fixups

Flake lock file updates:

• Updated input 'home-manager-2511':
    'github:nix-community/home-manager/0759e0e137305bc9d0c52c204c6d8dffe6f601a6?narHash=sha256-o8hrZrigP0JYcwnglCp8Zi8jQafWsxbDtRRPzuVwFxY%3D' (2026-03-16)
  → 'github:nix-community/home-manager/0d02ec1d0a05f88ef9e74b516842900c41f0f2fe?narHash=sha256-KY6HsebJHEe5nHOWP7ur09mb0drGxYSzE3rQxy62rJo%3D' (2026-04-05)
• Updated input 'home-manager-edge':
    'github:nix-community/home-manager/57d5560ee92a424fb71fde800acd6ed2c725dfce?narHash=sha256-%2BbRqxoFCJFO9ZTFhcCkzNXbDT3b8AEk88fyjB7Is6eo%3D' (2026-03-16)
  → 'github:nix-community/home-manager/5b56ad02dc643808b8af6d5f3ff179e2ce9593f4?narHash=sha256-Lh5Ns9DI67E%2BlSMOCGK0S%2BmFPy0mz0yOGiJTUXiR9JI%3D' (2026-04-19)
• Updated input 'nix-index-database':
    'github:Mic92/nix-index-database/8faeb68130df077450451b6734a221ba0d6cde42?narHash=sha256-mHSRNrT1rjeYBgkAlj07dW3%2B1nFEgAd8Gu6lgyfT9DU%3D' (2026-03-15)
  → 'github:Mic92/nix-index-database/3b9653a107c736222b5ae0d4036dd3b885219065?narHash=sha256-28Gqz0GDpGsBv8GtAn2dywEQRr%2BCtTDsD5J7VD6icBE%3D' (2026-04-19)
• Updated input 'nixos-hardware':
    'github:NixOS/nixos-hardware/f8e82243fd601afb9f59ad230958bd073795cbfe?narHash=sha256-qonGfS2lzCgCl59Zl63jF6dIRRpvW3AJooBGMaXjHiY%3D' (2026-03-15)
  → 'github:NixOS/nixos-hardware/c775c2772ba56e906cbeb4e0b2db19079ef11ff7?narHash=sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM%3D' (2026-04-06)
• Updated input 'nixpkgs-2511':
    'https://releases.nixos.org/nixos/25.11/nixos-25.11.7702.48652e9d5aea/nixexprs.tar.xz?narHash=sha256-HrGloA/j2MflqpYyyq2xeOYCQTk4eUIR7LfqXkW8bec%3D' (2026-03-16)
  → 'https://releases.nixos.org/nixos/25.11/nixos-25.11.9418.c7f47036d3df/nixexprs.tar.xz?narHash=sha256-EVobw7mrC4S2%2BTuLll6DMAX3p3VTc%2Br4UmMeFRhOvB0%3D' (2026-04-17)
• Updated input 'nixpkgs-edge':
    'https://releases.nixos.org/nixos/unstable/nixos-26.05pre963917.5b2c2d84341b/nixexprs.tar.xz?narHash=sha256-VZOCgpW2WxpWrw4ZNwgA%2B9MZ/QNTYM2iNTiBMxaTX00%3D' (2026-03-16)
  → 'https://releases.nixos.org/nixos/unstable/nixos-26.05pre980183.4bd9165a9165/nixexprs.tar.xz?narHash=sha256-Gk2T0tDDDAs319hp/ak%2BbAIUG5bPMvnNEjPV8CS86Fg%3D' (2026-04-14)
• Updated input 'sops-nix-2511':
    'github:Mic92/sops-nix/8237de83e8200d16fe0c4467b02a1c608ff28044?narHash=sha256-VCiDjE8kNs8uCAK73Ezk1r3fFuc4JepvW07YFqaN968%3D' (2026-03-16)
  → 'github:Mic92/sops-nix/d4971dd58c6627bfee52a1ad4237637c0a2fb0cd?narHash=sha256-Zm6bxLNnEOYuS/SzrAGsYuXSwk3cbkRQZY0fJnk8a5M%3D' (2026-04-13)
• Updated input 'sops-nix-edge':
    'github:Mic92/sops-nix/8237de83e8200d16fe0c4467b02a1c608ff28044?narHash=sha256-VCiDjE8kNs8uCAK73Ezk1r3fFuc4JepvW07YFqaN968%3D' (2026-03-16)
  → 'github:Mic92/sops-nix/d4971dd58c6627bfee52a1ad4237637c0a2fb0cd?narHash=sha256-Zm6bxLNnEOYuS/SzrAGsYuXSwk3cbkRQZY0fJnk8a5M%3D' (2026-04-13)
• Updated input 'system-manager-edge':
    'github:numtide/system-manager/06c040b8712e78c417824af9a4d5b35d295c429b?narHash=sha256-gAlzRG8sNJpmgmnhE/yOQP4nn0Z2DkWYDFAwH9fexEg%3D' (2026-03-17)
  → 'github:numtide/system-manager/39b3806f065ed131d7abb607ad194a63891e020a?narHash=sha256-bqjt0B5j0IBoc3IwM25srMZuZ26Jlk4uZi%2B9kTuU9ME%3D' (2026-04-14)

.envrc

@@ -1,28 +1,73 @@
 #!/usr/bin/env bash
-git config --local core.hooksPath "$PWD"/.githooks
+# https://direnv.net/man/direnv-stdlib.1.html
 
-test -d .direnv || mkdir -p .direnv
-now="$(date +%Y-%m-%d)"
-if ! test -s .direnv/pull-date || test "$now" != "$(cat .direnv/pull-date)"; then
-  git reset flake.lock
-  git restore flake.lock
-  git pull --rebase --autostash
-  grep -q "^=======" flake.lock && { git reset flake.lock; rm flake.lock; }
-  nix flake update
-  echo "$now" > .direnv/pull-date
+# for when i spawn a bunch of tabs
+if command -v git-wait >/dev/null; then
+  git() { git-wait "$@"; }
 fi
 
+# TODO:
+# git config --local core.hooksPath "$PWD"/.githooks
 
-if ! test -f .remote.toml; then
-  use flake .#envrc-local
-else
-  use flake .#envrc-remote
-  echo
-  just remote-current
-  just remote-list
-  echo
+flake_shell=.#envrc
+if [[ -f .remote.toml ]]; then
+  flake_shell+=-remotes
+fi
+if [[ ! -f /run/current-system/nixos-version ]]; then
+  flake_shell+=-fhs
 fi
 
-if rg 'TODO' -q ; then
-  echo "There are $(rg 'TODO' | wc -l ) 'TODO'"
+# ensure (dirty) updated flake lock
+# TODO: cache this on gitea? Run in background?
+# now="$(date +%Y-%m-%d)" # daily
+now="$(date +%Y-%m--%V)" # weekly
+if [[ ! -d .direnv/tmp ]]; then
+  mkdir -p .direnv/tmp
+elif command -v find >/dev/null; then
+  find .direnv/tmp/ -mindepth 1 -maxdepth 1 -type d -and ! -newermt "4 hours ago" -exec rm -rf {} \;
 fi
+if [[ ! -s .direnv/pull-date || "$now" != "$(cat .direnv/pull-date)" ]]; then
+  just pull
+  direnv allow # :3
+
+  # nix flake update
+  ! declare -F update_flake >&/dev/null || ! echo >&2 "ERROR: update_flake() already declared!"
+  update_flake() (
+    set -euo pipefail
+    declare -a update_args=()
+    readarray -td $'\n' update_args <<<"$(
+      nix eval --file flake.nix --apply 'x: builtins.attrNames x.inputs' --json |
+        jq '.[]' -r |
+        grep -v '^nixpkgs-expensive$'
+    )"
+    # update_args+=(--output-lock-file "$tmp"/new-flake.lock)
+    set -x
+    nix flake update "${update_args[@]}" || {
+      nix flake update "${update_args[@]}" --option access-tokens ""
+      nix flake prefetch-inputs --option access-tokens ""
+    }
+  )
+  if command -v pueue >/dev/null && pueue status >&/dev/null; then
+    # update and build shell in background
+    echo >&2 "+ pueue add --immediate nix flake update ..."
+    pueue add --immediate "$(declare -f update_flake); update_flake \"\$@\"; set -x; nix print-dev-env \"$flake_shell\" >/dev/null"
+  else
+    # update while blocking
+    update_flake
+  fi
+  unset -f update_flake
+
+  # TODO: move to pueue job?
+  printf "%s\n" "$now" >.direnv/pull-date
+fi
+
+# source env
+use flake "$flake_shell"
+
+echo
+just motd
+echo
+
+unset -f git
+
+export QEMU_NET_OPTS="hostfwd=tcp::10022-:22,hostfwd=tcp::10080-:80,hostfwd=tcp::10443-:443"

.gitignore

@@ -1,7 +1,13 @@
 result
+results
+result-*
+results-*
 /configuration.nix
 /hardware-configuration.nix
 .direnv
 .remote.toml
+/.pre-commit-config.yaml
 _*
 /logs
+mprocs.log
+*.qcow2

.remoteenv

@@ -1,5 +1,34 @@
 #!/usr/bin/env bash
 export HOST_SHELL="$(command -v "$SHELL")"
-eval "$(nix print-dev-env .#remoteenv)"
-echo Entered "$(hostname --fqdn)"
-df -h /nix/store
+export IS_REMOTE_ENV=1
+
+flake_shell=.#remoteenv
+if [[ ! -f /run/current-system/nixos-version ]]; then
+  flake_shell+=-fhs
+fi
+
+# nix() {
+#   if [[ "$(nix --version | cut -d. -f2)" -lt 18 ]]; then
+#     command nix run nixpkgs#nix -- "$@"
+#   else
+#     command nix "$@"
+#   fi
+# }
+
+# `test A -nt B` deferences symlinks
+t1=$(stat --format=%Z flake.nix  2>/dev/null || printf 0)
+t2=$(stat --format=%Z flake.lock  2>/dev/null || printf 0)
+t3=$(stat --format=%Z .direnv/flake-remote-devshell-profile  2>/dev/null || printf 0)
+if [[ "$t1" -gt "$t3" || "$t2" -gt "$t3" ]]; then
+  mkdir -p .direnv/
+  eval "$(nix --extra-experimental-features "nix-command flakes" print-dev-env --profile ".direnv/flake-remote-devshell-profile" "$flake_shell" --option access-tokens '')"
+else
+  eval "$(nix --extra-experimental-features "nix-command flakes" print-dev-env ".direnv/flake-remote-devshell-profile" --option access-tokens '')"
+fi
+unset t1 t2 t3 flake_shell
+
+{
+  echo Entered "$(hostname --fqdn)"
+  df -h /nix/store
+  echo
+} >&2

.remoteignore.toml

@@ -4,8 +4,15 @@ include = []
 
 [pull]
 exclude = ["*"]
-include = [ ".sops.yaml" ]
+include = []
 
 [both]
-exclude = [ ".remote.toml", "result", ".direnv"]
+exclude = [
+  ".remote.toml",
+  "result",
+  "results",
+  "result-*",
+  "results-*",
+  ".direnv",
+]
 include = []

.sops.yaml

@@ -1,12 +1,13 @@
 # sops updatekeys <fname>
 keys: # https://github.com/getsops/sops/pull/1123
   user_pbsds: &user_pbsds
+  # just sops-pubkey-user
   # test -s ~/.config/sops/age/keys.txt || ( mkdir -p ~/.config/sops/age; age-keygen -o ~/.config/sops/age/keys.txt >/dev/null ); age-keygen -y ~/.config/sops/age/keys.txt
   - &user_pbsds_sopp   age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
   - &user_pbsds_nord   age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
   - &user_pbsds_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
-  - &user_pbsds_hm_pvv age1dws633vckj6aye9y5p0nv867v2y06j6cfeys87rsy6e8nq6dsfyqg0aksk
   hosts: &hosts
+  # (remote-quick) just sops-pubkey-system
   # ssh $(remote-host) cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
   - &host_sopp   age1zvqjaanff7x3f2a7853sd9ylna99khw4x6qfpf6am4yupsc44phsr2vfy3
   - &host_nox    age1zh3nmy2a7s2v7g9t7zg56p8sjqwmvqv5s7dn2v22x5nxyl5wfdcsaf5tw7
@@ -14,13 +15,12 @@ keys: # https://github.com/getsops/sops/pull/1123
   - &host_garp   age14qunhxz08gmw5r8ky0ez9rjf9dj3ue9hrzz580gwwj4cms46vd7ss4rutf
   - &host_eple   age1fha09v5edg88ys45a0u3tpjqfyl29fsy9xaz8xxfy60zjhmas5psfdxynp
   - &host_nord   age19xrvt0gjl4fcfjyy62mrl9uuzrq9e0wgemtkykr07ewz7nqn9cwshngel5
-  - &host_brumle age1czlqpfdvey2hzgr79skxvtg4stnfawq045l5sl59j0cd9hfuqvlq83v647 # brumlebasse
   - &host_bjarte age13dmsned3exqn2wwwxa465vwmdtfuktk49gpshwtu0ujp94syzq5suj0a9w
 
 # https://github.com/getsops/sops#key-groups
 creation_rules:
   # global
-  - path_regex: secrets/default.yaml$
+  - path_regex: secrets/common.yaml$
     key_groups:
     - age:
       - *user_pbsds_sopp
@@ -32,7 +32,6 @@ creation_rules:
       - *host_garp
       - *host_eple
       - *host_nord
-      - *host_brumle
       - *host_bjarte
   # dns
   - path_regex: secrets/dns.yaml$
@@ -45,7 +44,25 @@ creation_rules:
       - *host_bolle
       - *host_garp
       - *host_eple
-      - *host_brumle
+  - path_regex: secrets/tailscale-inner.yaml$
+    key_groups:
+    - age:
+      - *user_pbsds_sopp
+      - *user_pbsds_nord
+      - *user_pbsds_bjarte
+      - *host_sopp
+      - *host_nox
+      - *host_eple
+      - *host_nord
+      - *host_bjarte
+  - path_regex: secrets/tailscale-outer.yaml$
+    key_groups:
+    - age:
+      - *user_pbsds_sopp
+      - *user_pbsds_nord
+      - *user_pbsds_bjarte
+      - *host_bolle
+      - *host_garp
   # home-manager
   - path_regex: secrets/user-pbsds.yaml$
     key_groups:
@@ -54,7 +71,7 @@ creation_rules:
       - *user_pbsds_nord
       - *user_pbsds_bjarte
   # sopp only
-  - path_regex: secrets/sopp(/[^/]+)?\.yaml$
+  - path_regex: hosts/nixos/sopp/secrets.yaml$
     key_groups:
     - age:
       - *user_pbsds_sopp
@@ -62,7 +79,7 @@ creation_rules:
       - *user_pbsds_bjarte
       - *host_sopp
   # nox only
-  - path_regex: secrets/noximilien(/[^/]+)?\.yaml$
+  - path_regex: hosts/nixos/noximilien/secrets.yaml$
     key_groups:
     - age:
       - *user_pbsds_sopp
@@ -70,7 +87,7 @@ creation_rules:
       - *user_pbsds_bjarte
       - *host_nox
   # bolle only
-  - path_regex: secrets/bolle(/[^/]+)?\.yaml$
+  - path_regex: hosts/nixos/bolle/secrets.yaml$
     key_groups:
     - age:
       - *user_pbsds_sopp
@@ -78,7 +95,7 @@ creation_rules:
       - *user_pbsds_bjarte
       - *host_bolle
   # garp only
-  - path_regex: secrets/garp(/[^/]+)?\.yaml$
+  - path_regex: hosts/nixos/garp/secrets.yaml$
     key_groups:
     - age:
       - *user_pbsds_sopp
@@ -86,7 +103,7 @@ creation_rules:
       - *user_pbsds_bjarte
       - *host_garp
   # eple only
-  - path_regex: secrets/eple(/[^/]+)?\.yaml$
+  - path_regex: hosts/nixos/eple/secrets.yaml$
     key_groups:
     - age:
       - *user_pbsds_sopp
@@ -94,7 +111,7 @@ creation_rules:
       - *user_pbsds_bjarte
       - *host_eple
   # nord only
-  - path_regex: secrets/nord(/[^/]+)?\.yaml$
+  - path_regex: hosts/nixos/nord/secrets.yaml$
     key_groups:
     - age:
       - *user_pbsds_sopp
@@ -102,18 +119,10 @@ creation_rules:
       - *user_pbsds_bjarte
       - *host_nord
   # bjarte only
-  - path_regex: secrets/bjarte(/[^/]+)?\.yaml$
+  - path_regex: hosts/nixos/bjarte/secrets.yaml$
     key_groups:
     - age:
       - *user_pbsds_sopp
       - *user_pbsds_nord
       - *user_pbsds_bjarte
       - *host_bjarte
-  # brumlebasse only
-  - path_regex: secrets/brumle(basse)?(/[^/]+)?\.yaml$
-    key_groups:
-    - age:
-      - *user_pbsds_sopp
-      - *user_pbsds_nord
-      - *user_pbsds_bjarte
-      - *host_brumle

.zed/settings.json

@@ -0,0 +1,4 @@
+// https://zed.dev/docs/configuring-zed#settings-files
+{
+  "format_on_save": "off"
+}

base.nix

@@ -1,101 +0,0 @@
-{ config, pkgs, lib, inputs, ... }:
-
-{
-  imports = let ifExists = p: if builtins.pathExists p then p else {}; in [
-    ./cachix.nix # update with `cachix use --mode nixos -d . FOOBAR`
-    ./profiles/locale-no.nix
-    ./profiles/upgrade-diff.nix
-    ./profiles/lix.nix
-    # results of 'nixos-generate-config'
-    # nice to have if i just dump this flake into /etc/nixos on a clean install
-    (ifExists ./configuration.nix )
-    (ifExists ./hardware-configuration.nix )
-  ];
-
-  nixpkgs.overlays = [ (import ./overlay.nix) ];
-
-  nixpkgs.config.permittedInsecurePackages = [
-    pkgs.pulsar.name
-    pkgs.zotero.name
-    pkgs.gitea.name
-  ];
-
-  environment.systemPackages = with pkgs; [
-    ddrescue
-    gptfdisk
-    ms-sys
-    nvme-cli
-    parted
-    pciutils
-    smartmontools
-    testdisk
-    usbutils
-  ] ++ lib.optionals (builtins.elem config.nixpkgs.system [ "x86_64-linux" "aarch64_linux"]) [
-    cage
-    weston
-  ];
-
-  # TODO: selectively whitelist
-  nixpkgs.config.allowUnfree = true;
-  nixpkgs.config.allowUnfreePredicate = (pkg: true);
-  nixpkgs.config.nonfreeLicensing = true; # used by ffmpeg
-
-  hardware.enableRedistributableFirmware = true;
-
-  sops.secrets.nix-access-tokens.mode = "0440";
-  sops.secrets.nix-access-tokens.group = config.users.groups.keys.name;
-  nix.extraOptions = ''
-    !include ${config.sops.secrets.nix-access-tokens.path}
-  '';
-
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-  #nix.settings.allowed-users = [ "@builders" ]; # TODO: this
-  nix.settings.allowed-users = [ "root" "pbsds" "@wheel" ]; # default is [ "*" ]
-  nix.settings.trusted-users = [ "root" "pbsds" "@wheel" ];
-  nix.settings.keep-derivations = true; # keep .drv in store, great with nix-diff
-  nix.settings.auto-optimise-store = true; # deduplicate with hardlinks, expensive. Alternative: nix-store --optimise
-  nix.settings.max-silent-time = 3600;
-  #nix.settings.keep-failed = true; # fills up $TMPDIR
-  nix.settings.log-lines = 35;
-  #nix.optimize.automatic = true; # periodic optimization
-  nix.gc.automatic = true;
-  nix.gc.dates     = "weekly";
-  nix.gc.options   = lib.mkIf config.system.autoUpgrade.enable "--delete-older-than 15d";
-  nix.settings.min-free =  3 * 1024 * 1024 * 1024;
-  nix.settings.max-free = 20 * 1024 * 1024 * 1024;
-
-  services.thermald.enable = lib.mkIf (lib.all (x: x) [
-      (config.nixpkgs.system == "x86_64-linux")
-      (!config.boot.isContainer or false)
-    ]) true;
-
-  # no acme in VM mode:
-  virtualisation.vmVariant = {
-     /* users.users.root.initialPassword = "root"; */
-     security.acme.defaults.server = "https://127.0.0.1";
-     security.acme.preliminarySelfsigned = true;
-   };
-
-  # System fonts
-  # Nice to have when X-forwading on headless machines
-  fonts.fontDir.enable = true; # creates /run/current-system/sw/share/X11/fonts
-  fonts.enableDefaultPackages = true; # dejavu, freefont, gyre, liberation, unifont, noto-fonts-emoji
-  fonts.packages = with pkgs; [
-    noto-fonts # includes Cousine
-    noto-fonts-cjk
-    noto-fonts-emoji
-    noto-fonts-extra
-  ];
-
-  networking.firewall.enable = true; # default
-
-  # https://discourse.nixos.org/t/what-to-do-with-a-full-boot-partition/2049
-  # raise to 15 if auto upgrading
-  boot.loader.grub.configurationLimit = lib.mkDefault 5;
-  boot.loader.systemd-boot.configurationLimit = lib.mkDefault 5;
-  boot.loader.raspberryPi.uboot.configurationLimit = lib.mkDefault 5;
-  boot.loader.generic-extlinux-compatible.configurationLimit = lib.mkDefault 5;
-}

cachix.nix

@@ -1,13 +0,0 @@
-
-# WARN: this file will get overwritten by $ cachix use <name>
-{ pkgs, lib, ... }:
-
-let
-  folder = ./cachix;
-  toImport = name: value: folder + ("/" + name);
-  filterCaches = key: value: value == "regular" && lib.hasSuffix ".nix" key;
-  imports = lib.mapAttrsToList toImport (lib.filterAttrs filterCaches (builtins.readDir folder));
-in {
-  inherit imports;
-  nix.settings.substituters = ["https://cache.nixos.org/"];
-}

cachix/cuda-maintainers.nix

@@ -1,13 +0,0 @@
-# via https://nixos.wiki/wiki/CUDA
-{
-  nix = {
-    settings = {
-      substituters = [
-        "https://cuda-maintainers.cachix.org"
-      ];
-      trusted-public-keys = [
-        "cuda-maintainers.cachix.org-1:0dq3bujKpuEPMCX6U4WylrUDZ9JyUG0VpVZa7CNfq5E="
-      ];
-    };
-  };
-}

cachix/nix-community.nix

@@ -1,13 +0,0 @@
-
-{
-  nix = {
-    settings = {
-      substituters = [
-        "https://nix-community.cachix.org"
-      ];
-      trusted-public-keys = [
-        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-      ];
-    };
-  };
-}

cachix/nixos-rocm.nix

@@ -1,13 +0,0 @@
-
-{
-  nix = {
-    settings = {
-      substituters = [
-        "https://nixos-rocm.cachix.org"
-      ];
-      trusted-public-keys = [
-        "nixos-rocm.cachix.org-1:VEpsf7pRIijjd8csKjFNBGzkBqOmw8H9PRmgAq14LnE="
-      ];
-    };
-  };
-}

cachix/nixpkgs-unfree.nix

@@ -1,13 +0,0 @@
-
-{
-  nix = {
-    settings = {
-      substituters = [
-        "https://nixpkgs-unfree.cachix.org"
-      ];
-      trusted-public-keys = [
-        "nixpkgs-unfree.cachix.org-1:hqvoInulhbV4nJ9yJOEr+4wxhDV4xq2d1DK7S6Nj6rs="
-      ];
-    };
-  };
-}

cachix/numtide.nix

@@ -1,13 +0,0 @@
-
-{
-  nix = {
-    settings = {
-      substituters = [
-        "https://numtide.cachix.org"
-      ];
-      trusted-public-keys = [
-        "numtide.cachix.org-1:2ps1kLBUWjxIneOy1Ik6cQjb41X0iXVXeHigGmycPPE="
-      ];
-    };
-  };
-}

flake.nix

@@ -3,23 +3,39 @@
 
   inputs = {
     # https://github.com/nixos/nixpkgs
-    nixpkgs-test.url = "github:NixOS/nixpkgs/refs/pull/295155/head"; # for testing
-    nixpkgs-edge.url = "github:NixOS/nixpkgs/nixos-unstable"; # "edge" is four letters
-    nixpkgs-2405.url = "github:NixOS/nixpkgs/nixos-24.05";
-    nixpkgs-2311.url = "github:NixOS/nixpkgs/nixos-23.11";
-    nixpkgs-2305.url = "github:NixOS/nixpkgs/nixos-23.05";
-    nixpkgs-2211.url = "github:NixOS/nixpkgs/nixos-22.11"; # for old docs
-    nixpkgs-2205.url = "github:NixOS/nixpkgs/nixos-22.05"; # for old docs
-    nixpkgs-2111.url = "github:NixOS/nixpkgs/nixos-21.11"; # for old docs
-    nixpkgs-2105.url = "github:NixOS/nixpkgs/nixos-21.05"; # for old docs
-    nixpkgs-2009.url = "github:NixOS/nixpkgs/nixos-20.09"; # for old docs
-    nixpkgs-2003.url = "github:NixOS/nixpkgs/nixos-20.03"; # for old docs
-    nixpkgs-1909.url = "github:NixOS/nixpkgs/nixos-19.09"; # for old docs
+    nixpkgs-test.url = "github:NixOS/nixpkgs/refs/pull/379645/merge"; # for testing
+    nixpkgs-edge.url = "https://nixos.org/channels/nixos-unstable/nixexprs.tar.xz"; # len("edge") == 4
+    # remember to update ./profiles/auto-upgrade.nix
+    nixpkgs-2605.url = "https://nixos.org/channels/nixos-26.05/nixexprs.tar.xz";
+    nixpkgs-2511.url = "https://nixos.org/channels/nixos-25.11/nixexprs.tar.xz";
+    nixpkgs-2505.url = "https://nixos.org/channels/nixos-25.05/nixexprs.tar.xz";
+    nixpkgs-2411.url = "https://nixos.org/channels/nixos-24.11/nixexprs.tar.xz"; # for old docs
+    nixpkgs-2405.url = "https://nixos.org/channels/nixos-24.05/nixexprs.tar.xz"; # for old docs
+    nixpkgs-2311.url = "https://nixos.org/channels/nixos-23.11/nixexprs.tar.xz"; # for old docs
+    nixpkgs-2305.url = "https://nixos.org/channels/nixos-23.05/nixexprs.tar.xz"; # for old docs
+    nixpkgs-2211.url = "https://nixos.org/channels/nixos-22.11/nixexprs.tar.xz"; # for old docs
+    nixpkgs-2205.url = "https://nixos.org/channels/nixos-22.05/nixexprs.tar.xz"; # for old docs
+    nixpkgs-2111.url = "https://nixos.org/channels/nixos-21.11/nixexprs.tar.xz"; # for old docs
+    nixpkgs-2105.url = "https://nixos.org/channels/nixos-21.05/nixexprs.tar.xz"; # for old docs
+    nixpkgs-2009.url = "https://nixos.org/channels/nixos-20.09/nixexprs.tar.xz"; # for old docs
+    nixpkgs-2003.url = "https://nixos.org/channels/nixos-20.03/nixexprs.tar.xz"; # for old docs
+    nixpkgs-1909.url = "https://nixos.org/channels/nixos-19.09/nixexprs.tar.xz"; # for old docs
     nixpkgs-1909.flake = false; # Earlier versions are not flake-pure
 
+    # expensive to bump
+    # nixpkgs-expensive.url = "github:NixOS/nixpkgs/nixos-unstable";
+
     # https://github.com/nix-community/home-manager
     home-manager-edge.url = "github:nix-community/home-manager/master";
     home-manager-edge.inputs.nixpkgs.follows = "nixpkgs-edge";
+    home-manager-2605.url = "github:nix-community/home-manager/release-26.05";
+    home-manager-2605.inputs.nixpkgs.follows = "nixpkgs-2605";
+    home-manager-2511.url = "github:nix-community/home-manager/release-25.11";
+    home-manager-2511.inputs.nixpkgs.follows = "nixpkgs-2511";
+    home-manager-2505.url = "github:nix-community/home-manager/release-25.05";
+    home-manager-2505.inputs.nixpkgs.follows = "nixpkgs-2505";
+    home-manager-2411.url = "github:nix-community/home-manager/release-24.11";
+    home-manager-2411.inputs.nixpkgs.follows = "nixpkgs-2411";
     home-manager-2405.url = "github:nix-community/home-manager/release-24.05";
     home-manager-2405.inputs.nixpkgs.follows = "nixpkgs-2405";
     home-manager-2311.url = "github:nix-community/home-manager/release-23.11";
@@ -27,39 +43,61 @@
     home-manager-2305.url = "github:nix-community/home-manager/release-23.05";
     home-manager-2305.inputs.nixpkgs.follows = "nixpkgs-2305";
 
+    nix-on-droid-edge.url = "github:nix-community/nix-on-droid/master";
+    nix-on-droid-edge.inputs.nixpkgs.follows = "nixpkgs-edge";
+    nix-on-droid-2505.url = "github:nix-community/nix-on-droid/release-24.05";
+    nix-on-droid-2505.inputs.nixpkgs.follows = "nixpkgs-2505";
+    nix-on-droid-2405.url = "github:nix-community/nix-on-droid/release-24.05";
+    nix-on-droid-2405.inputs.nixpkgs.follows = "nixpkgs-2405";
+
     # https://github.com/nix-community/nix-index-database
     nix-index-database.url = "github:Mic92/nix-index-database";
-    nix-index-database.inputs.nixpkgs.follows = "nixpkgs-2311"; # only used for .packages
+    nix-index-database.inputs.nixpkgs.follows = "nixpkgs-2411"; # only used for .packages
 
     # https://github.com/NixOS/nixos-hardware
     nixos-hardware.url = "github:NixOS/nixos-hardware";
-    nixos-hardware-2311.url = "github:NixOS/nixos-hardware/ae5c8dcc4d0182d07d75df2dc97112de822cb9d6"; # pre https://github.com/NixOS/nixos-hardware/pull/977
+
+    # https://github.com/numtide/system-manager
+    system-manager-edge.url = "github:numtide/system-manager";
+    system-manager-edge.inputs.nixpkgs.follows = "nixpkgs-edge";
+
+    # https://github.com/soupglasses/nix-system-graphics
+    nix-system-graphics-edge.url = "github:soupglasses/nix-system-graphics";
+    nix-system-graphics-edge.inputs.nixpkgs.follows = "nixpkgs-edge";
 
     # https://github.com/tfc/nspawn-nixos
     nixos-nspawn.url = "github:tfc/nspawn-nixos";
     nixos-nspawn.flake = false; # we don't use it /shrug
 
+    # https://github.com/nix-community/nix-unit
+    /* nix-unit.url = "github:nix-community/nix-unit"; */
+    /* nix-unit.inputs.nixpkgs.follows = "nixpkgs-edge"; */
+
     # https://github.com/wamserma/flake-programs-sqlite
     #flake-programs-sqlite-2311.url = "github:wamserma/flake-programs-sqlite";
     #flake-programs-sqlite-2311.inputs.nixpkgs.follows = "nixpkgs-2311";
 
     # https://github.com/nix-community/nixos-generators
-    nixos-generators-2311.url = "github:nix-community/nixos-generators";
-    nixos-generators-2311.inputs.nixpkgs.follows = "nixpkgs-2311";
+    nixos-generators-2405.url = "github:nix-community/nixos-generators";
+    nixos-generators-2405.inputs.nixpkgs.follows = "nixpkgs-2405";
 
     # https://github.com/Mic92/sops-nix
     sops-nix-edge.url = "github:Mic92/sops-nix";
     sops-nix-edge.inputs.nixpkgs.follows = "nixpkgs-edge";
-    sops-nix-edge.inputs.nixpkgs-stable.follows = "nixpkgs-2405";
+    sops-nix-2605.url = "github:Mic92/sops-nix";
+    sops-nix-2605.inputs.nixpkgs.follows = "nixpkgs-2605";
+    sops-nix-2511.url = "github:Mic92/sops-nix";
+    sops-nix-2511.inputs.nixpkgs.follows = "nixpkgs-2511";
+    sops-nix-2505.url = "github:Mic92/sops-nix";
+    sops-nix-2505.inputs.nixpkgs.follows = "nixpkgs-2505";
+    sops-nix-2411.url = "github:Mic92/sops-nix";
+    sops-nix-2411.inputs.nixpkgs.follows = "nixpkgs-2411";
     sops-nix-2405.url = "github:Mic92/sops-nix";
     sops-nix-2405.inputs.nixpkgs.follows = "nixpkgs-2405";
-    sops-nix-2405.inputs.nixpkgs-stable.follows = "nixpkgs-2405";
     sops-nix-2311.url = "github:Mic92/sops-nix";
     sops-nix-2311.inputs.nixpkgs.follows = "nixpkgs-2311";
-    sops-nix-2311.inputs.nixpkgs-stable.follows = "nixpkgs-2311";
     sops-nix-2305.url = "github:Mic92/sops-nix";
     sops-nix-2305.inputs.nixpkgs.follows = "nixpkgs-2305";
-    sops-nix-2305.inputs.nixpkgs-stable.follows = "nixpkgs-2305";
 
     ## https://github.com/h7x4/maunium-stickerpicker-nix
     #maunium-stickerpicker-nix.url = "github:h7x4/maunium-stickerpicker-nix";
@@ -74,331 +112,304 @@
     nix-vscode-extensions.url = "github:nix-community/nix-vscode-extensions"
     #https://github.com/numtide/nixpkgs-unfree # has a cache
     #https://github.com/matthewbauer/nixiosk
-
-    # https://github.com/cachix/pre-commit-hooks.nix
-    inputs.pre-commit-hooks.url = "github:cachix/pre-commit-hooks.nix";
-    inputs.pre-commit-hooks.inputs.nixpkgs.follows = "nixpkgs-edge";
-    inputs.pre-commit-hooks.inputs.nixpkgs-stable.follows = "nixpkgs-2311";
     /**/
 
-    #pbsds-papers.url = "git+ssh://git@github.com/pbsds/papers.git";
+    /** /
+    # https://github.com/cachix/pre-commit-hooks.nix
+    pre-commit-hooks.url = "github:cachix/pre-commit-hooks.nix";
+    pre-commit-hooks.inputs.nixpkgs.follows = "nixpkgs-edge";
+    /**/
+
+    # #pbsds-papers.url = "git+ssh://git@github.com/pbsds/papers.git";
+    # roroslyd-no.url = "https://git.pvv.ntnu.no/pederbs/roroslyd.no/archive/main.tar.gz";
+    # roroslyd-no.flake = false;
+    # refleksjon-net.url = "https://git.pvv.ntnu.no/pederbs/refleksjon.net/archive/main.tar.gz";
+    # refleksjon-net.flake = false;
+
   };
 
-  nixConfig.extra-substituters = [
-    "https://cuda-maintainers.cachix.org"
-    "https://nix-community.cachix.org"
-    "https://nixos-rocm.cachix.org"
-    "https://nixpkgs-unfree.cachix.org"
-    "https://numtide.cachix.org"
-  ];
-  nixConfig.extra-trusted-public-keys = [
-    "cuda-maintainers.cachix.org-1:0dq3bujKpuEPMCX6U4WylrUDZ9JyUG0VpVZa7CNfq5E="
-    "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-    "nixos-rocm.cachix.org-1:VEpsf7pRIijjd8csKjFNBGzkBqOmw8H9PRmgAq14LnE="
-    "nixpkgs-unfree.cachix.org-1:hqvoInulhbV4nJ9yJOEr+4wxhDV4xq2d1DK7S6Nj6rs="
-    "numtide.cachix.org-1:2ps1kLBUWjxIneOy1Ik6cQjb41X0iXVXeHigGmycPPE="
-  ];
+  nixConfig = {
+    # ./profiles/base/binary-caches.nix | jq '.nix.settings.substituters[]'
+    extra-substituters = [
+      "https://cache.flox.dev/?priority=60"
+      "https://cache.nixos-cuda.org?priority=45"
+      "https://cache.nixos.org/"
+      "https://nix-community.cachix.org/?priority=50"
+    ];
+    # ./profiles/base/binary-caches.nix | jq '.nix.settings."trusted-public-keys"[]'
+    extra-trusted-public-keys = [
+      "flox-cache-public-1:7F4OyH7ZCnFhcze3fJdfyXYLQw/aV7GEed86nQ7IsOs="
+      "cache.nixos-cuda.org:74DUi4Ye579gUqzH4ziL9IyiJBlDpMRn9MBN8oNan9M="
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+    ];
+  };
 
-  outputs = {
-    self,
-    nixos-hardware,
-    nixos-hardware-2311,
-    nixos-nspawn,
-    nixos-generators-2311,
-    ...
-  } @ inputs':
+  outputs = { self, ... } @ inputs':
   let
-    inputs-edge = inputs' // {
+    input-views.inputs-edge = inputs' // {
       nixpkgs = inputs'.nixpkgs-edge;
       unstable = inputs'.nixpkgs-edge;
       home-manager = inputs'.home-manager-edge;
       sops-nix = inputs'.sops-nix-edge;
     };
-    inputs-2405 = inputs' // {
-      nixpkgs = inputs'.nixpkgs-2405;
+    input-views.inputs-2605 = inputs' // {
+      nixpkgs = inputs'.nixpkgs-2605;
       unstable = inputs'.nixpkgs-edge;
+      home-manager = inputs'.home-manager-2605;
+      sops-nix = inputs'.sops-nix-2605;
+    };
+    input-views.inputs-2511 = inputs' // {
+      nixpkgs = inputs'.nixpkgs-2511;
+      unstable = inputs'.nixpkgs-2605;
+      home-manager = inputs'.home-manager-2511;
+      sops-nix = inputs'.sops-nix-2511;
+    };
+    input-views.inputs-2505 = inputs' // {
+      nixpkgs = inputs'.nixpkgs-2505;
+      unstable = inputs'.nixpkgs-2511;
+      home-manager = inputs'.home-manager-2505;
+      sops-nix = inputs'.sops-nix-2505;
+    };
+    input-views.inputs-2411 = inputs' // {
+      nixpkgs = inputs'.nixpkgs-2411;
+      unstable = inputs'.nixpkgs-2505;
+      home-manager = inputs'.home-manager-2411;
+      sops-nix = inputs'.sops-nix-2411;
+    };
+    input-views.inputs-2405 = inputs' // {
+      nixpkgs = inputs'.nixpkgs-2405;
+      unstable = inputs'.nixpkgs-2411;
       home-manager = inputs'.home-manager-2405;
       sops-nix = inputs'.sops-nix-2405;
     };
-    inputs-2311 = inputs' // {
+    input-views.inputs-2311 = inputs' // {
       nixpkgs = inputs'.nixpkgs-2311;
       unstable = inputs'.nixpkgs-2405;
       home-manager = inputs'.home-manager-2311;
       sops-nix = inputs'.sops-nix-2311;
     };
-    inputs-2305 = inputs' // {
+    input-views.inputs-2305 = inputs' // {
       nixpkgs = inputs'.nixpkgs-2305;
       unstable = inputs'.nixpkgs-2311;
       home-manager = inputs'.home-manager-2305;
       sops-nix = inputs'.sops-nix-2305;
     };
-    inputs-2211 = inputs-2305 // { nixpkgs = inputs'.nixpkgs-2211; };
-    inputs-2205 = inputs-2305 // { nixpkgs = inputs'.nixpkgs-2205; };
-    inputs-2111 = inputs-2305 // { nixpkgs = inputs'.nixpkgs-2111; };
-    inputs-2105 = inputs-2305 // { nixpkgs = inputs'.nixpkgs-2105; };
-    inputs-2009 = inputs-2305 // { nixpkgs = inputs'.nixpkgs-2009; };
-    inputs-2003 = inputs-2305 // { nixpkgs = inputs'.nixpkgs-2003; };
-    inputs-1909 = inputs-2305 // { nixpkgs = inputs'.nixpkgs-1909; };
-    inputs-test = inputs-edge // { nixpkgs = inputs'.nixpkgs-test; unstable = inputs'.nixpkgs-test; };
+    input-views.inputs-2211 = input-views.inputs-2305 // { nixpkgs = inputs'.nixpkgs-2211; };
+    input-views.inputs-2205 = input-views.inputs-2305 // { nixpkgs = inputs'.nixpkgs-2205; };
+    input-views.inputs-2111 = input-views.inputs-2305 // { nixpkgs = inputs'.nixpkgs-2111; };
+    input-views.inputs-2105 = input-views.inputs-2305 // { nixpkgs = inputs'.nixpkgs-2105; };
+    input-views.inputs-2009 = input-views.inputs-2305 // { nixpkgs = inputs'.nixpkgs-2009; };
+    input-views.inputs-2003 = input-views.inputs-2305 // { nixpkgs = inputs'.nixpkgs-2003; };
+    input-views.inputs-1909 = input-views.inputs-2305 // { nixpkgs = inputs'.nixpkgs-1909; };
+    input-views.inputs-test = input-views.inputs-edge // { nixpkgs = inputs'.nixpkgs-test; unstable = inputs'.nixpkgs-test; };
+    input-views.inputs-250T = input-views.inputs-2505 // { unstable = inputs'.nixpkgs-test; };
+    input-views.inputs-241T = input-views.inputs-2411 // { unstable = inputs'.nixpkgs-test; }; # TODO: remove
 
-    mkFlakeView = inputs: system: inputs.nixpkgs.lib.mapAttrs (name: flake: flake // {
-      # TODO filter non-flake inputs
-      nixos = flake.nixosModules
-        or null;
-      pkgs = flake.packages.${system}
-        or flake.legacyPackages.${system}
-        or null;
-      lib = flake.lib.${system}
-        or flake.lib
-        or null;
-    }) inputs;
-
-    forSystems = systems: f: inputs-edge.nixpkgs.lib.genAttrs systems (system: f rec {
+    forSystems = systems: f: input-views.inputs-edge.nixpkgs.lib.genAttrs systems (system: f rec {
       inherit system;
-      inputs = inputs-edge;
+      inputs = input-views.inputs-edge;
       pkgs = inputs.nixpkgs.legacyPackages.${system};
       lib  = inputs.nixpkgs.legacyPackages.${system}.lib;
-      flakes = mkFlakeView inputs system;
     });
     forAllSystems = forSystems [
       "x86_64-linux"
       "aarch64-linux"
-      #"riscv64-linux"
+      "riscv64-linux"
     ];
 
-    mkModule = extra-modules: domain: system: inputs: stateVersion: modules: hostname: ({ lib, ... }: {
-      system.stateVersion = lib.mkDefault stateVersion; # TODO: home-manager
-
-      imports = let ifExists = p: if builtins.pathExists p then p else {}; in [
-        ./base.nix
-        "${self}/hosts/${hostname}" # (ifExists "${self}/hosts/${hostname}")
-        inputs.sops-nix.nixosModules.sops
-        inputs.home-manager.nixosModule
-        #inputs.nix-index-database.nixosModules.nix-index # TODO: fix?
-      ] ++ modules ++ extra-modules;
-      #++ inputs.flake-programs-sqlite.nixosModules.programs-sqlite; # TODO: make work
-
-      sops.defaultSopsFile = ./secrets/default.yaml;
-      #sops.defaultSopsFile = lib.mkIf (builtins.pathExists ./secrets/${hostname}.yaml) ./secrets/${hostname}.yaml;
-      sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-      sops.age.keyFile = "/var/lib/sops-nix/key.txt";
-      sops.age.generateKey = true;
-
-      home-manager.useGlobalPkgs = true; # go brrr, reuse overrides
-      home-manager.extraSpecialArgs = {
-        inherit inputs;
-        flakes = mkFlakeView inputs system;
-      };
-      home-manager.sharedModules = [
-        inputs.sops-nix.homeManagerModules.sops
-        inputs.nix-index-database.hmModules.nix-index
-      ];
-
-      # still needed even if using networkd
-      networking.hostName = hostname;
-      networking.domain   = domain;
-      networking.search = [ domain ];
-      nixpkgs.overlays = [
-        (final: prev: {
-          #unstable = unstable.legacyPackages.${final.system};
-          unstable = import inputs.unstable { inherit system; config.allowUnfree = true; }; # TODO: inherit nixos config from stable
-        })
-      ];
-      # This makes commandline tools like 'nix run nixpkgs#hello'
-      # and 'nix-shell -p hello' use the same channel as system was built with
-      nix.registry.nixpkgs.flake = inputs.nixpkgs;
-      nix.registry.nixpkgs-unstable.flake = inputs.unstable;
-      nix.nixPath = [
-        "nixpkgs=${inputs.nixpkgs}"
-        "nixpkgs-unstable=${inputs.unstable}"
-      ];
-    });
-    mkConfig = extra-modules: domain: system: inputs: stateVersion: modules: hostname: inputs.nixpkgs.lib.nixosSystem {
-      inherit system;
-      specialArgs = {
-        inherit inputs;
-        flakes = mkFlakeView inputs system;
-      };
-      modules = [ (mkModule extra-modules domain system inputs stateVersion modules hostname) ];
-    };
-    mkReport = extra-modules: domain: system: inputs: stateVersion: modules: hostname: let
-      nixos = mkConfig extra-modules domain system inputs stateVersion modules hostname;
-      cfg = nixos.config;
-      inherit (nixos.pkgs) lib;
-      # TODO: make it work, is it faster?
-      #inherit (inputs.nixpkgs.legacyPackages.${system}) lib;
-      #nixos = lib.evalModules { modules = [ (mkModule (extra-modules ++ { _module.check = false; }) domain system inputs stateVersion modules hostname) ]; };
-      #cfg = nixos.config;
-    in {
-      inherit system; # TODO: cross system
-      inherit (cfg.boot.binfmt) emulatedSystems;
-      #inherit (cfg.system.build.toplevel) outPath;
-      inherit (cfg.networking) fqdn;
-      inherit (cfg.networking.firewall) allowedTCPPorts allowedUDPPorts;
-      buildMachines = lib.forEach cfg.nix.buildMachines (buildMachine: buildMachine.hostName);
-      users = lib.pipe cfg.users.users [
-        (lib.filterAttrs  (uname: user: user.isNormalUser))
-        (builtins.mapAttrs (uname: user: {
-          authorizedKeys = lib.forEach user.openssh.authorizedKeys.keys (key: builtins.concatStringsSep " " [
-            (builtins.elemAt (lib.splitString " " key) 0)
-            "..."
-            (builtins.elemAt (lib.splitString " " key) 2)
-          ]);
-        }))
-      ];
-      bootloader = if cfg.boot.loader.grub.enable then "grub"
-        else if cfg.boot.loader.systemd-boot.enable then "systemd-boot"
-        else null;
-      mounts = lib.pipe cfg.fileSystems [
-        (lib.filterAttrs (mount: fs: fs.fsType != "nfs"))
-        (lib.mapAttrs (mount: fs: "${fs.fsType}://${fs.device}"))
-      ];
-      nginx-vhosts = lib.pipe cfg.services.nginx.virtualHosts [
-        #(lib.filterAttrs (domain: vhost: )
-        (lib.mapAttrs (domain: vhost: vhost.serverAliases or []))
-      ];
-    };
-    mkHosts = mk: let
-      ls = imports: { inherit imports; };
-      hw = nixos-hardware.nixosModules;
-      hw_ = nixos-hardware-2311.nixosModules;
-      #vf = nixos-vf2.nixosModules;
-      amd         = ls [ hw.common-pc hw.common-pc-ssd hw.common-cpu-amd ];
-      intel       = ls [ hw.common-pc hw.common-pc-ssd hw.common-cpu-intel ./hardware/gpu/intel.nix ];
-      intel-novga = ls [ hw.common-pc hw.common-pc-ssd hw.common-cpu-intel-cpu-only ];
-      cuda        = ls [ ./hardware/gpu/cuda.nix hw.common-gpu-nvidia-nonprime ];
-      cuda-prime  = ls [ ./hardware/gpu/cuda.nix hw.common-gpu-nvidia ];
-      rocm        = ls [ ./hardware/gpu/rocm.nix hw.common-gpu-amd ];
-      rocm_       = ls [ ./hardware/gpu/rocm.nix hw_.common-gpu-amd ];
-      nspawn      = ls [ "${nixos-nspawn}/nspawn-image.nix" { boot.isContainer = true; } ];
-      hidpi       = hw.common-hidpi;
-      p1005       = ./hardware/printer/hp-laserjet-p1005.nix;
-      au          = ./profiles/auto-upgrade.nix;
-      #rb          = ./profiles/remote-builders.nix; # TODO
-      nixld       = ./profiles/nix-ld.nix;
-      binfmt      = ./profiles/binfmt-emu.nix;
-      dns64       = { config, ... }: {
-        networking.nameservers = [ "2001:700:1:11::2:51" ]; # dns64.uninett.no
-        networking.networkmanager.enable = true;
-        networking.networkmanager.insertNameservers = config.networking.nameservers; # https://github.com/NixOS/nixpkgs/issues/61230
-        networking.resolvconf.enable = false;
-      };
-    in builtins.mapAttrs (hostname: curried: curried hostname) {
-      #hostname        "domain"    "system"        inputs      "state" [ modules ... ]
-      noximilien  = mk "pbsds.net" "x86_64-linux"  inputs-2405 "23.11" [ au intel ];
-      brumlebasse = mk "pbsds.net" "x86_64-linux"  inputs-2311 "23.11" [ au amd nspawn ];
-      nord        = mk "pbsds.net" "x86_64-linux"  inputs-2405 "23.11" [ au intel-novga hw.common-gpu-intel-sandy-bridge rocm hidpi ];
-      sopp        = mk "pbsds.net" "x86_64-linux"  inputs-2405 "23.11" [ au nixld intel cuda p1005 ];
-      bjarte      = mk "pbsds.net" "x86_64-linux"  inputs-2405 "23.11" [    nixld intel hw.lenovo-thinkpad-x1-7th-gen ];
-      bolle       = mk "pbsds.net" "x86_64-linux"  inputs-2405 "23.11" [ au dns64 intel ];
-      eple        = mk "pbsds.net" "x86_64-linux"  inputs-2311 "23.11" [ au dns64 intel rocm_ ];
-      garp        = mk "pbsds.net" "x86_64-linux"  inputs-2405 "23.11" [ au dns64 intel-novga cuda ];
-      hasselknippe= mk "pbsds.net" "aarch64-linux" inputs-2311 "23.11" [    hw.pine64-pinebook-pro ];
-      #gomperud smattkuken skrytebiffen skalkesnerken balleby bingus skjrlaltatjlstad
-      #bergjlot snortheimsmoen ditlefsen skrukkerud podebusk zmaragd makrell alfnes blix urke pytte uddu imdorf rosenqvist
-    };
   in {
     inputs = inputs';
 
-    lib = {
-      inherit mkFlakeView forSystems;
-    } // forAllSystems ({ system, ... }: {
-      inherit mkFlakeView forSystems;
-      flakes      = mkFlakeView inputs-edge system;
-      flakes-2311 = mkFlakeView inputs-2311 system;
-      flakes-2305 = mkFlakeView inputs-2305 system;
-    });
+    lib = import ./lib.nix { inputs = inputs'; };
 
-    nixosModules        = mkHosts (mkModule []);
-    nixosConfigurations = mkHosts (mkConfig []);
-    nixosReports        = mkHosts (mkReport []);
+    inherit (import ./hosts { inherit input-views; })
+      # nixos
+      nixosModules
+      nixosConfigurations
+      nixosReports
+      images
+      # system-manager
+      systemConfigs
+      # nix-on-droid
+      nixOnDroidConfigurations
+      ;
 
-    packages = forAllSystems ({ inputs, pkgs, lib, flakes, ... }: let
-      mk-nspawn-setup = hostname: # TODO: nspawn-tarball.nix populates /etc/nixos with junk
-        (pkgs.callPackage ./pkgs/mk-nspawn-setup {})
-        (mkHosts (mkConfig [ "${nixos-nspawn}/nspawn-tarball.nix" ])).${hostname};
-    in {
-      # TODO: get faketty to work ${expect}/bin/unbuffer is bad
-      nixos-rebuild-nom = pkgs.writeScriptBin "nixos-rebuild" ''
-        if test -t 1 || test -z "''${NIX_NO_NOM-}"; then
-          exec ${lib.getExe pkgs.nixos-rebuild} "$@" -L |& ${lib.getExe pkgs.nix-output-monitor}
-        else
-          exec ${lib.getExe pkgs.nixos-rebuild} "$@" -L
-        fi
-      '';
+    overlays = {
+      pbsdspkgs = import ./overlays/pbsdspkgs.nix;
+      wl-clipboard-timeout = import ./overlays/wl-clipboard-timeout.nix;
+      default = self.overlays.pbsdspkgs;
+    };
 
-      device-mon = pkgs.callPackage ./pkgs/device-mon {};
-      #pdoc-docs  = (pkgs.callPackage ./pkgs/pdocs.nix {}).pdocs;
-      #pdoc3-docs = (pkgs.callPackage ./pkgs/pdocs.nix {}).pdocs3;
-
-      nspawn-setup-brumlebasse = mk-nspawn-setup "brumlebasse";
-      image-brumlebasse-openstack = nixos-generators-2311.nixosGenerate {
-        system = "x86_64-linux";
-        specialArgs = { inherit inputs flakes; };
-        modules = [ (mkHosts (mkModule [])).brumlebasse ];
-        format = "openstack";
-      };
-    });
+    packages = forAllSystems (
+      { pkgs, lib, ... }:
+      let
+        # TODO: by-name
+        # TODO: this filterAttrs seems to force the inputs to download
+        pbsdspkgs = lib.filterAttrs (_: lib.isDerivation) (
+          pkgs.appendOverlays
+            [
+              input-views.inputs-edge.system-manager-edge.overlays.default
+              self.overlays.pbsdspkgs
+            ]
+        ).pbsds;
+      in
+      pbsdspkgs // { }
+    );
 
     homeModules.jump = ./users/pbsds/modules/jump.nix;
     homeModules.micro = ./users/pbsds/modules/micro.nix;
 
-    homeConfigurations = forAllSystems ({ system, ... }: let
-      mkHome = user: home: inputs: modules: inputs.home-manager.lib.homeManagerConfiguration {
+    homeConfigurations = let
+      mkHome = username: homeDirectory: system: inputs: modules: inputs.home-manager.lib.homeManagerConfiguration {
         pkgs = inputs.nixpkgs.legacyPackages.${system};
         modules = modules ++ [{
-          home.username = user;
-          home.homeDirectory = home;
-          home-manager.sharedModules = [
+          home = { inherit username homeDirectory; };
+          imports = [
+            { home.stateVersion = "25.05"; }
             inputs.sops-nix.homeManagerModules.sops
-            inputs.nix-index-database.hmModules.nix-index
+            inputs.nix-index-database.homeModules.nix-index
+          ];
+          nixpkgs.overlays = [
+            self.overlays.pbsdspkgs
+            inputs.system-manager-edge.overlays.default
+            (final: prev: {
+              unstable = import inputs.unstable {
+                inherit (final.pkgs) system config;
+              };
+            })
           ];
         }];
-        extraSpecialArgs = {
-          inherit inputs;
-          flakes = mkFlakeView inputs system;
-        };
+        extraSpecialArgs = { inherit inputs; };
+      };
+      forEach = xs: f: map f xs;
+      pipe = builtins.foldl' (x: f: f x);
+      attrsToList = a: builtins.attrValues (builtins.mapAttrs (name: value: { inherit name value; }) a);
+    in
+      pipe (
+        forEach ["edge" "2505" "2411"] (release: {
+          # TODO: static - fhs
+          # TODO: pvv - nfs home
+          # TODO: nix-portable - heid
+          # TODO: garmr
+          # TODO: furios?
+          "pbsds-minimal-${release}"       = mkHome "pbsds" "/home/pbsds" "x86_64-linux" input-views."inputs-${release}" [ ./users/pbsds/home/profiles/minimal ];
+          "pbsds-headless-${release}"      = mkHome "pbsds" "/home/pbsds" "x86_64-linux" input-views."inputs-${release}" [ ./users/pbsds/home/profiles/headless ];
+          "pbsds-comfy-${release}"         = mkHome "pbsds" "/home/pbsds" "x86_64-linux" input-views."inputs-${release}" [ ./users/pbsds/home/profiles/comfy ];
+          "pbsds-desktop-${release}"       = mkHome "pbsds" "/home/pbsds" "x86_64-linux" input-views."inputs-${release}" [ ./users/pbsds/home/profiles/desktop ];
+          "pbsds-desktop-gnome-${release}" = mkHome "pbsds" "/home/pbsds" "x86_64-linux" input-views."inputs-${release}" [ ./users/pbsds/home/profiles/desktop/gnome ];
+        })
+        ++ forEach (builtins.attrNames self.nixosConfigurations) (machine: {
+          "pbsds@${machine}" = rec {
+            config = self.nixosConfigurations.${machine}.config.home-manager.users.pbsds;
+            inherit (config.home) activationPackage;
+          };
+        })
+      ) [
+        (map attrsToList)
+        builtins.concatLists
+        builtins.listToAttrs
+      ]
+      // {
+        "pederbs@login.pvv.ntnu.no" = mkHome "pederbs" "/home/pvv/d/pederbs" "x86_64-linux" input-views.inputs-2505 [ ./users/pbsds/home/profiles/minimal ];
       };
-    in {
-      # TODO: pvv
-      pbsds            = mkHome "pbsds" "/home/pbsds" inputs-edge [ ./users/pbsds/home ];
-      pbsds-2405       = mkHome "pbsds" "/home/pbsds" inputs-2405 [ ./users/pbsds/home ];
-      pbsds-2311       = mkHome "pbsds" "/home/pbsds" inputs-2311 [ ./users/pbsds/home ];
-      pbsds-2305       = mkHome "pbsds" "/home/pbsds" inputs-2305 [ ./users/pbsds/home ];
-      pbsds-gnome      = mkHome "pbsds" "/home/pbsds" inputs-edge [ ./users/pbsds/home/gnome.nix ];
-      pbsds-gnome-2405 = mkHome "pbsds" "/home/pbsds" inputs-2405 [ ./users/pbsds/home/gnome.nix ];
-      pbsds-gnome-2311 = mkHome "pbsds" "/home/pbsds" inputs-2311 [ ./users/pbsds/home/gnome.nix ];
-      pbsds-gnome-2305 = mkHome "pbsds" "/home/pbsds" inputs-2305 [ ./users/pbsds/home/gnome.nix ];
-    });
 
-    devShells = forAllSystems ({ pkgs, flakes, ... }: let
-      mkShell = packages: pkgs.mkShellNoCC { inherit packages; };
+    # TODO: use this to pull changes to repo
+    homeFileMap = let
+      inherit (input-views.inputs-edge.nixpkgs) lib;
+      files = self.homeConfigurations.x86_64-linux.pbsds-gnome.config.home.file;
+    in lib.pipe files [
+      (lib.filterAttrs (k: v: lib.hasPrefix (toString self) (toString v.source)))
+      (lib.mapAttrs' (k: v: lib.nameValuePair
+        (lib.removePrefix "/home/pbsds/" k)
+        ("." + lib.removePrefix  (toString self) (toString v.source))
+      ))
+    ];
+
+    devShells = forAllSystems ({ pkgs, system, ... }: let
+      mkShell = {...}@args: packages: pkgs.mkShellNoCC (args // { packages = (args.packages or []) ++ packages; });
+      #mkShell'= {...}@args: packages: pkgs.mkShellNoCC (args // {
+      #    inherit (self.checks.${system}.pre-commit-check) shellHook;
+      #    packages = (args.packages or []) ++ packages ++ self.checks.${system}.pre-commit-check.enabledPackages;
+      #});
+      inherit  (input-views.inputs-edge.system-manager-edge.packages.${system}) system-manager;
+      inherit  (self.packages.${system}) nom-system-manager;
       envrc-pkgs = [
-        flakes.self.pkgs.nixos-rebuild-nom
-        pkgs.home-manager
+        # pkgs.nixos-rebuild-ng
+        self.packages.${system}.nom-nixos-rebuild-ng
+        # self.packages.${system}.nom-home-manager
         pkgs.nix-output-monitor
-        pkgs.cachix
         pkgs.age
         pkgs.sops
         pkgs.ssh-to-age
         pkgs.just
         pkgs.gum
+        pkgs.mprocs
+        pkgs.dix # pkgs.nvd
       ];
-    in {
-      envrc-local  = mkShell envrc-pkgs;
-      envrc-remote = mkShell (envrc-pkgs ++ [
-        (pkgs.remote-exec or flakes.unstable.pkgs.remote-exec)
-        pkgs.yq
+    in rec {
+      envrc         = mkShell { } envrc-pkgs;
+      envrc-remotes = mkShell { } (envrc-pkgs ++ [
+        pkgs.remote-exec
+        pkgs.yq # TODO: remove
         pkgs.rsync
       ]);
-      remoteenv = mkShell [
-        flakes.self.pkgs.nixos-rebuild-nom
+      remoteenv = mkShell { } [
+        # pkgs.nixos-rebuild-ng
+        self.packages.${system}.nom-nixos-rebuild-ng
+        # self.packages.${system}.nom-home-manager
         pkgs.age
         pkgs.ssh-to-age
         pkgs.just
         pkgs.gum
+        # pkgs.lix # bruh, debian, why so old
+        pkgs.dix # pkgs.nvd
       ];
+      envrc-fhs         = mkShell { inheritFrom = [ envrc ]; }         [ system-manager ];
+      envrc-remotes-fhs = mkShell { inheritFrom = [ envrc-remotes ]; } [ system-manager ];
+      remoteenv-fhs     = mkShell { inheritFrom = [ remoteenv ]; }     [ system-manager ];
+      # envrc-fhs         = mkShell { inheritFrom = [ envrc ]; }         [ nom-system-manager ];
+      # envrc-remotes-fhs = mkShell { inheritFrom = [ envrc-remotes ]; } [ nom-system-manager ];
+      # remoteenv-fhs     = mkShell { inheritFrom = [ remoteenv ]; }     [ nom-system-manager ];
     });
 
+    #checks = forAllSystems ({ inputs, system, ... }: {
+    #  pre-commit-check = inputs.pre-commit-hooks.lib.${system}.run {
+    #    src = ./.;
+    #    excludes = ["flake.lock"];
+    #    hooks = {
+    #      # https://devenv.sh/reference/options/#pre-commithooks
+    #      alejandra.enable = true;
+    #      pretties.enable = true;
+    #      /* pretties.excludes = [".js" ".md" ".ts"]; */
+    #    };
+    #  };
+    #});
+
+    /*
+    checks = forAllSystems ({ pkgs, inputs, system }: {
+      unitTests = pkgs.runCommand "tests" {
+          nativeBuildInputs = [ inputs.nix-unit.packages.${system}.default ];
+        } ''
+        export HOME="$(realpath .)"
+        # The nix derivation must be able to find all used inputs in the nix-store because it cannot download it during buildTime.
+        nix-unit --eval-store "$HOME" \
+          --extra-experimental-features flakes \
+          --override-input nixpkgs ${inputs.nixpkgs} \
+          --flake ${self}#unitTests
+        touch $out
+      '';
+    });
+
+    unitTests = let
+      doesEval = x: {
+        expr = (builtins.tryEval x).success;
+        expected = true;
+      };
+    in {
+      # https://nix-community.github.io/nix-unit/
+    };
+    */
+
   };
 }

hardware/gpu/cuda-common.nix

@@ -0,0 +1,162 @@
+{ config, pkgs, lib, ... }:
+# assumes common-gpu-nvidia from nixos-hardware is also added
+# https://github.com/NixOS/nixos-hardware/blob/master/common/gpu/nvidia/default.nix
+# https://github.com/NixOS/nixos-hardware/blob/master/common/gpu/nvidia/prime.nix
+lib.mkMerge [
+
+(lib.mkIf (lib.versionOlder lib.version "24.11") {
+  hardware.opengl.enable = true;
+  hardware.opengl.driSupport = true;
+  hardware.opengl.driSupport32Bit = true;
+})
+(lib.mkIf (lib.versionAtLeast lib.version "24.11") {
+  hardware.graphics.enable = true;
+  hardware.graphics.enable32Bit = true;
+
+  # does not work on pascal
+  # hardware.nvidia.open = lib.mkDefault true;
+
+  # Experimental and only works on modern Nvidia GPUs (Turing or newer).
+  /* powerManagement.finegrained = true; */
+})
+{
+
+  nixpkgs.config.cudaSupport= true;
+
+  nixpkgs.config.allowUnfreePredicate =
+    pkg:
+    let
+      pkgname = (lib.toLower (lib.getName pkg));
+    in
+    lib.any (x: x) [
+      (lib.hasInfix "nvidia" pkgname)
+      (lib.hasInfix "cuda"   pkgname)
+      (lib.hasInfix "cudnn"  pkgname)
+      (lib.hasInfix "cublas" pkgname)
+    ];
+
+  # avoid expensive rebuilds
+  nixpkgs.config.packageOverrides = pkgs:
+    let
+      # pkgsNoCuda = pkgs.nixpkgsFun {
+      pkgsNoCuda =
+        # if !pkgs.config.cudaSupport then pkgs else
+        import pkgs.path {
+          # TODO: support cross?
+          localSystem.system = pkgs.stdenv.hostPlatform.system;
+          inherit (pkgs) overlays;
+          config = pkgs.config // { cudaSupport = false; };
+        };
+    in
+    lib.optionalAttrs pkgs.config.cudaSupport {
+      inherit (pkgsNoCuda)
+        firefox-unwrapped
+        openusd
+        vtk
+        ;
+
+      # firefox-unwrapped = pkgs.firefox-unwrapped.override (old: {
+      #   onnxruntime = old.onnxruntime.override {
+      #     cudaSupport = false;
+      #     ncclSupport = false;
+      #   };
+      # });
+
+      # openusd is slow to build
+      # opensubdiv  = pkgs.opensubdiv.override { cudaSupport = false; };
+      # # pythonPackagesExtensions = pkgs.pythonPackagesExtensions ++ [
+      # #   (
+      # #     ps-final: ps-prev: {
+      # #       # openusd = ps-prev.openusd.overridePythonAttrs (old: {
+      # #       openusd = ps-prev.openusd.override (old: {
+      # #         opensubdiv = old.opensubdiv.override { cudaSupport = false; };
+      # #       });
+      # #     }
+      # #   )
+      # # ];
+    };
+
+}
+{
+  # # blocked by https://github.com/NixOS/nix/issues/9272
+  # programs.nix-required-mounts.enable = true;
+  # programs.nix-required-mounts.presets.nvidia-gpu.enable = true;
+}
+{
+
+  # https://wiki.nixos.org/wiki/Nvidia
+
+  hardware.opengl.extraPackages = [
+    #pkgs.vaapiVdpau # added by nixos-hardware
+    #pkgs.libvdpau-va-gl
+    pkgs.nvidia-vaapi-driver
+  ];
+
+  hardware.nvidia.modesetting.enable = lib.mkDefault true; # needed for most wayland compositors
+  hardware.nvidia.nvidiaSettings = lib.mkDefault true;
+
+  # https://discourse.nixos.org/t/nvidia-docker-container-runtime-doesnt-detect-my-gpu/51336/2?u=pbsds
+  /* virtualisation.docker.enableNvidia = lib.mkDefault true; # deprecated */
+  /* virtualisation.podman.enableNvidia = lib.mkDefault true; # deprecated */
+  # this works, but you have to use `--device nvidia.com/gpu=all` rather than --gpus
+  hardware.nvidia-container-toolkit.enable = lib.mkDefault true;
+
+  # services.ollama.acceleration = lib.mkDefault "cuda";
+
+  # only do these per-host
+
+  #hardware.nvidia.open = lib.mkDefault true; # open source version of kernel module, only on driver 515.43.04+
+  #hardware.nvidia.powerManagement.enable = lib.mkDefault true; # Fix graphical corruption on suspend/resume
+  #hardware.nvidia.powerManagement.finegrained = lib.mkDefault false; # Turns off GPU when not in use, Turing or newer
+
+  # https://www.nvidia.com/en-us/drivers/unix/legacy-gpu/
+  # https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/os-specific/linux/nvidia-x11/default.nix
+  #hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.stable;
+  #hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.production;
+  #hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.latest;
+  #hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.beta;
+
+  environment.systemPackages = [
+    (pkgs.nvtopPackages.nvidia or pkgs.nvtop-nvidia)
+  ];
+
+  # nvidia bad
+  nixpkgs.config.packageOverrides = pkgs: {
+    /** /
+    teams = pkgs.teams.overrideAttrs (old: rec {
+      postInstall = (old.postInstall or "") + ''
+        substituteInPlace $out/share/applications/teams.desktop \
+          --replace 'Exec=teams' 'Exec=teams --use-gl=desktop'
+      '';
+      #  --replace 'Exec=teams' 'Exec=teams --disable-gpu'
+    });
+    /**/
+    discord = pkgs.discord.overrideAttrs (old: rec {
+      desktopItem = old.desktopItem.override (old: {
+        #exec = "env NIXOS_OZONE_WL=1 ${old.exec}";
+        exec = "${old.exec} --use-gl=desktop";
+      });
+      postInstall = ''
+        ln -sf "${desktopItem}/share/applications" $out/share/
+      '' + old.postInstall;
+    });
+    /** /
+    slack = pkgs.slack.overrideAttrs (old: {
+      postInstall = old.postInstall or "" + ''
+        substituteInPlace $out/share/applications/slack.desktop \
+          --replace "$out/bin/slack " "$out/bin/slack --use-gl=desktop "
+      '';
+      #  --replace "$out/bin/slack " "$out/bin/slack --disable-gpu --in-process-gpu "
+    });
+    element-desktop = pkgs.element-desktop.overrideAttrs (old: {
+      desktopItem = old.desktopItem.override (old: {
+        #exec = "env NIXOS_OZONE_WL=1 element-desktop %u";
+        #exec = "element-desktop --disable-gpu --in-process-gpu %u";
+        exec = "element-desktop --use-gl=desktop %u";
+      });
+    });
+    /**/
+  };
+}
+
+]

hardware/gpu/cuda-prime.nix

@@ -0,0 +1,18 @@
+{ inputs, ... }:
+{
+  imports = [
+    inputs.nixos-hardware.nixosModules.common-gpu-nvidia
+    ./cuda-common.nix
+  ];
+
+  hardware.nvidia.prime = {
+    # (required) Bus IDs. You can find them using lspci, grepping for "3D" or "VGA"
+    #     lspci | grep -iE "(3D|VGA)"
+    # intelBusId  = "PCI:0:2:0";
+    # nvidiaBusId = "PCI:1:0:0";
+
+    offload.enable = true;
+    offload.enableOffloadCmd = true;
+    offload.offloadCmdMainProgram = "prime-run";
+  };
+}

hardware/gpu/cuda.nix

@@ -1,115 +1,7 @@
-{ config, pkgs, lib, ... }:
+{ inputs, ... }:
 {
-  # assumes common-gpu-nvidia from nixos-hardware is also added
-  # TODO: should we move it from flake.nix to here?
-  # https://github.com/NixOS/nixos-hardware/blob/master/common/gpu/nvidia/default.nix
-  # https://github.com/NixOS/nixos-hardware/blob/master/common/gpu/nvidia/prime.nix
-
-  hardware.opengl.enable = true;
-  hardware.opengl.driSupport = true;
-  hardware.opengl.driSupport32Bit = true;
-
-  nixpkgs.config.openglSupport = true; # why is this not set by hardware.opengl.enable ?
-  nixpkgs.config.cudaSupport = true;
-  nixpkgs.config.vdpauSupport  = true;
-  nixpkgs.config.vaapiSupport  = true;
-  nixpkgs.config.nvidiaSupport = true;
-
-  nixpkgs.config.allowUnfreePredicate = pkg: lib.any (x: x) [
-    (lib.hasInfix "nvidia"  (lib.toLower (lib.getName pkg)))
-    (lib.hasInfix "cuda"    (lib.toLower (lib.getName pkg)))
-    (lib.hasInfix "cudnn"   (lib.toLower (lib.getName pkg)))
-    (lib.hasInfix "cublas"  (lib.toLower (lib.getName pkg)))
+  imports = [
+    inputs.nixos-hardware.nixosModules.common-gpu-nvidia-nonprime
+    ./cuda-common.nix
   ];
-
-  # https://nixos.wiki/wiki/Nvidia
-
-  hardware.opengl.extraPackages = [
-    #pkgs.vaapiVdpau # added by nixos-hardware
-    #pkgs.libvdpau-va-gl
-    pkgs.nvidia-vaapi-driver
-  ];
-
-  hardware.nvidia.modesetting.enable = lib.mkDefault true; # needed for most wayland compositors
-  hardware.nvidia.nvidiaSettings = lib.mkDefault true;
-
-  virtualisation.docker.enableNvidia = lib.mkDefault true;
-  virtualisation.podman.enableNvidia = lib.mkDefault true;
-
-  # only do these per-host
-
-  #hardware.nvidia.open = lib.mkDefault true; # open source version of kernel module, only on driver 515.43.04+
-  #hardware.nvidia.powerManagement.enable = lib.mkDefault true; # Fix graphical corruption on suspend/resume
-  #hardware.nvidia.powerManagement.finegrained = lib.mkDefault false; # Turns off GPU when not in use, Turing or newer
-
-  # https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/os-specific/linux/nvidia-x11/default.nix
-  #hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.stable;
-  #hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.production;
-  #hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.latest;
-  #hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.beta;
-
-  #hardware.nvidia.prime = {
-  #  offload.enable = true;
-  #  # Bus IDs. You can find them using lspci, grepping for "3D" or "VGA"
-  #  intelBusId  = "PCI:0:2:0";
-  #  nvidiaBusId = "PCI:1:0:0";
-  #};
-
-  environment.systemPackages = [
-    (pkgs.nvtopPackages.nvidia or pkgs.nvtop-nvidia)
-  ] ++ lib.optionals config.hardware.nvidia.prime.offload.enable [
-    (pkgs.writeShellScriptBin "prime-run" ''
-      export __NV_PRIME_RENDER_OFFLOAD=1
-      export __NV_PRIME_RENDER_OFFLOAD_PROVIDER=NVIDIA-G0
-      export __GLX_VENDOR_LIBRARY_NAME=nvidia
-      export __VK_LAYER_NV_optimus=NVIDIA_only
-      exec "$@"
-    '')
-    # already added by nixos-hardware.common-gpu-nvidia
-    #(pkgs.writeShellScriptBin "nvidia-offload" ''
-    #  export __NV_PRIME_RENDER_OFFLOAD=1
-    #  export __NV_PRIME_RENDER_OFFLOAD_PROVIDER=NVIDIA-G0
-    #  export __GLX_VENDOR_LIBRARY_NAME=nvidia
-    #  export __VK_LAYER_NV_optimus=NVIDIA_only
-    #  exec "$@"
-    #'')
-  ];
-
-  # nvidia bad
-  nixpkgs.config.packageOverrides = (pkgs: {
-    /** /
-    teams = pkgs.teams.overrideAttrs (old: rec {
-      postInstall = (old.postInstall or "") + ''
-        substituteInPlace $out/share/applications/teams.desktop \
-          --replace 'Exec=teams' 'Exec=teams --use-gl=desktop'
-      '';
-      #  --replace 'Exec=teams' 'Exec=teams --disable-gpu'
-    });
-    /**/
-    discord = pkgs.discord.overrideAttrs (old: rec {
-      desktopItem = old.desktopItem.override (old: {
-        #exec = "env NIXOS_OZONE_WL=1 ${old.exec}";
-        exec = "${old.exec} --use-gl=desktop";
-      });
-      postInstall = ''
-        ln -sf "${desktopItem}/share/applications" $out/share/
-      '' + old.postInstall;
-    });
-    /** /
-    slack = pkgs.slack.overrideAttrs (old: {
-      postInstall = old.postInstall or "" + ''
-        substituteInPlace $out/share/applications/slack.desktop \
-          --replace "$out/bin/slack " "$out/bin/slack --use-gl=desktop "
-      '';
-      #  --replace "$out/bin/slack " "$out/bin/slack --disable-gpu --in-process-gpu "
-    });
-    element-desktop = pkgs.element-desktop.overrideAttrs (old: {
-      desktopItem = old.desktopItem.override (old: {
-        #exec = "env NIXOS_OZONE_WL=1 element-desktop %u";
-        #exec = "element-desktop --disable-gpu --in-process-gpu %u";
-        exec = "element-desktop --use-gl=desktop %u";
-      });
-    });
-    /**/
-  });
 }

hardware/gpu/intel.nix

@@ -1,10 +1,27 @@
 { config, pkgs, lib, ... }:
+let
+  extraPackages = with pkgs; [
+    mesa #.drivers
+    intel-media-driver
+    # not added due to collision
+    # https://github.com/NixOS/nixos-hardware/issues/1170
+    # (if (lib.versionOlder lib.version "23.11")
+    #   then vaapiIntel
+    #   else intel-vaapi-driver)
+    libvdpau-va-gl
+    intel-ocl
+    intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
+    (pkgs.nvtopPackages.intel or pkgs.nvtop-intel)
+  ];
+in
+lib.mkMerge [
+
 {
   # enable opengl (headless)
 
   # https://github.com/NixOS/nixpkgs/blob/nixos-22.11/pkgs/development/libraries/ffmpeg/generic.nix
   # https://github.com/NixOS/nixpkgs/blob/nixos-22.11/pkgs/development/libraries/jellyfin-ffmpeg/default.nix
-  # https://nixos.wiki/wiki/Accelerated_Video_Playback
+  # https://wiki.nixos.org/wiki/Accelerated_Video_Playback
 
   nixpkgs.config.openglSupport = true; # why is this not set by hardware.opengl.enable ?
   nixpkgs.config.vaapiSupport  = true;
@@ -12,21 +29,21 @@
   nixpkgs.config.vdpauSupport  = true; # intel
   nixpkgs.config.libmfxSupport = true; # intel
 
-  nixpkgs.config.packageOverrides = pkgs: {
-    vaapiIntel         = pkgs.vaapiIntel.override         { enableHybridCodec = true; };
-    intel-vaapi-driver = pkgs.intel-vaapi-driver.override { enableHybridCodec = true; };
+  # TODO: test if this does anything
+  nixpkgs.config.packageOverrides = prev: {
+    vaapiIntel         = prev.vaapiIntel.override         { enableHybridCodec = true; };
+    intel-vaapi-driver = prev.intel-vaapi-driver.override { enableHybridCodec = true; };
   };
 
-  hardware.opengl.enable = true;
-  hardware.opengl.driSupport = true;
-  hardware.opengl.extraPackages = with pkgs; [
-    mesa.drivers
-    intel-media-driver
-    (if (lib.versionOlder (lib.versions.majorMinor lib.version) "23.11") then vaapiIntel else intel-vaapi-driver)
-    vaapiVdpau
-    libvdpau-va-gl
-    intel-ocl
-    intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
-    (pkgs.nvtopPackages.intel or pkgs.nvtop-intel)
-  ];
 }
+(lib.optionalAttrs (lib.versionOlder lib.version "24.11") {
+  hardware.opengl.driSupport = true;
+  hardware.opengl.enable = true;
+  hardware.opengl.extraPackages = extraPackages;
+})
+(lib.optionalAttrs (lib.versionAtLeast lib.version "24.11") {
+  hardware.graphics.enable = true;
+  hardware.graphics.extraPackages = extraPackages;
+})
+
+]

hardware/gpu/rocm.nix

@@ -1,64 +1,64 @@
-{ pkgs, lib, options, ... }: lib.mkMerge [
+{ inputs, pkgs, lib, options, ... }:
+
 {
-  # assumes common-gpu-amd from nixos-hardware is also added
-  # TODO: should we move it from flake.nix to here?
-  # https://github.com/NixOS/nixos-hardware/blob/master/common/gpu/amd/default.nix
+  imports = [
+    # https://github.com/NixOS/nixos-hardware/blob/master/common/gpu/amd/default.nix
+    inputs.nixos-hardware.nixosModules.common-gpu-amd
+  ];
 
-  hardware.opengl.enable = true;
-  hardware.opengl.driSupport = true;
-  hardware.opengl.driSupport32Bit = true;
+  config =  lib.mkMerge [
 
-  nixpkgs.config.openglSupport = true; # why is this not set by hardware.opengl.enable ?
-  nixpkgs.config.rocmSupport = true;
-  nixpkgs.config.vdpauSupport = true;
-  nixpkgs.config.vaapiSupport = true;
-
-}
-(lib.mkIf (lib.versionAtLeast (lib.versions.majorMinor lib.version) "24.05") {
-  hardware.amdgpu.opencl.enable = lib.mkDefault true;
-  #hardware.amdgpu.amdvlk.enable = lib.mkDefault true;
-  #hardware.amdgpu.amdvlk.support32Bit.enable = lib.mkDefault true;
-})
-#(lib.mkIf (lib.versionOlder (lib.versions.majorMinor lib.version) "24.05") {
-#  # nixos-hardware common-amd options
-#  # https://github.com/NixOS/nixos-hardware/blob/master/common/gpu/amd/default.nix
-#  hardware.amdgpu.opencl = lib.mkDefault true;
-#  #hardware.amdgpu.amdvlk = lib.mkDefault true;
-#})
-{
-  # https://libreddit.noximilien.pbsds.net/r/archlinux/comments/nih9c9/amdgpu_vs_modesetting_in_current_510_kernels_xorg/
-  services.xserver.videoDrivers = [ "amdgpu" ]; # use gpu, adaptive sync and and hardware page flipping
-  #services.xserver.videoDrivers = [ "modesetting" ]; # integrated (non-accelerated) framebuffer, KMS  (default in nixos-hardware)
-
-  # https://wiki.nixos.org/wiki/AMD_GPU#HIP
-  systemd.tmpfiles.rules = let
-    rocmEnv = pkgs.symlinkJoin {
-      name = "rocm-combined";
-      paths = with pkgs.rocmPackages; [
-        rocblas
-        hipblas
-        clr
-      ];
-    };
-  in [ "L+    /opt/rocm   -    -    -     -    ${rocmEnv}" ];
-
-  nixpkgs.overlays = [
-    (prev: final: {
-      blender = prev.blender-hip;
+    (lib.mkIf (lib.versionOlder lib.version "24.11") {
+      hardware.opengl.enable = true;
+      hardware.opengl.driSupport = true;
+      hardware.opengl.driSupport32Bit = true;
     })
+    (lib.mkIf (lib.versionAtLeast lib.version "24.11") {
+      hardware.graphics.enable = true;
+      hardware.graphics.enable32Bit = true;
+    })
+    {
+
+      nixpkgs.config.rocmSupport = true;
+
+      # services.ollama.acceleration = lib.mkDefault "rocm";
+      hardware.amdgpu.opencl.enable = lib.mkDefault true;
+
+      # https://libreddit.noximilien.pbsds.net/r/archlinux/comments/nih9c9/amdgpu_vs_modesetting_in_current_510_kernels_xorg/
+      services.xserver.videoDrivers = [ "amdgpu" ]; # use gpu, adaptive sync and and hardware page flipping
+      #services.xserver.videoDrivers = [ "modesetting" ]; # integrated (non-accelerated) framebuffer, KMS  (default in nixos-hardware)
+
+      # https://wiki.nixos.org/wiki/AMD_GPU#HIP
+      systemd.tmpfiles.rules = let
+        rocmEnv = pkgs.symlinkJoin {
+          name = "rocm-combined";
+          paths = with pkgs.rocmPackages; [
+            rocblas
+            hipblas
+            clr
+          ];
+        };
+      in [ "L+    /opt/rocm   -    -    -     -    ${rocmEnv}" ];
+
+      nixpkgs.overlays = [
+        (final: prev: {
+          blender = prev.blender-hip;
+        })
+      ];
+
+      # enable opencl on polaris, (rx580)
+      environment.variables.ROC_ENABLE_PRE_VEGA = "1";
+
+      environment.systemPackages = [
+        (pkgs.nvtopPackages.amd or pkgs.nvtop-amd)
+        pkgs.lact
+      ];
+
+      # lact - amdgpu GUI tool
+      systemd.packages = [ pkgs.lact ];
+      systemd.services.lactd.enable = true;
+      systemd.services.lactd.wantedBy = [ "multi-user.target" ]; # add this if you want the unit to auto start at boot time
+    }
+
   ];
-
-  # enable opencl on polaris, (rx580)
-  environment.variables.ROC_ENABLE_PRE_VEGA = "1";
-
-  environment.systemPackages = [
-    (pkgs.nvtopPackages.amd or pkgs.nvtop-amd)
-    pkgs.lact
-  ];
-
-  # lact - amdgpu GUI tool
-  systemd.packages = [ pkgs.lact ];
-  systemd.services.lactd.enable = true;
-  systemd.services.lactd.wantedBy = [ "multi-user.target" ]; # add this if you want the unit to auto start at boot time
 }
-]

hardware/gpu/zluda.nix

@@ -0,0 +1,15 @@
+{ pkgs, lib, ... }:
+
+/*
+
+ZLUDA runs CUDA binaries on non-CUDA runtimes like ROCM
+Interestingly, ROCM can also runs on decent CPUs
+
+*/
+
+{
+    environment.systemPackages = [
+      pkgs.zluda # only lib
+      pkgs.pbsds.zluda-run # prefix to LD_LIBRARY_PATH and NIX_LD_LIBRARY_PATH
+    ];
+}

hardware/printer/discover.nix

@@ -0,0 +1,21 @@
+{ lib, pkgs, ... }:
+{
+
+  # airprint
+  # https://wiki.nixos.org/wiki/Printing#Printer_sharing
+
+  services.avahi = {
+    enable = lib.mkDefault true;
+    nssmdns4 = true; # ipv4
+    # nssmdns6 = true; # ipv6, prone to cause timeouts
+    openFirewall = true; # opens UDP port 5353
+  };
+  services.printing = {
+    enable = lib.mkDefault true;
+    drivers = [
+      pkgs.cups-filters
+      pkgs.cups-browsed
+    ];
+  };
+
+}

hardware/printer/hp-laserjet-p1005.nix

@@ -1,21 +1,25 @@
 { lib, pkgs, ... }:
 {
-  # https://nixos.wiki/wiki/Printing
-  services.printing.enable = true;
+  # imports = [ ./share.nix ]; # up to the host to opt-in to
+
+  # https://wiki.nixos.org/wiki/Printing
+  services.printing.enable = lib.mkDefault true;
   #services.printing.drivers = with pkgs; [ foo2zjs foomatic-filters cups-filters ];
   #services.printing.drivers = with pkgs; [ foo2zjs hplip foomatic-filters cups-filters ];
   services.printing.drivers = with pkgs; [ foo2zjs hplipWithPlugin foomatic-filters cups-filters ];
   #services.printing.drivers = with pkgs; [ hplipWithPlugin cups-filters ];
 
-  #hardware.printers.ensureDefaultPrinter = lib.mkDefault "HP_LaserJet_P1005";
-  hardware.printers.ensurePrinters = lib.singleton {
-    name = "HP_LaserJet_P1005";
-    deviceUri = "hp:/usb/HP_LaserJet_P1005?serial=BC0CAEQ"; # `lpstat -s` # hplip
-    #deviceUri = "usb://HP/LaserJet%20P1005?serial=BC0CAEQ"; # `lpstat -s` # foo2zjs
-    model = "HP-LaserJet_P1005.ppd.gz"; # `lpinfo -m` # foo2zjs
-    #location = "";
-    description = "Laser printer";
-    ppdOptions.PageSize = "A4";
+  hardware.printers = {
+    ensureDefaultPrinter = lib.mkDefault "HP_LaserJet_P1005";
+    ensurePrinters = lib.singleton {
+      name = "HP_LaserJet_P1005";
+      deviceUri = "hp:/usb/HP_LaserJet_P1005?serial=BC0CAEQ"; # `lpstat -s` # hplip
+      # deviceUri = "usb://HP/LaserJet%20P1005?serial=BC0CAEQ"; # `lpstat -s` # foo2zjs
+      model = "HP-LaserJet_P1005.ppd.gz"; # `lpinfo -m` # foo2zjs
+      #location = "";
+      description = "Laser printer";
+      ppdOptions.PageSize = "A4";
+    };
   };
 
   services.printing.logLevel = "debug";

hardware/printer/share.nix

@@ -0,0 +1,58 @@
+{ lib, pkgs, ... }:
+{
+
+  # https://wiki.archlinux.org/title/CUPS/Printer_sharing
+
+  # https://wiki.nixos.org/wiki/Printing#Printer_sharing
+
+  services.avahi = {
+    enable = lib.mkDefault true;
+    nssmdns4 = true;
+    openFirewall = true; # opens port 5353
+
+    publish.enable = true;
+    publish.userServices = true;
+  };
+  services.printing = {
+    defaultShared = true;
+    browsing = true;
+    # allows anonymous access to printer
+    listenAddresses = [ "*:631" ];
+    allowFrom = [ "all" ];
+    openFirewall = true;
+  };
+
+
+  # samba
+  # https://wiki.nixos.org/wiki/Samba#Printer_sharing
+
+  /** /
+  services.samba = {
+    enable = lib.mkDefault true;
+    package = pkgs.sambaFull; # compiled with CUPS
+
+    openFirewall = true;
+    settings = {
+      "global" = {
+        "load printers" = "yes";
+        "printing" = "cups";
+        "printcap name" = "cups";
+      };
+      "printers" = {
+        "comment" = "All Printers";
+        "path" = "/var/spool/samba";
+        "public" = "yes";
+        "browseable" = "yes";
+        # allow user 'guest account' to print.
+        "guest ok" = "yes";
+        "writable" = "no";
+        "printable" = "yes";
+        "create mode" = 0700;
+    };
+  };
+  systemd.tmpfiles.rules = [
+    "d /var/spool/samba 1777 root root -"
+  ];
+  /**/
+
+}

hosts/asgaut/default.nix

@@ -1,2 +0,0 @@
-{}
-# TODO: visionfive 2

hosts/bjarte/default.nix

@@ -1,52 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  # Bootloader
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  #boot.kernel.sysctl."vm.swappiness" = lib.mkDefault 10; # 0-100, commonly 60
-
-  imports = [
-    ./hardware-configuration.nix
-    ../../profiles/sshd.nix
-    #../../profiles/no-suspend.nix
-    #../../profiles/oci/podman.nix
-    #../../profiles/oci/docker.nix
-    #../../profiles/oci/distrobox.nix
-
-    ../../users/pbsds
-
-    #../../profiles/mounts/freon-nfs.nix
-    #../../profiles/mounts/reidun-nfs.nix
-    #../../profiles/mounts/meconium-nfs.nix
-
-    ../../profiles/shell.nix
-
-    ../../profiles/desktop/base.nix
-    ../../profiles/desktop/gnome # configures gdm
-    #../../profiles/desktop/sound/alsa.nix
-    #../../profiles/desktop/sound/pulseaudio.nix
-    ../../profiles/desktop/sound/pipewire.nix
-
-    ../../profiles/desktop/steam.nix
-    #../../profiles/desktop/xboxdrv.nix # TODO: try out
-    ../../profiles/desktop/lutris.nix
-    ../../profiles/desktop/flatpak.nix
-
-    ../../profiles/remote-builders.nix
-    #../../profiles/autossh-reverse-tunnels
-  ];
-
-  networking.firewall.allowedTCPPorts = [ 57621 ]; # spotify local discovery
-
-  # Networking
-  networking.networkmanager.enable = true;
-  #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-  #networking.useDHCP = true;
-  #TODO: avahi? resolved? https://git.pvv.ntnu.no/Drift/pvv-nixos-config/src/main/base.nix#L15-L18
-
-  services.printing.enable = true;
-
-  # TODO: remove? Move?
-  programs.dconf.enable = true;
-}

hosts/bolle/default.nix

@@ -1,31 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  # Bootloader
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.loader.efi.efiSysMountPoint = "/boot/efi";
-
-  imports = [
-    ./hardware-configuration.nix
-    ../../profiles/sshd.nix
-
-    ../../users/pbsds
-    ../../users/daniel
-    ../../users/eirikwit
-    ../../users/h7x4
-    ../../users/adrlau
-
-    ../../profiles/shell.nix
-
-    ../../profiles/domeneshop-dyndns
-    ../../profiles/remote-builders.nix
-    #../../profiles/autossh-reverse-tunnels
-  ];
-  services.domeneshop-updater.targets = [ config.networking.fqdn ];
-
-  # Networking
-  networking.networkmanager.enable = true;
-
-  # TODO: remove? Move?
-  programs.dconf.enable = true;
-}

hosts/brumlebasse/default.nix

@@ -1,35 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  # Bootloader
-  #N/A
-
-  ## gated on formatAttr which is set by nixos-generators
-  #boot = lib.mkIf ((config.formatAttr or null) == null) {
-  #  loader.systemd-boot.enable = true;
-  #  loader.efi.canTouchEfiVariables = true;
-  #  loader.efi.efiSysMountPoint = "/boot/efi";
-  #};
-
-  imports = [
-    #./hardware-configuration.nix
-    ../../profiles/sshd.nix
-
-    ../../users/pbsds
-
-    ../../profiles/shell.nix
-
-    #../../profiles/domeneshop-dyndns
-    ../../profiles/remote-builders.nix
-  ];
-  #services.domeneshop-updater.targets = [ config.networking.fqdn ];
-
-  services.openssh.enable = true;
-  services.openssh.ports = lib.mkForce [ 2222 ];
-  networking.firewall.allowedTCPPorts = [ 2222 ];
-
-  # Networking
-  networking.networkmanager.enable = true;
-
-  # TODO: remove? Move?
-  programs.dconf.enable = true;
-}

hosts/default.nix

@@ -0,0 +1,169 @@
+{ input-views }:
+let
+  inherit (input-views.inputs-edge) self;
+
+  mkModule = extra-modules: domain: system: inputs: stateVersion: modules: hostname: ({ lib, ... }: {
+    system.stateVersion = lib.mkDefault stateVersion; # TODO: home-manager
+
+    nixpkgs.hostPlatform = system;
+    #nixpkgs.buildPlatform = buildSystem; # cross
+
+    imports = [
+      ./../profiles/base
+      ./nixos/${hostname}/configuration.nix
+      inputs.home-manager.nixosModules.default
+      #inputs.nix-index-database.nixosModules.nix-index # TODO: fix?
+    ]
+    ++ modules
+    ++ extra-modules
+    #++ inputs.flake-programs-sqlite.nixosModules.programs-sqlite # TODO: make work
+    ;
+
+    home-manager.useGlobalPkgs = true; # go brrr, reuse overrides
+    home-manager.extraSpecialArgs = { inherit inputs; };
+    home-manager.sharedModules = [
+      ({lib, ...}: {
+        nixpkgs = lib.mkForce {}; # ignored when home-manager.useGlobalPkgs
+      })
+      inputs.sops-nix.homeManagerModules.sops
+      (
+        inputs.nix-index-database.homeModules.nix-index
+        # or inputs.nix-index-database.hmModules.nix-index # TODO: old attrname, remove
+      )
+    ];
+
+    # still needed even if using networkd
+    networking.hostName = hostname;
+    networking.domain   = domain;
+    networking.search = [ domain ];
+
+    nixpkgs.overlays = [
+      self.overlays.pbsdspkgs
+      inputs.system-manager-edge.overlays.default
+      (final: prev: {
+        unstable = import inputs.unstable {
+          inherit system;
+          inherit (final.pkgs) config overlays;
+        };
+      })
+    ];
+
+    # This makes commandline tools like 'nix run nixpkgs#hello'
+    # and 'nix-shell -p hello' use the same channel as system was built with
+    nix.registry.nixpkgs.flake = inputs.nixpkgs;
+    nix.registry.nixpkgs-unstable.flake = inputs.unstable;
+    nix.nixPath = [
+      "nixpkgs=${inputs.nixpkgs}"
+      "nixpkgs-unstable=${inputs.unstable}"
+    ];
+  });
+  mkConfig = extra-modules: domain: system: inputs: stateVersion: modules: hostname: inputs.nixpkgs.lib.nixosSystem {
+    #inherit system;
+    specialArgs = { inherit inputs; };
+    modules = [
+      {
+        # _module.args = { inherit inputs; };
+      }
+      (mkModule extra-modules domain system inputs stateVersion modules hostname)
+    ];
+  };
+  # TODO: move this to a file or separate flake
+  mkHosts = mk:
+    let
+      #vf = input-views.inputs-edge.nixos-vf2.nixosModules;
+      # nspawn      = ls [ "${nixos-nspawn}/nspawn-image.nix" { boot.isContainer = true; } ];
+      au          = ./../profiles/auto-upgrade.nix;
+      ts1         = ./../profiles/tailscale/inner.nix;
+      ts2         = ./../profiles/tailscale/outer.nix;
+      tse         = ./../profiles/tailscale/exit-node.nix;
+      #rb          = ./../profiles/known-hosts; # TODO
+      dns64       = { config, ... }: {
+        networking.nameservers = [ "2001:700:1:11::2:51" ]; # dns64.uninett.no
+        networking.networkmanager.enable = true;
+        networking.networkmanager.insertNameservers = config.networking.nameservers; # https://github.com/NixOS/nixpkgs/issues/61230
+        networking.resolvconf.enable = false;
+      };
+    in builtins.mapAttrs (hostname: curried: curried hostname) {
+      #hostname        "domain"    "system"        inputs                  "state" [ modules ... ]
+      # asgaut      = mk "pbsds.net" "riscv64-linux" input-views.inputs-2405 "24.05" [ hw.starfive-visionfive-2 ];
+      # noximilien  = mk "pbsds.net" "x86_64-linux"  input-views.inputs-251T "24.11" [ ts1 au tse ];
+      noximilien  = mk "pbsds.net" "x86_64-linux"  input-views.inputs-2605 "25.05" [ ts1 au tse ];
+      nord        = mk "pbsds.net" "x86_64-linux"  input-views.inputs-2605 "25.05" [ ts1 au ];
+      sopp        = mk "pbsds.net" "x86_64-linux"  input-views.inputs-edge "25.05" [ ts1 au ];
+      bjarte      = mk "pbsds.net" "x86_64-linux"  input-views.inputs-edge "25.05" [ ts1    ];
+      bolle       = mk "pbsds.net" "x86_64-linux"  input-views.inputs-edge "25.05" [ ts2 au tse ];
+      eple        = mk "pbsds.net" "x86_64-linux"  input-views.inputs-2605 "25.05" [ ts1 au tse ];
+      garp        = mk "pbsds.net" "x86_64-linux"  input-views.inputs-edge "25.05" [ ts1 au ];
+      # hasselknippe= mk "pbsds.net" "aarch64-linux" input-views.inputs-2505 "24.05" [ ts1 ];
+
+      # alsaug gomperud smattkuken skrytebiffen skalkesnerken kelfrid balleby bingus skjrlaltatjlstad
+      # bergjlot snortheimsmoen ditlefsen skrukkerud podebusk zmaragd makrell alfnes blix urke pytte uddu imdorf rosenqvist
+    };
+
+in
+rec {
+  nixosModules        = mkHosts (mkModule []);
+  nixosConfigurations = mkHosts (mkConfig []);
+  nixosReports        = builtins.mapAttrs (key: self.lib.mkNixosConfigSummary) nixosConfigurations;
+
+  # system-manager
+  systemConfigs = let
+    mkSystem = name: inputs: system: inputs.system-manager-edge.lib.makeSystemConfig {
+      extraSpecialArgs = {
+        inherit inputs;
+        inherit system; # TODO: find an alternative
+      };
+      modules = [
+        { nixpkgs.hostPlatform = system; }
+        { system-manager.allowAnyDistro = true; }
+        inputs.nix-system-graphics-edge.systemModules.default
+        ./system-manager/${name}/system-configuration.nix
+      ];
+    };
+  in {
+    FuriPhoneFLX1 = mkSystem "furiphoneflx1" input-views.inputs-edge "aarch64-linux";
+    test          = mkSystem "furiphoneflx1" input-views.inputs-edge "x86_64-linux";
+  };
+
+  # https://github.com/nix-community/nix-on-droid
+  nixOnDroidConfigurations = {
+    default = input-views.inputs-edge.nix-on-droid-edge.lib.nixOnDroidConfiguration {
+      pkgs = import input-views.inputs-edge.nixpkgs-edge { system = "aarch64-linux"; };
+      modules = [ ./nix-on-droid/default/droid-configuration.nix ];
+    };
+    test = input-views.inputs-edge.nix-on-droid-edge.lib.nixOnDroidConfiguration {
+      pkgs = import input-views.inputs-edge.nixpkgs-edge { system = "x86_64-linux"; };
+      modules = [ ./nix-on-droid/default/droid-configuration.nix ];
+    };
+  };
+
+  images = {};
+  /** /
+  images =
+    let
+      mk-nspawn-setup =
+        hostname: # TODO: nspawn-tarball.nix populates /etc/nixos with junk
+        (pkgs.callPackage ./../pkgs/mk-nspawn-setup { })
+          (mkHosts (mkConfig [ "${nixos-nspawn}/nspawn-tarball.nix" ])).${hostname};
+    in
+    {
+      asgaut-sd =
+        (mkHosts (mkConfig [
+          "${nixos-hardware}/starfive/visionfive/v2/sd-image.nix"
+          {
+            nixpkgs.buildPlatform.system = system; # cross
+            sdImage.compressImage = false;
+          }
+        ])).asgaut.config.system.build.sdImage;
+      #brumlebasse-nspawn-setup = mk-nspawn-setup "brumlebasse";
+      #brumlebasse-openstack = nixos-generators-2405.nixosGenerate {
+      #  system = "x86_64-linux";
+      #  specialArgs = { inherit inputs; };
+      #  modules = [ (mkHosts (mkModule [])).brumlebasse ];
+      #  format = "openstack";
+      #};
+    };
+  /*
+  */
+
+}

hosts/eple/default.nix

@@ -1,34 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  # Bootloader
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.loader.efi.efiSysMountPoint = "/boot/efi";
-
-  services.nfs.server.enable = false; # TODO: remove?
-
-  imports = [
-    ./hardware-configuration.nix
-    ../../profiles/sshd.nix
-
-    ../../users/pbsds
-    ../../users/bartvbl
-
-    ../../profiles/mounts/panorama-zfs.nix
-
-    ../../profiles/shell.nix
-
-    ../../profiles/domeneshop-dyndns
-    ../../profiles/remote-builders.nix
-    #../../profiles/autossh-reverse-tunnels
-  ];
-  services.domeneshop-updater.targets = [ config.networking.fqdn ];
-
-  networking.hostId = "43c43ded"; # needed for zfs: head -c 8 /etc/machine-id
-
-  # Networking
-  networking.networkmanager.enable = true;
-
-  # TODO: remove? Move?
-  programs.dconf.enable = true;
-}

hosts/garp/default.nix

@@ -1,59 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  # Bootloader.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  /** /
-  services.xserver.displayManager.autoLogin.enable = true;
-  services.xserver.displayManager.autoLogin.user = "pbsds";
-  # tmp: https://github.com/NixOS/nixpkgs/issues/103746#issuecomment-945091229
-  systemd.services."getty@tty1".enable = false;
-  systemd.services."autovt@tty1".enable = false;
-
-  #boot.kernelPackages = pkgs.linuxPackages_latest;
-  #hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.latest;
-  #hardware.nvidia.modesetting.enable = false; # makes atom behave, but mpv refuses to start
-  /**/
-
-  # PRIME: (lspci)
-  #hardware.nvidia.prime.intelBusId  = "PCI:0:02:0";
-  #hardware.nvidia.prime.nvidiaBusId = "PCI:1:00:0";
-
-  imports = [
-    ./hardware-configuration.nix
-    ../../profiles/sshd.nix
-    #../../profiles/no-suspend.nix
-    #../../profiles/oci/podman.nix
-    #../../profiles/oci/docker.nix
-
-    ../../users/pbsds
-    ../../users/daniel
-    ../../users/eirikwit
-    ../../users/h7x4
-    ../../users/adrlau
-
-    ../../profiles/shell.nix
-
-    #../../profiles/desktop/base.nix
-    #../../profiles/desktop/gnome # configures gdm
-    ##../../profiles/desktop/sound/alsa.nix
-    ##../../profiles/desktop/sound/pulseaudio.nix
-    #../../profiles/desktop/sound/pipewire.nix
-
-    ../../profiles/domeneshop-dyndns
-    ../../profiles/remote-builders.nix
-  ];
-  services.domeneshop-updater.targets = [ config.networking.fqdn ];
-
-  #networking.firewall.allowedTCPPorts = [ 57621 ]; # spotify local discovery
-
-  # Networking
-  networking.networkmanager.enable = true;
-
-  # TODO: remove? Move?
-  programs.dconf.enable = true;
-
-  # Enable touchpad support (enabled default in most desktopManager).
-  # services.xserver.libinput.enable = true;
-}

hosts/hasselknippe/default.nix

@@ -1,45 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  # Bootloader
-  #boot.loader.systemd-boot.enable = true;
-  #boot.loader.efi.canTouchEfiVariables = true;
-
-  services.xserver.displayManager.autoLogin.enable = true;
-  services.xserver.displayManager.autoLogin.user = "pbsds";
-  # tmp: https://github.com/NixOS/nixpkgs/issues/103746#issuecomment-945091229
-  systemd.services."getty@tty1".enable = false;
-  systemd.services."autovt@tty1".enable = false;
-
-  imports = [
-    #./hardware-configuration.nix
-    ../../profiles/auto-upgrade.nix
-    ../../profiles/upgrade-diff.nix
-    #../../profiles/sshd.nix
-    #../../profiles/no-suspend.nix
-
-    ../../users/pbsds
-
-    #../../profiles/mounts/freon-nfs.nix
-    #../../profiles/mounts/reidun-nfs.nix
-    #../../profiles/mounts/meconium-nfs.nix
-
-    ../../profiles/shell.nix
-
-    ../../profiles/desktop/base.nix
-    ../../profiles/desktop/gnome # configures gdm
-    ../../profiles/desktop/sound/pipewire.nix
-
-    #../../profiles/desktop/steam.nix
-    #../../profiles/desktop/lutris.nix
-    #../../profiles/desktop/flatpak.nix
-
-    ../../profiles/remote-builders.nix
-  ];
-
-  networking.firewall.allowedTCPPorts = [ 57621 ]; # spotify local discovery
-
-  networking.networkmanager.enable = true;
-
-  # TODO: remove? Move?
-  programs.dconf.enable = true;
-}

hosts/known-hosts.toml

@@ -1,275 +0,0 @@
-# primarily used for remote builders, but also configures known public keys
-
-#["host.name"]
-# https://search.nixos.org/options?query=nix.buildMachine
-#systems
-#maxJobs
-#speedFactor
-#supportedFeatures
-#mandatoryFeatures
-#ssh.listenUser
-#ssh.listenPort
-#ssh.listenPublicKey # cat /etc/ssh/ssh_host_ed25519_key.pub || ssh-keyscan {{fqdn}}
-#ssh.userPublicKey   # sudo ssh-keygen -t ed25519 && sudo cat /root/.ssh/id_ed25519.pub
-#ssh.protocol
-#ssh.proxyJump
-
-[__default__]
-systems = ["x86_64-linux"]
-maxJobs = 0 # not a builder
-speedFactor = 1
-supportedFeatures = []
-mandatoryFeatures = []
-ssh.listenUser = "pbsds" # TODO: change
-# ssh.listenUser = "nixbld-remote"
-ssh.listenPort = 22
-ssh.protocol = "ssh" # "ssh-ng"
-
-# in general:
-#   headless:  one job per 4 threads and 8GB RAM
-#   graphical: one job
-
-["bolle.pbsds.net"]
-maxJobs = 3 # 12 threads 32GB
-speedFactor = 5
-supportedFeatures = ["kvm","big-parallel","nixos-test"]
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILeOB/57N1fQPVorIUlkkJZaQduBo+4+km2Qbj4ebd/k"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["eple.pbsds.net"] # r9 290x
-maxJobs = 3 # 12 threads 32GB
-speedFactor = 5
-supportedFeatures = ["kvm","big-parallel","nixos-test"]
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH03MEINNnjBvtmvN2QsCDCLkvF9ow5FQJp9uiyQ1Iwi"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["garp.pbsds.net"] # gtx 1080
-maxJobs = 2 # 8 threads 32GB
-speedFactor = 4
-supportedFeatures = ["kvm","big-parallel","nixos-test"]
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOkcZ3cUAKk8uUvZPsX7PDBInkb3Eps3Xh+xVrhPY+sx"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["noximilien.pbsds.net"]
-#maxJobs = 1 # 8 threads 8GB
-speedFactor = 2
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ3QhTGS03Sqm6OeCEz5AIGqJnBttKaBqMgNXp3Md7t4"
-ssh.userPublicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC7fYndgIXJM+tLSfkbprWc8ClOI58wlaZCg6I+wMYINeOwxLU24BmIyQAhNeqhHYBdXiyIAl5KN3+YajN1nx6zq2XPXLut31Xtf+0yMdRMX4rXgqOnsBeG4eTfNsPx+v7VNANth8dIADpk59Y9ioWB6JI6NF0wfkqrCSTpt2q9gpTA35MBe41hlaxqxYGq+PlfZyJbN4TJCORZROkjw1P6K+EoYUHTHmduMZSAnpzx5bTHL2r1VK1jLRL4q2O1LP9G7eVYUsZKxKznJqtAeoOGBL4OX2JeIXT51/pXTW0NNyVPELD6aUUZjK8aVK2JDXupXegYO8cHqwLaz7rZj3G8evGamSlGvAYR4Gwvvp4Du8ZRZVM3Gt1allhPMTLnm/gy9Lta35D8SHH0IUKWD3buo5HZliZgSMAvoSrT03vpuGILLoWEkTjpPT0qKIlBd/qlACBzKC9Wwmda5WWgMsfe0zP4zNLVdves5nkMrbY91TYSFM0FuDCaRsK5Mrhx7i0= root@noximilien"
-
-["sopp.pbsds.net"] # gtx 1080
-#maxJobs = 2 # 8 threads 32GB
-speedFactor = 3
-supportedFeatures = ["kvm","nixos-test"]
-ssh.listenPort = 26
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDYB9H1pHB1vTBiGhO/GCQjn70BtVdQuJyXx38zN2CDj"
-ssh.userPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL6eTQkxO/1XflHpGf3478+Z7HFYYaf1d4M6mvSK2nAU root@sopp"
-
-["nord.pbsds.net"] # rx 580
-#maxJobs = 1 # 4 threads 32GB
-speedFactor = 2
-supportedFeatures = ["kvm","nixos-test"]
-ssh.listenPort = 24
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBSdIUtUfAxnVbPDmDDFdP2S3Wd3+CC8IfZAANJ76oh"
-ssh.userPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnS1TmV9q7n+s7+RouuB6vQllnhqNCE1RqPmTMJ2/29 root@nord"
-
-["rocm.pbsds.net"] # gtx 3070 laptop edition
-#maxJobs = 1 # 16 threads 32GB
-speedFactor = 5
-ssh.listenUser = "pbsds"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDuWdqEQ5mmVjuKi6f/Q2PFxuqB3URpgTHid06Vw7we"
-
-["bjarte.pbsds.net"]
-ssh.userPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF4v1+FbiEa6Mohpf3/Una5ahKeKSG9yZ9iU5TC7ddL5 root@bjarte"
-
-["isvegg.pvv.ntnu.no"]
-# maxJobs = 1 # 4 threads 16GB
-speedFactor = 1
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGurF7rdnrDP/VgIK2Tx38of+bX/QGCGL+alrWnZ1Ca5llGneMulUt1RB9xZzNLHiaWIE+HOP0i4spEaeZhilfU="
-
-["eirin.pvv.ntnu.no"]
-maxJobs = 2 # 8 threads 16GB
-speedFactor = 1
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBILGULKEzYe5kPorM0rWATv10qq6debfCuYUYqw3HWZm4Y5Pi7mVKcf8lKFNPc1DxT/dStfxxtHj/2fbezaxElk="
-
-["demiurgen.pvv.ntnu.no"]
-maxJobs = 2 # 8 threads 16GB
-speedFactor = 1
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKw92q3eB5HZbKJN3p+80MtirqcXPu01USE9LnoGYJuDvko1udjIy4UR0wAwELqgs+r7mJyuQPeXmOZKwjHP6tM="
-
-["orchid.pvv.ntnu.no"] # GTX 1060
-maxJobs = 2 # 12 threads 16GB
-speedFactor = 2
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJXBrUdX0iFCkADXvqrcljEu0gxFOX+uOy6kqNx15WcNI+vt/YI7e/K4COf6LxuLsplLrrymcPdqsteAeWnPszs="
-
-["hildring.pvv.ntnu.no"]
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGurF7rdnrDP/VgIK2Tx38of+bX/QGCGL+alrWnZ1Ca5llGneMulUt1RB9xZzNLHiaWIE+HOP0i4spEaeZhilfU="
-
-["microbel.pvv.ntnu.no"]
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEq0yasKP0mH6PI6ypmuzPzMnbHELo9k+YB5yW534aKudKZS65YsHJKQ9vapOtmegrn5MQbCCgrshf+/XwZcjbM="
-
-
-#["heid.idi.ntnu.no"]
-#maxJobs = 24 # 96 threads 1.4TB
-#supportedFeatures = [ "big-parallel" ];
-#ssh.listenUser = "pederbs"
-#ssh.listenPublicKey = "TODO"
-#ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-#["bob.pvv.ntnu.no"]
-#maxJobs = 10 # 40 threads
-#ssh.listenUser = "pederbs"
-#ssh.listenPublicKey = "TODO"
-
-#["darwin-build-box.winter.cafe"]
-#systems = [ "aarch64-darwin", "x86_64-darwin" ];
-#maxJobs = 1; # TODO
-#ssh.listenUser = "TODO";
-#ssh.listenPublicKey  = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB0io9E0eXiDIEHvsibXOxOPveSjUPIr1RnNKbUkw3fD";
-#ssh.egressPrivateKey = "/run/secrets/nix-community-builders-ssh-key";
-
-#["aarch64.nixos.community"]
-#systems = [ "aarch64-linux" ];
-#supportedFeatures = [ "big-parallel" ];
-#maxJobs = 1; # TODO: 64 threads?
-#ssh.listenUser = "TODO";
-#ssh.listenPublicKey  = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMUTz5i9u5H2FHNAmZJyoJfIGyUm/HfGhfwnc142L3ds";
-#ssh.egressPrivateKey = "/run/secrets/nix-community-builders-ssh-key";
-
-
-["clab01.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJfJV5Ov3D0qErVnbQZ3oxhA3i0zuAmjmVUf3JV08aSg"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab02.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHNhQPotOGWZdFeW4B3eDYGcaF/2xB56hNL+x3QEURa6"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab03.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH5srnYPuULchLvlCOlWOwrhQEBznQn61kj0Oawnp44Y"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab04.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICgMxLYYiYb/6IAH6nyc9eGXASgDPTE2JcRZ9ODjhQt5"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab05.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHw4h4dH689bLYWjrhhsvfljyWfUEClPa1Kb0cYxLRaD"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab06.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDVZ394P3124lSxkzVodFqbindIvCB3kcn4YcgbaPrAs"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab07.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILKQfcOmWC73bmE2mlWEcXFHiDUhsYWA7Xy9Dtq8kKmn"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab08.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKlyZq3uTBCgkvPgs6nWRzsdhHmXHph14dmYWgt1vuBx"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab09.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAj4eXT/k7iiUYx+CXq5ShLWm1N6SNO23EIs4xYEaQaW"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab10.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG5xEUkiwXWaUCA+QfMDq2vHfXKzcpXlrHpJMNQ8EU+K"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab11.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFlKZhdQBrjafzzwdRR3arem3TXnnPucQskd7RWW9L5V"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab12.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDEr2zGzev8JffE67Hkb3Qli7K0kzVdu8VXxJW47PK7m"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab13.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIZgIhgpMCdegJaW6Huad7Dj4YfyR8Zhi1UmDsgcJYK2"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab14.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL3pAYx5rtbaUCf4xsiy+7/qKqnGMnSa9KCp42j+XmEh"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab15.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7XwwhLJGwK+a7zShr2Ok9f2GlvPkP+FxKdbGYsNHtd"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab16.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJKAaMXBAYsDd2QQOAQhXAAJCejbylQNLI9KsN3/EsY+"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab20.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEGBbcKU5uDTgaQoREjaNuzQkCKNm5wlnhln6ZNiL3o2"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab22.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMHlaYq184VDBoEOtaIIu2jnuBihhWiGPlyku0SMKORG"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab23.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAsIRgqoFF900olTCy6DSrFMpZyRmtK6aVP2oYQhNi8g"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab24.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICqh/Sp13OcUnZ8gVgiylcLsqAgIw+twQG92GyZK3FBZ"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab25.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOdL5coXj0geu9O1cMLdYuUE0TWlIkKLNj71/XF0e8eg"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"
-
-["clab26.idi.ntnu.no"] # gtx 4090
-#maxJobs = 1 # 24 threads 64GB
-ssh.listenUser = "pederbs"
-ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINqqxg0hVT/gPBM1xqrR9QtMRHVBZDYWZ3pzbJv9MHUG"
-ssh.proxyJump = "isvegg.pvv.ntnu.no"

hosts/nix-on-droid/default/droid-configuration.nix

@@ -0,0 +1,34 @@
+{ pkgs, ... }:
+
+{
+  system.stateVersion = "24.05";
+
+  environment.packages = [
+    pkgs.micro
+    pkgs.git
+    pkgs.openssh
+
+    pkgs.hostname
+    pkgs.gnugrep
+    pkgs.findutils
+    pkgs.fd
+    pkgs.sd
+    pkgs.xe
+    pkgs.gnupg
+    pkgs.gnused
+  ];
+
+  nix.extraOptions = ''
+    experimental-features = nix-command flakes
+  '';
+
+  # Backup etc files instead of failing to activate generation if a file already exists in /etc
+  # environment.etcBackupExtension = ".bak";
+
+  # # Configure home-manager
+  # home-manager = {
+  #   config = ./home.nix;
+  #   backupFileExtension = "hm-bak";
+  #   useGlobalPkgs = true;
+  # };
+}

hosts/nixos/asgaut/configuration.nix

@@ -0,0 +1,10 @@
+{ config, lib, pkgs, ...}:
+
+{
+  environment.systemPackages = [
+    pkgs.fastfetch
+  ];
+
+  networking.interfaces.end0.useDHCP = true;
+  networking.interfaces.end1.useDHCP = true;
+}

hosts/nixos/bjarte/configuration.nix

@@ -0,0 +1,89 @@
+{ inputs, config, pkgs, lib, ... }:
+{
+  # Bootloader
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  #boot.kernel.sysctl."vm.swappiness" = lib.mkDefault 10; # 0-100, commonly 60
+  zramSwap.enable = true;
+  zramSwap.memoryPercent = 30;
+  # swapDevices = lib.mkForce [];
+
+  # for testing only, not for building
+  boot.binfmt.addEmulatedSystemsToNixSandbox = false;
+  boot.binfmt.emulatedSystems = [
+    "aarch64-linux"
+    "armv7l-linux"
+    "riscv64-linux"
+    "x86_64-windows"
+  ];
+  #nix.settings.system = "x86_64-linux";
+  #nix.settings.extra-platforms = [ "i686-linux" ];
+
+  imports = [
+    ./hardware-configuration.nix
+    inputs.nixos-hardware.nixosModules.lenovo-thinkpad-x1-7th-gen
+    inputs.nixos-hardware.nixosModules.common-pc
+    inputs.nixos-hardware.nixosModules.common-pc-ssd
+    inputs.nixos-hardware.nixosModules.common-cpu-intel
+    ../../../hardware/gpu/intel.nix
+
+    ../../../profiles/nix-ld.nix
+    ../../../profiles/sshd/ts-only.nix
+    ../../../profiles/ccache
+    #../../../profiles/no-suspend.nix
+    ../../../profiles/earlyoom.nix
+    ../../../profiles/oci/podman.nix
+    #../../../profiles/oci/docker.nix
+    ../../../profiles/oci/distrobox.nix
+
+    ../../../users/pbsds
+    ../../../users/pbsds/syncthing.nix
+
+    #../../../profiles/mounts/freon-nfs.nix
+    #../../../profiles/mounts/reidun-nfs.nix
+    # ../../../profiles/mounts/meconium-nfs.nix
+    # ../../../profiles/mounts/panorama-nfs.nix
+
+    ../../../profiles/shell.nix
+    # ../../../profiles/earlyoom # TODO
+
+    ../../../profiles/desktop
+    ../../../profiles/desktop/gnome # configures gdm
+    ../../../profiles/desktop/sound/pipewire.nix
+
+    ../../../profiles/desktop/steam.nix
+    #../../../profiles/desktop/xboxdrv.nix # TODO: try out
+    ../../../profiles/desktop/lutris.nix
+    ../../../profiles/desktop/flatpak.nix
+    ../../../profiles/desktop/waydroid.nix
+
+    ../../../profiles/printing.nix
+
+    ../../../profiles/known-hosts
+  ];
+
+  pbsds.nfs-lazy-mount.enable = true;
+
+  environment.systemPackages = [
+    pkgs.krita
+    pkgs.chromium
+  ];
+
+  time.timeZone = null; # allows imperative configuring
+
+  networking.firewall.allowedTCPPorts = [ 57621 ]; # spotify local discovery
+
+  hardware.bluetooth.enable = true;
+
+  # services.irqbalance.enable = true; # different balancer, avoids freezes, god for old laptops
+
+  # Networking
+  networking.networkmanager.enable = true;
+  #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  #networking.useDHCP = true;
+  #TODO: avahi? resolved? https://git.pvv.ntnu.no/Drift/pvv-nixos-config/src/main/base.nix#L15-L18
+
+  # TODO: remove? Move?
+  programs.dconf.enable = true;
+}

hosts/nixos/bolle/configuration.nix

@@ -0,0 +1,46 @@
+{ inputs, config, pkgs, lib, ... }:
+{
+  # Bootloader
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.efi.efiSysMountPoint = "/boot/efi";
+
+  boot.binfmt.emulatedSystems = [
+    "riscv64-linux"
+  ];
+
+  imports = [
+    ./hardware-configuration.nix
+    inputs.nixos-hardware.nixosModules.common-pc
+    inputs.nixos-hardware.nixosModules.common-pc-ssd
+    inputs.nixos-hardware.nixosModules.common-cpu-intel
+    ../../../hardware/gpu/intel.nix
+
+    ../../../profiles/sshd
+    # ../../../profiles/ccache # https://github.com/NixOS/nix/issues/9272
+    ../../../profiles/nix-cgroups.nix
+
+    ../../../users/pbsds
+    ../../../users/daniel
+    ../../../users/eirikwit
+    ../../../users/h7x4
+    ../../../users/adrlau
+    /* ../../../users/treefortwo */
+
+    ../../../profiles/shell.nix
+
+    # ../../../profiles/domeneshop-dyndns.nix
+    ../../../profiles/known-hosts
+  ];
+  # services.domeneshop-updater.targets = [ config.networking.fqdn ];
+
+  # Networking
+  networking.networkmanager.enable = true;
+
+  # use memory more efficiently at the cost of some compute
+  # zramSwap.enable = true;
+  # zramSwap.memoryPercent = 20;
+
+  # TODO: remove? Move?
+  programs.dconf.enable = true;
+}

hosts/nixos/eple/configuration.nix

@@ -0,0 +1,48 @@
+{ inputs, config, pkgs, lib, ... }:
+{
+  # Bootloader
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.efi.efiSysMountPoint = "/boot/efi";
+
+  boot.binfmt.emulatedSystems = [
+    "riscv64-linux"
+  ];
+
+  services.nfs.server.enable = false; # TODO: remove?
+
+  imports = [
+    ./hardware-configuration.nix
+    inputs.nixos-hardware.nixosModules.common-pc
+    inputs.nixos-hardware.nixosModules.common-pc-ssd
+    inputs.nixos-hardware.nixosModules.common-cpu-intel
+    ../../../hardware/gpu/intel.nix
+    ../../../hardware/gpu/rocm.nix
+
+    ../../../profiles/sshd
+    # ../../../profiles/ccache # https://github.com/NixOS/nix/issues/9272
+    ../../../profiles/nix-cgroups.nix
+
+    ../../../users/pbsds
+    ../../../users/bartvbl
+
+    # ../garp/sftp.nix # TODO: remove?
+
+    ../../../users/pbsds/syncthing.nix
+    ../../../profiles/mounts/panorama-zfs.nix
+
+    ../../../profiles/shell.nix
+
+    # ../../../profiles/domeneshop-dyndns.nix
+    ../../../profiles/known-hosts
+  ];
+  # services.domeneshop-updater.targets = [ config.networking.fqdn ];
+
+  networking.hostId = "43c43ded"; # needed for zfs: head -c 8 /etc/machine-id
+
+  # Networking
+  networking.networkmanager.enable = true;
+
+  # TODO: remove? Move?
+  programs.dconf.enable = true;
+}

hosts/nixos/garp/configuration.nix

@@ -0,0 +1,68 @@
+{ inputs, config, pkgs, lib, ... }:
+{
+  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  boot.binfmt.emulatedSystems = [
+    "riscv64-linux"
+  ];
+
+  #boot.kernelPackages = pkgs.linuxPackages_latest;
+  #hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.latest;
+  #hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.beta;
+  #hardware.nvidia.modesetting.enable = false; # makes atom behave, but mpv refuses to start
+
+  # The open source driver does not support Pascal GPUs (1080)
+  # https://github.com/NixOS/nixos-hardware/blob/master/common/gpu/nvidia/pascal/default.nix
+  hardware.nvidia.open = false;
+
+  # PRIME: (lspci)
+  #hardware.nvidia.prime.intelBusId  = "PCI:0:02:0";
+  #hardware.nvidia.prime.nvidiaBusId = "PCI:1:00:0";
+
+  imports = [
+    ./hardware-configuration.nix
+    inputs.nixos-hardware.nixosModules.common-pc
+    inputs.nixos-hardware.nixosModules.common-pc-ssd
+    inputs.nixos-hardware.nixosModules.common-cpu-intel-cpu-only
+    ../../../hardware/gpu/cuda.nix
+    ../../../hardware/gpu/zluda.nix
+
+    ../../../profiles/nix-ld.nix
+    ../../../profiles/sshd
+    # ../../../profiles/ccache # https://github.com/NixOS/nix/issues/9272
+    ../../../profiles/nix-cgroups.nix
+    #../../../profiles/no-suspend.nix
+    # ../../../profiles/oci/podman.nix
+    ../../../profiles/oci/docker.nix
+
+    ../../../users/pbsds
+    # ../../../users/daniel
+    # ../../../users/eirikwit
+    # ../../../users/h7x4
+    # ../../../users/adrlau
+
+    # ../../../profiles/mounts/freon-nfs.nix
+    # ../../../profiles/mounts/reidun-nfs.nix
+    # ../../../profiles/mounts/meconium-nfs.nix
+
+    # ./sftp.nix
+
+    ../../../profiles/shell.nix
+
+    ../../../profiles/known-hosts
+    # ../../../profiles/domeneshop-dyndns.nix
+  ];
+  # services.domeneshop-updater.targets = [ config.networking.fqdn ];
+
+  # Networking
+  networking.networkmanager.enable = true;
+
+  # use memory more efficiently at the cost of some compute
+  # zramSwap.enable = true;
+  # zramSwap.memoryPercent = 20;
+
+  # TODO: remove? Move?
+  programs.dconf.enable = true;
+}

hosts/nixos/garp/sftp.nix

@@ -0,0 +1,64 @@
+{ lib, config, ...}:
+
+let
+  chroot-path = "/run/sftp-chroot";
+  # sftp-paths."ifield" = "/opt/ifield"; # garp - no booty, now deleted
+  sftp-paths."ifield" = "/mnt/panorama/Backups/rocm.pbsds.net/ifield-mmarf/data/storage"; # eple
+in
+
+{
+
+  systemd.tmpfiles.settings."10-sftp-chroot" = {
+    "${chroot-path}".d = {
+      user = "root";
+      group = "root";
+      mode = "0755";
+    };
+  };
+
+  users.groups."sftp_users" = {
+    members = [ "pbsds" ];
+  };
+  users.users."sftp" = {
+    isSystemUser = true;
+    createHome = false;
+    home = chroot-path;
+    shell = null;
+    password = null; # deny password login
+    #hashedPassword = ""; # use mkpasswd
+
+    group = "sftp_users";
+    # TODO: can I somehow idmap instead?
+    extraGroups = [ "users" "pbsds" ];
+
+    openssh.authorizedKeys.keys = lib.mkMerge [
+      [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKaE4W5Qe+ZBRtsY2KiIHbpx6v+8KrgrVT8ZgFvSVbvz ifield-sftp"
+      ]
+      # no work?
+      # config.users.users."pbsds".authorizedKeys.keys
+    ];
+  };
+
+  services.openssh.sftpServerExecutable = "internal-sftp";
+  services.openssh.extraConfig = ''
+    Match User sftp
+      ChrootDirectory ${chroot-path}
+      ForceCommand internal-sftp
+      PasswordAuthentication no
+      PubkeyAuthentication yes
+      PermitTunnel no
+      AllowAgentForwarding no
+      AllowTcpForwarding no
+      X11Forwarding no
+  '';
+
+  imports = lib.flip lib.mapAttrsToList sftp-paths (target: source: {
+    fileSystems."${chroot-path}/${target}" = {
+      device = source;
+      options = ["ro" "bind"]; # Read only
+      # depends = [ "/" ];
+      noCheck = true; # skip fsck
+    };
+  });
+}

hosts/nixos/hasselknippe/configuration.nix

@@ -0,0 +1,67 @@
+{ inputs, config, pkgs, lib, ... }:
+/*
+
+https://wiki.pine64.org/wiki/Pinebook_Pro
+https://wiki.pine64.org/wiki/Pinebook_Pro_Software_Releases
+https://wiki.nixos.org/wiki/NixOS_on_ARM/PINE64_Pinebook_Pro
+https://github.com/NixOS/nixos-hardware/blob/master/pine64/pinebook-pro/README.md
+
+# tow-boot
+https://tow-boot.org/devices/pine64-pinebookPro.html
+https://github.com/Tow-Boot/Tow-Boot/releases
+
+# nixos aarch64 sd-images
+https://wiki.nixos.org/wiki/NixOS_on_ARM/Installation#SD_card_images_(SBCs_and_similar_platforms)
+
+https://wiki.nixos.org/wiki/NixOS_on_ARM
+https://wiki.nixos.org/wiki/NixOS_on_ARM/Initial_Configuration
+
+*/
+{
+  # Bootloader
+  #boot.loader.systemd-boot.enable = true;
+  #boot.loader.efi.canTouchEfiVariables = true;
+
+  imports = [
+    #./hardware-configuration.nix
+    inputs.nixos-hardware.nixosModules.pine64-pinebook-pro
+
+    # ../../../profiles/nix-ld.nix
+    ../../../profiles/sshd
+    # ../../../profiles/earlyoom.nix
+    # ../../../profiles/no-suspend.nix
+    # ../../../profiles/oci/podman.nix
+    # ../../../profiles/oci/docker.nix
+
+    ../../../users/pbsds
+
+    #../../../profiles/mounts/freon-nfs.nix
+    #../../../profiles/mounts/reidun-nfs.nix
+    #../../../profiles/mounts/meconium-nfs.nix
+    #../../../profiles/mounts/fridge-nfs.nix
+
+    ../../../profiles/shell.nix
+
+    ../../../profiles/desktop
+    ../../../profiles/desktop/gnome # configures gdm
+    ../../../profiles/desktop/sound/pipewire.nix
+
+    # ../../../profiles/desktop/steam.nix
+    # ../../../profiles/desktop/retroarch.nix
+    # ../../../profiles/desktop/flatpak.nix
+    # ../../../profiles/desktop/waydroid.nix
+
+    ../../../profiles/known-hosts
+  ];
+
+  environment.systemPackages = [
+      pkgs.pinebookpro-keyboard-updater
+  ];
+
+  networking.firewall.allowedTCPPorts = [ 57621 ]; # spotify local discovery
+
+  networking.networkmanager.enable = true;
+
+  # TODO: remove? Move?
+  programs.dconf.enable = true;
+}

hosts/nixos/nord/configuration.nix

@@ -0,0 +1,127 @@
+{ inputs, config, pkgs, lib, ... }:
+{
+  # Bootloader
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.efi.efiSysMountPoint = "/boot/efi";
+
+  # boot.kernel.sysctl."vm.swappiness" = lib.mkDefault 10; # 0-100, commonly 60
+  # swapDevices = lib.mkForce [];
+  # zramSwap.enable = true;
+  # zramSwap.memoryPercent = 20;
+
+  # for testing only, not for building
+  # boot.binfmt.addEmulatedSystemsToNixSandbox = false;
+  # boot.binfmt.emulatedSystems = [
+  #   # "armv7l-linux"
+  #   # "aarch64-linux"
+  #   # "riscv64-linux"
+  #   "i686-windows"
+  #   "x86_64-windows"
+  # ];
+
+  services.displayManager.autoLogin.enable = true;
+  services.displayManager.autoLogin.user = "pbsds";
+  # tmp: https://github.com/NixOS/nixpkgs/issues/103746#issuecomment-945091229
+  systemd.services."getty@tty1".enable = false;
+  systemd.services."autovt@tty1".enable = false;
+
+  # amdgpu audio fix when at 4k@60fps
+  # boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  #boot.kernelPackages = pkgs.linuxPackages_latest;
+  #hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.latest;
+  #hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.beta;
+  #hardware.nvidia.modesetting.enable = false; # makes atom behave, but mpv refuses to start
+
+  # The open source driver does not support Pascal GPUs (1080)
+  # https://github.com/NixOS/nixos-hardware/blob/master/common/gpu/nvidia/pascal/default.nix
+  hardware.nvidia.open = false;
+
+  # PRIME: (lspci)
+  #hardware.nvidia.prime.intelBusId  = "PCI:0:02:0";
+  #hardware.nvidia.prime.nvidiaBusId = "PCI:1:00:0";
+
+  imports = [
+    ./hardware-configuration.nix
+    inputs.nixos-hardware.nixosModules.common-pc
+    inputs.nixos-hardware.nixosModules.common-pc-ssd
+    inputs.nixos-hardware.nixosModules.common-cpu-intel-cpu-only
+    inputs.nixos-hardware.nixosModules.common-gpu-intel-sandy-bridge
+    # ../../../hardware/gpu/intel.nix
+    # ../../../hardware/gpu/cuda.nix
+    ../../../hardware/gpu/rocm.nix
+    ../../../hardware/gpu/zluda.nix
+    ../../../hardware/printer/discover.nix
+    ../../../profiles/hidpi.nix
+
+    ../../../profiles/nix-ld.nix
+    ../../../profiles/sshd
+    ../../../profiles/ccache
+    ../../../profiles/earlyoom.nix
+    #../../../profiles/oci/podman.nix
+    ../../../profiles/oci/docker.nix
+    # ../../../profiles/oci/distrobox.nix
+
+    #../../../profiles/vpn-pbsds/tailscale.nix
+
+    ../../../users/pbsds
+    ../../../users/pbsds/syncthing.nix
+
+    ../../../profiles/mounts/freon-nfs.nix
+    ../../../profiles/mounts/reidun-nfs.nix
+    ../../../profiles/mounts/meconium-nfs.nix
+    #../../../profiles/mounts/fridge-nfs.nix
+    #../../../profiles/mounts/fridge-sshfs.nix # TODO
+
+    ../../../profiles/shell.nix
+
+    ../../../profiles/desktop
+    ../../../profiles/desktop/gnome # configures gdm
+    ../../../profiles/desktop/sound/pipewire.nix
+
+    ../../../profiles/desktop/steam.nix
+    # ../../../profiles/desktop/retroarch.nix
+    ../../../profiles/desktop/flatpak.nix
+    # ../../../profiles/desktop/waydroid.nix
+
+    ../../../profiles/known-hosts
+    #../../../profiles/domeneshop-dyndns.nix
+  ];
+  # services.domeneshop-updater.targets = [ config.networking.fqdn ];
+
+  nix.settings.max-jobs = 1; # this host do be stinky
+
+  networking.firewall.allowedTCPPorts = [ 57621 ]; # spotify local discovery
+
+  #networking.wireguard.interfaces."wg0".ips = [ "172.22.48.4/24" ]; # fyrkat
+
+  environment.systemPackages = [
+    pkgs.cemu
+    pkgs.supertuxkart
+    pkgs.azahar # citra
+  ];
+
+
+  # Networking
+  networking.networkmanager.enable = true;
+  #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  networking.interfaces.eno1.ipv4.addresses = [
+    { address = "192.168.1.8"; prefixLength = 24; }
+  ];
+  networking.defaultGateway.address = "192.168.1.254";
+  networking.defaultGateway.interface = "eno1";
+  networking.nameservers = [
+    "192.168.1.254"
+    "8.8.8.8"
+    "1.1.1.1"
+  ];
+  #networking.useDHCP = true;
+  #TODO: avahi? resolved? https://git.pvv.ntnu.no/Drift/pvv-nixos-config/src/main/base.nix#L15-L18
+
+  # TODO: remove? Move?
+  programs.dconf.enable = true;
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+}

hosts/nixos/nord/hardware-configuration.nix

@@ -23,9 +23,10 @@
       fsType = "vfat";
     };
 
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/cd7b72b7-738a-4399-a887-ad69f6aa6ec9"; }
-    ];
+  swapDevices = [{
+    device = "/dev/disk/by-uuid/04a7ef41-239c-4830-8026-0797b73b7c59";
+    # randomEncryption.enable = true;
+  }];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

hosts/nixos/noximilien/configuration.nix

@@ -0,0 +1,158 @@
+{ inputs, config, pkgs, lib, ... }:
+{
+  # Bootloader
+  boot.loader.grub.enable      = true;
+  boot.loader.grub.device      = "/dev/sda";
+  boot.loader.grub.useOSProber = true;
+  imports = [
+    ./hardware-configuration.nix
+    inputs.nixos-hardware.nixosModules.common-pc
+    inputs.nixos-hardware.nixosModules.common-pc-ssd
+    inputs.nixos-hardware.nixosModules.common-cpu-intel
+    ../../../hardware/gpu/intel.nix
+
+    ../../../profiles/sshd
+    # ../../../profiles/oci/podman.nix
+
+    #./yt-dlp-archive.nix
+
+    # ../../../profiles/vpn-pbsds/headscale.nix # opens port 3478 # TODO: move outside of home net?
+
+    ../../../users/pbsds
+    ../../../users/jornane
+
+    ../../../profiles/mounts/freon-nfs.nix
+    ../../../profiles/mounts/reidun-nfs.nix
+    ../../../profiles/mounts/meconium-zfs.nix
+    # ../../../profiles/mounts/fridge-nfs.nix
+    # ../../../profiles/mounts/fridge-sshfs.nix # TODO
+
+    ../../../profiles/shell.nix
+
+    # ../../../profiles/services/tmate-server.nix # opens port 42244 # TODO: move outside of home net
+
+    # TODO:
+    # ../../../profiles/backup/client
+    # ../../../profiles/backup/server.nix # setups the sftp user
+
+    ../../../profiles/http # enables nginx+acme, defines mkDomain
+    ../../../profiles/http/index
+    # ../../../profiles/http/services/cache-proxy
+    # ../../../profiles/http/services/attic.nix
+    # ../../../profiles/http/services/cinny.nix
+    # ../../../profiles/http/services/element.nix
+    ../../../profiles/http/services/flexget.nix
+    # ../../../profiles/http/services/polaris.nix # TODO: fix
+    ../../../profiles/http/services/plex.nix
+    ../../../profiles/http/services/roundcube.nix
+    ../../../profiles/http/services/vaultwarden.nix
+    ../../../profiles/http/services/webdav-zotero.nix
+    # === decommissioned ===
+    # ../../../profiles/http/services/thelounge.nix
+    # ../../../profiles/http/services/redlib.nix
+    # ../../../profiles/http/services/invidious.nix
+    # ../../../profiles/http/services/gitea.nix
+    # ../../../profiles/http/services/rss-bridge.nix # TODO: move out of home net
+    # ../../../profiles/http/services/jellyfin.nix
+    # ../../../profiles/http/services/tautulli.nix # will run a first-time-setup where admin account is made
+    # ../../../profiles/http/services/netdata.nix # put behind firewall
+    # ../../../profiles/http/services/nitter.nix
+    # ../../../profiles/http/services/microbin.nix # TODO: move out of home net
+    # ../../../profiles/http/services/owncast.nix
+    # === incomplete ===
+    # ../../../profiles/http/services/hydra.nix
+    # ../../../profiles/http/services/mattermost.nix
+    # ../../../profiles/http/services/navidrome.nix
+    # ../../../profiles/http/services/ntopng.nix
+    # ../../../profiles/http/services/paperless.nix
+    # ../../../profiles/http/services/resilio.nix
+    # ../../../profiles/http/services/snappymail.nix # WIP
+    # ../../../profiles/http/services/garage/gunktrunk.nix
+    # ../../../profiles/http/services/convos.nix
+    # ../../../profiles/http/services/cryptpad.nix
+    # ../../../profiles/http/services/galene.nix
+    # ../../../profiles/http/services/graphana.nix
+    # ../../../profiles/http/services/hedgedoc.nix # TODO: move out of home net
+    # ../../../profiles/http/services/home-assistant.nix
+    # ../../../profiles/http/services/jitsi-meet.nix
+    # ../../../profiles/http/services/kukkee
+    # ../../../profiles/http/services/matrix-synapse.nix
+    # ../../../profiles/http/services/shlink.nix
+    # ../../../profiles/http/services/sourcegraph.nix
+    # ../../../profiles/http/services/censordodge.nix
+    # ../../../profiles/http/services/openspeedtest.nix
+
+    /**/
+    # TODO: move to a separate host, these suck to build
+    ../../../profiles/http/docs
+    # ../../../profiles/http/docs/pdoc.nix
+    # ../../../profiles/http/docs/python-docs.nix
+    ../../../profiles/http/docs/nixpkgs.nix
+    ../../../profiles/http/docs/home-manager.nix
+    ../../../profiles/http/docs/linux-docs.nix # TODO: fix
+    ../../../profiles/http/docs/programs.nix
+    ../../../profiles/http/docs/yagcd.nix
+    /**/
+
+    # TODO: make into flake inputs
+    # ../../../profiles/http/sites/linktree-pbsds.nix # github bby!! TODO: remove
+    # ../../../profiles/http/sites/refleksjon-no.nix
+    # ../../../profiles/http/sites/roroslyd-no.nix
+    ../../../profiles/http/sites/kuklefse.nix
+
+    # ../../../profiles/http/services/trivial-gradios
+
+    # ../../../profiles/code-remote # TODO: move into web? services?
+    ../../../profiles/domeneshop-dyndns.nix
+    ../../../profiles/known-hosts
+    /* ../../../profiles/autossh-reverse-tunnels */
+    # ../../../profiles/xrdp
+  ];
+  services.domeneshop-updater.targets = [
+    #"pbsds.net" # github bby!! TODO: remove
+    #"olavtr.pbsds.net" # KISS
+    config.networking.fqdn
+    "kuklef.se"
+  ];
+
+  nix.settings.max-jobs = 1; # this host do be stinky
+
+  networking.hostId = "e1ffd469"; # needed for zfs: head -c 8 /etc/machine-id
+
+  #networking.wireguard.interfaces."wg0".ips = [ "172.22.48.3/24" ]; # fyrkat
+
+  sops.secrets.flexget.sopsFile = ./secrets.yaml;
+  sops.secrets.atticd.sopsFile = ./secrets.yaml;
+
+  # TODO: remove? Move to where relevant?
+  nixpkgs.overlays = [
+    /** /
+    (final: prev: {
+      mapcrafter          = prev.callPackage /home/pbsds/repos/nixpkgs-mapcrafter/pkgs/tools/games/minecraft/mapcrafter/default.nix { };
+      mapcrafter-world112 = prev.callPackage /home/pbsds/repos/nixpkgs-mapcrafter/pkgs/tools/games/minecraft/mapcrafter/default.nix { world="world112"; };
+    })
+    /**/
+  ];
+
+  # Networking
+  networking.networkmanager.enable = true;
+  #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  #networking.iwd.enable = true # # alternative wireless backend, doesn't support eduroam
+  networking.interfaces.eno1.ipv4.addresses = [
+    { address = "192.168.1.9"; prefixLength = 24; }
+  ];
+  networking.nameservers = [
+    "192.168.1.254"
+    "8.8.8.8"
+    "1.1.1.1"
+  ];
+  networking.defaultGateway = {
+    address = "192.168.1.254";
+    interface = "eno1";
+  };
+  #networking.useDHCP = true;
+  #TODO: avahi? resolved? https://git.pvv.ntnu.no/Drift/pvv-nixos-config/src/main/base.nix#L15-L18
+
+  # TODO: remove? Move?
+  programs.dconf.enable = true;
+}

hosts/nixos/sopp/configuration.nix

@@ -0,0 +1,147 @@
+{ inputs, config, pkgs, lib, modulesPath, ... }:
+
+{
+  # Bootloader
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # add driver to stage-1 to make the usb dock not prevent boot
+  # https://github.com/NixOS/nixpkgs/issues/171625#issuecomment-2068283656
+  boot.kernelModules = [ "xhci_pci" "ehci_pci" ];
+
+  # boot.kernel.sysctl."vm.swappiness" = lib.mkDefault 10; # 0-100, commonly 60
+  # swapDevices = lib.mkForce [];
+  # zramSwap.enable = true;
+  # zramSwap.memoryPercent = 20;
+
+  # for testing only, not for building
+  boot.binfmt.addEmulatedSystemsToNixSandbox = false;
+  boot.binfmt.emulatedSystems = [
+    "aarch64-linux"
+    "armv7l-linux"
+    "riscv64-linux"
+  ];
+  #nix.settings.system = "x86_64-linux";
+  #nix.settings.extra-platforms = [ "i686-linux" ];
+
+  services.displayManager.autoLogin.enable = true;
+  services.displayManager.autoLogin.user = "pbsds";
+  # tmp: https://github.com/NixOS/nixpkgs/issues/103746#issuecomment-945091229
+  systemd.services."getty@tty1".enable = false;
+  systemd.services."autovt@tty1".enable = false;
+
+  hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.legacy_580 or config.boot.kernelPackages.nvidiaPackages.stable; # 580 is the last to support Pascal GPUs (1080)
+  #hardware.nvidia.modesetting.enable = false; # makes atom behave, but mpv refuses to start
+
+  # The open source driver does not support Pascal GPUs (1080)
+  # https://github.com/NixOS/nixos-hardware/blob/master/common/gpu/nvidia/pascal/default.nix
+  hardware.nvidia.open = false;
+
+  # PRIME: (lspci)
+  #hardware.nvidia.prime.intelBusId  = "PCI:0:02:0";
+  #hardware.nvidia.prime.nvidiaBusId = "PCI:1:00:0";
+
+  imports = [
+    ./hardware-configuration.nix
+    inputs.nixos-hardware.nixosModules.common-pc
+    inputs.nixos-hardware.nixosModules.common-pc-ssd
+    inputs.nixos-hardware.nixosModules.common-cpu-intel
+    ../../../hardware/gpu/intel.nix
+    ../../../hardware/gpu/cuda.nix
+    # ../../../hardware/gpu/rocm.nix
+    ../../../hardware/gpu/zluda.nix
+    # ../../../hardware/printer/discover.nix
+    ../../../hardware/printer/hp-laserjet-p1005.nix
+    ../../../hardware/printer/share.nix
+
+    ../../../profiles/nix-ld.nix
+    ../../../profiles/sshd
+    ../../../profiles/ccache
+    ../../../profiles/earlyoom.nix
+    ../../../profiles/no-suspend.nix
+    #../../../profiles/oci/podman.nix
+    ../../../profiles/oci/docker.nix
+    ../../../profiles/oci/distrobox.nix
+
+    ../../../users/pbsds
+    ../../../users/pbsds/syncthing.nix
+
+    ../../../profiles/mounts/freon-nfs.nix
+    ../../../profiles/mounts/reidun-nfs.nix
+    ../../../profiles/mounts/meconium-nfs.nix
+
+    ../../../profiles/shell.nix
+
+    ../../../profiles/desktop
+    ../../../profiles/desktop/gnome # configures gdm
+    ../../../profiles/desktop/sound/pipewire.nix
+
+    ../../../profiles/desktop/steam.nix
+    #../../../profiles/desktop/xboxdrv.nix # TODO: try out
+    ../../../profiles/desktop/lutris.nix
+    ../../../profiles/desktop/flatpak.nix
+
+    ../../../profiles/known-hosts
+    #../../../profiles/domeneshop-dyndns.nix
+  ];
+  # services.domeneshop-updater.targets = [ config.networking.fqdn ];
+
+  networking.firewall.allowedTCPPorts = [ 57621 ]; # spotify local discovery
+
+  hardware.bluetooth.enable = true;
+
+  environment.systemPackages = [
+    # pkgs.davinci-resolve # broken on cuda
+    pkgs.krita
+    # pkgs.pbsds.v4l2-play
+    # pkgs.librealsense-gui
+    # pkgs.freecad
+    pkgs.chromium
+    # pkgs.cemu
+    # pkgs.azahar # citra
+  ];
+
+
+  # Networking
+  /**/
+  networking.networkmanager.enable = true;
+  #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  networking.interfaces.enp3s0.wakeOnLan.enable = true;
+  networking.interfaces.enp3s0.ipv4.addresses = [
+    { address = "192.168.1.7"; prefixLength = 24; }
+  ];
+  networking.defaultGateway.address = "192.168.1.254";
+  networking.defaultGateway.interface = "enp3s0";
+  networking.nameservers = [
+    "192.168.1.254"
+    "8.8.8.8"
+    "1.1.1.1"
+  ];
+  #networking.useDHCP = true;
+  /** /
+  systemd.network.enable = true;
+  systemd.network.networks."50-static" = {
+    matchConfig.Name = "enp3s0";
+    address = [ "192.168.1.7/24" ];
+    gateway = [ "192.168.1.254" ];
+    dns = [ "192.168.1.254" "8.8.8.8" "1.1.1.1" ];
+    domains = [ config.networking.domain ]; # set by flake
+    networkConfig.IPv6AcceptRA = false;
+    linkConfig.RequiredForOnline = "routable"; # dependency for network-online.target
+  };
+  /** /
+  systemd.network.networks."51-dhcp" = {
+    matchConfig.Name = "enp3s0";
+    networkConfig.DHCP = "yes";
+    networkConfig.IPv6AcceptRA = true;
+    linkConfig.RequiredForOnline = "no"; # not always connected and not required to be online
+  };
+  /**/
+  #TODO: avahi? resolved? https://git.pvv.ntnu.no/Drift/pvv-nixos-config/src/main/base.nix#L15-L18
+
+  # TODO: remove? Move?
+  programs.dconf.enable = true;
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+}

hosts/nixos/sopp/hardware-configuration.nix

@@ -11,7 +11,9 @@
   boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" "wl" ];
-  boot.extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ];
+  # TODO: insecure...
+  # https://github.com/NixOS/nixpkgs/pull/421163/files
+  # boot.extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ];
 
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/4bdb8a48-2493-4043-80fa-254fbf910643";
@@ -23,9 +25,10 @@
       fsType = "vfat";
     };
 
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/e9b56879-e406-44c7-ab60-fcd374fdf0ea"; }
-    ];
+  swapDevices = [{
+    device = "/dev/disk/by-uuid/e9b56879-e406-44c7-ab60-fcd374fdf0ea";
+    # randomEncryption.enable = true;
+  }];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

hosts/nord/default.nix

@@ -1,73 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  # Bootloader
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.loader.efi.efiSysMountPoint = "/boot/efi";
-
-  services.xserver.displayManager.autoLogin.enable = true;
-  services.xserver.displayManager.autoLogin.user = "pbsds";
-  # tmp: https://github.com/NixOS/nixpkgs/issues/103746#issuecomment-945091229
-  systemd.services."getty@tty1".enable = false;
-  systemd.services."autovt@tty1".enable = false;
-
-  boot.kernelPackages = pkgs.linuxPackages_latest; # amdgpu audio fix when at 4k@60fps
-
-  imports = [
-    ./hardware-configuration.nix
-    ../../profiles/sshd.nix
-    #../../profiles/oci/podman.nix
-    #../../profiles/oci/docker.nix
-
-    #../../profiles/vpn-pbsds/tailscale.nix
-
-    ../../users/pbsds
-
-    ../../profiles/mounts/freon-nfs.nix
-    ../../profiles/mounts/reidun-nfs.nix
-    ../../profiles/mounts/meconium-nfs.nix
-    #../../profiles/mounts/fridge-nfs.nix
-
-    ../../profiles/shell.nix
-
-    ../../profiles/desktop/base.nix
-    ../../profiles/desktop/gnome # configures gdm
-    #../../profiles/desktop/sound/alsa.nix
-    #../../profiles/desktop/sound/pulseaudio.nix
-    ../../profiles/desktop/sound/pipewire.nix
-
-    ../../profiles/desktop/steam.nix
-    ../../profiles/desktop/flatpak.nix
-
-    ../../profiles/remote-builders.nix
-    #../../profiles/autossh-reverse-tunnels
-    #../../profiles/domeneshop-dyndns # handled by noximilien
-  ];
-
-  networking.firewall.allowedTCPPorts = [ 57621 ]; # spotify local discovery
-
-  #networking.wireguard.interfaces."wg0".ips = [ "172.22.48.4/24" ]; # fyrkat
-
-
-  # Networking
-  networking.networkmanager.enable = true;
-  #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-  networking.interfaces.eno1.ipv4.addresses = [
-    { address = "192.168.1.8"; prefixLength = 24; }
-  ];
-  networking.defaultGateway.address = "192.168.1.254";
-  networking.defaultGateway.interface = "eno1";
-  networking.nameservers = [
-    "192.168.1.254"
-    "8.8.8.8"
-    "1.1.1.1"
-  ];
-  #networking.useDHCP = true;
-  #TODO: avahi? resolved? https://git.pvv.ntnu.no/Drift/pvv-nixos-config/src/main/base.nix#L15-L18
-
-  # TODO: remove? Move?
-  programs.dconf.enable = true;
-
-  # Enable touchpad support (enabled default in most desktopManager).
-  # services.xserver.libinput.enable = true;
-}

hosts/noximilien/default.nix

@@ -1,140 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  # Bootloader
-  boot.loader.grub.enable      = true;
-  boot.loader.grub.device      = "/dev/sda";
-  boot.loader.grub.useOSProber = true;
-  imports = [
-    ./hardware-configuration.nix
-    ../../profiles/sshd.nix
-    #../../profiles/oci/podman.nix
-
-    #./yt-dlp-archive.nix
-
-
-    #../../profiles/vpn-pbsds/headscale.nix # opens port 3478 # TODO: move outside of home net?
-
-    ../../users/pbsds
-    ../../users/jornane
-
-    ../../profiles/mounts/freon-nfs.nix
-    ../../profiles/mounts/reidun-nfs.nix
-    ../../profiles/mounts/meconium-zfs.nix
-    #../../profiles/mounts/fridge-nfs.nix # TODO: fix
-
-    ../../profiles/shell.nix
-
-    #../../profiles/services/tmate-server.nix # opens port 42244 # TODO: move outside of home net
-
-    ../../profiles/http # enables nginx+acme, defines mkDomain
-    ../../profiles/http/index
-    ../../profiles/http/services/cinny.nix
-    ../../profiles/http/services/element.nix
-    ../../profiles/http/services/flexget.nix
-    ../../profiles/http/services/gitea.nix
-    #../../profiles/http/services/hydra.nix
-    ../../profiles/http/services/invidious.nix
-    #../../profiles/http/services/rss-bridge.nix # TODO: move out of home net
-    #../../profiles/http/services/jellyfin.nix
-    ../../profiles/http/services/plex.nix
-    #../../profiles/http/services/tautulli.nix # will run a first-time-setup where admin account is made
-    ../../profiles/http/services/libreddit.nix
-    #../../profiles/http/services/mattermost.nix
-    #../../profiles/http/services/navidrome.nix
-    #../../profiles/http/services/netdata.nix # put behind firewall
-    #../../profiles/http/services/nitter.nix
-    #../../profiles/http/services/ntopng.nix
-    #../../profiles/http/services/microbin.nix # TODO: move out of home net
-    #../../profiles/http/services/owncast.nix
-    #../../profiles/http/services/paperless.nix
-    ../../profiles/http/services/polaris.nix
-    #../../profiles/http/services/resilio.nix
-    ../../profiles/http/services/roundcube.nix
-    #../../profiles/http/services/snappymail.nix # WIP
-    ../../profiles/http/services/thelounge.nix
-    ../../profiles/http/services/vaultwarden.nix
-    ../../profiles/http/services/webdav-zotero.nix
-    #../../profiles/http/services/garage/gunktrunk.nix
-    #../../profiles/http/services/convos.nix
-    #../../profiles/http/services/cryptpad.nix
-    #../../profiles/http/services/galene.nix
-    #../../profiles/http/services/graphana.nix
-    #../../profiles/http/services/hedgedoc.nix # TODO: move out of home net
-    #../../profiles/http/services/home-assistant.nix
-    #../../profiles/http/services/jitsi-meet.nix
-    #../../profiles/http/services/kukkee
-    #../../profiles/http/services/matrix-synapse.nix
-    #../../profiles/http/services/shlink.nix
-    #../../profiles/http/services/sourcegraph.nix
-    #../../profiles/http/services/censordodge.nix
-    #../../profiles/http/services/openspeedtest.nix
-
-    /**/
-    # TODO: move to brumle
-    ../../profiles/http/docs
-    ../../profiles/http/docs/pdoc.nix
-    ../../profiles/http/docs/python-docs.nix
-    #../../profiles/http/docs/nixpkgs.nix # TODO: fix
-    ../../profiles/http/docs/home-manager.nix
-    #../../profiles/http/docs/linux-docs.nix # TODO: fix
-    ../../profiles/http/docs/programs.nix
-    ../../profiles/http/docs/yagcd.nix
-    /**/
-
-    #../../profiles/http/sites/linktree-pbsds.nix # github bby!! TODO: remove
-    ../../profiles/http/sites/refleksjon-no.nix
-    ../../profiles/http/sites/roroslyd-no.nix
-    ../../profiles/http/sites/kuklefse.nix
-
-    #../../profiles/http/services/trivial-gradios
-
-    #../../profiles/code-remote # TODO: move into web? services?
-    ../../profiles/domeneshop-dyndns
-    ../../profiles/remote-builders.nix
-    ../../profiles/autossh-reverse-tunnels
-    #../../profiles/xrdp
-  ];
-  services.domeneshop-updater.targets = [
-    #"pbsds.net" # github bby!! TODO: remove
-    "olavtr.pbsds.net"
-    "kuklef.se"
-  ];
-
-  networking.hostId = "e1ffd469"; # needed for zfs: head -c 8 /etc/machine-id
-
-  #networking.wireguard.interfaces."wg0".ips = [ "172.22.48.3/24" ]; # fyrkat
-
-  sops.secrets.flexget.sopsFile = ../../secrets/${config.networking.hostName}.yaml;
-
-  # TODO: remove? Move to where relevant?
-  nixpkgs.overlays = [
-    /** /
-    (final: prev: {
-      mapcrafter          = prev.callPackage /home/pbsds/repos/nixpkgs-mapcrafter/pkgs/tools/games/minecraft/mapcrafter/default.nix { };
-      mapcrafter-world112 = prev.callPackage /home/pbsds/repos/nixpkgs-mapcrafter/pkgs/tools/games/minecraft/mapcrafter/default.nix { world="world112"; };
-    })
-    /**/
-  ];
-
-  # Networking
-  networking.networkmanager.enable = true;
-  #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-  #networking.iwd.enable = true
-  networking.interfaces.eno1.ipv4.addresses = [
-    { address = "192.168.1.9"; prefixLength = 24; }
-  ];
-  networking.nameservers = [
-    "192.168.1.254"
-    "8.8.8.8"
-    "1.1.1.1"
-  ];
-  networking.defaultGateway = {
-    address = "192.168.1.254";
-    interface = "eno1";
-  };
-  #networking.useDHCP = true;
-  #TODO: avahi? resolved? https://git.pvv.ntnu.no/Drift/pvv-nixos-config/src/main/base.nix#L15-L18
-
-  # TODO: remove? Move?
-  programs.dconf.enable = true;
-}

hosts/sopp/default.nix

@@ -1,100 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  # Bootloader
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  boot.kernel.sysctl."vm.swappiness" = lib.mkDefault 10; # 0-100, commonly 60
-  boot.kernelModules = [ "xhci_pci" ]; # add driver to stage-1 to make the usb dock not prevent boot - https://github.com/NixOS/nixpkgs/issues/171625#issuecomment-2068283656
-
-  services.xserver.displayManager.autoLogin.enable = true;
-  services.xserver.displayManager.autoLogin.user = "pbsds";
-  # tmp: https://github.com/NixOS/nixpkgs/issues/103746#issuecomment-945091229
-  systemd.services."getty@tty1".enable = false;
-  systemd.services."autovt@tty1".enable = false;
-
-  #boot.kernelPackages = pkgs.linuxPackages_latest;
-  #hardware.nvidia.modesetting.enable = false; # makes atom behave, but mpv refuses to start
-  hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.beta;
-
-  # PRIME: (lspci)
-  #hardware.nvidia.prime.intelBusId  = "PCI:0:02:0";
-  #hardware.nvidia.prime.nvidiaBusId = "PCI:1:00:0";
-
-  imports = [
-    ./hardware-configuration.nix
-    ../../profiles/sshd.nix
-    ../../profiles/no-suspend.nix
-    #../../profiles/oci/podman.nix
-    ../../profiles/oci/docker.nix
-    ../../profiles/oci/distrobox.nix
-
-    ../../users/pbsds
-
-    ../../profiles/mounts/freon-nfs.nix
-    ../../profiles/mounts/reidun-nfs.nix
-    ../../profiles/mounts/meconium-nfs.nix
-
-    ../../profiles/shell.nix
-
-    ../../profiles/desktop/base.nix
-    ../../profiles/desktop/gnome # configures gdm
-    #../../profiles/desktop/sound/alsa.nix
-    #../../profiles/desktop/sound/pulseaudio.nix
-    ../../profiles/desktop/sound/pipewire.nix
-
-    ../../profiles/desktop/steam.nix
-    #../../profiles/desktop/xboxdrv.nix # TODO: try out
-    ../../profiles/desktop/lutris.nix
-    ../../profiles/desktop/flatpak.nix
-
-    ../../profiles/remote-builders.nix
-    #../../profiles/autossh-reverse-tunnels
-    #../../profiles/domeneshop-dyndns # handled by noximilien
-  ];
-
-  networking.firewall.allowedTCPPorts = [ 57621 ]; # spotify local discovery
-
-  # Networking
-  /**/
-  networking.networkmanager.enable = true;
-  #networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-  networking.interfaces.enp3s0.wakeOnLan.enable = true;
-  networking.interfaces.enp3s0.ipv4.addresses = [
-    { address = "192.168.1.7"; prefixLength = 24; }
-  ];
-  networking.defaultGateway.address = "192.168.1.254";
-  networking.defaultGateway.interface = "enp3s0";
-  networking.nameservers = [
-    "192.168.1.254"
-    "8.8.8.8"
-    "1.1.1.1"
-  ];
-  #networking.useDHCP = true;
-  /** /
-  systemd.network.enable = true;
-  systemd.network.networks."50-static" = {
-    matchConfig.Name = "enp3s0";
-    address = [ "192.168.1.7/24" ];
-    gateway = [ "192.168.1.254" ];
-    dns = [ "192.168.1.254" "8.8.8.8" "1.1.1.1" ];
-    domains = [ config.networking.domain ]; # set by flake
-    networkConfig.IPv6AcceptRA = false;
-    linkConfig.RequiredForOnline = "routable"; # dependency for network-online.target
-  };
-  /** /
-  systemd.network.networks."51-dhcp" = {
-    matchConfig.Name = "enp3s0";
-    networkConfig.DHCP = "yes";
-    networkConfig.IPv6AcceptRA = true;
-    linkConfig.RequiredForOnline = "no"; # not always connected and not required to be online
-  };
-  /**/
-  #TODO: avahi? resolved? https://git.pvv.ntnu.no/Drift/pvv-nixos-config/src/main/base.nix#L15-L18
-
-  # TODO: remove? Move?
-  programs.dconf.enable = true;
-
-  # Enable touchpad support (enabled default in most desktopManager).
-  # services.xserver.libinput.enable = true;
-}

hosts/system-manager/furiphoneflx1/modules/networking.nix

@@ -0,0 +1,40 @@
+{ lib, ... }:
+
+let
+  cfg = config.networking;
+in
+
+{
+  options = {
+    # from https://github.com/NixOS/nixpkgs/blob/799ba5bffed04ced7067a91798353d360788b30d/nixos/modules/tasks/network-interfaces.nix
+
+    networking.hostName = mkOption {
+      default = config.system.nixos.distroId;
+      defaultText = literalExpression "config.system.nixos.distroId";
+      type = types.strMatching
+        "^$|^[[:alnum:]]([[:alnum:]_-]{0,61}[[:alnum:]])?$";
+    };
+
+    networking.fqdn = mkOption {
+      readOnly = true;
+      type = types.str;
+      default = if (cfg.hostName != "" && cfg.domain != null)
+        then "${cfg.hostName}.${cfg.domain}"
+        else throw ''
+          The FQDN is required but cannot be determined. Please make sure that
+          both networking.hostName and networking.domain are set properly.
+        '';
+      defaultText = literalExpression ''"''${networking.hostName}.''${networking.domain}"'';
+      description = ''
+        The fully qualified domain name (FQDN) of this host. It is the result
+        of combining `networking.hostName` and `networking.domain.` Using this
+        option will result in an evaluation error if the hostname is empty or
+        no domain is specified.
+
+        Modules that accept a mere `networking.hostName` but prefer a fully qualified
+        domain name may use `networking.fqdnOrHostName` instead.
+      '';
+    };
+
+  };
+}

hosts/system-manager/furiphoneflx1/modules/udev.nix

@@ -0,0 +1 @@
+# TODO

hosts/system-manager/furiphoneflx1/system-configuration.nix

@@ -0,0 +1,61 @@
+{ lib, pkgs, config, nixosModulesPath, inputs, system, ... }:
+
+{
+
+  imports =
+    [
+      /* ./modules/udev.nix */
+      /* ../../../secrets */
+      /* ../../../profiles/lix.nix */
+      /* ../../../profiles/auto-upgrade.nix */
+      /* ../../../profiles/known-hosts */
+    ]
+    # import modules from nixos
+    # based on https://github.com/numtide/system-manager/blob/e09166d9d4eab2bf010c1589fbf4542a54b022e3/nix/modules/upstream/nixpkgs/default.nix#L9
+    ++ map (path: nixosModulesPath + path) [
+      /* "/config/nix.nix" */
+      /* "/config/nix-remote-build.nix" */
+      "/services/networking/tailscale.nix"
+    ];
+
+  # stub nixos shit
+  options =
+    let
+      stub = lib.mkOption { type = lib.types.raw; };
+    in {
+      networking.firewall = stub;
+      networking.dhcpcd = stub;
+      systemd.network = stub;
+    };
+
+  config = {
+
+    nixpkgs.overlays = [
+      /* inputs.system-manager-edge.overlays.packages */
+    ];
+    environment.systemPackages = [
+      /* pkgs.system-manager */
+      inputs.system-manager-edge.packages.${system}.system-manager # ewww
+
+      /* pkgs.superTuxKart */
+    ];
+
+    # https://github.com/soupglasses/nix-system-graphics
+    system-graphics.enable = true;
+
+    /** /
+    nix.registry.nixpkgs.flake = inputs.nixpkgs;
+    nix.registry.nixpkgs-unstable.flake = inputs.unstable;
+    nix.nixPath = [
+      "nixpkgs=${inputs.nixpkgs}"
+      "nixpkgs-unstable=${inputs.unstable}"
+    ];
+    /**/
+
+    # from https://wiki.archlinux.org/title/Power_management#Using_a_script_and_an_udev_rule
+    # in /etc/udev/rules.d/powersave.rules
+    # SUBSYSTEM=="power_supply", ATTR{online}=="0", RUN+="${lib.getExe tailscale} up"
+    # SUBSYSTEM=="power_supply", ATTR{online}=="1", RUN+="${lib.getExe tailscale} down"
+
+  };
+}

justfile

@@ -1,69 +1,546 @@
+set positional-arguments # makes variables accesible as $1 $2 $@
+export invokedir := invocation_directory()
+export GUM_CHOOSE_HEIGHT := "15"
 export GUM_FILTER_HEIGHT := "15"
+export FZF_DEFAULT_OPTS := "--height 15 --cycle --bind 'ctrl-a:toggle-all' " + env('FZF_DEFAULT_OPTS', "")
+
+#export hosts_nixos := `2>/dev/null nix eval .\#nixosConfigurations --apply builtins.attrNames --json`
+#export hosts_fhs   := `2>/dev/null nix eval .\#systemConfigs --apply builtins.attrNames --json`
 
 @_default:
   just "$(gum filter --placeholder "Pick a recipie..." $(just --summary --unsorted))"
 
-eval hostname=`just _a_host`:
-  nix eval .#nixosConfigurations.{{hostname}}.config.system.build.toplevel.outPath
+@eval $hostname=`just _a_host` $attrpath="system.build.toplevel.outPath" *args:
+  set -x; nix eval --log-format raw ".#nixosConfigurations.\"$hostname\".config.$attrpath" --show-trace "${@:3}"
+@eval-vm $hostname=`just _a_host` $attrpath="system.build.toplevel.outPath" *args:
+  # set -x; nix eval --log-format raw ".#nixosConfigurations.\"$hostname\".config.system.build.vm.outPath" --show-trace "${@:3}"
+  set -x; nix eval --log-format raw ".#nixosConfigurations.\"$hostname\".config.virtualisation.vmVariant.$attrpath" --show-trace "${@:3}"
+@eval-pkgs $hostname $attrpath *args:
+  set -x; nix eval --log-format raw ".#nixosConfigurations.\"$hostname\".pkgs.$attrpath" --show-trace "${@:3}"
+
+repl $hostname=`just _a_host`:
+  NIX_NO_NOM=1 nixos-rebuild --flake .#"$hostname" repl
+
+why-depends $hostname $attrpath:
+  nix why-depends .#nixosConfigurations."$hostname".config.system.build.toplevel .#nixosConfigurations."$hostname".pkgs."$attrpath"
+why-depends-drv $hostname $attrpath:
+  nix why-depends .#nixosConfigurations."$hostname".config.system.build.toplevel.drvPath .#nixosConfigurations."$hostname".pkgs."$attrpath"
 
 report hostname=`just _a_host`:
-  nix eval .#nixosReports.{{hostname}} --json | yq . --yaml-output | bat --language yaml --style plain --paging never
+  nix eval .#nixosReports."{{hostname}}" --json --show-trace | yq . --yaml-output --width=999999 | bat --language yaml --style plain --paging never
 
 reports:
-  nix eval .#nixosReports --json | yq . --yaml-output | bat --language yaml --style plain --paging never
+  nix eval .#nixosReports --json --show-trace | yq . --yaml-output --width=999999 | bat --language yaml --style plain --paging never
 
-update:
+pull: # used in .envrc, cannot be interative
+  #!/usr/bin/env -S bash -euo pipefail
+  tmp=$(mktemp -p .direnv/tmp -d)
+  if ! git diff --exit-code --quiet HEAD -- flake.lock >&/dev/null; then
+    cp flake.lock "$tmp"/dirty-flake.lock
+    git reset -- flake.lock
+    git restore -- flake.lock
+    cp flake.lock "$tmp"/clean-flake.lock # we could instead preserve the current git rev
+  fi
+  git pull --rebase --autostash
+  if grep -q "^=======" flake.lock; then
+    git reset -- flake.lock
+    rm flake.lock # git restore?
+    git checkout -- flake.lock
+  elif [[ -s "$tmp"/clean-flake.lock ]] && ! diff -q "$tmp"/clean-flake.lock flake.lock >&/dev/null; then
+    cp "$tmp"/flake-dirty.lock flake.lock
+  fi
+
+# --option access-tokens ""
+update *args: # interactive
+  #!/usr/bin/env -S bash -euo pipefail
+  args=("$@")
+  verbose() ( set -x; "$@"; )
+  if gum confirm "Pull first?" --default=yes; then
+    just pull
+  fi
+  if gum confirm "add --option access-tokens ''?" --default=no; then
+    args+=( --option access-tokens "" )
+  fi
+  if gum confirm "use --commit-lock-file?" --default=yes; then
+    verbose git reset flake.lock
+    verbose git restore flake.lock
+    # verbose git pull --rebase --autostash
+    verbose nix flake update --commit-lock-file "${args[@]}"
+  else
+    verbose nix flake update "${args[@]}"
+  fi
+  if gum confirm "prefetch inputs?" --default=yes; then
+    nix flake prefetch-inputs "${args[@]}"
+  fi
+  # mkdir -p .direnv/
+  # printf "%s\n" "$(date +%Y-%m-%d)" > .direnv/pull-date
+
+@update-select:
   git reset flake.lock
   git restore flake.lock
-  git pull --rebase --autostash
-  nix flake update --commit-lock-file
-  @mkdir -p .direnv/
-  @echo "$(date +%Y-%m-%d)" > .direnv/pull-date
+  nix eval --file flake.nix --apply 'x: builtins.attrNames x.inputs' --json \
+    | (printf "%s\n" --commit-lock-file '--option access-tokens ""'; jq '.[]' -r | tr '0123456789' '9876543210' | sort | tr '0123456789' '9876543210' | grep -v "^self$") \
+    | gum choose --no-limit \
+    | xargs nix flake update
+  git add flake.lock
 
-build:
-  nixos-rebuild build --accept-flake-config --show-trace --flake .
+dconf-pull:
+  ./users/pbsds/home/profiles/desktop/gnome/dconf-pull.sh
+  git diff ./users/pbsds/home/profiles/desktop/gnome/
+  -gum confirm "git add --patch?" --default=no \
+    && git add --patch ./users/pbsds/home/profiles/desktop/gnome/
+  -gum confirm "git checkout --path?" --default=no \
+    && git checkout --patch ./users/pbsds/home/profiles/desktop/gnome/
 
-test:
-  sudo nixos-rebuild test --accept-flake-config --show-trace --flake .
+alias pull-dconf := dconf-pull
 
-switch:
-  sudo nixos-rebuild switch --accept-flake-config --show-trace --flake .
+# todo: support system-manager?
+# todo: support nix-darwin?
+# todo: support nixbsd?
+# todo: support nixng?
+build $hostname="" *_:
+  #!/usr/bin/env -S bash -euo pipefail
+  if [[ "${hostname::1}" = "-" ]]; then
+    echo >&2 "WARNING(just): 'hostname' starts with '-', moving it to nix args..."
+    set -- "" "$@"; hostname=""
+  fi
+  set -x; nixos-rebuild build --accept-flake-config --show-trace --flake .#"$hostname" "${@:2}"
 
-boot:
-  sudo nixos-rebuild boot --accept-flake-config --show-trace --flake .
+build-vm hostname=`just _a_host` *_:
+  #!/usr/bin/env -S bash -euo pipefail
+  if [[ "${hostname::1}" = "-" ]]; then
+    echo >&2 "WARNING(just): 'hostname' starts with '-', moving it to nix args..."
+    set -- "" "$@"; hostname=""
+  fi
+  set -x; nixos-rebuild build-vm --accept-flake-config --show-trace --flake .#"$hostname" "${@:2}"
+
+build-vm-and-run $hostname=`just _a_host` *_:
+  #!/usr/bin/env -S bash -euo pipefail
+  [[ -n "$hostname" ]]
+  # TODO: setup ports?
+  # TODO: attach serial instead of gui?
+  # TODO: headless and ssh?
+  just build-vm "$hostname" "${@:2}"
+  set -x; ./result/bin/run-"$hostname"-vm
+
+# compares new closure against /run/current-system
+build-diff $hostname="" *_:
+  #!/usr/bin/env -S bash -euo pipefail
+  current_system="/run/current-system"
+  new_system="$(just build "$hostname" "${@:2}")"
+  echo >&2; set -x
+  # nvd diff "$current_system" "$new_system" # python based, slow
+  dix "$current_system" "$new_system" # rust based, fast, nixos-unstable only
+
+build-closure-size $hostname="" *_:
+  #!/usr/bin/env -S bash -euo pipefail
+  new_system="$(just build "$hostname" "${@:2}")"
+  echo; set -x
+  # nix path-info --recursive --size --closure-size --human-readable "$new_system" | sort -nk3 # broki
+  nix path-info --recursive --size --closure-size "$new_system" | sort -nk3 | numfmt --field=2,3 --to iec
+
+test *_:
+  #!/usr/bin/env -S bash -euo pipefail
+  if   [[ $# -gt 0 && "${1:-}" = "" ]]; then
+    echo >&2 "WARNING(just): first arg is empty, popping it off..."; shift
+  elif [[ $# -gt 0 && "${1::1}" != "-" ]]; then
+    echo >&2 "WARNING(just): first arg does not start with "-", is it a hostname?"
+  fi
+  set -x; sudo nixos-rebuild test --accept-flake-config --show-trace --flake . "$@"
+
+switch *_:
+  #!/usr/bin/env -S bash -euo pipefail
+  if   [[ $# -gt 0 && "${1:-}" = "" ]]; then
+    echo >&2 "WARNING(just): first arg is empty, popping it off..."; shift
+  elif [[ $# -gt 0 && "${1::1}" != "-" ]]; then
+    echo >&2 "WARNING(just): first arg does not start with "-", is it a hostname?"
+  fi
+  set -x; sudo nixos-rebuild switch --accept-flake-config --show-trace --flake . "$@"
+
+boot *_:
+  #!/usr/bin/env -S bash -euo pipefail
+  if   [[ $# -gt 0 && "${1:-}" = "" ]]; then
+    echo >&2 "WARNING(just): first arg is empty, popping it off..."; shift
+  elif [[ $# -gt 0 && "${1::1}" != "-" ]]; then
+    echo >&2 "WARNING(just): first arg does not start with "-", is it a hostname?"
+  fi
+  set -x; sudo nixos-rebuild boot --accept-flake-config --show-trace --flake . "$@"
+
+boot-and-reboot *_:
+  #!/usr/bin/env -S bash -euo pipefail
+  if   [[ $# -gt 0 && "${1:-}" = "" ]]; then
+    echo >&2 "WARNING(just): first arg is empty, popping it off..."; shift
+  elif [[ $# -gt 0 && "${1::1}" != "-" ]]; then
+    echo >&2 "WARNING(just): first arg does not start with "-", is it a hostname?"
+  fi
+  set -x
+  sudo nixos-rebuild boot --accept-flake-config --show-trace --flake . "$@"
+  sudo reboot # TODO: can i somehow ensure that the sudo hasn't timed out by this time?
+
+# TODO: does this support nixos-rebuild-ng?
+push $hostname=`just _a_host` cmd=`gum choose test switch boot --header "Select mode..."`:
+  #!/usr/bin/env -S bash -euo pipefail
+  remote_sudo=1
+  gum confirm "Use '--use-remote-sudo'?" || remote_sudo=0
+  # build once first for nom output
+  (set -x; nixos-rebuild build --flake .#"$hostname") || exit $?
+  # target_host="root@$(nix eval --log-format raw ".#nixosConfigurations.\"$hostname\".config.networking.fqdn" --json | jq . -r)"
+  target_host="$hostname"
+  printf "%s\n" pushing...
+  # nixos-rebuild will perform a build still, meaning another full eval...
+  # TODO: support a simple copy-closure with no activation on remote
+  if [[ "$remote_sudo" -eq 1 ]]; then
+    # set -x; NIX_NO_NOM=1 NIX_SSHOPTS="-t" nixos-rebuild {{cmd}} --flake .#"$hostname" --target-host "$target_host" --use-substitutes --use-remote-sudo
+    set -x; NIX_NO_NOM=1 IX_SSHOPTS="-o RequestTTY=force" nixos-rebuild {{cmd}} --flake .#"$hostname" --target-host "$target_host" --use-substitutes --use-remote-sudo
+  else
+    set -x; NIX_NO_NOM=1 nixos-rebuild {{cmd}} --flake .#"$hostname" --target-host "root@$target_host" --use-substitutes
+  fi
+
+home-why-depends $attrpath:
+  #!/usr/bin/env -S bash -euo pipefail
+  hostname="$(hostname)"
+  username="$(whoami)"
+  set -x
+  # assumes useGlobalPkgs
+  nix why-depends \
+    .#nixosConfigurations."${hostname}".config.home-manager.users."${username}".home.activationPackage \
+    .#nixosConfigurations."${hostname}".pkgs."$attrpath"
+
+home-eval $attrpath="home.activationPackage" *_:
+  #!/usr/bin/env -S bash -euo pipefail
+  hostname="$(hostname)"
+  username="$(whoami)"
+  set -x
+  nix eval --log-format raw .#nixosConfigurations."${hostname}".config.home-manager.users."${username}"."$attrpath" --show-trace "${@:2}"
+  # TODO: fallback to .#homeConfigurations.$(whoami) ?
+  # TODO: alternative behaviour for system-manager and nix-darwin
+
+home-build *_:
+  #!/usr/bin/env -S bash -euo pipefail
+  # home-manager build --flake .
+  # home-manager build --flake .#nixosConfigurations.$(hostname).config.home-manager.users.$(whoami)
+  hostname="$(hostname)"
+  username="$(whoami)"
+  set -x
+  nom build .#nixosConfigurations."${hostname}".config.home-manager.users."${username}".home.activationPackage "${@:1}"
+  # TODO: fallback to .#homeConfigurations.$(whoami) ?
+  # TODO: alternative behaviour for system-manager and nix-darwin
+
+home-build-diff *_: home-build
+  #!/usr/bin/env -S bash -euo pipefail
+  current_home="${XDG_STATE_HOME:-"$HOME/.local/state"}/home-manager/gcroots/current-home"
+  new_home="$(just home-build --print-out-paths "${@:1}")"
+  echo >&2; set -x
+  # nvd diff "$current_home" "$new_home" # python based, slow
+  dix "$current_home" "$new_home" # rust based, fast, nixos-unstable only
+
+home-build-closure-size *_:
+  #!/usr/bin/env -S bash -euo pipefail
+  new_home="$(just home-build --print-out-paths "${@:1}")"
+  set -x
+  # nix path-info --recursive --size --closure-size --human-readable "$new_home" | sort -nk3 # broki
+  nix path-info --recursive --size --closure-size "$new_home" | sort -nk3 | numfmt --field=2,3 --to iec
+
+home-switch *_:
+  #!/usr/bin/env -S bash -euo pipefail
+  new_home="$(just home-build --print-out-paths "${@:1}")"
+  set -x
+  # ./result/activate
+  "$new_home"/activate
+
+# QoL
+alias hm-build              := home-build
+alias hm-build-diff         := home-build-diff
+alias hm-build-closure-size := home-build-closure-size
+alias hm-switch             := home-switch
+alias build-home              := home-build
+alias build-diff-home         := home-build-diff
+alias build-closure-size-home := home-build-closure-size
+alias switch-home             := home-switch
+
+# test-files $hostname=`just _a_host` *filenames:
+#   #!/usr/bin/env -S bash -euo pipefail
+#   # TODO: remember previous choices
+#   [[ -n "$hostname" ]] || { printf >&2 "%s\n" "ERROR: no hostname"; false; }
+#   declare -a filenames=("${@:2}")
+#   if [[ "${#filenames[@]}" -eq 0 ]]; then
+#     etcfiles=$(
+#       nix eval ".#nixosConfigurations.\"$hostname\".config.environment.etc" --json \
+#         --apply 'builtins.mapAttrs (k: v: { inherit (v) enable target mode; })'
+#     )
+#     homekeys=$(
+#       nix eval ".#nixosConfigurations.\"$hostname\".config.home-manager.users" --json \
+#         --apply 'builtins.mapAttrs (user: config: { inherit (config.home) homeDirectory; files = builtins.mapAttrs (k: v: { inherit (v) enable target recursive; }) config.home.file; } )'
+#         # | jq 'to_entries[]| .key as $user | .value.homeDirectory as $homeDirectory | .value.files | to_entries[] | select(.value) | [ "config.home-manager.users.\"\($user)\".home.file.\"\(.key)\"", $homeDirectory + "/" + .value.target, .value.target, .key, $user, $homeDirectory] | @tsv' -r
+#     )
+#     filepathindex=$(
+#       jq --null-input -c \
+#         --arg     hostname "$hostname" \
+#         --argjson etcfiles "$etcfiles" \
+#         --argjson homekeys "$homekeys" \
+#         '{
+#           "nixosConfigurations.\"\($hostname)\".config.environment.etc": (
+#             $etcfiles | with_entries( select(.value.enable) | { key, value: (.value + { target : ("/etc/" + .value.target) }) } )
+#           )
+#         } + (
+#           $homekeys | with_entries(
+#             .key as $user |
+#             .value.homeDirectory as $homeDirectory |
+#             {
+#               key: ("nixosConfigurations.\"\($hostname)\".config.home-manager.users.\"\($user)\".home.file"),
+#               value: (
+#                 .value.files | with_entries(
+#                   select(.value.enable) | {
+#                     key,
+#                     value: (.value + {
+#                       target: ($homeDirectory + "/" + .value.target),
+#                     }),
+#                   }
+#                 )
+#               ),
+#             }
+#           )
+#         )'
+#     )
+
+#     # cache
+#     if [[ "$UID" -ne 0 ]]; then
+#       mkdir -p .direnv/
+#       cat <<<"$filepathindex" >.direnv/just-cache-test-files-"$hostname".json
+#     fi
+#   else
+#     [[ -s .direnv/just-cache-test-files-"$hostname".json ]] || { printf >&2 "%s\n" "ERROR: no cache found"; false; }
+#     filepathindex=$(cat .direnv/just-cache-test-files-"$hostname".json)
+#   fi
+
+#   if [[ "${#filenames[@]}" -eq 0 ]]; then
+#     filenames=$(
+#       set +e
+#       jq <<<"$filepathindex" 'to_entries[] | .value | to_entries[] | .value' -r \
+#         | fzf --height=50% --reverse --multi -d$'\t' --with-nth 2
+#     )
+#     [[ -n "$selection" ]]
+#   fi
+
+#   # jq <<<"$filepathindex" . ; false
+
+#   filepathindex_inverse=$(
+#     jq <<<"$filepathindex" 'with_entries( .key as $attr | .value | to_entries[] | {key: .value.target, value: (.value + {attr: $attr, key})} )' -c
+#   )
+#   # jq <<<"$filepathindex_inverse" . ; false
+
+#   # jq <<<"$filepathindex" 'to_entries[] | .key as $attr | .value | to_entries[] | @sh "\(.value) \($attr).\("\""+.key+"\"")"' -r
+
+#   nix_expr=$(
+#     printf "%s\n" 'pkgs.writeScript "do" ('
+#     printf '"%s\\n" +\n' '#!${pkgs.runtimeShell}'
+#     printf '"%s\\n" +\n' 'set -euo pipefail'
+#     printf '"%s\\n" +\n' 'sudo : && SUDO=sudo || SUDO=:'
+#     printf "%s\n" "${filenames[@]}" |
+#       jq -sR --argjson index "$filepathindex_inverse" '
+#         split("\n") | map(select(.==""|not) | $index[.] ) | group_by(.attr) | map(
+#           "  (let cfg = \(.[0].attr); in '"''"'" + (map(
+#             if .target | startswith("/etc/") then
+#               if .mode == "symlink" and false then "
+#                 $SUDO ln -sfn ${cfg.\"\(.key)\".source} \(.target | @sh )
+#               " else "
+#                 $SUDO rm -rf \(.target | @sh )
+#                 $SUDO cp -a ${cfg.\"\(.key)\".source} \(.target | @sh )
+#                 $SUDO chown -R ${toString cfg.\"\(.key)\".uid}:${toString cfg.\"\(.key)\".gid} \(.target | @sh )
+#                 $SUDO chmod -R ${toString cfg.\"\(.key)\".uid}:${toString cfg.\"\(.key)\".gid} \(.target | @sh )
+#                 # TODO: cfg.\"\(.key)\".user
+#                 # TODO: cfg.\"\(.key)\".group
+#               " end
+#             else
+#               if .recursive then
+#                 "${lib.getExe pkgs.lndir} -silent ${cfg.\"\(.key)\".source} \(.target | @sh )\n"
+#               else
+#                 "ln -sfn ${cfg.\"\(.key)\".source} \(.target | @sh )\n"
+#               end
+#             end
+#           ) | join("")) + "'"''"')"
+#         ) | join(" + \n")
+#       ' -r
+#     printf "%s\n" ')'
+#   )
+#   # printf "%s\n" "$nix_expr" ; false
+
+#   flake=$(nix flake archive  . --json | jq .path -r)
+#   nix build --impure --expr "with (builtins.getFlake ''$flake''); let inherit (nixosConfigurations.\"$hostname\") pkgs; in $nix_expr" --show-trace
+#   false
+
+#   # TODO: run the result
 
-push hostname=`just _a_host` cmd=`gum choose test switch boot --header "Select mode..."`:
-  nixos-rebuild build --flake .#{{hostname}}
-  @echo pushing...
-  NIX_NO_NOM=1 NIX_SSHOPTS="-tt" nixos-rebuild {{cmd}} --flake .#{{hostname}} --use-remote-sudo --target-host $(nix eval .#nixosReports.{{hostname}}.fqdn --json | jq . -r) --use-substitutes
 
 inspect:
   nix run -- nixpkgs#nix-inspect -p .
 
+inspect-config host=`just _a_host` prefix="":
+  nix run -- nixpkgs#nix-inspect  -e '(builtins.getFlake "'"$PWD"'").nixosConfigurations."{{host}}".config{{ if prefix == "" { "" } else { "." + prefix } }}'
+
+_nixos_attrnames:
+  #!/usr/bin/env -S bash -euo pipefail
+  hostname=$(hostname)
+  cachefile=.direnv/just-cache-nixos-attrnames.txt
+  if [[ flake.nix -nt "$cachefile" ]]; then
+    hostnames=$(nix eval .#nixosConfigurations --apply builtins.attrNames --json 2>/dev/null | jq '.[]' -r)
+    if [[ "$(grep <<<"$hostnames" -Fx "$hostname" | wc -l)" -eq 1 ]]; then
+      hostnames="$(printf "%s\n" "$hostname"; grep <<<"$hostnames" -v "^$hostname$")"
+    fi
+    if [[ "$UID" -ne 0 ]]; then
+      mkdir -p .direnv/
+      cat <<<"$hostnames" >"$cachefile"
+    fi
+  else
+    hostnames="$(cat $cachefile)"
+  fi
+  current_remote=$(just remote-current)
+  if [[ -n "$current_remote" && "$current_remote" != "$hostname" && "$(grep <<<"$hostnames" -Fx "$current_remote" | wc -l)" -eq 1 ]]; then
+    head -n1 <<<"$hostnames"
+    printf "%s\n" "$current_remote"
+    tail -n+2 <<<"$hostnames" | grep -vFx "$current_remote"
+  else
+    printf "%s\n" "$hostnames"
+  fi
+
 @_a_host:
-  nix eval .#nixosConfigurations --apply builtins.attrNames --json 2>/dev/null | jq '.[]' -r | gum filter --placeholder "Pick a host..."
+  # just _nixos_attrnames | gum filter --placeholder "Pick a host..."
+  # just _nixos_attrnames | fzf --reverse
+  just _nixos_attrnames | fzf
+
+@_some_hosts:
+  # just _nixos_attrnames | gum filter --placeholder "Pick a host..." --no-limit
+  # just _nixos_attrnames | fzf --reverse --multi
+  just _nixos_attrnames | fzf --multi
+
+_nixos_fqdns:
+  #!/usr/bin/env -S bash -euo pipefail
+  cachefile=.direnv/just-cache-nixos-fqdns.json
+  if [[ flake.nix -nt "$cachefile" ]]; then
+    mkdir -p .direnv/
+    fqdns=$(nix eval .#nixosConfigurations --apply 'builtins.mapAttrs (_: x: x.config.networking.fqdn)' --json 2>/dev/null)
+    if [[ "$UID" -ne 0 ]]; then
+      cat <<<"$fqdns" >"$cachefile"
+    fi
+  else
+    fqdns=$( cat "$cachefile" )
+  fi
+  just _nixos_attrnames | jq -R --argjson fqdns "$fqdns" '$fqdns[.]' -r
+
+@_a_fqdn:
+  # just _nixos_fqdns | gum filter --placeholder "Pick a host..."
+  # just _nixos_fqdns | fzf --reverse
+  just _nixos_fqdns | fzf
+
+@_some_fqdns:
+  # just _nixos_fqdns | gum filter --placeholder "Pick a host..." --no-limit
+  # just _nixos_fqdns | fzf --reverse --multi
+  just _nixos_fqdns | fzf --multi
 
 @remote-current:
-  >&2 echo Current remote: $(remote-host)
+  # remote-host # slow
+  test ! -s .remote.toml || \
+  printf "%s\n" "$(tomlq <.remote.toml '.hosts | to_entries[] | select(.value.default==true) | .value.host' -r)"
 
 @remote-list:
   tomlq <.remote.toml '.hosts | to_entries[] | "remote-set \(.key+1) # -> \(.value.host)"' -r
 
-@_a-remote-label:
+@remote-set remote=`just remote-current >&2 && just _a_remote_label`:
+  remote-set "{{remote}}"
+
+motd:
+  #!/usr/bin/env -S bash -euo pipefail
+  printf "%s\n" "Current remote: $(just remote-current)"
+  just remote-list
+  printf "\n"
+  todos=$(rg 'TODO' | wc -l)
+  if [[ "$todos" -gt 10 ]]; then
+    printf "%s\n" "There are $todos 'TODO's"
+  fi
+
+sops-pubkey-user:
+  #!/usr/bin/env -S bash -euo pipefail
+  keyfile="${XDG_CONFIG_HOME:-"$HOME"/.config}"/sops/age/keys.txt
+  if [[ ! -s "$keyfile" ]]; then
+    gum confirm "Generate a new age key at $(hostname):$keyfile?" # otherwise error
+    (
+      set -x
+      mkdir -p "$(dirname "$keyfile")"
+      age-keygen -o "$keyfile" >/dev/null
+    )
+  fi
+  age-keygen -y "$keyfile"
+
+sops-pubkey-system:
+  #!/usr/bin/env -S bash -euo pipefail
+  ssh-to-age </etc/ssh/ssh_host_ed25519_key.pub
+
+# ===== helpers =====
+
+@_a_remote_label:
   just remote-list | gum filter --placeholder "Pick a remote..." | cut -d' ' -f2
 
-@_a-remote-fqdn:
+@_some_remote_labels:
+  just remote-list | gum filter --placeholder "Pick remotes..." --no-limit | cut -d' ' -f2
+
+@_some_remote_label_names:
+  just remote-list | gum filter --placeholder "Pick remotes..." --no-limit | tr ' ' '\t' | cut -f2,5
+
+@_a_remote_fqdn:
   just remote-list | gum filter --placeholder "Pick a remote..." | cut -d' ' -f5-
 
-@remote-set remote=`just remote-current && just _a-remote-label`:
-  remote-set {{remote}}
+@_some_remote_fqdns:
+  just remote-list | gum filter --placeholder "Pick remote..." --no-limit | cut -d' ' -f5-
+
+_remote_ensure $hostname=`just _a_fqdn`:
+  #!/usr/bin/env -S bash -euo pipefail
+  if test ! -s .remote.toml; then
+    remote-init "$hostname"
+  elif tomlq <.remote.toml '.hosts | to_entries[] |.value.host' -r | grep -q "$hostname"; then
+    true
+  else
+    remote-add "$hostname"
+  fi
+
+@_remote_label_from_fqdn hostname=`just _a_fqdn`:
+  tomlq <.remote.toml '.hosts | to_entries[] | select(.value.host == "{{ hostname }}") | .key+1' -r
+
+remote-mprocs *cmd:
+  #!/usr/bin/env -S bash -euo pipefail
+  declare -a cmd=("$@")
+  if [[ "${#cmd[@]}" -eq 0 ]]; then
+    cmd=($(just --summary --unsorted | xargs printf "just %s\n" | gum filter --placeholder "Pick a recipie..."))
+    [[ "${#cmd[@]}" -gt 0 ]]
+  fi
+  escaped_cmd="$(printf " %q" "${cmd[@]}" | cut -c2-)"
+
+  declare -a labels=()
+  declare -a names=()
+  label_names=$(just _some_remote_label_names | grep .)
+  readarray -td $'\n' labels < <( cut -f1 <<<"$label_names" )
+  readarray -td $'\n' names  < <( cut -f2 <<<"$label_names" )
+  # printf "%s\n" "${label_names[@]}"; exit # DEBUG
+  # printf "%s\n" "${labels[@]}"; exit # DEBUG
+  # printf "%s\n" "${names[@]}"; exit # DEBUG
+
+  readarray -td $'\n' commands <<<"$(
+    # # TODO: when tmux exits the output is cleared
+    # printf "tmux new \"remote --label=%q ${escaped_cmd//%/%%} ; read\" \; set-option destroy-unattached\n" "${labels[@]}"
+    printf "remote --label=%q \"${escaped_cmd//%/%%}\"\n" "${labels[@]}"
+  )"
+  # mprocs --names "$(IFS=','; printf "%s" "${names[*]}")" "${commands[@]}"
+  mprocs --names "$(IFS=','; printf "%s" "${names[*]}")" "${commands[@]}" --on-all-finished '{c: quit-or-ask}'
+
+@remote-mprocs-init +$cmd=`printf "just %s\n" $(just --summary --unsorted) | gum filter --placeholder "Pick a recipie..."`:
+  just _some_fqdns | xe -s 'just _remote_ensure "$1"; just _remote_label_from_fqdn "$1"' | sed -E 's/(.*)/remote --label="\1" "env NIX_NO_NOM=1 $cmd"/g' | xargs -d'\n' mprocs
 
 # TODO: support multiple labels, run in tmux
-remote label=`just _a-remote-label` cmd=`printf "just %s\n" $(just --summary --unsorted) | gum filter --placeholder "Pick a recipie..."`:
-  remote --label={{label}} {{cmd}}
+#remote label=`just _a_remote_label` cmd=`printf "just %s\n" $(just --summary --unsorted) | gum filter --placeholder "Pick a recipie..."`:
+#  remote --label={{label}} {{cmd}}
 
 # TODO: packaged as nix-web
 @gorgon:
   # https://codeberg.org/gorgon/gorgon/src/branch/main/nix-web
   # https://discourse.nixos.org/t/a-web-ui-for-the-nix-store-early-beta/35762
-  nix run 'git+https://codeberg.org/gorgon/gorgon#nix-web'
+  # nix run 'git+https://codeberg.org/gorgon/gorgon#nix-web'
+  nix run nixpkgs#nix-web

lib.nix

@@ -0,0 +1,94 @@
+{ inputs }:
+let
+  nlib = inputs.nixpkgs-edge.lib;
+
+  ellipsis =
+    maxlen: take: str:
+    if builtins.stringLength str > maxlen then builtins.substring 0 take str + "..." else str;
+
+  denix =
+    str:
+    builtins.concatStringsSep "/nix/store/..." (
+      builtins.filter builtins.isString (builtins.split "(/nix/store/[^ /-]+.?)" str)
+    );
+
+  # make a pretty summary of a lib.nixosSystem
+  mkNixosConfigSummary =
+    nixosSystem:
+    let
+      cfg = nixosSystem.config;
+      inherit (nixosSystem) pkgs;
+      inherit (pkgs) lib;
+    in
+    {
+      system =
+        if pkgs.stdenv.hostPlatform.system == pkgs.stdenv.buildPlatform.system then
+          pkgs.stdenv.hostPlatform.system
+        else
+          {
+            # inherit (pkgs.stdenv) hostPlatform buildPlatform;
+            hostPlatform = pkgs.stdenv.hostPlatform.system;
+            buildPlatform = pkgs.stdenv.buildPlatform.system;
+          };
+      inherit (cfg.boot.binfmt) emulatedSystems;
+      inherit (cfg.networking) hostName fqdn search;
+      inherit (cfg.networking.firewall) allowedTCPPorts allowedUDPPorts;
+      buildMachines = lib.pipe cfg.nix.buildMachines [
+        (map (buildMachine: "${buildMachine.protocol}:${buildMachine.sshUser}@${buildMachine.hostName}"))
+        (lib.sort (a: b: a < b))
+      ];
+      users = lib.pipe cfg.users.users [
+        (lib.filterAttrs (uname: user: user.isNormalUser || user.openssh.authorizedKeys.keys != [ ]))
+        (lib.mapAttrs (
+          uname: user: {
+            inherit (user) home;
+            authorizedKeys = lib.sort (a: b: a < b) (
+              lib.forEach user.openssh.authorizedKeys.keys (
+                key:
+                lib.pipe key [
+                  (lib.splitString " ")
+                  (map denix)
+                  (map (ellipsis 60 12))
+                  (lib.concatStringsSep " ")
+                ]
+              )
+            );
+          }
+        ))
+      ];
+      nix-system-features = cfg.nix.settings.system-features;
+      bootloader =
+        if cfg.boot.loader.grub.enable then
+          "grub"
+        else if cfg.boot.loader.systemd-boot.enable then
+          "systemd-boot"
+        else if cfg.boot.isContainer then
+          "container"
+        else
+          null;
+      mounts =
+        lib.pipe cfg.fileSystems [
+          (lib.filterAttrs (mount: fs: fs.fsType != "nfs")) # spammy
+          (lib.mapAttrs (mount: fs: "${fs.fsType}://${fs.device}"))
+        ]
+        // lib.pipe cfg.swapDevices [
+          (lib.map (s: s.device or s.label))
+          (
+            sx:
+            lib.optionalAttrs (sx != [ ]) {
+              swap = if lib.length sx == 1 then lib.head sx else sx;
+            }
+          )
+        ];
+    }
+    // lib.optionalAttrs cfg.services.nginx.enable {
+      nginx-vhosts = lib.pipe cfg.services.nginx.virtualHosts [
+        (lib.filterAttrs (domain: vhost: vhost == "_"))
+        (lib.mapAttrs (domain: vhost: vhost.serverAliases or [ ]))
+      ];
+    };
+
+in
+{
+  inherit mkNixosConfigSummary;
+}

other/wiiuxinput-antimicro.gamecontroller.amgp

@@ -0,0 +1,316 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<gamecontroller configversion="19" appversion="3.4.0">
+    <!--The SDL name for a joystick is included for informational purposes only.-->
+    <sdlname>Atari Xbox 360 Game Controller</sdlname>
+    <!--The Unique ID for a joystick is included for informational purposes only.-->
+    <uniqueID>030081b85e0400008e020000010100001118654</uniqueID>
+    <profilename>Xbox Generic</profilename>
+    <stickAxisAssociation index="2" xAxis="3" yAxis="4"/>
+    <stickAxisAssociation index="1" xAxis="1" yAxis="2"/>
+    <vdpadButtonAssociations index="1">
+        <vdpadButtonAssociation axis="0" button="12" direction="1"/>
+        <vdpadButtonAssociation axis="0" button="13" direction="4"/>
+        <vdpadButtonAssociation axis="0" button="14" direction="8"/>
+        <vdpadButtonAssociation axis="0" button="15" direction="2"/>
+    </vdpadButtonAssociations>
+    <names>
+        <controlstickname index="2">R Stick</controlstickname>
+        <controlstickname index="1">L Stick</controlstickname>
+    </names>
+    <sets>
+        <set index="1">
+            <stick index="2">
+                <stickbutton index="8">
+                    <wheelspeedx>70</wheelspeedx>
+                    <wheelspeedy>70</wheelspeedy>
+                </stickbutton>
+                <stickbutton index="1">
+                    <wheelspeedx>70</wheelspeedx>
+                    <wheelspeedy>70</wheelspeedy>
+                    <slots>
+                        <slot>
+                            <code>4</code>
+                            <mode>mousebutton</mode>
+                        </slot>
+                    </slots>
+                </stickbutton>
+                <stickbutton index="3">
+                    <wheelspeedx>70</wheelspeedx>
+                    <wheelspeedy>70</wheelspeedy>
+                    <slots>
+                        <slot>
+                            <code>7</code>
+                            <mode>mousebutton</mode>
+                        </slot>
+                    </slots>
+                </stickbutton>
+                <stickbutton index="2">
+                    <wheelspeedx>70</wheelspeedx>
+                    <wheelspeedy>70</wheelspeedy>
+                </stickbutton>
+                <stickbutton index="5">
+                    <wheelspeedx>70</wheelspeedx>
+                    <wheelspeedy>70</wheelspeedy>
+                    <slots>
+                        <slot>
+                            <code>5</code>
+                            <mode>mousebutton</mode>
+                        </slot>
+                    </slots>
+                </stickbutton>
+                <stickbutton index="4">
+                    <wheelspeedx>70</wheelspeedx>
+                    <wheelspeedy>70</wheelspeedy>
+                </stickbutton>
+                <stickbutton index="7">
+                    <wheelspeedx>70</wheelspeedx>
+                    <wheelspeedy>70</wheelspeedy>
+                    <slots>
+                        <slot>
+                            <code>6</code>
+                            <mode>mousebutton</mode>
+                        </slot>
+                    </slots>
+                </stickbutton>
+                <stickbutton index="6">
+                    <wheelspeedx>70</wheelspeedx>
+                    <wheelspeedy>70</wheelspeedy>
+                </stickbutton>
+            </stick>
+            <stick index="1">
+                <deadZone>5628</deadZone>
+                <maxZone>31629</maxZone>
+                <diagonalRange>90</diagonalRange>
+                <squareStick>55</squareStick>
+                <stickbutton index="8">
+                    <mousespeedx>135</mousespeedx>
+                    <mousespeedy>135</mousespeedy>
+                </stickbutton>
+                <stickbutton index="1">
+                    <mousespeedx>135</mousespeedx>
+                    <mousespeedy>135</mousespeedy>
+                    <slots>
+                        <slot>
+                            <code>1</code>
+                            <mode>mousemovement</mode>
+                        </slot>
+                    </slots>
+                </stickbutton>
+                <stickbutton index="3">
+                    <mousespeedx>135</mousespeedx>
+                    <mousespeedy>135</mousespeedy>
+                    <slots>
+                        <slot>
+                            <code>4</code>
+                            <mode>mousemovement</mode>
+                        </slot>
+                    </slots>
+                </stickbutton>
+                <stickbutton index="2">
+                    <mousespeedx>135</mousespeedx>
+                    <mousespeedy>135</mousespeedy>
+                </stickbutton>
+                <stickbutton index="5">
+                    <mousespeedx>135</mousespeedx>
+                    <mousespeedy>135</mousespeedy>
+                    <slots>
+                        <slot>
+                            <code>2</code>
+                            <mode>mousemovement</mode>
+                        </slot>
+                    </slots>
+                </stickbutton>
+                <stickbutton index="4">
+                    <mousespeedx>135</mousespeedx>
+                    <mousespeedy>135</mousespeedy>
+                </stickbutton>
+                <stickbutton index="7">
+                    <mousespeedx>135</mousespeedx>
+                    <mousespeedy>135</mousespeedy>
+                    <slots>
+                        <slot>
+                            <code>3</code>
+                            <mode>mousemovement</mode>
+                        </slot>
+                    </slots>
+                </stickbutton>
+                <stickbutton index="6">
+                    <mousespeedx>135</mousespeedx>
+                    <mousespeedy>135</mousespeedy>
+                </stickbutton>
+            </stick>
+            <dpad index="1">
+                <mode>four-way</mode>
+                <dpadbutton index="8">
+                    <slots>
+                        <slot>
+                            <code>0x1000012</code>
+                            <mode>keyboard</mode>
+                        </slot>
+                    </slots>
+                </dpadbutton>
+                <dpadbutton index="1">
+                    <slots>
+                        <slot>
+                            <code>0x1000013</code>
+                            <mode>keyboard</mode>
+                        </slot>
+                    </slots>
+                </dpadbutton>
+                <dpadbutton index="2">
+                    <slots>
+                        <slot>
+                            <code>0x1000014</code>
+                            <mode>keyboard</mode>
+                        </slot>
+                    </slots>
+                </dpadbutton>
+                <dpadbutton index="4">
+                    <slots>
+                        <slot>
+                            <code>0x1000015</code>
+                            <mode>keyboard</mode>
+                        </slot>
+                    </slots>
+                </dpadbutton>
+            </dpad>
+            <trigger index="6">
+                <deadZone>2000</deadZone>
+                <throttle>positivehalf</throttle>
+                <triggerbutton index="2">
+                    <slots>
+                        <slot>
+                            <code>0x1000034</code>
+                            <mode>keyboard</mode>
+                        </slot>
+                    </slots>
+                </triggerbutton>
+            </trigger>
+            <trigger index="5">
+                <deadZone>2000</deadZone>
+                <throttle>positivehalf</throttle>
+                <triggerbutton index="2">
+                    <slots>
+                        <slot>
+                            <code>0x1000000</code>
+                            <mode>keyboard</mode>
+                        </slot>
+                    </slots>
+                </triggerbutton>
+            </trigger>
+            <button index="2">
+                <slots>
+                    <slot>
+                        <code>3</code>
+                        <mode>mousebutton</mode>
+                    </slot>
+                </slots>
+            </button>
+            <button index="1">
+                <slots>
+                    <slot>
+                        <code>1</code>
+                        <mode>mousebutton</mode>
+                    </slot>
+                </slots>
+            </button>
+            <button index="4">
+                <slots>
+                    <slot>
+                        <code>0x1000021</code>
+                        <mode>keyboard</mode>
+                    </slot>
+                    <slot>
+                        <code>0x57</code>
+                        <mode>keyboard</mode>
+                    </slot>
+                </slots>
+            </button>
+            <button index="3">
+                <slots>
+                    <slot>
+                        <code>2</code>
+                        <mode>mousebutton</mode>
+                    </slot>
+                </slots>
+            </button>
+            <button index="6">
+                <slots>
+                    <slot>
+                        <code>0x4d</code>
+                        <mode>keyboard</mode>
+                    </slot>
+                </slots>
+            </button>
+            <button index="5">
+                <slots>
+                    <slot>
+                        <code>0x1000021</code>
+                        <mode>keyboard</mode>
+                    </slot>
+                    <slot>
+                        <code>0x2d</code>
+                        <mode>keyboard</mode>
+                    </slot>
+                </slots>
+            </button>
+            <button index="8">
+                <slots>
+                    <slot>
+                        <code>0x1000004</code>
+                        <mode>keyboard</mode>
+                    </slot>
+                </slots>
+            </button>
+            <button index="7">
+                <slots>
+                    <slot>
+                        <code>0x1000021</code>
+                        <mode>keyboard</mode>
+                    </slot>
+                    <slot>
+                        <code>0x2b</code>
+                        <mode>keyboard</mode>
+                    </slot>
+                </slots>
+            </button>
+            <button index="10">
+                <slots>
+                    <slot>
+                        <code>0x1000021</code>
+                        <mode>keyboard</mode>
+                    </slot>
+                    <slot>
+                        <code>0x1000020</code>
+                        <mode>keyboard</mode>
+                    </slot>
+                    <slot>
+                        <code>0x1000001</code>
+                        <mode>keyboard</mode>
+                    </slot>
+                </slots>
+            </button>
+            <button index="9">
+                <toggle>true</toggle>
+                <slots>
+                    <slot>
+                        <code>0x1000020</code>
+                        <mode>keyboard</mode>
+                    </slot>
+                </slots>
+            </button>
+            <button index="11">
+                <slots>
+                    <slot>
+                        <code>0x1000021</code>
+                        <mode>keyboard</mode>
+                    </slot>
+                    <slot>
+                        <code>0x1000001</code>
+                        <mode>keyboard</mode>
+                    </slot>
+                </slots>
+            </button>
+        </set>
+    </sets>
+</gamecontroller>

overlays/pbsdspkgs.nix

@@ -0,0 +1,32 @@
+prev: final:
+let
+  inherit (prev) lib;
+
+  # TODO: get faketty to work, ${expect}/bin/unbuffer is bad
+  mkNomWrapper =
+    pkg:
+    prev.writeScriptBin (pkg.meta.mainProgram or (lib.getName pkg)) ''
+      if test -t 1 && test -z "''${NIX_NO_NOM-}"; then
+        exec ${lib.getExe pkg} -L "$@" |& ${lib.getExe prev.nix-output-monitor}
+      else
+        exec ${lib.getExe pkg} -L "$@"
+      fi
+    '';
+in
+{
+  pbsds = lib.makeScope prev.newScope (pbsds: {
+    # nom-nixos-rebuild = mkNomWrapper prev.nixos-rebuild;
+    nom-nixos-rebuild-ng = mkNomWrapper prev.nixos-rebuild-ng;
+    nom-home-manager = mkNomWrapper prev.home-manager;
+    nom-system-manager = mkNomWrapper prev.system-manager;
+
+    # TODO: make these automatic, maybe use by-name?
+    v4l2-play = prev.callPackage ./../pkgs/v4l2-play { };
+    device-mon = prev.callPackage ./../pkgs/device-mon { };
+    zluda-run = prev.callPackage ./../pkgs/zluda-run.nix { };
+
+    # TODO: move to separate flake, maintain with CI
+    #pdoc-docs  = (prev.callPackage ./../pkgs/pdocs.nix {}).pdocs;
+    #pdoc3-docs = (prev.callPackage ./../pkgs/pdocs.nix {}).pdocs3;
+  });
+}

pkgs/mk-nspawn-setup/default.nix

@@ -20,7 +20,7 @@ let
 
 in
 
-pkgs.runCommandNoCC "nspawn-setup-${hostname}.sh" {
+pkgs.runCommand "nspawn-setup-${hostname}.sh" {
   nativeBuildInputs = with pkgs; [ makeself ];
 } ''
   mkdir -p archive/

pkgs/mk-nspawn-setup/setup-nspawn.sh

@@ -6,19 +6,19 @@ NSPAWN_NAME=nixos-@hostname@
 TARBALL=./nixos-@hostname@.tar.xz
 
 test $(id -u) -eq 0 || {
-  >&2 echo you must run this as root
+  echo >&2 you must run this as root
   exit 1
 }
 
 if ! >/dev/null command -v systemd-nspawn; then
-  >&2 echo "systemd-nspawn" not found in PATH
-  >&2 echo consider installing 'systemd-container'
+  echo >&2 "systemd-nspawn" not found in PATH
+  echo >&2 consider installing 'systemd-container'
   exit 1
 fi
 
 if ! >/dev/null command -v machinectl; then
-  >&2 echo "machinectl" not found in PATH
-  >&2 echo consider installing 'systemd-container'
+  echo >&2 "machinectl" not found in PATH
+  echo >&2 consider installing 'systemd-container'
   exit 1
 fi
 

pkgs/v4l2-play/default.nix

@@ -0,0 +1,59 @@
+{
+  lib,
+  pkgs,
+}:
+
+let
+  runtimeInputs =  with pkgs; [
+    ffmpeg
+    v4l-utils
+    alsa-utils
+    (pkgs.zenity or pkgs.gnome.zenity)
+  ];
+in
+
+pkgs.stdenvNoCC.mkDerivation (finalAttrs: {
+  name = "v4l2-play";
+  meta.mainProgram = "v4l2-play";
+
+  nativeBuildInputs = with pkgs; [
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  dontUnpack = true;
+  dontBuild = true;
+  dontConfigure = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp ${./script.sh} $out/bin/v4l2-play
+    chmod +wx $out/bin/v4l2-play
+
+    substituteInPlace $out/bin/v4l2-play \
+      --replace-fail \
+        "#!/usr/bin/env nix-shell" \
+        "#!${pkgs.runtimeShell}"
+
+    wrapProgram $out/bin/v4l2-play \
+      --prefix PATH : ${lib.makeBinPath runtimeInputs}
+
+    runHook postInstall
+  '';
+
+  desktopItems = pkgs.makeDesktopItem {
+    name = "v4l2-play";
+    desktopName = "View video device";
+    exec = "v4l2-play";
+    keywords = [
+      "elgato"
+      "passthrough"
+      "v4l2"
+      "video4linux2"
+      "capture card"
+    ];
+  };
+
+})

pkgs/v4l2-play/script.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p ffmpeg v4l-utils alsa-utils gnome.zenity
+set -euo pipefail
+
+video_devices=()
+audio_devices=()
+
+tab=$(printf '\t')
+current_name=
+while IFS= read line; do
+    if ! [[ $line == "$tab"* ]]; then
+        current_name="$line"
+    else
+        video_devices+=("$(echo "$line - $current_name" | xargs)")
+    fi
+done < <( v4l2-ctl --list-devices )
+
+printf "%s\n" "${video_devices[@]}"
+
+current_name=
+current_device=
+current_subdevice=
+while IFS= read line; do
+    if ! [[ $line == "  "* ]]; then
+        current_name=$(echo $line | cut -d: -f2- | cut -c2-)
+        current_device=$(echo $line | grep -E 'card [0-9]+:' -o | tr -dc '[:digit:]' || true)
+    elif [[ $line == "  Subdevice #"* ]]; then
+        current_subdevice=$(echo $line | grep -E 'Subdevice #[0-9]+:' -o | tr -dc '[:digit:]' || true)
+        #audio_devices+=("$(echo "$line - $current_name" | xargs)")
+        audio_devices+=("hw:$current_device,$current_subdevice - $current_name")
+    else
+        :
+    fi
+done < <( arecord -l )
+
+
+printf "%s\n" "${audio_devices[@]}"
+
+
+zenity_cells=()
+maybe_true=TRUE
+for video_device in "${video_devices[@]}"; do
+    if grep <<<"$video_device" -q Elgato; then
+        zenity_cells+=("$maybe_true")
+        maybe_true=FALSE
+    else
+        zenity_cells+=(FALSE)
+    fi
+    zenity_cells+=("$video_device")
+done
+selected_video_device=$(
+    zenity --list --text="Which video device" --radiolist --column=Select --column=Device "${zenity_cells[@]}" \
+        | cut -d' ' -f1
+)
+
+zenity_cells=()
+maybe_true=TRUE
+for audio_device in "${audio_devices[@]}"; do
+    if grep <<<"$audio_device" -q Elgato; then
+        zenity_cells+=("$maybe_true")
+        maybe_true=FALSE
+    else
+        zenity_cells+=(FALSE)
+    fi
+    zenity_cells+=("$audio_device")
+done
+selected_audio_device=$(
+    zenity --list --text="Which audio device" --radiolist --column=Select --column=Device "${zenity_cells[@]}" \
+        | cut -d' ' -f1
+)
+
+# TODO:
+#     ffmpeg -f video4linux2 -list_formats all -i /dev/video3
+#     [video4linux2,v4l2 @ 0x23ed7140] Raw       :     yuyv422 :           YUYV 4:2:2 : 1920x1080 1600x1200 1280x720 720x576 720x480 640x480
+#     [video4linux2,v4l2 @ 0x23ed7140] Raw       :        nv12 :           Y/UV 4:2:0 : 3840x2160 2560x1440 1920x1080 1600x1200 1280x720 720x576 720x480 640x480
+
+ffmpeg_common=(
+    -fflags nobuffer
+    -flags nobuffer
+    -flags low_delay
+    -strict experimental
+)
+ffmpeg_args=(
+    -f v4l2
+        -input_format nv12
+        -video_size 1920x1080
+        -framerate 60
+        #-i /dev/video3
+        -i "$selected_video_device"
+    -f alsa
+        #-i hw:5,0
+        -i "$selected_audio_device"
+)
+
+set -x
+ffmpeg "${ffmpeg_common[@]}" "${ffmpeg_args[@]}" -c copy -f nut pipe: | ffplay -framedrop "${ffmpeg_common[@]}" -f nut -i pipe:

pkgs/zluda-run.nix

@@ -0,0 +1,15 @@
+{
+  lib,
+  writeShellScriptBin,
+  zluda,
+}:
+
+writeShellScriptBin "zluda-run" ''
+  export LD_LIBRARY_PATH="${lib.getLib zluda}/lib''${LD_LIBRARY_PATH:+":''$LD_LIBRARY_PATH"}"
+  if [[ -v NIX_LD_LIBRARY_PATH ]]; then
+    export NIX_LD_LIBRARY_PATH="${lib.getLib zluda}/lib''${NIX_LD_LIBRARY_PATH:+":''$NIX_LD_LIBRARY_PATH"}"
+  fi
+
+  # exec -a "$0" "$@"
+  exec "$@"
+''

profiles/auto-upgrade.nix

@@ -1,5 +1,10 @@
 { config, pkgs, lib, inputs, ... }:
 
+let
+  inherit (config.virtualisation) isVmVariant;
+  inputUrls = lib.mapAttrs (input: value: value.url) (import (inputs.self + "/flake.nix")).inputs;
+in
+
 # TODO: make /etc/nixos a symlink to the in-store flake? - bad idea, horrible error recovery
 # TODO: make /etc/nixos a writeable checkout of repo?
 
@@ -8,7 +13,56 @@
   system.autoUpgrade.enable = true;
   #system.autoUpgrade.allowReboot = true; # reboot after a kernel (module) or initrd upgrade, consider also setting `rebootWindow`
 
-  environment.etc."current-system-flake".source = inputs.self; # the plan was to allow me to locate the new flake.lock, but alas https://github.com/NixOS/nix/issues/6895
+  environment.etc."current-system-flake".enable = !isVmVariant; # makes the outPath depend on flake src
+  environment.etc."current-system-flake".source = inputs.self;
+  # workaround for https://github.com/NixOS/nix/issues/6895
+  environment.etc."current-system-flake-inputs.json".enable = !isVmVariant; # makes the outPath depend on flake src
+  environment.etc."current-system-flake-inputs.json".source
+    = pkgs.writers.writeJSON "flake-inputs.json" (
+      lib.flip lib.mapAttrs inputs (name: input:
+        # inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like derivation
+        lib.filterAttrs (key: val: !builtins.elem key ["outPath"]) (input.sourceInfo or {})
+          // { store-path = builtins.unsafeDiscardStringContext input.outPath; } # use this line instead if you want to retain a store reference to the flake inputs, but don't make it a part of the closure
+          # // { store-path = input.outPath; } # use this line instead if you want to retain a store reference to the flake inputs
+      )
+    );
+
+  environment.etc."current-system-flake-inputs-overrides.sh".enable = !isVmVariant;
+  environment.etc."current-system-flake-inputs-overrides.sh".source = pkgs.writeShellScript "with-input-overrides.sh" ''
+    if [[ $# -eq 0 ]]; then
+      echo >&2 "Example usage: $0 nix flake update --output-lock-file flake.lock"
+      exit 1
+    fi
+    set -euo pipefail
+    declare -a cmd_args=()
+    readarray -td $'\0' cmd_args < <(
+      ${lib.getExe pkgs.jq} --raw-output0 \
+        </etc/current-system-flake-inputs.json \
+        --argjson inputUrls "$(
+          nix eval --file /etc/current-system-flake/flake.nix \
+            --apply 'x: builtins.mapAttrs (input: value: value.url) x.inputs' --json
+        )" '
+          to_entries[] |
+          select(.key == "self" | not) |
+          select(.value.rev) |
+          select($inputUrls[.key]) |
+          [
+            "--override-input",
+            .key,
+            (
+              if .value.rev
+              then (if $inputUrls[.key] | startswith("github:")
+                then ($inputUrls[.key] | split("/") | .[:2] | join("/")) + "/\(.value.rev)"
+                else $inputUrls[.key] + "?rev=\(.value.rev | @uri)"
+                end)
+              else .value["store-path"]
+              end
+            )
+          ][]
+        '
+    )
+    exec "$@" "''${cmd_args[@]}"
+  '';
 
   #system.autoUpgrade.flake = inputs.self.outPath; # a nix store path
   #system.autoUpgrade.flake = "github:pbsds/nix-config"; # TODO: use this instead?
@@ -18,19 +72,35 @@
   system.autoUpgrade.flags = [
     "-L" # print build logs
     "--no-write-lock-file" # no write new flakelock, as the in-store flake is read-only
+    "--option" "access-tokens" "" # don't risk expired github tokens blocking upgrade
     # fetch new inputs
     #"--recreate-lock-file" # update all
-    "--update-input" "nixpkgs-edge" "--update-input" "home-manager-edge"
-    "--update-input" "nixpkgs-2405" "--update-input" "home-manager-2405"
-    "--update-input" "nixpkgs-2311" "--update-input" "home-manager-2311"
-    "--update-input" "nix-index-database"
-    "--update-input" "nixos-hardware"
-  ];
+    "--refresh"
+    #"--update-input" "nixpkgs-edge" # deprecated in nix 2.22, removed in lix 2.90
+    # "--override-input" "nixpkgs-edge" "github:NixOS/nixpkgs/nixos-unstable"
+  ] ++ (lib.pipe inputUrls [
+    # TODO: i keep forgetting to update this, perhaps use a blacklist instead?
+    (lib.filterAttrs (key: _: builtins.elem key [
+      "nixpkgs-edge"
+      "nixpkgs-2605"
+      # "nixpkgs-2511"
+      # "nixpkgs-2505"
+      # "nixpkgs-2411"
+      "home-manager-edge"
+      "home-manager-2605"
+      # "home-manager-2511"
+      # "home-manager-2505"
+      # "home-manager-2411"
+      "nix-index-database"
+      "nixos-hardware"
+    ]))
+    (lib.mapAttrsToList (input: url: ["--override-input" input url]))
+    lib.concatLists
+  ]);
 
   # lots of "empty" updates
-  boot.loader.grub.configurationLimit = 15;
-  boot.loader.systemd-boot.configurationLimit = 15;
-  boot.loader.raspberryPi.uboot.configurationLimit = 15;
-  boot.loader.generic-extlinux-compatible.configurationLimit = 15;
+  boot.loader.grub.configurationLimit = 10;
+  boot.loader.systemd-boot.configurationLimit = 10;
+  boot.loader.generic-extlinux-compatible.configurationLimit = 10;
 
 }

profiles/autossh-reverse-tunnels/default.nix

@@ -1,4 +1,7 @@
 { config, pkgs, lib, ... }:
+
+lib.mkIf (!config.virtualisation.isVmVariant)
+
 {
   # AutoSSH reverse tunnels
 

profiles/backup/client/default.nix

@@ -0,0 +1,147 @@
+{ config, lib, ... }:
+
+let
+  notInVM = lib.mkIf (!config.virtualisation.isVmVariant);
+  inherit (config.networking) hostName;
+  sopsFile = lib.mkDefault ../../hosts/nixos/${hostName}/secrets.yaml;
+in
+
+# 3-2-1 Backup Rule:
+# * have 3 separate copies
+# * on 2 different media
+# * with 1 kept offsite
+
+# # borgbackup vs restic vs kopia vs diplicity
+# https://mangohost.net/blog/duplicacy-vs-restic-vs-borg-which-backup-tool-is-right-in-2025/
+# https://onidel.com/restic-vs-borgbackup-vs-kopia-2025/
+# https://www.reddit.com/r/BorgBackup/comments/v3bwfg/why_should_i_switch_from_restic_to_borg/
+# https://www.aarsen.me/posts/2022-02-15-sweet-unattended-backups.html
+#
+# restic:
+#   * native s3, go, decent restore, good deduplication, simplicity, decent backup/restore speed, slow prunes on huge repos
+# borgbackup:
+#   * clunky s3 (rclone), python/c, 1 machine per repo, backup goes brr, multiple encryption modes
+# kopia:
+#   * native s3, go, fast restore, restore goes brr, flexible key management, no nixos module
+# duplicity:
+#   * global deduplication, but global job, paid gui
+# zrepl:
+#   * requires zfs on both ends
+
+# TODO: can i make restic backup from a zfs snapshot for atomicity?
+#       https://www.aarsen.me/posts/2022-02-15-sweet-unattended-backups.html#pulling-it-together
+#       https://gist.github.com/stackcoder/ccb3b17812ed11700ee83d762b970b98
+
+{
+  options = {
+    pbsds.backup.paths = lib.mkOption {
+      type = with lib.types; listOf str;
+      default = [ ];
+    };
+  };
+
+  imports = lib.map notInVM [
+    # https://search.nixos.org/options?channel=unstable&query=backup
+    ./mysqlBackup.nix
+    ./postgresqlBackup.nix
+    # ./vaultwarden.nix # services.vaultwarden.backupDir
+    # ./gitea.nix # services.gitea.dump.enable
+    # ./forgejo.nix # services.forgejo.dump.enable
+    # stuff in /var/lib on nox:
+    # ./transmission.nix
+    # ./plex.nix
+    # ./thelounge.nix
+  ];
+
+  config = notInVM {
+
+    # https://restic.readthedocs.io/en/latest/070_encryption.html#manage-repository-keys
+
+    sops.secrets = {
+      # $ sops --set '["restic_systems_password_meconium"] "'$(pwgen --ambiguous --secure 64 1)'"' hosts/nixos/$(nix eval .#nixosConfigurations --apply builtins.attrNames --json | jq .[] -r | xargs gum choose)/secrets.yaml
+      restic_systems_password_meconium.sopsFile = sopsFile;
+
+      # $ sops --set '["restic_systems_password_panorama"] "'$(pwgen --ambiguous --secure 64 1)'"' hosts/nixos/$(nix eval .#nixosConfigurations --apply builtins.attrNames --json | jq .[] -r | xargs gum choose)/secrets.yaml
+      restic_systems_password_panorama.sopsFile = sopsFile;
+
+      # # https://restic.readthedocs.io/en/latest/040_backup.html#environment-variables
+      restic_systems_password_s3.sopsFile = sopsFile;
+      restic_systems_environment_s3.sopsFile = sopsFile;
+    };
+
+    services.restic.backups =
+      let
+        shared = {
+          initialize = true;
+          # createWrapper = true; # adds a "restic-${name}" wrapper in system path
+
+          # TODO: --skip-if-unchanged ?
+          paths = [ "/var/lib" ] ++ config.pbsds.backup.paths;
+
+          # TODO: How should the timer behave on a laptop?
+          timerConfig.OnCalendar = "hourly";
+          pruneOpts = [
+            "--keep-daily 5"
+            "--keep-weekly 3"
+            "--keep-monthly 2"
+          ];
+        };
+      in
+      {
+        "systems-meconium" = shared // {
+          # repository = "sftp:USER_TODO@noximilien:/mnt/meconium/Backups/restic/system-${hostName}";
+          repository = "sftp:USER_TODO@noximilien:/mnt/meconium/Backups/restic/systems";
+          passwordFile = config.sops.secrets.restic_systems_password_meconium.path;
+          # environmentFile = config.sops.secrets.restic_systems_environment_meconium.path;
+        };
+
+        "systems-panorama" = shared // {
+          # repository = "sftp:USER_TODO@eple:/mnt/panorama/Backups/restic/system-${hostName}";
+          repository = "sftp:USER_TODO@eple:/mnt/panorama/Backups/restic/systems";
+          passwordFile = config.sops.secrets.restic_systems_password_panorama.path;
+          # environmentFile = config.sops.secrets.restic_systems_environment_panorama.path;
+        };
+
+        # "systems-b2" = shared // {
+        #   repository = "s3:1246890.r2.cloudflarestorage.com/restic-systems";
+        #   passwordFile = config.sops.secrets.restic_systems_password_s3.path;
+        #   environmentFile = config.sops.secrets.restic_systems_environment_s3.path;
+        # };
+      };
+
+    # backup of user homes
+
+    /*
+      TODO = lib.pip config.users.users [
+        lib.attrNames
+        (lib.filter (user: config.users.users.${user}.enable))
+        (lib.filter (user: config.users.users.${user}.isNormalUser))
+        # (lib.filter (user: config.users.users.${user}.createHome))
+        (lib.map (user:
+          {
+            # sops.secrets.restic_user_${user}_password_meconium.owner = user;
+            # sops.secrets.restic_user_${user}_password_meconium.sopsFile = sopsFile;
+
+            services.restic.backups."user-${user}" = {
+              inherit (config.services.restic.backups."system")
+                initialize
+                pruneOpts
+                timerConfig
+                ;
+
+              # createWrapper = true; # adds a "restic-${name}" wrapper in system path
+
+              inherit user; # the user can see this password, hence we must use per-user restic repositories
+              passwordFile = config.sops.secrets.restic_user_${user}_password_meconium.path;
+              # environmentFile = config.sops.secrets.restic_user_${user}_environment_meconium.path;
+
+              paths = [ config.users.users.${user}.home ];
+              repository = "sftp:noximilien/mnt/meconium/Backups/restic/user-${user}";
+            };
+          }
+        ))
+      ];
+    */
+
+  };
+}

profiles/backup/client/mysqlBackup.nix

@@ -0,0 +1,24 @@
+{ lib, config, ... }:
+let
+  mkIf = lib.mkIf config.services.mysql.enable;
+in
+{
+
+  pbsds.backup.paths = mkIf [ config.mysqlBackup.location ]; # "/var/backup/postgresql"
+
+  services.mysqlBackup = mkIf {
+    enable = true;
+    databases = config.services.mysql.ensureDatabases;
+    # calendar = "*-*-* 01:15:00"; # nightly (default)
+
+    # there is now way to select no compression...
+    # should be trivial to fix ;)
+    # https://github.com/NixOS/nixpkgs/blob/89c2b2330e733d6cdb5eae7b899326930c2c0648/nixos/modules/services/backup/mysql-backup.nix#L23-L45
+    # https://github.com/NixOS/nixpkgs/pull/364630
+    # compressionAlg = "gzip";
+    # compressionAlg = "xz";
+    # compressionAlg = "zstd";
+    # compressionLevel = null;
+  };
+
+}

profiles/backup/client/postgresqlBackup.nix

@@ -0,0 +1,17 @@
+{ lib, config, ... }:
+let
+  mkIf = lib.mkIf config.services.postgresql.enable;
+in
+{
+
+  pbsds.backup.paths = mkIf [ config.postgresqlBackup.location ]; # "/var/backup/postgresql"
+
+  services.postgresqlBackup = mkIf {
+    enable = true;
+    # databases = [ "foo" ];
+    backupAll = true; # default if no databases are specified, mutually exclusive
+    compression = "none"; # Let restic handle the compression, enabling de-duplication
+    # startAt = "*-*-* 01:15:00"; # nightly (default)
+  };
+
+}

profiles/backup/server.nix

@@ -0,0 +1,4 @@
+
+# todo
+# some "restrict,pty,command=..." ssh authorized_keys bullshit to verify restic, or maybe even just host the REST server?
+# see ./hosts/nixos/garp/sftp.nix

profiles/base/binary-caches.nix

@@ -0,0 +1,48 @@
+#!/usr/bin/env -S nix eval --json --file
+let
+  caches = {
+    # lower ?priority=x numbers go first, will fallback to https://.../nix-cache-info if unset, final fallback is the default 0
+    # https://nix.dev/manual/nix/latest/command-ref/conf-file#conf-substituters
+    # https://nix.dev/manual/nix/latest/command-ref/conf-file#conf-trusted-public-keys
+
+    # https://cache.nixos.org/nix-cache-info (WantMassQuery: 1, priority: 40)
+    "https://cache.nixos.org/" = [
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+    ];
+
+    # https://nix-community.cachix.org/nix-cache-info (WantMassQuery: 1, priority: 41)
+    "https://nix-community.cachix.org/?priority=50" = [
+      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+    ];
+
+    # https://wiki.nixos.org/wiki/CUDA
+    # https://cache.nixos-cuda.org/nix-cache-info (WantMassQuery: 1, Priority: 50)
+    "https://cache.nixos-cuda.org?priority=45" = [
+      "cache.nixos-cuda.org:74DUi4Ye579gUqzH4ziL9IyiJBlDpMRn9MBN8oNan9M="
+    ];
+
+    # # dead? https://github.com/numtide/nixpkgs-unfree/commit/399ae17bda97a0318a0c5316edb169d097a776dc
+    # # https://numtide.cachix.org/nix-cache-info (WantMassQuery: 1, priority: 41)
+    # "https://numtide.cachix.org/?priority=55" = [
+    #   "numtide.cachix.org-1:2ps1kLBUWjxIneOy1Ik6cQjb41X0iXVXeHigGmycPPE="
+    # ];
+
+    # https://flox.dev/blog/flox-the-nix-foundation-and-nvidia-partner-for-cuda/
+    # https://cache.flox.dev/nix-cache-info (no WantMassQuery, no priority(!!!))
+    "https://cache.flox.dev/?priority=60" = [
+      "flox-cache-public-1:7F4OyH7ZCnFhcze3fJdfyXYLQw/aV7GEed86nQ7IsOs="
+    ];
+
+    # me!
+    # "https://cache-proxy.pbsds.net/?priority=41" = [ ];
+  };
+in
+
+{
+  nix.settings = {
+    # nixos will add the public binary cache as well with a mkAfter, unless we mkForce these
+    substituters = builtins.attrNames caches;
+    trusted-substituters = builtins.attrNames caches;
+    trusted-public-keys = builtins.concatLists (builtins.attrValues caches);
+  };
+}

profiles/base/default.nix

@@ -0,0 +1,148 @@
+{ config, pkgs, lib, inputs, ... }:
+
+# TODO: split this file into a `base` folder?
+
+{
+  imports = let ifExists = p: if builtins.pathExists p then p else {}; in [
+    ./../../secrets
+    ./binary-caches.nix
+    ./nix.nix
+    # ./lix.nix # too slow eval...
+    ./locale-no.nix
+    ./upgrade-diff.nix
+    ./vm-variant.nix
+    ./../mounts/common-nfs.nix
+    # ./profiles/mounts/common-zfs.nix
+  ];
+
+  nixpkgs.overlays = [
+    (import ./../../overlays/wl-clipboard-timeout.nix)
+  ];
+
+  # reaffirm these defaults in case we add mroe via 'programs.nix-required-mounts'
+  # adding "cuda" or "ccache" overrides the implicit defaults
+  nix.settings.system-features = lib.mkIf (pkgs.stdenv.hostPlatform.system == "x86_64-linux") ["kvm" "nixos-test"];
+
+  # TODO: selectively whitelist
+  nixpkgs.config.allowUnfree = true;
+  # nixpkgs.config.allowAliases = false;
+  # nixpkgs.config.warnAliases = true;
+  nixpkgs.config.nonfreeLicensing = true; # used by ffmpeg
+
+  # TODO:
+  # nixpkgs.config.allowUnfreePredicate = drv: lib.elem (lib.getName drv) [
+  #   pkgs.davinci-resolve.pname
+  #   pkgs.intel-ocl.pname
+  # ];
+
+  nixpkgs.config.permittedInsecurePackages = [
+    pkgs.pulsar.name # TODO: remove once electron is bumped
+    pkgs.zotero.name
+    pkgs.gitea.name
+    pkgs.forgejo.name
+    pkgs.olm.name # TODO: remove
+  ];
+
+  # https://consoledonottrack.com/
+  environment.variables.DO_NOT_TRACK = "1";
+
+  environment.systemPackages = lib.mkIf (!config.virtualisation.isVmVariant) ([
+    pkgs.dmidecode
+    pkgs.ddrescue
+    pkgs.gptfdisk
+    pkgs.ms-sys
+    pkgs.nvme-cli
+    pkgs.parted
+    pkgs.pciutils
+    pkgs.smartmontools
+    pkgs.testdisk
+    pkgs.usbutils
+  ] ++ lib.optionals (lib.elem pkgs.stdenv.hostPlatform [ "x86_64-linux" "aarch64_linux"]) [
+    pkgs.cage
+    pkgs.weston
+  ]);
+
+  # apply microcode to fix functional and security issues
+  hardware.enableRedistributableFirmware = true;
+  hardware.cpu.amd.updateMicrocode = pkgs.stdenv.isx86_64;
+  hardware.cpu.intel.updateMicrocode = pkgs.stdenv.isx86_64;
+
+  # enable kernel same-page merging for improved vm test performance
+  hardware.ksm.enable = true;
+
+  # enable Alt+SysRq+<key> shortcuts
+  # https://wiki.nixos.org/wiki/Linux_kernel#Enable_SysRq
+  # boot.kernel.sysctl."kernel.sysrq" = 1;
+
+  boot.initrd.systemd.enable = true; # systemd manages initfs boot, systemd-analyse can see what happened
+  # https://discourse.nixos.org/t/what-to-do-with-a-full-boot-partition/2049
+  # raised to 15 if auto upgrading by auto-upgrade.nix
+  boot.loader.grub.configurationLimit = lib.mkDefault 5;
+  boot.loader.systemd-boot.configurationLimit = lib.mkDefault 5;
+  boot.loader.generic-extlinux-compatible.configurationLimit = lib.mkDefault 5;
+
+  networking.firewall.enable = lib.mkDefault true; # default is true
+  #networking.nftables.enable = true; # wirewall backend, instead of iptables, breaks docker which uses iptables
+  #networking.firewall.allowPing = false;
+  #networking.networkmanager.wifi.backend = "iwd"; # default is wpa_supplicant, iwd doesn't support eduroam
+  networking.firewall.logRefusedConnections = false; # too spammy, rotates dmesg too quickly
+
+  # nixos-rebuild switch --specialisation no-firewall
+
+  specialisation = lib.mkIf (config.networking.firewall.enable && !config.virtualisation.isVmVariant) {
+    no-firewall.configuration = {
+      networking.firewall.enable = false;
+      services.fail2ban.enable = false; # requires firewall
+    };
+  };
+
+  security.sudo.execWheelOnly = true;
+
+  services.thermald.enable = lib.all (x: x) [
+    (pkgs.stdenv.hostPlatform.system == "x86_64-linux")
+    (!config.boot.isContainer or false)
+  ];
+
+  # no acme in build-vm mode:
+  virtualisation.vmVariant = {
+    security.acme.defaults.server = "https://127.0.0.1";
+    security.acme.preliminarySelfsigned = true;
+  };
+
+  # set VM root password in build-vm mode
+  virtualisation.vmVariant = {
+    users.users.root.initialPassword = "root";
+  };
+
+  # fix VM networking, disable static IPs
+  virtualisation.vmVariant = {
+    networking.interfaces = lib.mkForce {};
+    networking.defaultGateway = lib.mkForce null;
+    networking.nameservers = lib.mkForce [];
+    networking.networkmanager.enable = lib.mkForce false;
+    networking.useDHCP = lib.mkForce true;
+  };
+
+  # System fonts
+  # Nice to have when X-forwarding on headless machines
+  fonts.fontDir.enable = true; # creates /run/current-system/sw/share/X11/fonts
+  fonts.enableDefaultPackages = true; # dejavu, freefont, gyre, liberation, unifont, noto-fonts-emoji
+  fonts.packages = with pkgs; [
+    noto-fonts # includes Cousine
+    noto-fonts-cjk-sans
+    noto-fonts-cjk-serif
+    #noto-fonts-emoji # removed
+    noto-fonts-color-emoji
+    #noto-fonts-extra
+    noto-fonts
+  ];
+
+  services.fail2ban = {
+    ignoreIP = [
+      # Whitelist some subnets
+      "192.168.0.0/24" # local
+      "10.0.0.0/8" # local
+      "100.64.0.0/10" # tailscale
+    ];
+  };
+}

profiles/base/lix.nix

@@ -0,0 +1,31 @@
+{ pkgs, lib, ... }:
+
+# https://lix.systems/add-to-config/
+
+{
+  nix.package = pkgs.lix;
+
+  # this should also affect pkgs.unstable which inherits final.pkgs.overlays
+  nixpkgs.overlays = [
+    (final: prev: {
+      # oc
+
+      nixpkgs-review = prev.nixpkgs-review.override {
+        nix = prev.lix;
+      };
+
+      # pkgs/tools/package-management/lix/default.nix
+      # https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/package-management/lix/default.nix
+
+      nix-direnv = prev.nix-direnv.override {
+        nix = prev.lix;
+      };
+
+      nix-update = prev.nix-update.override {
+        nix = prev.lix;
+        inherit (prev) nixpkgs-review;
+      };
+
+    })
+  ];
+}

profiles/base/locale-no.nix

@@ -0,0 +1,25 @@
+{ lib, ... }: lib.mkMerge [
+{
+  # Time zone and internationalisation properties.
+  time.timeZone      = lib.mkDefault "Europe/Oslo";
+  i18n.defaultLocale = "en_US.UTF-8";
+  i18n.extraLocaleSettings.LC_ADDRESS        = "nb_NO.UTF-8";
+  i18n.extraLocaleSettings.LC_IDENTIFICATION = "nb_NO.UTF-8";
+  i18n.extraLocaleSettings.LC_MEASUREMENT    = "nb_NO.UTF-8";
+  i18n.extraLocaleSettings.LC_MONETARY       = "nb_NO.UTF-8";
+  i18n.extraLocaleSettings.LC_NAME           = "nb_NO.UTF-8";
+  i18n.extraLocaleSettings.LC_NUMERIC        = "nb_NO.UTF-8";
+  i18n.extraLocaleSettings.LC_PAPER          = "nb_NO.UTF-8";
+  i18n.extraLocaleSettings.LC_TELEPHONE      = "nb_NO.UTF-8";
+  i18n.extraLocaleSettings.LC_TIME           = "nb_NO.UTF-8";
+  console.keyMap              = "no";
+}
+(lib.mkIf (lib.versionAtLeast lib.version "24.05") {
+  services.xserver.xkb.layout  = "no";
+  services.xserver.xkb.variant = "";
+})
+(lib.mkIf (lib.versionOlder lib.version "24.05") {
+  services.xserver.layout     = "no";
+  services.xserver.xkbVariant = "";
+})
+]

profiles/base/nix.nix

@@ -0,0 +1,82 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+{
+  sops.secrets.nix-access-tokens = { };
+  sops.secrets.nix-access-tokens-all.mode = "0440";
+  sops.secrets.nix-access-tokens-all.group = config.users.groups."keys".name;
+  nix.extraOptions = ''
+    !include ${config.sops.secrets.nix-access-tokens.path}
+    !include ${config.sops.secrets.nix-access-tokens-all.path}
+  '';
+
+  # https://nix.dev/manual/nix/stable/command-ref/conf-file.html
+  # https://nix.dev/manual/nix/latest/command-ref/conf-file.html
+  # https://docs.lix.systems/manual/lix/stable/command-ref/conf-file.html
+  nix.settings = {
+
+    # === behaviour
+    experimental-features = [
+      "nix-command"
+      "flakes"
+      # "pipe-operator" # not supported on lix 2.91
+    ];
+    log-lines = 35;
+    # keep-going = true;
+
+    # === access
+    #nix.settings.allowed-users = [ "@builders" ]; # TODO: this
+    allowed-users = [
+      # default is [ "*" ]
+      "root"
+      "@wheel"
+    ];
+    trusted-users = [
+      "root"
+      "@wheel"
+    ];
+
+    # === eval and realization
+    keep-derivations = true; # keep .drv in store, great with nix-diff
+    max-silent-time = 3600; # kill long-running silent builds
+
+    # === substitution
+    http-connections = 128; # default is 25
+    max-substitution-jobs = 128; # default is 16
+    connect-timeout = 5; # timeout in seconds for binary caches
+    download-attempts = 2; # download attempts, in case a binary cache fails
+    # fallback = lib.mkDefault true; # fallback to building if a binary cache fails
+
+    # === store
+    #settings.keep-failed = true; # fills up $TMPDIR
+    auto-optimise-store = true; # deduplicate with hardlinks, expensive. Alternative: nix-store --optimise
+    min-free = 5 * 1024 * 1024 * 1024; # starts cg
+    max-free = 20 * 1024 * 1024 * 1024; # condition to end gc triggered by min-free
+
+    # should not be needed since https://github.com/NixOS/nixpkgs/pull/383052
+    system-features =
+      lib.mkIf
+        (
+          pkgs.stdenv.hostPlatform.system == "x86_64-linux"
+          && (lib.versionOlder lib.version "25.05")
+        )
+        [
+          "nixos-test"
+          "big-parallel"
+          "kvm"
+        ];
+  };
+
+  #nix.optimize.automatic = true; # periodic store optimization, alternative nix.settings.auto-optimise-store
+
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = lib.mkIf config.system.autoUpgrade.enable "--delete-older-than 15d";
+  };
+
+}

profiles/base/upgrade-diff.nix

@@ -0,0 +1,31 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+
+  # dix: https://github.com/faukah/dix
+  # rust based
+  # module from https://github.com/getchoo/borealis/blob/a35749aa6280fbe4cbe72291bb9c4cc643780c76/modules/nixos/custom/activation-diff.nix
+
+  # nvd: https://discourse.nixos.org/t/nvd-simple-nix-nixos-version-diff-tool/12397
+  # python based
+  # module from https://github.com/luishfonseca/dotfiles/blob/ab7625ec406b48493eda701911ad1cd017ce5bc1/modules/upgrade-diff.nix
+
+  # gated on formatAttr which is set by nixos-generators
+  system.activationScripts.show-nixos-closure-diff = lib.mkIf ((config.formatAttr or null) == null) {
+    supportsDryActivation = true;
+    text =
+      if pkgs ? dix then
+        ''
+          ${pkgs.dix}/bin/dix /run/current-system "$systemConfig"
+        ''
+      else
+        ''
+          ${pkgs.nvd}/bin/nvd --nix-bin-dir=${pkgs.nix}/bin diff /run/current-system "$systemConfig"
+        '';
+  };
+
+}

profiles/base/vm-variant.nix

@@ -0,0 +1,11 @@
+{lib, ... }:
+{
+  options.virtualisation.isVmVariant = lib.mkOption {
+    type = lib.types.bool;
+    default = false;
+  };
+  # to be used with 'lib.mkIf (!config.virtualisation.isVmVariant)'
+  config.virtualisation.vmVariant = {
+    virtualisation.isVmVariant = true;
+  };
+}

profiles/binfmt-emu.nix

@@ -1,14 +0,0 @@
-{ pkgs, ... }:
-{
-  # run/build weird binaries
-  # TODO: somehow make sure this is in sync with remote-builders
-  boot.binfmt.emulatedSystems = [
-    #"wasm32-wasi"
-    #"wasm64-wasi"
-    #"x86_64-windows"
-    "aarch64-linux"
-    "riscv64-linux"
-    #"x86_64-darwin"
-    #"aarch64-darwin"
-  ];
-}

profiles/ccache/default.nix

@@ -0,0 +1,74 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+# serge <3
+# TODO: distributed (s)ccache (with redis?)
+# TODO: garbage collect this
+
+{
+  programs.ccache.enable = true;
+  programs.ccache.owner = "root"; # default
+  programs.ccache.group = "nixbld"; # default
+
+  programs.nix-required-mounts.enable = true;
+  programs.nix-required-mounts.allowedPatterns."ccache" = {
+    onFeatures = [
+      "ccache"
+      "sccache"
+    ];
+    paths = [
+      config.programs.ccache.cacheDir
+      "/var/cache/sccache" # TODO: upstream?
+    ];
+  };
+
+  nix.settings.system-features = [
+    "ccache"
+    "sccache"
+  ];
+
+  # can be monitored with `nix-ccache --show-stats`
+  systemd.tmpfiles.settings."50-ccache" =
+    let
+      tmp = rec {
+        "d" = {
+          user = config.programs.ccache.owner;
+          group = config.programs.ccache.group;
+          mode = "0770";
+        };
+        "Z" = d;
+      };
+    in
+    {
+      "/var/cache/ccache" = tmp;
+      "/var/cache/sccache" = tmp;
+    };
+
+  # based on https://github.com/NixOS/nixpkgs/blob/d89fc19e405cb2d55ce7cc114356846a0ee5e956/nixos/modules/programs/ccache.nix#L49-L67
+  security.wrappers."nix-sccache" =
+    let
+      cfg = config.programs.ccache;
+    in
+    {
+      inherit (cfg) owner group;
+      setuid = false;
+      setgid = true;
+      source = pkgs.writeScript "nix-sccache.pl" ''
+        #!${pkgs.perl}/bin/perl
+        %ENV=( SCCACHE_DIR => '/var/cache/sccache' );
+        sub untaint {
+          my $v = shift;
+          return '--version'        if $v eq '-V' || $v eq '--version';
+          return '-s'               if $v eq '-s' || $v eq '--show-stats';
+          return '--show-adv-stats' if $v               eq '--show-adv-stats';
+          return '-z'               if $v eq '-z' || $v eq '--zero-stats';
+          exec('${lib.getExe pkgs.sccache}', '-h');
+        }
+        exec('${lib.getExe pkgs.sccache}', map { untaint $_ } @ARGV);
+      '';
+    };
+}

profiles/code-remote/default.nix

@@ -107,6 +107,8 @@ in {
         #group = "code.server";
 
         # a nice tool if you don't care about security: https://argon2.online/
+        # otherwise:
+        # echo -n 'password' | nix run nixpkgs#libargon2 -- "$(pwgen 20 -n1)" -e
         hashedPassword = "$argon2i$v=19$m=16,t=2,p=1$MHh5UGNtU1lWR1UySnhIZw$ITg8U7Gq2CXByuOOnrKVUg"; # hunter2
 
         extraArguments = [

profiles/desktop/base.nix

@@ -1,8 +0,0 @@
-{ pkgs, ... }:
-{
-
-  environment.systemPackages = with pkgs; [
-    gparted
-  ];
-
-}

profiles/desktop/default.nix

@@ -0,0 +1,26 @@
+{ config, pkgs, ... }:
+{
+
+  # invasive as fuck
+  # https://github.com/NixOS/nixpkgs/blob/89c2b2330e733d6cdb5eae7b899326930c2c0648/nixos/modules/programs/firefox.nix#L13-L20
+  # programs.firefox.enable = true;
+
+  environment.systemPackages = [
+    # instead of programs.firefox.enable
+    (if !config.services.gnome.gnome-browser-connector.enable
+      then pkgs.firefox
+      else pkgs.firefox.override {
+          nativeMessagingHosts = [ pkgs.gnome-browser-connector ];
+        }
+    )
+
+    pkgs.gparted
+  ];
+
+  # used by gparted?
+  boot.supportedFilesystems.ntfs = true;
+  boot.supportedFilesystems.vfat = true;
+  boot.supportedFilesystems.xfs = true;
+  boot.supportedFilesystems.exfat = true;
+
+}

profiles/desktop/gnome/default.nix

@@ -1,29 +1,84 @@
-{ config, pkgs, ... }:
-{
+{ config, lib, pkgs, ... }:
+lib.mkMerge [
+/*
+
+https://wiki.nixos.org/wiki/GNOME
+
+*/
+
+
+(lib.optionalAttrs (lib.versionOlder lib.version "25.11") {
   services.xserver.enable = true;
   services.xserver.displayManager.gdm.enable = true;
   services.xserver.displayManager.gdm.wayland = true;
   services.xserver.desktopManager.gnome.enable = true;
-  #services.printing.enable = true; # CUPS
+})
+(lib.optionalAttrs (lib.versionAtLeast lib.version "25.11") {
+  services.displayManager.gdm.enable = true;
+  services.desktopManager.gnome.enable = true;
+})
+
+{
+  # services.xserver.enable = true;
+  # services.xserver.displayManager.gdm.enable = true;
+  # services.xserver.displayManager.gdm.wayland = true;
+  # services.xserver.desktopManager.gnome.enable = true;
+
+  #services.printing.enable = true; # CUPS, done in printing.nix
   programs.xwayland.enable = true;
   xdg.portal.enable = true;
 
-  services.udev.packages = with pkgs; [ gnome.gnome-settings-daemon ];
+  qt.enable = true;
+  qt.platformTheme = "gnome";
+  qt.style = "adwaita-dark";
+
+  # support GConf-based applications
+  # services.dbus.packages = [ pkgs.gnome2.GConf ];
+
+  # Enable system tray icons (used by gnomeExtensions.appindicator)
+  services.udev.packages = [ pkgs.gnome-settings-daemon ];
+
+  # programs.dconf.profiles.user.databases = [
+  #   {
+  #     settings."org/gnome/mutter".experimental-features = [
+  #       # "scale-monitor-framebuffer" # Enables fractional scaling (125% 150% 175%)
+  #       # "variable-refresh-rate" # Enables Variable Refresh Rate (VRR) on compatible displays
+  #       # "xwayland-native-scaling" # Scales Xwayland applications to look crisp on HiDPI screens
+  #     ];
+  #   }
+  # ];
 
   programs.gnome-terminal.enable = false;
 
   services.tumbler.enable = true; # TODO: needed when we have ffmpegthumbnailer?
-  services.gnome.sushi.enable = true;
-  services.gnome.gnome-online-accounts.enable = true;
+  services.gnome.sushi.enable = true; # quick previewer for nautilus
+  # services.gnome.gnome-online-accounts.enable = true; # Gnome SSO service
 
-  environment.systemPackages = with pkgs; [
-    firefox
-    pavucontrol
-    lxterminal
-    # TODO: shadow gnome-terminal
-    ffmpegthumbnailer
-    libheif # HEIF thumbnails
-    gnomeExtensions.appindicator
+  # for managing gnome extensions with firefox, assumes programs.firefox.enable
+  services.gnome.gnome-browser-connector.enable  = true;
+
+  environment.systemPackages = [
+    pkgs.pavucontrol
+    pkgs.lxterminal # TODO: remove?
+    pkgs.ghostty
+
+    pkgs.gnome-tweaks
+    pkgs.refine # Tweak various aspects of GNOME
+
+    # pkgs.thumbler # TODO?
+    pkgs.ffmpegthumbnailer
+    pkgs.libheif.bin # provides heif-thumbnailer, the program that generates HEIF thumbnails
+    pkgs.libheif.out # provides heif.thumbnailer, allows for the viewing of HEIF thumbnails
+    pkgs.gnomeExtensions.appindicator
+
+    pkgs.decibels # audio player
+    pkgs.dconf-editor
+
+    pkgs.loupe # eog replacement
+    pkgs.shotwell # image editor
+    # pkgs.gnome-clocks
+
+    pkgs.desktop-file-utils # update-desktop-database
   ];
 
   # an attempt to make nautilus discover new files, but it proved to be a freebsd-linux incompatiblity
@@ -36,20 +91,30 @@
   # https://en.wikipedia.org/wiki/File_Alteration_Monitor
   # or https://github.com/fsnotify/fsnotify
 
-  environment.gnome.excludePackages = (with pkgs; [
-    gnome-photos
-    gnome-tour
-    (pkgs.gedit or pkgs.gnome.gedit) # text editor (24.05 vs 23.11)
-  ]) ++ (with pkgs.gnome; [
-    #cheese # webcam tool
-    gnome-music
-    gnome-terminal
-    #epiphany # web browser
-    geary # email reader
-    totem # video player
-    tali # poker game
-    iagno # go game
-    hitori # sudoku game
-    atomix # puzzle game
-  ]);
+  environment.gnome.excludePackages = [
+    pkgs.gnome-console
+    pkgs.gnome-terminal
+    pkgs.gnome-photos
+    pkgs.gnome-tour
+    pkgs.gnome-maps
+    pkgs.gedit # text editor (24.05 vs 23.11)
+    # pkgs.papers # Document Viewer (new)
+    pkgs.eog
+    #pkgs.cheese # webcam tool
+    #pkgs.baobab # Disk Usage Analyser
+    pkgs.simple-scan # scanning utility
+    pkgs.yelp # Help
+    pkgs.gnome-music
+    pkgs.evince # Document Viewer
+    pkgs.epiphany # web browser
+    pkgs.geary # email reader
+    pkgs.showtime # video player
+    pkgs.totem # video player
+    pkgs.tali # poker game
+    pkgs.iagno # go game
+    pkgs.hitori # sudoku game
+    pkgs.atomix # puzzle game
+  ];
 }
+
+]

profiles/desktop/lutris.nix

@@ -1,4 +1,5 @@
 { config, pkgs, lib, ... }:
+lib.mkMerge [
 {
 
   # TODO: gamemode?
@@ -8,29 +9,38 @@
   environment.systemPackages = [
     (pkgs.lutris.override {
       extraPkgs = pkgs: [
-        pkgs.wineWowPackages.staging
+        # pkgs.wineWowPackages.staging # slow to build
+        # pkgs.wineWowPackages.stable
         pkgs.winetricks
         pkgs.pixman
         pkgs.libjpeg
-        pkgs.gnome.zenity
+        (pkgs.zenity or pkgs.gnome.pkgs.adwaita-icon-theme)
       ];
       extraLibraries =  pkgs: [
       ];
     })
 
     # ensure icons appear
-    pkgs.gnome3.adwaita-icon-theme
+    (pkgs.adwaita-icon-theme or pkgs.gnome.pkgs.adwaita-icon-theme)
     pkgs.hicolor-icon-theme #
 
     # Needed for some installers like League of Legends
     pkgs.openssl
-    pkgs.gnome.zenity
+    (pkgs.zenity or pkgs.gnome.pkgs.adwaita-icon-theme)
 
   ];
 
-	hardware.opengl.enable = true;
-	hardware.opengl.driSupport = true;
-	hardware.opengl.driSupport32Bit = true;
-	hardware.opengl.extraPackages32 = with pkgs.pkgsi686Linux; [ libva ];
-
 }
+(lib.optionalAttrs (lib.versionOlder lib.version "24.11") {
+  hardware.opengl.enable = true;
+  hardware.opengl.driSupport = true;
+  hardware.opengl.driSupport32Bit = true;
+  hardware.opengl.extraPackages32 = with pkgs.pkgsi686Linux; [ libva ];
+})
+(lib.optionalAttrs (lib.versionAtLeast lib.version "24.11") {
+  hardware.graphics.enable = true;
+  hardware.graphics.enable32Bit = true;
+  hardware.graphics.extraPackages32 = with pkgs.pkgsi686Linux; [ libva ];
+})
+
+]

profiles/desktop/retroarch.nix

@@ -0,0 +1,123 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = [
+    pkgs.retroarch-full
+    /* pkgs.retroarch */
+    /* pkgs.retroarchBare */
+    /*
+    (pkgs.retroarch.override {
+      cores = with pkgs.libretro; [
+        ## selection
+        #bsnes
+        #citra
+        #desmume
+        #dolphin
+        #fceumm
+        #gambatte
+        #genesis-plus-gx
+        #melonds
+        #mgba
+        #mupen64plus
+        #parallel-n64
+        #pcsx-rearmed
+        #pcsx2
+        #ppsspp
+        #snes9x
+        #vba-m
+        #beetle-psx-hw
+
+        # ALL
+        atari800
+        beetle-gba
+        beetle-lynx
+        beetle-ngp
+        beetle-pce-fast
+        beetle-pce
+        beetle-pcfx
+        beetle-psx
+        beetle-saturn
+        beetle-supafaust
+        beetle-supergrafx
+        beetle-vb
+        beetle-wswan
+        blastem
+        bluemsx
+        bsnes-hd
+        bsnes-mercury
+        bsnes
+        citra
+        desmume
+        desmume2015
+        dolphin
+        dosbox-pure
+        dosbox
+        easyrpg
+        eightyone
+        fbalpha2012
+        fbneo
+        fceumm
+        flycast
+        fmsx
+        freeintv
+        fuse
+        gambatte
+        genesis-plus-gx
+        gpsp
+        gw
+        handy
+        hatari
+        mame
+        mame2000
+        mame2003-plus
+        mame2003
+        mame2010
+        mame2015
+        mame2016
+        melonds
+        mesen-s
+        mesen
+        meteor
+        mgba
+        mrboom
+        mupen64plus
+        neocd
+        nestopia
+        np2kai
+        nxengine
+        o2em
+        opera
+        parallel-n64
+        pcsx-rearmed
+        pcsx2
+        picodrive
+        play
+        ppsspp
+        prboom
+        prosystem
+        puae
+        quicknes
+        same_cdi
+        sameboy
+        scummvm
+        smsplus-gx
+        snes9x
+        snes9x2002
+        snes9x2005
+        snes9x2010
+        stella
+        stella2014
+        swanstation
+        tgbdual
+        thepowdertoy
+        tic80
+        twenty-fortyeight
+        vba-m
+        vba-next
+        vecx
+        virtualjaguar
+        yabause
+      ];
+    })
+    */
+  ];
+}

profiles/desktop/sound/alsa.nix

@@ -1,6 +0,0 @@
-{
-  sound.enable = true; # alsa sound?
-  #sound.mediaKeys.enable = true # only enable if headless
-
-  security.rtkit.enable = true; # optional
-}

profiles/desktop/sound/pipewire.nix

@@ -1,24 +1,30 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:
+
+# https://wiki.nixos.org/wiki/PipeWire
+
 {
-  hardware.pulseaudio.enable = false; # gnome defaults it to true
+  services.pulseaudio.enable = false; # gnome defaults it to true
 
-  #sound.enable = true # alsa? likely conflicts with pipewire
-  #sound.mediaKeys.enable = true # alsa? only enable if headless
-  services.pipewire.enable = true;
-  services.pipewire.alsa.enable = true;
-  services.pipewire.alsa.support32Bit = true;
-  #services.pipewire.jack.enable = true;
-  services.pipewire.pulse.enable = true;
-  # use the example session manager (no others are packaged yet so this is enabled by default,
-  # no need to redefine it in your config for now)
-  #services.pipewire.media-session.enable = true;
+  services.pipewire = {
+    enable = true;
 
-  environment.systemPackages = with pkgs; [
-    pavucontrol # volume and defaults
-    easyeffects # eq
-    helvum      # patchbay
-    carla       # VST (TODO: move into a DAW profile?)
+    alsa.enable = true;
+    alsa.support32Bit = true;
+
+    pulse.enable = true;
+
+    jack.enable = true;
+  };
+
+
+  environment.systemPackages = [
+    pkgs.pavucontrol # volume and defaults
+    pkgs.easyeffects # eq
+    # helvum      # patchbay - removed from nixpkgs
+    (pkgs.crosspipe or pkgs.helvum) # patchbay - helvum alternative
+    # carla       # VST patchbay (TODO: move into a DAW profile? Can be used for midi) # TODO: build broken
   ];
 
-  security.rtkit.enable = true; # optional
+  # optional, allows Pipewire to use the realtime scheduler for increased performance.
+  security.rtkit.enable = config.services.pipewire.jack.enable;
 }

profiles/desktop/sound/pulseaudio.nix

@@ -1,15 +0,0 @@
-{ pkgs, ... }:
-{
-  sound.enable = true; # alsa, needed?
-  #sound.mediaKeys.enable = true # only enable if headless
-  hardware.pulseaudio.enable = true;
-  hardware.pulseaudio.package = pkgs.pulseaudioFull; # optional
-  #hardware.pulseaudio.support32Bit = true;
-  nixpkgs.config.pulseaudio = true;
-
-  environment.systemPackages = with pkgs; [
-    pulseeffects-legacy
-  ];
-
-  security.rtkit.enable = true; # optional
-}

profiles/desktop/steam.nix

@@ -1,9 +1,10 @@
-{ config, pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 {
 	programs.steam.enable = true;
   programs.steam.remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
   programs.steam.dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
 
+  # TODO: gamescope?
   # TODO: gamemode?
 
   nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
@@ -12,6 +13,15 @@
     "steam-runtime"
   ];
 
+  programs.bash.shellInit = ''
+    if command -v complete >/dev/null; then
+    if [ -n "''${BASH_VERSION:-}" ]; then
+      complete -F _command steam-run
+      # complete -F _command fhs-run
+    fi
+    fi
+  '';
+
   /** /
   #programs.java.enable = true;
   nixpkgs.config.packageOverrides = pkgs: {
@@ -48,11 +58,11 @@
 				gtk3
 				gtk3-x11
 
-        xorg.libXcursor
-        xorg.libXi
-        xorg.libXinerama
-        xorg.libXScrnSaver
-        xorg.libxcb
+        libXcursor
+        libXi
+        libXinerama
+        libXScrnSaver
+        libxcb
 
 	      stdenv.cc.cc.lib
 	      #libkrb5
@@ -64,22 +74,35 @@
 
 	#services.joycond.enable = true;
 
-	hardware.opengl.enable = true;
-	hardware.opengl.driSupport = true;
-	hardware.opengl.driSupport32Bit = true;
-	hardware.opengl.extraPackages32 = with pkgs.pkgsi686Linux; [ libva ];
+  hardware.graphics.enable = true;
+  hardware.graphics.enable32Bit = true;
+  hardware.graphics.extraPackages32 = with pkgs.pkgsi686Linux; [ libva ];
 
   environment.systemPackages = with pkgs; [
-    steam-tui
+    # steam-tui
     steamcmd
+
     #winetricks
     #protontricks
 
-    wineWowPackages.full
+    # wineWowPackages.full
     #wineWowPackages.waylandFull
 
+    # bottles
+    # lutris
+
     # nice to have
     jstest-gtk
+    antimicrox
+
+    # since gnome doesn't let me select the provided [Desktop Action BigPicture]
+    # in the overview without right clicking /shrug
+    (makeDesktopItem {
+      desktopName = "Steam Big Picture";
+      name = "Steam";
+      exec = "steam steam://open/bigpicture";
+      icon = "steam";
+    })
   ];
 
 }

profiles/desktop/waydroid.nix

@@ -0,0 +1,60 @@
+{ pkgs, ... }:
+/*
+  = setup: =
+
+  $ sudo waydroid init
+  $ sudo waydroid init -S GAPPS -f
+
+  $ sudo systemctl start waydroid-container
+  $ sudo journalctl -u waydroid-container -e
+
+  $ waydroid session start
+
+  = maintenance: =
+
+  $ sudo waydroid upgrade
+
+  = wipe: =
+
+  $ sudo systemctl stop waydroid-container
+  $ sudo rm -r /var/lib/waydroid/* ~/.local/share/waydroid
+*/
+{
+  # https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/virtualisation/waydroid.nix
+  virtualisation.waydroid.enable = true; # will enable virtualisation.lxc.enable
+  environment.systemPackages = [ pkgs.wl-clipboard-timeout ];
+  # environment.systemPackages = [ (pkgs.wl-clipboard-timeout or pkgs.wl-clipboard) ];
+
+  # https://wiki.nixos.org/wiki/Waydroid
+
+  /** /
+  # waydroid-helper GUI:
+  environment.systemPackages = [ pkgs.waydroid-helper ];
+  systemd.packages = [ pkgs.waydroid-helper ];
+  systemd.services.waydroid-mount.wantedBy = [ "multi-user.target" ];
+  # required at runtime:
+  # $ systemctl --user start waydroid-monitor
+  # TODO: one of
+  # systemd.user.targets.multi-user.wants = [ "multi-user.target" ];
+  # systemd.user.services.waydroid-monitor.wantedBy = [ "waydroid-monitor.service" ];
+  /**/
+
+
+  # https://github.com/SCLorentz/NixOS-config/blob/abf4eefd8d8797878b3620faedfcdb3db696e7aa/modules/android.nix
+
+  # TODO:
+  # systemd.services."waydroid-set-props" = {
+  #   wantedBy = [ "multi-user.target" ];
+  #   after = [ "waydroid-container.service" ];
+  #   serviceConfig = {
+  #     Type = "oneshot";
+  #     # https://docs.waydro.id/usage/waydroid-prop-options
+  #     ExecStart = pkgs.writeShellScript "set-waydroid-props" ''
+  #         	  	${pkgs.waydroid}/bin/waydroid prop set persist.waydroid.multi_windows true
+  #         	  	# ${pkgs.waydroid}/bin/waydroid prop set persist.waydroid.reverse_scrolling true
+  #         	  	# ${pkgs.waydroid}/bin/waydroid prop set persist.sys.nativebridge 1
+  #         	  	# ${pkgs.waydroid}/bin/waydroid prop set ro.hardware ranchu
+  #       	  	'';
+  #   };
+  # };
+}

profiles/domeneshop-dyndns.nix

@@ -5,14 +5,16 @@ in
 {
   # auto domain update
 
+  # TODO: ensure dns64 does not interfere with this
+
   options = with lib; {
     services.domeneshop-updater.targets = mkOption {
       type = with types; listOf str;
-      #default = [ config.networking.fqdn ];
+      example = [ config.networking.fqdn ];
     };
   };
-
-  config = lib.mkIf (cfg.targets != []) {
+  # don't run if local VM
+  config = lib.mkIf (cfg.targets != [] && !config.virtualisation.isVmVariant) {
 
     users.users.domeneshop.isSystemUser = true;
     users.users.domeneshop.group = "domeneshop";
@@ -33,20 +35,44 @@ in
       serviceConfig = let
         prog = pkgs.writeShellApplication {
           name = "domeneshop-dyndns-updater.sh";
-          runtimeInputs = with pkgs; [ curl yq ];
+          runtimeInputs = with pkgs; [ curl iproute2 jq ];
           text = ''
             test -s /run/secrets/domeneshop/token || {
-              >&2 echo "ERROR: /run/secrets/domeneshop/token not found!"
+              echo >&2 "ERROR: /run/secrets/domeneshop/token not found!"
               exit 1
             }
             test -s /run/secrets/domeneshop/secret || {
-              >&2 echo "ERROR: /run/secrets/domeneshop/secret not found!"
+              echo >&2 "ERROR: /run/secrets/domeneshop/secret not found!"
               exit 1
             }
             DOMENESHOP_TOKEN="$( cat /run/secrets/domeneshop/token)"
             DOMENESHOP_SECRET="$(cat /run/secrets/domeneshop/secret)"
+
+            # get stable ipv6 addr, fallback to ipv4, fallback to curl default
+            IF=$(
+              ip -6 -json addr show scope global -temporary \
+                | jq '.[]| select(.ifname|contains("docker") or contains("tailscale")|not) | .addr_info[].local | select(.==null|not)' -r \
+                | head -n1
+            )
+            if [[ -z "$IF" ]]; then
+              IF=$(
+                ip -4 -json addr show scope global -temporary \
+                  | jq '.[]| select(.ifname|contains("docker") or contains("tailscale")|not) | .addr_info[].local | select(.==null|not)' -r \
+                  | head -n1
+              )
+            fi
+            if [[ -n "$IF" ]]; then
+              IF="--interface $IF"
+            else
+              IF=""
+            fi
+
+            # shellcheck disable=SC2086
+            echo + curl $IF api.domeneshop.no...
+
             ${lib.concatMapStringsSep "\n" (target: ''
-              curl https://"$DOMENESHOP_TOKEN":"$DOMENESHOP_SECRET"@api.domeneshop.no/v0/dyndns/update?hostname="${target}"
+              # shellcheck disable=SC2086
+              curl $IF https://"$DOMENESHOP_TOKEN":"$DOMENESHOP_SECRET"@api.domeneshop.no/v0/dyndns/update?hostname="${target}"
             '') cfg.targets}
           '';
         };

profiles/earlyoom.nix

@@ -0,0 +1,16 @@
+{
+  services.earlyoom = {
+    enable = true;
+    # all must be true for earlyoom to kill shit
+    freeMemThreshold = 2; # in percent
+    freeSwapThreshold = 20; # in percent
+    freeSwapKillThreshold = 5; # in percent, sigkill
+    extraArgs = [
+      # "-g" # Kill all processes that have same process group id
+      "--avoid"
+      "^(X|init|Xorg|ssh|plasma.*|gnome.*|konsole|lxterminal|ghostty|kwin)$"
+      "--prefer"
+      "^(electron|libreoffice|gimp|zen*|nix-env|nix-instantiate|gcc|rustc)$"
+    ];
+  };
+}

profiles/hidpi.nix

@@ -0,0 +1,24 @@
+{ inputs, ... }:
+{
+  imports = [
+    # https://github.com/NixOS/nixos-hardware/blob/master/common/hidpi.nix
+    inputs.nixos-hardware.nixosModules.common-hidpi
+  ];
+
+  environment.variables = {
+    # better fonts:
+    # https://web.archive.org/web/20230921201835/https://old.reddit.com/r/linux_gaming/comments/16lwgnj/is_it_possible_to_improve_font_rendering_on_linux/
+    # via
+    # https://github.com/samemrecebi
+    FREETYPE_PROPERTIES = "cff:no-stem-darkening=0 autofitter:no-stem-darkening=0";
+
+    # TODO: enable these?
+
+    # # https://wiki.archlinux.org/title/HiDPI#Qt_5
+    # QT_AUTO_SCREEN_SCALE_FACTOR = 1;
+    # QT_ENABLE_HIGHDPI_SCALING = 1;
+
+    # # https://wiki.archlinux.org/title/HiDPI#GDK_3_(GTK_3)
+    # GDK_SCALE = 2;
+  };
+}

profiles/http/default.nix

@@ -1,81 +1,169 @@
 { config, pkgs, lib, ... }:
 let
-  mkDomain = subname: "${subname}.${config.networking.fqdn}";
+  inherit (config.pbsds.nginx) mkDomain allSubdomains;
 in
 {
-  _module.args.mkDomain = mkDomain;
-  _module.args.allSubdomains = lib.pipe config.services.nginx.virtualHosts [
-    #(lib.mapAttrsToList (domain: vhost: [ domain ] ++ vhost.serverAliases))
-    (lib.mapAttrsToList (domain: vhost: [ domain ]))
-    lib.flatten
-    (builtins.filter (domain: domain != ""))
-    (lib.sort (x: y: x<y))
-  ];
+  options.pbsds.nginx = {
 
-  security.acme.acceptTerms = true;
-  security.acme.defaults.email = "pbsds+acme@hotmail.com"; # TODO: parametrize per host
-  #security.acme.defaults.renewInterval = "daily";
-  #security.acme.defaults.reloadServices
-
-  # https://www.xf.is/2020/06/30/list-of-free-acme-ssl-providers/
-  #security.acme.defaults.server = "https://acme-staging-v02.api.letsencrypt.org/directory"; # STAGING
-  #security.acme.defaults.server = "https://api.buypass.com/acme/directory"; # no wildcards, rate limit: 20 domains/week, 5 duplicate certs / week
-  #security.acme.defaults.server = "https://api.test4.buypass.no/acme/directory"; # STAGING. no wildcards, rate limit: 20 domains/week, 5 duplicate certs / week
-
-  # DNS-based ACME:
-  # - https://go-acme.github.io/lego/dns/domeneshop/
-  # - https://nixos.org/manual/nixos/stable/index.html#module-security-acme-config-dns-with-vhosts
-  #security.acme.defaults.dnsProvider = "domeneshop";
-  #security.acme.defaults.credentialsFile = "/var/lib/secrets/domeneshop.key"; # TODO: this file must be made by hand, containing env variables.
-
-  services.nginx.enable = true;
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
-  services.nginx.recommendedGzipSettings = true;
-  services.nginx.recommendedOptimisation = true;
-  services.nginx.recommendedProxySettings = true;
-  services.nginx.recommendedTlsSettings = true;
-
-  /** /
-  services.nginx.virtualHosts."" = {
-    default = true;
-    forceSSL = false;
-    enableACME = false;
-    root = pkgs.writeTextDir "index.html" ''
-      <!DOCTYPE html>
-      no
-    '';
-  };
-  /**/
-
-  # Website tunnel
-  # TODO: remove
-  /** /
-  services.nginx.virtualHosts.${config.networking.fqdn} = {
-    forceSSL = true; # addSSL = true;
-    enableACME = true;
-    #acmeRoot = null; # use DNS
-    default = true;
-    serverAliases = map mkDomain [
-      "www"
-      #"*" # requires DNS ACME
-    ];
-    # The alternative to ^ is: config.security.acme.certs."${acmeDomain}".extraDomainNames = [ (mkDomain "foo") ];
-    # TODO: 'nox' alias for everything
-    locations."/" = {
-      proxyPass = "http://pbuntu.pbsds.net";
-      proxyWebsockets = true;
+    mkDomain = lib.mkOption {
+      visible = false; internal = true; readOnly = true;
+      default = subname: "${subname}.${config.networking.fqdn}";
     };
+
+    allSubdomains = lib.mkOption {
+      visible = false; internal = true; readOnly = true;
+      default = lib.pipe config.services.nginx.virtualHosts [
+        # #(lib.mapAttrsToList (domain: vhost: [ domain ] ++ vhost.serverAliases))
+        # (lib.mapAttrsToList (domain: vhost: [ domain ]))
+        # lib.flatten
+        lib.attrNames
+        (lib.filter (domain: domain != "" && domain != "_"))
+        (lib.sort (x: y: x<y))
+      ];
+    };
+
+    allowList.extraConfig = lib.mkOption {
+      visible = false; internal = true; readOnly = true;
+      default = ''
+        # home https://ipinfo.io/ips/193.71.0.0/16
+        allow 193.71.0.0/16;
+
+        # ntnu https://ipinfo.io/ips/129.241.0.0/16
+        allow 129.241.0.0/16;
+
+        # local
+        ${
+          lib.pipe config.services.fail2ban.ignoreIP [
+            (map (x: "allow ${x};"))
+            lib.concatLines
+          ]
+        }
+        deny all;
+      '';
+    };
+
   };
-  #services.nginx.virtualHosts.${mkDomain "www"} = {
-  #  addSSL = true;
-  #  useACMEHost = acmeDomain; #enableACME = true;
-  #  locations."/" = {
-  #    proxyPass = "http://pbuntu.pbsds.net";
-  #    proxyWebsockets = true;
-  #  };
-  #};
-  /**/
 
+  config = {
 
+    security.acme.acceptTerms = true;
+    security.acme.defaults.email = "pbsds+acme@hotmail.com"; # TODO: parametrize per host
+    #security.acme.defaults.renewInterval = "daily";
+    #security.acme.defaults.reloadServices
+
+    # https://www.xf.is/2020/06/30/list-of-free-acme-ssl-providers/
+    #security.acme.defaults.server = "https://acme-v02.api.letsencrypt.org/directory" # default
+    #security.acme.defaults.server = "https://acme-staging-v02.api.letsencrypt.org/directory"; # STAGING
+    #security.acme.defaults.server = "https://api.buypass.com/acme/directory"; # no wildcards, rate limit: 20 domains/week, 5 duplicate certs / week
+    #security.acme.defaults.server = "https://api.test4.buypass.no/acme/directory"; # STAGING. no wildcards, rate limit: 20 domains/week, 5 duplicate certs / week
+
+    # DNS-based ACME:
+    # - https://go-acme.github.io/lego/dns/domeneshop/
+    # - https://nixos.org/manual/nixos/stable/index.html#module-security-acme-config-dns-with-vhosts
+    #security.acme.defaults.dnsProvider = "domeneshop";
+    #security.acme.defaults.credentialsFile = "/var/lib/secrets/domeneshop.key"; # TODO: this file must be made by hand, containing env variables.
+
+    services.nginx.enable = true;
+    networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+    # TODO:
+    #services.nginx.commonHttpConfig = ''
+    #  proxy_hide_header X-Frame-Options;
+    #'';
+    # TODO: Somehow distribute and add this to all location."/".extraConfig
+    #default = {
+    #  #useACMEHost = config.networking.fqdn;
+    #  forceSSL = true; # addSSL = true;
+    #  enableACME = true; #useACMEHost = acmeDomain;
+    #}
+    # TODO: Somehow distribute and add this to all location."/".extraConfig
+    #commonProxySettings = ''
+    #  proxy_set_header Host $host;
+    #  proxy_set_header X-Real-IP $remote_addr;
+    #  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    #  proxy_set_header X-Forwarded-Proto $scheme;
+    #  proxy_set_header X-Forwarded-Host $host;
+    #  proxy_set_header X-Forwarded-Server $host;
+    #'';
+
+    services.nginx.recommendedGzipSettings = true;
+    services.nginx.recommendedOptimisation = true;
+    services.nginx.recommendedProxySettings = true;
+    services.nginx.recommendedTlsSettings = true;
+
+    # nginx return 444 for all nonexistent virtualhosts
+    services.nginx.virtualHosts."_" = {
+      default = true;
+      addSSL = true;
+      sslCertificate = "${pkgs.path}/nixos/tests/common/acme/server/acme.test.cert.pem";
+      sslCertificateKey = "${pkgs.path}/nixos/tests/common/acme/server/acme.test.key.pem";
+      extraConfig = "return 444;";
+    };
+
+    # https://wiki.nixos.org/wiki/Fail2ban
+    # Defines a filter that detects URL probing by reading the Nginx access log
+    /*--* /
+    environment.etc."fail2ban/filter.d/nginx-url-probe.local".text = lib.mkDefault (lib.mkAfter ''
+    [Definition]
+    failregex = ^<HOST>.*(GET /(wp-|admin|boaform|phpmyadmin|\.env|\.git)|\.(dll|so|cfm|asp)|(\?|&)(=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000|=PHPE9568F36-D428-11d2-A769-00AA001ACF42|=PHPE9568F35-D428-11d2-A769-00AA001ACF42|=PHPE9568F34-D428-11d2-A769-00AA001ACF42)|\\x[0-9a-zA-Z]{2})
+    '');
+    services.fail2ban.enable = true;
+    services.fail2ban.jails = {
+      nginx-url-probe.settings = {
+        enabled = true;
+        filter = "nginx-url-probe";
+        logpath = "/var/log/nginx/access.log";
+        backend = "auto"; # Do not forget to specify this if your jail uses a log file
+        action = ''
+          %(action_)s[blocktype=DROP]
+          ntfy
+        '';
+        maxretry = 5;
+        findtime = 600;
+      };
+    };
+    /**/
+
+    /*--* /
+    services.nginx.virtualHosts."" = {
+      default = true;
+      forceSSL = false;
+      enableACME = false;
+      root = pkgs.writeTextDir "index.html" ''
+        <!DOCTYPE html>
+        no
+      '';
+    };
+    /**/
+
+    # Website tunnel
+    # TODO: remove
+    /*--* /
+    services.nginx.virtualHosts.${config.networking.fqdn} = {
+      forceSSL = true; # addSSL = true;
+      enableACME = true;
+      #acmeRoot = null; # use DNS
+      default = true;
+      serverAliases = map mkDomain [
+        "www"
+        #"*" # requires DNS ACME
+      ];
+      # The alternative to ^ is: config.security.acme.certs."${acmeDomain}".extraDomainNames = [ (mkDomain "foo") ];
+      # TODO: 'nox' alias for everything
+      locations."/" = {
+        proxyPass = "http://pbuntu.pbsds.net";
+        proxyWebsockets = true;
+      };
+    };
+    #services.nginx.virtualHosts.${mkDomain "www"} = {
+    #  addSSL = true;
+    #  useACMEHost = acmeDomain; #enableACME = true;
+    #  locations."/" = {
+    #    proxyPass = "http://pbuntu.pbsds.net";
+    #    proxyWebsockets = true;
+    #  };
+    #};
+    /**/
+
+  };
 }