations."/api" = {
-        proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
-        proxyWebsockets = true;
-      };
    };

    "${machine}-backend.pvv.ntnu.no" = {
--- a/modules/matrix-ooye.nix
+++ b/modules/matrix-ooye.nix
@ -1,211 +0,0 @@
-# Original from: https://cgit.rory.gay/nix/OOYE-module.git/
-
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.services.matrix-ooye;
-  mkStringOption =
-    name: default:
-    lib.mkOption {
-      type = lib.types.str;
-      default = default;
-    };
-in
-{
-  options = {
-    services.matrix-ooye = {
-      enable = lib.mkEnableOption "Enable OOYE service";
-      package = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.out-of-your-element;
-      };
-      appserviceId = mkStringOption "The ID of the appservice." "ooye";
-      homeserver = mkStringOption "The homeserver to connect to." "http://localhost:8006";
-      homeserverName = mkStringOption "The name of the homeserver to connect to." "localhost";
-      namespace = mkStringOption "The prefix to use for the MXIDs/aliases of bridged users/rooms. Should end with a _!" "_ooye_";
-      discordTokenPath = mkStringOption "The path to the discord token file." "/etc/ooye-discord-token";
-      discordClientSecretPath = mkStringOption "The path to the discord token file." "/etc/ooye-discord-client-secret";
-      socket = mkStringOption "The socket to listen on, can either be a port number or a unix socket path." "6693";
-      bridgeOrigin = mkStringOption "The web frontend URL for the bridge, defaults to http://localhost:{socket}" "";
-
-      enableSynapseIntegration = lib.mkEnableOption "Enable Synapse integration";
-    };
-  };
-  config = lib.mkIf cfg.enable (
-    let
-      baseConfig = pkgs.writeText "matrix-ooye-config.json" (
-        builtins.toJSON {
-          id = cfg.appserviceId;
-          namespaces = {
-            users = [
-              {
-                exclusive = true;
-                regex = "@${cfg.namespace}.*:${cfg.homeserverName}";
-              }
-            ];
-            aliases = [
-              {
-                exclusive = true;
-                regex = "#${cfg.namespace}.*:${cfg.homeserverName}";
-              }
-            ];
-          };
-          protocols = [ "discord" ];
-          sender_localpart = "${cfg.namespace}bot";
-          rate_limited = false;
-          socket = cfg.socket; # Can either be a TCP port or a unix socket path
-          url = if (lib.hasPrefix "/" cfg.socket) then "unix:${cfg.socket}" else "http://localhost:${cfg.socket}";
-          ooye = {
-            server_name = cfg.homeserverName;
-            namespace_prefix = cfg.namespace;
-            max_file_size = 5000000;
-            content_length_workaround = false;
-            include_user_id_in_mxid = true;
-            server_origin = cfg.homeserver;
-            bridge_origin = if (cfg.bridgeOrigin == "") then "http://localhost:${cfg.socket}" else cfg.bridgeOrigin;
-          };
-        }
-      );
-
-      script = pkgs.writeScript "matrix-ooye-pre-start.sh" ''
-        #!${lib.getExe pkgs.bash}
-        REGISTRATION_FILE=registration.yaml
-
-        id
-        echo "Before if statement"
-        stat ''${REGISTRATION_FILE}
-
-        if [[ ! -f ''${REGISTRATION_FILE} ]]; then
-          echo "No registration file found at '$REGISTRATION_FILE'"
-          cp --no-preserve=mode,ownership ${baseConfig} ''${REGISTRATION_FILE}
-        fi
-
-        echo "After if statement"
-        stat ''${REGISTRATION_FILE}
-
-        AS_TOKEN=$(${lib.getExe pkgs.jq} -r .as_token ''${REGISTRATION_FILE})
-        HS_TOKEN=$(${lib.getExe pkgs.jq} -r .hs_token ''${REGISTRATION_FILE})
-        DISCORD_TOKEN=$(cat /run/credentials/matrix-ooye-pre-start.service/discord_token)
-        DISCORD_CLIENT_SECRET=$(cat /run/credentials/matrix-ooye-pre-start.service/discord_client_secret)
-
-        # Check if we have all required tokens
-        if [[ -z "$AS_TOKEN" || "$AS_TOKEN" == "null" ]]; then
-          AS_TOKEN=$(${lib.getExe pkgs.openssl} rand -hex 64)
-          echo "Generated new AS token: ''${AS_TOKEN}"
-        fi
-
-        if [[ -z "$HS_TOKEN" || "$HS_TOKEN" == "null" ]]; then
-          HS_TOKEN=$(${lib.getExe pkgs.openssl} rand -hex 64)
-          echo "Generated new HS token: ''${HS_TOKEN}"
-        fi
-
-        if [[ -z "$DISCORD_TOKEN" ]]; then
-          echo "No Discord token found at '${cfg.discordTokenPath}'"
-          echo "You can find this on the 'Bot' tab of your Discord application."
-          exit 1
-        fi
-
-        if [[ -z "$DISCORD_CLIENT_SECRET" ]]; then
-          echo "No Discord client secret found at '${cfg.discordTokenPath}'"
-          echo "You can find this on the 'OAuth2' tab of your Discord application."
-          exit 1
-        fi
-
-        shred -u ''${REGISTRATION_FILE}
-        cp --no-preserve=mode,ownership ${baseConfig} ''${REGISTRATION_FILE}
-
-        ${lib.getExe pkgs.jq} '.as_token = "'$AS_TOKEN'" | .hs_token = "'$HS_TOKEN'" | .ooye.discord_token = "'$DISCORD_TOKEN'" | .ooye.discord_client_secret = "'$DISCORD_CLIENT_SECRET'"' ''${REGISTRATION_FILE} > ''${REGISTRATION_FILE}.tmp
-
-        shred -u ''${REGISTRATION_FILE}
-        mv ''${REGISTRATION_FILE}.tmp ''${REGISTRATION_FILE}
-      '';
-
-    in
-    {
-      warnings =
-        lib.optionals ((builtins.substring (lib.stringLength cfg.namespace - 1) 1 cfg.namespace) != "_") [
-          "OOYE namespace does not end with an underscore! This is recommended to have better ID formatting. Provided: '${cfg.namespace}'"
-        ]
-        ++ lib.optionals ((builtins.substring 0 1 cfg.namespace) != "_") [
-          "OOYE namespace does not start with an underscore! This is recommended to avoid conflicts with registered users. Provided: '${cfg.namespace}'"
-        ];
-
-      environment.systemPackages = [ cfg.package ];
-
-      systemd.services."matrix-ooye-pre-start" = {
-        enable = true;
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig = {
-          ExecStart = script;
-          WorkingDirectory = "/var/lib/matrix-ooye";
-          StateDirectory = "matrix-ooye";
-          DynamicUser = true;
-          RemainAfterExit = true;
-          Type = "oneshot";
-
-          LoadCredential = [
-            "discord_token:${cfg.discordTokenPath}"
-            "discord_client_secret:${cfg.discordClientSecretPath}"
-          ];
-        };
-      };
-
-      systemd.services."matrix-ooye" = {
-        enable = true;
-        description = "Out of Your Element - a Discord bridge for Matrix.";
-
-        wants = [
-          "network-online.target"
-          "matrix-synapse.service"
-          "conduit.service"
-          "dendrite.service"
-        ];
-        after = [
-          "matrix-ooye-pre-start.service"
-          "network-online.target"
-        ];
-        requires = [ "matrix-ooye-pre-start.service" ];
-        wantedBy = [ "multi-user.target" ];
-
-        serviceConfig = {
-          ExecStart = lib.getExe config.services.matrix-ooye.package;
-          WorkingDirectory = "/var/lib/matrix-ooye";
-          StateDirectory = "matrix-ooye";
-          #ProtectSystem = "strict";
-          #ProtectHome = true;
-          #PrivateTmp = true;
-          #NoNewPrivileges = true;
-          #PrivateDevices = true;
-          Restart = "on-failure";
-          DynamicUser = true;
-        };
-      };
-
-      systemd.services."matrix-synapse" = lib.mkIf cfg.enableSynapseIntegration {
-
-        after = [
-          "matrix-ooye-pre-start.service"
-          "network-online.target"
-        ];
-        requires = [ "matrix-ooye-pre-start.service" ];
-        serviceConfig = {
-          LoadCredential = [
-            "matrix-ooye-registration:/var/lib/matrix-ooye/registration.yaml"
-          ];
-          ExecStartPre = [
-            "+${pkgs.coreutils}/bin/cp /run/credentials/matrix-synapse.service/matrix-ooye-registration ${config.services.matrix-synapse.dataDir}/ooye-registration.yaml"
-            "+${pkgs.coreutils}/bin/chown matrix-synapse:matrix-synapse ${config.services.matrix-synapse.dataDir}/ooye-registration.yaml"
-          ];
-        };
-      };
-
-      services.matrix-synapse.settings.app_service_config_files = lib.mkIf cfg.enableSynapseIntegration [
-        "${config.services.matrix-synapse.dataDir}/ooye-registration.yaml"
-      ];
-    }
-  );
-}
--- a/packages/out-of-your-element.nix
+++ b/packages/out-of-your-element.nix
@ -1,42 +0,0 @@
-{
-  lib,
-  fetchgit,
-  makeWrapper,
-  nodejs,
-  buildNpmPackage,
-}:
-buildNpmPackage {
-  pname = "delete-your-element";
-  version = "3.1-unstable-2025-06-23";
-  src = fetchgit {
-    url = "https://git.pvv.ntnu.no/Drift/delete-your-element.git";
-    rev = "67658bf68026918163a2e5c2a30007364c9b2d2d";
-    sha256 = "sha256-jSQ588kwvAYCe6ogmO+jDB6Hi3ACJ/3+rC8M94OVMNw=";
-  };
-  npmDepsHash = "sha256-HNHEGez8X7CsoGYXqzB49o1pcCImfmGYIw9QKF2SbHo=";
-  dontNpmBuild = true;
-
-  nativeBuildInputs = [makeWrapper];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/share
-    cp -a . $out/share/ooye
-    makeWrapper ${nodejs}/bin/node $out/bin/matrix-ooye --add-flags $out/share/ooye/start.js
-    makeWrapper ${nodejs}/bin/node $out/bin/matrix-ooye-addbot --add-flags $out/share/ooye/addbot.js
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    description = "Matrix-Discord bridge with modern features.";
-    homepage = "https://gitdab.com/cadence/out-of-your-element";
-    longDescription = ''
-      Modern Matrix-to-Discord appservice bridge, created by @cadence:cadence.moe.
-    '';
-    license = licenses.gpl3;
-    # maintainers = with maintainers; [ RorySys ];
-    mainProgram = "matrix-ooye";
-  };
-}
--- a/secrets/bicep/matrix.yaml
+++ b/secrets/bicep/matrix.yaml
@ -9,15 +9,14 @@ mjolnir:
 discord:
    as_token: ENC[AES256_GCM,data:cnPZjBbODZUA1p0kLNeWpKh1oGkDPxDw/g7163XnoRCIgpqk,iv:Uu4L36uDPMBgzdXE2Lt9U0qrBSl3Xuufh1313BD8B/U=,tag:nTm6s7IGd4vNzZ95mfxDpA==,type:str]
    hs_token: ENC[AES256_GCM,data:UzcaNsJtJPKvFT4gQDNfat0nmyJzmQ6OcSI73pANibzOVrWl,iv:ujgRM2jb1rbeloPB4UPLBEvQ7uue4a+bHiqsZAHIqtk=,tag:uIfuaTWSTeVvpQx5o28HPA==,type:str]
-ooye:
-    hs_token: ENC[AES256_GCM,data:QBrdRt4ozAh2XYJtssm82uHlk9aGO1Nr0fEZetmWfLvmw52FZEq8ijyKOgwS6uTcndMi4gGKkq9r4eapLwcMdQ==,iv:VHOAqxR1WGzZ9dmNx+FmjGAKRpUFjWOwyOVmgDswpE0=,tag:k5it/yx7pOfGbJXZUlV69Q==,type:str]
-    as_token: ENC[AES256_GCM,data:RMkY0xVj14FwDbYaAysSmzB0IlJuk0ucicNhhTmVAEgiU05PxWG+qk3/elFcaFwaXRFgQQtVyGFZEcK5gpE9hA==,iv:8JgNrTe7GQqPMdUCxEaxJ9qV7Uec2fkYBmF9LmH4X3o=,tag:tRnFpRAZs9kO3u2SDMwNnA==,type:str]
-    discord_token: ENC[AES256_GCM,data:6rzv3glW03jcYiJ7sAvDcvDmQHs9iVbV11tIFwgD3GuTkVn6mbAoQhjUaz3zpb/OeoGt+j/pCBRlZgk=,iv:JwkqLpeGYhgwLX7SACNh0AUO53XSx9IKgncI0+KkvyU=,tag:30C0X9nVSlEYPITVzuN0qA==,type:str]
-    discord_client_secret: ENC[AES256_GCM,data:wbM7bPZCWa2+UNUqXi27fP0ppdinRkEC4N9KB68TJzg=,iv:Y2j+8oI+kI7DMrBfFU3G5HtFWguNxDpxbNvJkpK5lQs=,tag:GntocbTCybCVqZ2T3lNSIQ==,type:str]
 hookshot:
    as_token: ENC[AES256_GCM,data:L4vEw5r4RhcgritOeDTLHN5E/dM=,iv:pC8BLzxf6NaVAGsotoq6chOceBVdMLvrsQn1LGw9H9w=,tag:SI3CDFHAvgQZEvf/oms3EA==,type:str]
    hs_token: ENC[AES256_GCM,data:2ufSJfYzzAB5IO+edwKSra5d/+M=,iv:cmTycGzNL+IeRRKZGbkhTtiksYTtbxED0k0B5haFw7k=,tag:FmWe5sGi9rlapUeAE6lKvg==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
    age:
        - recipient: age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
          enc: |
@ -73,8 +72,8 @@ sops:
            WEh5NFN6SFF1TlltdWFWTGw4MHRHUkUKrKIvC87xjEmwxPQhH8dN+ZuaJTCgPY28
            pR62KxmoKFICLTHPpYP3euiAx5M9BWvgvCnA/US/5klpk8MtlreNFA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-21T21:23:24Z"
-    mac: ENC[AES256_GCM,data:bEJoCzxph/MOnTOJKdrRiQmbVWmAgsKy8vbD5YBeWagWUCJPDAZNDFLzEzmPvt0jDBol04JosrSIKZS1JzJIIm0zRkcOWSqERQCgjgtGdAYmfp0V6ddseDUVfKlZYJDkt6Bdkqg+9LzrP8dDVm2tMDXpo8vzs02o9dTYFm7imVQ=,iv:buP/297JMfvEm9+IdMWRGV7AgZwF0+G6Z2YIeYw/z1o=,tag:+zG612MJA4Ui8CZBgxM+AQ==,type:str]
+    lastmodified: "2024-10-13T23:30:01Z"
+    mac: ENC[AES256_GCM,data:vdsAZmg7gPqzeucBhLhPemtRVkcxRecIdB6PXZ4paU+Uv5UorBKcTZ3jseN2cLi6ot3ycTIm+UI6uhlCy87vAJVynVJhuJS+ICFRS2+DfoVyuttLjZQGC2sr3+dEBHxIH7sZJSo9PIzbIWw3qHrpOPAZj0//1pFyp/k15k3vidM=,iv:jWtV+WAPt08lgdrVvtXOl35rDB4QflkZWuGBW1+ESyw=,tag:YxSHncZZOAW5uDxXtb/krw==,type:str]
    pgp:
        - created_at: "2024-08-04T00:03:46Z"
          enc: |-
@ -97,4 +96,4 @@ sops:
            -----END PGP MESSAGE-----
          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
    unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.8.1
--- a/shell.nix
+++ b/shell.nix
@ -1,6 +1,18 @@
 { pkgs ? import <nixpkgs> {} }:
+
+let
+  nixos-rebuild-nom = pkgs.writeScriptBin "nixos-rebuild" ''
+    if [[ -t 1 && -z "''${NIX_NO_NOM-}" ]]; then
+      exec ${pkgs.lib.getExe pkgs.nixos-rebuild} -L "$@" |& ${pkgs.lib.getExe pkgs.nix-output-monitor}
+    else
+      exec ${pkgs.lib.getExe pkgs.nixos-rebuild} -L "$@"
+    fi
+  '';
+in
+
 pkgs.mkShellNoCC {
  packages = with pkgs; [
+    nixos-rebuild-nom
    just
    jq
    gum