From 16918d62b34b7e4d7817837057b88acb44e4f63c Mon Sep 17 00:00:00 2001
From: Kleidi Bujari <mail@4kb.net>
Date: Sat, 3 Oct 2026 19:56:13 -0700
Subject: enable flake-less machine builds

---
 modules/desktop.nix | 489 +++++++++++++++++++++++++++-------------------------
 1 file changed, 252 insertions(+), 237 deletions(-)

(limited to 'modules/desktop.nix')

diff --git a/modules/desktop.nix b/modules/desktop.nix
index 894a7db..747c302 100644
--- a/modules/desktop.nix
+++ b/modules/desktop.nix
@@ -1,283 +1,298 @@
-{ lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
-  inherit (lib) mkDefault;
+  cfg = config.depot.desktop;
+
+  inherit (lib) mkIf mkDefault mkEnableOption;
   inherit (builtins) listToAttrs;
 in
 {
-  environment.systemPackages = with pkgs; [
-    audacious
-    brightnessctl
-    foot
-    fuzzel
-    imv
-    man-pages
-    man-pages-posix
-    mpv
-    playerctl
-    pop-icon-theme
-    pwvucontrol
-    swaybg
-    swayidle
-    swaylock
-    tigervnc
-    wl-clipboard
-    xeyes
-    xwayland-satellite
-    zathura
+  options.depot.desktop.enable = mkEnableOption "depot desktop";
 
-    # Spell checking
-    aspell
-    aspellDicts.en
-    aspellDicts.en-science
-    aspellDicts.en-computers
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      audacious
+      brightnessctl
+      foot
+      fuzzel
+      imv
+      man-pages
+      man-pages-posix
+      mpv
+      playerctl
+      pop-icon-theme
+      pwvucontrol
+      swaybg
+      swayidle
+      swaylock
+      tigervnc
+      wl-clipboard
+      xeyes
+      xwayland-satellite
+      zathura
 
-    hunspell
-    hunspellDicts.en-us
-  ];
+      # Spell checking
+      aspell
+      aspellDicts.en
+      aspellDicts.en-science
+      aspellDicts.en-computers
 
-  documentation = {
-    dev.enable = true;
-    doc.enable = true;
-    info.enable = true;
-    man.enable = true;
-  };
+      hunspell
+      hunspellDicts.en-us
+    ];
 
-  security.rtkit.enable = true;
-  services.pipewire = {
-    enable = true;
-    pulse.enable = true;
-    alsa.enable = true;
-  };
+    documentation = {
+      dev.enable = true;
+      doc.enable = true;
+      info.enable = true;
+      man.enable = true;
+    };
 
-  services.emacs = {
-    enable = true;
-    defaultEditor = true;
-    package = with pkgs; (emacsPackagesFor emacs).emacsWithPackages
-      (epkgs: [ epkgs.mu4e epkgs.treesit-grammars.with-all-grammars ]);
-  };
+    security.rtkit.enable = true;
+    services.pipewire = {
+      enable = true;
+      pulse.enable = true;
+      alsa.enable = true;
+    };
 
-  # Build nix derivations on disk rather than in /tmp which is mounted
-  # in RAM, otherwise large closures fail to build due to lack of
-  # space. Since desktops are used as dev machines, this option lives
-  # here rather than on a more general module.
-  systemd.services.nix-daemon.environment.TMPDIR = "/nix/tmp";
+    services.emacs = {
+      enable = true;
+      defaultEditor = true;
+      package =
+        with pkgs;
+        (emacsPackagesFor emacs).emacsWithPackages (epkgs: [
+          epkgs.mu4e
+          epkgs.treesit-grammars.with-all-grammars
+        ]);
+    };
 
-  # Make sure the directory for evaluating large closures exists for
-  # the nix daemon.
-  systemd.tmpfiles.rules = [ "d /nix/tmp 755 root root - -" ];
+    # Build nix derivations on disk rather than in /tmp which is mounted
+    # in RAM, otherwise large closures fail to build due to lack of
+    # space. Since desktops are used as dev machines, this option lives
+    # here rather than on a more general module.
+    systemd.services.nix-daemon.environment.TMPDIR = "/nix/tmp";
 
-  systemd.packages = with pkgs; [ mako ];
-  systemd.user.services =
-    let
-      afterGraphical = ExecStart: {
-        enable = true;
-        after = [ "graphical-session.target" ];
-        partOf = [ "graphical-session.target" ];
-        wantedBy = [ "graphical-session.target" ];
-        serviceConfig = {
-          inherit ExecStart;
-          Type = "simple";
+    # Make sure the directory for evaluating large closures exists for
+    # the nix daemon.
+    systemd.tmpfiles.rules = [ "d /nix/tmp 755 root root - -" ];
+
+    systemd.packages = with pkgs; [ mako ];
+    systemd.user.services =
+      let
+        afterGraphical = ExecStart: {
+          enable = true;
+          after = [ "graphical-session.target" ];
+          partOf = [ "graphical-session.target" ];
+          wantedBy = [ "graphical-session.target" ];
+          serviceConfig = {
+            inherit ExecStart;
+            Type = "simple";
+          };
         };
-      };
-    in
-    {
-      udiskie = afterGraphical "${pkgs.udiskie}/bin/udiskie";
-      swayidle =
-        let
-          swaylock = lib.concatStringsSep " " [
-            "${pkgs.swaylock}/bin/swaylock"
-            "--color 2b3328"
-            "--indicator-caps-lock"
-            "--ignore-empty-password"
-            "--daemonize"
-          ];
-        in
-        afterGraphical (
-          pkgs.writeShellScript "start-swayidle" ''
-            ${pkgs.swayidle}/bin/swayidle -w \
-            timeout 601 '${pkgs.niri}/bin/niri msg action power-off-monitors' \
-            timeout 600 '${swaylock}' \
-            before-sleep '${swaylock}'
-          ''
-        );
+      in
+      {
+        udiskie = afterGraphical "${pkgs.udiskie}/bin/udiskie";
+        swayidle =
+          let
+            swaylock = lib.concatStringsSep " " [
+              "${pkgs.swaylock}/bin/swaylock"
+              "--color 2b3328"
+              "--indicator-caps-lock"
+              "--ignore-empty-password"
+              "--daemonize"
+            ];
+          in
+          afterGraphical (
+            pkgs.writeShellScript "start-swayidle" ''
+              ${pkgs.swayidle}/bin/swayidle -w \
+              timeout 601 '${pkgs.niri}/bin/niri msg action power-off-monitors' \
+              timeout 600 '${swaylock}' \
+              before-sleep '${swaylock}'
+            ''
+          );
 
-      waybar = {
-        partOf = [ "graphical-session.target" ];
-        wantedBy = [ "graphical-session.target" ];
-        after = [ "graphical-session.target" ];
+        waybar = {
+          partOf = [ "graphical-session.target" ];
+          wantedBy = [ "graphical-session.target" ];
+          after = [ "graphical-session.target" ];
 
-        path = with pkgs; [
-          pwvucontrol
-        ];
+          path = with pkgs; [
+            pwvucontrol
+          ];
 
-        serviceConfig = {
-          Type = "exec";
-          ExecStart = "${pkgs.waybar}/bin/waybar";
-          ExecReload = "kill -SIGUSR2 $MAINPID";
-          Restart = "on-failure";
+          serviceConfig = {
+            Type = "exec";
+            ExecStart = "${pkgs.waybar}/bin/waybar";
+            ExecReload = "kill -SIGUSR2 $MAINPID";
+            Restart = "on-failure";
+          };
         };
       };
-    };
 
-  qt = {
-    enable = true;
-    style = "adwaita-dark";
-    platformTheme = "gnome";
-  };
+    qt = {
+      enable = true;
+      style = "adwaita-dark";
+      platformTheme = "gnome";
+    };
 
-  fonts = {
-    # Expose system fonts in case something non-standard needs them
-    fontDir.enable = true;
-    packages = with pkgs; [
-      ibm-plex
-      iosevka
-      nerd-fonts.symbols-only
-    ];
+    fonts = {
+      # Expose system fonts in case something non-standard needs them
+      fontDir.enable = true;
+      packages = with pkgs; [
+        ibm-plex
+        iosevka
+        nerd-fonts.symbols-only
+      ];
 
-    fontconfig.defaultFonts = {
-      serif = [ "IBM Plex Serif" ];
-      sansSerif = [ "IBM Plex Sans" ];
-      monospace = [ "IBM Plex Mono" ];
+      fontconfig.defaultFonts = {
+        serif = [ "IBM Plex Serif" ];
+        sansSerif = [ "IBM Plex Sans" ];
+        monospace = [ "IBM Plex Mono" ];
+      };
     };
-  };
-
-  environment.etc."xdg/user-dirs.defaults".text = ''
-    DOWNLOAD=/tmp/downloads
-  '';
 
-  environment.sessionVariables = {
-    MOZ_ENABLE_WAYLAND = 1;
-    MOZ_USE_XINPUT2 = 1;
-    MOZ_WEBRENDER = 1;
-    QT_QPA_PLATFORM = "wayland;xcb";
-  };
+    environment.etc."xdg/user-dirs.defaults".text = ''
+      DOWNLOAD=/tmp/downloads
+    '';
 
-  programs = {
-    niri.enable = true;
-    direnv.enable = true;
-    fish = {
-      enable = true;
-      interactiveShellInit = ''
-        # disable greeting
-        set fish_greeting
-      '';
+    environment.sessionVariables = {
+      MOZ_ENABLE_WAYLAND = 1;
+      MOZ_USE_XINPUT2 = 1;
+      MOZ_WEBRENDER = 1;
+      QT_QPA_PLATFORM = "wayland;xcb";
     };
 
-    # GTK settings
-    dconf = {
-      enable = true;
-      profiles.user.databases = [
-        {
-          lockAll = true;
-          settings = {
-            "org/gnome/desktop/interface" = {
-              color-scheme = "prefer-dark";
-              gtk-font-name = "Sans Serif 10";
-              icon-theme = "Pop";
-              theme-name = "Adwaita";
+    programs = {
+      niri.enable = true;
+      direnv.enable = true;
+      fish = {
+        enable = true;
+        interactiveShellInit = ''
+          # disable greeting
+          set fish_greeting
+        '';
+      };
+
+      # GTK settings
+      dconf = {
+        enable = true;
+        profiles.user.databases = [
+          {
+            lockAll = true;
+            settings = {
+              "org/gnome/desktop/interface" = {
+                color-scheme = "prefer-dark";
+                gtk-font-name = "Sans Serif 10";
+                icon-theme = "Pop";
+                theme-name = "Adwaita";
+              };
             };
-          };
-        }
-      ];
+          }
+        ];
+      };
     };
-  };
 
-  hardware.bluetooth = {
-    enable = true;
-    powerOnBoot = true;
-    settings = {
-      General = {
-        Experimental = true;
-      };
-      Policy = {
-        AutoEnable = true;
+    hardware.bluetooth = {
+      enable = true;
+      powerOnBoot = true;
+      settings = {
+        General = {
+          Experimental = true;
+        };
+        Policy = {
+          AutoEnable = true;
+        };
       };
     };
-  };
 
-  services.blueman.enable = true;
+    services.blueman.enable = true;
 
-  # Helper for managing dotfiles
-  environment.shellAliases.dots = "git --git-dir=$HOME/.local/cfg/ --work-tree=$HOME";
+    # Helper for managing dotfiles
+    environment.shellAliases.dots = "git --git-dir=$HOME/.local/cfg/ --work-tree=$HOME";
 
-  # Enable modifying keyboard firmware
-  hardware.keyboard.qmk.enable = true;
+    # Enable modifying keyboard firmware
+    hardware.keyboard.qmk.enable = true;
 
-  security.polkit.enable = true;
+    security.polkit.enable = true;
 
-  services = {
-    gnome.gnome-keyring.enable = true;
-    upower.enable = true;
-    pcscd.enable = true;
-    udev.packages = with pkgs; [ yubikey-personalization ];
-    udisks2 = {
-      enable = true;
-      mountOnMedia = true;
+    services = {
+      gnome.gnome-keyring.enable = true;
+      upower.enable = true;
+      pcscd.enable = true;
+      udev.packages = with pkgs; [ yubikey-personalization ];
+      udisks2 = {
+        enable = true;
+        mountOnMedia = true;
+      };
     };
-  };
 
-  programs.firefox = {
-    enable = true;
-    preferences = {
-      # Enable hardware transcoding
-      "media.ffmpeg.vaapi.enabled" = true;
+    programs.firefox = {
+      enable = true;
+      preferences = {
+        # Enable hardware transcoding
+        "media.ffmpeg.vaapi.enabled" = true;
 
-      # Disable controlling media with keyboard
-      "media.hardwaremediakeys.enabled" = false;
-      # Enable legacy compact mode
-      "browser.compactmode.show" = true;
-      "browser.uidensity" = 1;
+        # Disable controlling media with keyboard
+        "media.hardwaremediakeys.enabled" = false;
+        # Enable legacy compact mode
+        "browser.compactmode.show" = true;
+        "browser.uidensity" = 1;
 
-      # Disable ctrl+q closing browser
-      "browser.quitShortcut.disabled" = true;
+        # Disable ctrl+q closing browser
+        "browser.quitShortcut.disabled" = true;
 
-      # Hardcode theme to dark mode
-      "ui.systemUsesDarkTheme" = 1;
-    };
-    policies = {
-      DefaultDownloadDirectory = "/tmp/firefox";
-      DisableTelemetry = true;
-      DisableFirefoxStudies = true;
-      EnableTrackingProtection = {
-        Value = true;
-        Locked = true;
-        Cryptomining = true;
-        Fingerprinting = true;
+        # Hardcode theme to dark mode
+        "ui.systemUsesDarkTheme" = 1;
       };
-      DisableAccounts = true;
-      DisableFirefoxAccounts = true;
-      DisableFirefoxScreenshots = true;
-      DisablePocket = true;
-      DisplayBookmarksToolbar = "never";
-      DisplayMenuBar = "default-off";
-      DontCheckDefaultBrowser = true;
-      Homepage = {
-        URL = "about:blank";
-        StartPage = "homepage";
-      };
-      HttpsOnlyMode = "enabled";
-      DNSOverHTTPS = false;
-      NewTabPage = false;
-      OfferToSaveLogins = false;
-      PasswordManagerEnabled = false;
-      SearchBar = "unified";
-      SearchEngines.Default = "DuckDuckGo";
-      SearchSuggestEnabled = false;
-      ExtensionSettings =
-        let
-          extension = shortId: uuid: {
-            name = uuid;
-            value = {
-              install_url = "https://addons.mozilla.org/en-US/firefox/downloads/latest/${shortId}/latest.xpi";
-              installation_mode = "force_installed";
+      policies = {
+        DefaultDownloadDirectory = "/tmp/firefox";
+        DisableTelemetry = true;
+        DisableFirefoxStudies = true;
+        EnableTrackingProtection = {
+          Value = true;
+          Locked = true;
+          Cryptomining = true;
+          Fingerprinting = true;
+        };
+        DisableAccounts = true;
+        DisableFirefoxAccounts = true;
+        DisableFirefoxScreenshots = true;
+        DisablePocket = true;
+        DisplayBookmarksToolbar = "never";
+        DisplayMenuBar = "default-off";
+        DontCheckDefaultBrowser = true;
+        Homepage = {
+          URL = "about:blank";
+          StartPage = "homepage";
+        };
+        HttpsOnlyMode = "enabled";
+        DNSOverHTTPS = false;
+        NewTabPage = false;
+        OfferToSaveLogins = false;
+        PasswordManagerEnabled = false;
+        SearchBar = "unified";
+        SearchEngines.Default = "DuckDuckGo";
+        SearchSuggestEnabled = false;
+        ExtensionSettings =
+          let
+            extension = shortId: uuid: {
+              name = uuid;
+              value = {
+                install_url = "https://addons.mozilla.org/en-US/firefox/downloads/latest/${shortId}/latest.xpi";
+                installation_mode = "force_installed";
+              };
             };
-          };
-        in
-        listToAttrs [
-          (extension "ublock-origin" "uBlock0@raymondhill.net")
-          (extension "bitwarden-password-manager" "{446900e4-71c2-419f-a6a7-df9c091e268b}")
-          (extension "darkreader" "addon@darkreader.org")
-        ];
+          in
+          listToAttrs [
+            (extension "ublock-origin" "uBlock0@raymondhill.net")
+            (extension "bitwarden-password-manager" "{446900e4-71c2-419f-a6a7-df9c091e268b}")
+            (extension "darkreader" "addon@darkreader.org")
+          ];
+      };
     };
   };
 }
-- 
cgit v1.3.1


From bb585fb98b80729ce3ebc930b14c6cbab4acbabf Mon Sep 17 00:00:00 2001
From: Kleidi Bujari <mail@4kb.net>
Date: Sat, 3 Oct 2026 22:05:36 -0700
Subject: bump nixpkgs again and fix other flake refs

---
 flake.lock               |  8 ++++----
 machines/feneri.nix      | 33 +++++++++++++++++++++++++++++----
 machines/t1.nix          |  1 +
 modules/desktop.nix      |  2 --
 modules/disk.nix         |  2 --
 modules/network.nix      |  5 ++++-
 modules/xnet/default.nix |  8 ++++++--
 7 files changed, 44 insertions(+), 15 deletions(-)

(limited to 'modules/desktop.nix')

diff --git a/flake.lock b/flake.lock
index 615c445..62d1fb2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -23,11 +23,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1790822859,
-        "narHash": "sha256-VBA0QerzzmL+4wxgtwiCdiLwLpJg2/9xOxhgO3BRJQA=",
-        "rev": "c59305bab2065cfecc4944690d9eedbb56f3a9fa",
+        "lastModified": 1791048980,
+        "narHash": "sha256-u3KCLxsnf1622GdFccg8hmkEIutOZ1h4pvia5ERjIuI=",
+        "rev": "a7868a727837f3c09cee2ce0ca671c76b1589fed",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1083223.c59305bab206/nixexprs.tar.zst"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1084968.a7868a727837/nixexprs.tar.zst"
       },
       "original": {
         "type": "tarball",
diff --git a/machines/feneri.nix b/machines/feneri.nix
index e75738b..605159e 100644
--- a/machines/feneri.nix
+++ b/machines/feneri.nix
@@ -1,9 +1,7 @@
-{ flake, modulesPath, ... }:
+{ config, modulesPath, ... }:
 
 {
   imports = [
-    # flake.outputs.nixosModules.disk
-    # flake.outputs.nixosModules.network
     (modulesPath + "/profiles/qemu-guest.nix")
     (modulesPath + "/virtualisation/qemu-guest-agent.nix")
   ];
@@ -44,5 +42,32 @@
     };
   };
 
-  networking.hostName = "feneri";
+  services.hydra = {
+    enable = true;
+    hydraURL = "https://hydra.web.4kb.net";
+    notificationSender = "hydra@localhost";
+    buildMachinesFiles = [];
+    useSubstitutes = true;
+  };
+
+  services.nginx.virtualHosts."hydra.web.4kb.net" = {
+    useACMEHost = "4kb.net";
+    forceSSL = true;
+
+    locations."/".proxyPass = "http://localhost:${toString config.services.hydra.port}";
+  };
+
+  nix.settings.allowed-uris = [
+    "git+https://github.com/NixOS/nixpkgs/"
+    "https://channels.nixos.org/"
+    "https://releases.nixos.org/nixos/"
+  ];
+
+  systemd.services.hydra-notify.enable = false;
+
+  networking = {
+    hostName = "feneri";
+    domain = "4kb.net";
+    useDHCP = false;
+  };
 }
diff --git a/machines/t1.nix b/machines/t1.nix
index d8d749b..3a46494 100644
--- a/machines/t1.nix
+++ b/machines/t1.nix
@@ -19,6 +19,7 @@
     desktop.enable = true;
     users.kle.enable = true;
     net = {
+      enable = true;
       v6Token = "::beef";
       sshd.enable = true;
       sshd.publish = true;
diff --git a/modules/desktop.nix b/modules/desktop.nix
index 747c302..b098020 100644
--- a/modules/desktop.nix
+++ b/modules/desktop.nix
@@ -38,8 +38,6 @@ in
       # Spell checking
       aspell
       aspellDicts.en
-      aspellDicts.en-science
-      aspellDicts.en-computers
 
       hunspell
       hunspellDicts.en-us
diff --git a/modules/disk.nix b/modules/disk.nix
index bf4a9a8..a8f7fbf 100644
--- a/modules/disk.nix
+++ b/modules/disk.nix
@@ -61,7 +61,6 @@ in
       kernelParams = [
         "nohibernate"
         "elevator=none"
-        "rd.systemd.unit=rescue.target"
       ];
       supportedFilesystems = [
         "vfat"
@@ -145,7 +144,6 @@ in
       '';
     };
 
-    boot.initrd.systemd.emergencyAccess = true;
     boot.initrd.systemd.initrdBin = [
       pkgs.cloud-utils
       pkgs.util-linux
diff --git a/modules/network.nix b/modules/network.nix
index 8264102..e9383c2 100644
--- a/modules/network.nix
+++ b/modules/network.nix
@@ -3,6 +3,8 @@ let
   cfg = config.depot.net;
   inherit (lib)
     mkOption
+    mkEnableOption
+    mkIf
     types
     ;
 
@@ -27,6 +29,7 @@ in
   ];
 
   options.depot.net = {
+    enable = mkEnableOption "depot networking";
     v6Token = mkOption {
       type = types.str;
       default = "eui64";
@@ -34,7 +37,7 @@ in
     };
   };
 
-  config = {
+  config = mkIf cfg.enable {
     # networkd handles this
     networking.useDHCP = false;
 
diff --git a/modules/xnet/default.nix b/modules/xnet/default.nix
index 67bbbe5..415fc0b 100644
--- a/modules/xnet/default.nix
+++ b/modules/xnet/default.nix
@@ -45,14 +45,15 @@ in
     time.timeZone = mkDefault "US/Pacific";
 
     nix = {
-      nixPath = mkForce [ "nixpkgs=${pkgs.path}" ];
       settings = {
         auto-optimise-store = true;
+        nix-path = mkForce [ "nixpkgs=${pkgs.path}" ];
         experimental-features = [
           "nix-command"
           "flakes"
           "pipe-operators"
         ];
+
         warn-dirty = false;
 
         # timeout fast from binary cache
@@ -62,7 +63,7 @@ in
         automatic = true;
         options = mkDefault "--delete-older-than 30d";
       };
-      # registry.nixpkgs.flake = pkgs.path;
+      registry.nixpkgs.flake.outPath = "path:${pkgs.path}";
     };
 
     documentation = {
@@ -99,6 +100,9 @@ in
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmWInQNT6EoU1NtUYzTs5jtpfbO/m6yvCckOiEGjvDc";
       };
       extraConfig = ''
+        Host *
+          SetEnv TERM=xterm-256color
+
         Host github
           HostName github.com
           User git
-- 
cgit v1.3.1