fix calibre-web write issue

i don't like having to build them

docs/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 2026-07-25
+
+- Added jjui config generation to `jujutsu.nix` in Home Manager to include custom GitHub ruleset bypass commands (`ctrl+b` and `ctrl+shift+b`).
+- Added `overlays/cheetah3.nix` to disable `pythonMetadataCheckPhase` for `cheetah3`. 
+  This fixes an issue where the NixOS rebuild fails for `sabnzbd` due to `importlib.metadata.PackageNotFoundError: No package metadata was found for cheetah3` during the Python package evaluation in `nixos-unstable`.
+
 ## 2026-07-20
 
 - Added `overlays/paho-mqtt.nix` to disable paho-mqtt's flaky, socket-based

flake.lock

@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784123936,
+        "lastModified": 1784500460,
-        "narHash": "sha256-IOWwQMJhUxcojm0MRvuKs1fKLH727u4+hHeEOPhdUyA=",
+        "narHash": "sha256-UvORnAxTRHax7RG74W8Z2t4GvIkX6AjJ5kk0QlwZomo=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "a4cf1d10853b0d2be19b9eca35d749e201d70b55",
+        "rev": "57a3171f94705599a2499248ca5758d5eb47c0e0",
         "type": "github"
       },
       "original": {
@@ -80,6 +80,22 @@
       }
     },
     "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_3": {
       "flake": false,
       "locked": {
         "lastModified": 1767039857,
@@ -179,11 +195,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784351324,
+        "lastModified": 1784913159,
-        "narHash": "sha256-By+kuRJZRqs2TuXgtR8vJ8cTKWXw33YG/Yollu5cO1U=",
+        "narHash": "sha256-JWq0BfjO4ktpH5USfQNQzdvHpIDT8fSKD5K7LvdMRFs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "460108009ca1ff69ca2ff19079ca2c838d6e3080",
+        "rev": "079a3b5d1aa6a719920a51316253b7d6dd22738d",
         "type": "github"
       },
       "original": {
@@ -216,6 +232,26 @@
         "type": "github"
       }
     },
+    "nix-caddy-withplugins": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": "nixpkgs_5"
+      },
+      "locked": {
+        "lastModified": 1784936738,
+        "narHash": "sha256-X4w9BrFkisfzla3m1WwDJUicUbI7JRdhzq5aS7rrB0k=",
+        "owner": "MichailiK",
+        "repo": "nix-caddy-withplugins",
+        "rev": "70307cfc568e5434cf42067d797b27c38ea69944",
+        "type": "github"
+      },
+      "original": {
+        "owner": "MichailiK",
+        "ref": "nixos-unstable",
+        "repo": "nix-caddy-withplugins",
+        "type": "github"
+      }
+    },
     "nix2vim": {
       "inputs": {
         "flake-utils": "flake-utils_2",
@@ -306,11 +342,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1784280462,
+        "lastModified": 1784707089,
-        "narHash": "sha256-DtoqIqM7VkR6NxAkcLpMwmi02USwWb3JdmNGLyhthc0=",
+        "narHash": "sha256-2V/6imsUgB7mPZlHY54oeVBRDoZbPKnvzwkAHUSSufk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "293d6abedf0478e681a4dfcfcb35b30fc796a32f",
+        "rev": "b3fe9581c9061c749abef42b6d4ee7b7c05c33fa",
         "type": "github"
       },
       "original": {
@@ -370,11 +406,27 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1784120854,
+        "lastModified": 1781074563,
-        "narHash": "sha256-KesHgItiZPgGX740axSiQLcIQ8D24MDqNpkKYWIek8k=",
+        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1784796856,
+        "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "753cc8a3a87467296ddd1fa93f0cc3e81120ee46",
+        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
         "type": "github"
       },
       "original": {
@@ -384,7 +436,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_6": {
+    "nixpkgs_7": {
       "locked": {
         "lastModified": 1744536153,
         "narHash": "sha256-awS2zRgF4uTwrOKwwiJcByDzDOdo3Q1rPZbiHQg/N38=",
@@ -408,11 +460,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784353280,
+        "lastModified": 1784959021,
-        "narHash": "sha256-MV8bFWGuoJCELexhGWWhv0GiWnDY9hpgGXgxB81mr9g=",
+        "narHash": "sha256-Atc5ydxAmAAD5o8e6F8VVxVCOQb82bqi5TRNRUSBvZU=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "697f13fd230047493989b03576419792273c3a9e",
+        "rev": "1166a294990afd245fd72b8d2896075222408399",
         "type": "github"
       },
       "original": {
@@ -427,9 +479,10 @@
         "disko": "disko",
         "home-manager": "home-manager",
         "mac-app-util": "mac-app-util",
+        "nix-caddy-withplugins": "nix-caddy-withplugins",
         "nix2vim": "nix2vim",
         "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": "nixpkgs_6",
         "nixpkgs-stable": "nixpkgs-stable",
         "nur": "nur",
         "rust-overlay": "rust-overlay",
@@ -440,14 +493,14 @@
     },
     "rust-overlay": {
       "inputs": {
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_7"
       },
       "locked": {
-        "lastModified": 1784350408,
+        "lastModified": 1784956772,
-        "narHash": "sha256-OstzLWL5t7Xe14xEC6GIMJCp0PrYNTSA0El7GG2av88=",
+        "narHash": "sha256-5polVWDhgATIQj+RUV2ZlOd5nE6cGJo+C4tOEs5vp6U=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "3c38e1e1ba9c8d7030f7b5a801398ea7d8a6fdc0",
+        "rev": "a163bd01a6e11ac58d4f8d11669da550b5afbbc6",
         "type": "github"
       },
       "original": {
@@ -554,17 +607,17 @@
     },
     "wsl": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1784058842,
+        "lastModified": 1784642409,
-        "narHash": "sha256-3u3tvbCIAid3Mv7RrJx13jusIEQC/HeKYhO/SUSxR3A=",
+        "narHash": "sha256-hcbDqFuySAJawljt5r0sKBCJKYnbtGD0T/ZIozH1Dq0=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "24c8dc8e0f2170e1a377be24dfadc7d9d21dc1ad",
+        "rev": "eaeb18da90024448a60eb1ec7132eafa4003404e",
         "type": "github"
       },
       "original": {

flake.nix

@@ -40,6 +40,12 @@
       # inputs.nixpkgs.follows = "nixpkgs"; # Use system packages list for their inputs
     };
 
+    # Caddy with decoupled plugin hashes
+    nix-caddy-withplugins = {
+      url = "github:MichailiK/nix-caddy-withplugins/nixos-unstable";
+      # Important: Do not follow nixpkgs here, per the README
+    };
+
     # Manage disk format and partitioning
     disko = {
       url = "github:nix-community/disko";

overlays/cheetah3.nix

@@ -0,0 +1,9 @@
+_inputs: _final: prev: {
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (_pyfinal: pyprev: {
+      cheetah3 = pyprev.cheetah3.overridePythonAttrs (_old: {
+        dontCheckPythonMetadata = true;
+      });
+    })
+  ];
+}

overlays/nix-caddy-withplugins.nix

@@ -0,0 +1 @@
+inputs: inputs.nix-caddy-withplugins.overlays.default

pkgs/caddy/package.nix

@@ -2,21 +2,10 @@
 
 {
   pkgs,
-  fetchFromGitHub,
   ...
 }:
 
-# Maintain a static version so that the plugin hash doesn't keep breaking
+pkgs.caddy.withPlugins {
-(pkgs.caddy.overrideAttrs rec {
-  version = "2.10.2";
-  src = fetchFromGitHub {
-    owner = "caddyserver";
-    repo = "caddy";
-    tag = "v${version}";
-    hash = "sha256-KvikafRYPFZ0xCXqDdji1rxlkThEDEOHycK8GP5e8vk=";
-  };
-}).withPlugins
-  {
   plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-    hash = "sha256-pNIRthmPf+J6BPfJ51afBCWt66evnRs1+f9wv09EvK0=";
+  hash = "sha256-HuVBmiT3kD6RrDejQ6SnjCN8f7pFdZlGtZFbEf47bks=";
-  }
+}

platforms/home-manager/modules/nmasur/presets/programs/jujutsu.nix

@@ -7,6 +7,7 @@
 
 let
   cfg = config.nmasur.presets.programs.jujutsu;
+  tomlFormat = pkgs.formats.toml { };
 in
 
 {
@@ -31,6 +32,31 @@ in
       };
     };
 
+    xdg.configFile."jjui/config.toml".source = tomlFormat.generate "jjui-config" {
+      actions = [
+        {
+          name = "set-github-bypass";
+          lua = ''
+            exec_shell([[gh api --method PATCH -H "Accept: application/vnd.github+json" /repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)/properties/values -f 'properties[][property_name]=Allow-Ruleset-Bypass' -f 'properties[][value]=true']])
+            flash("Set GitHub rule bypass")
+          '';
+          key = "ctrl+b";
+          scope = "revisions";
+          desc = "Set GitHub rule bypass";
+        }
+        {
+          name = "remove-github-bypass";
+          lua = ''
+            exec_shell([[gh api --method PATCH -H "Accept: application/vnd.github+json" /repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)/properties/values -f 'properties[][property_name]=Allow-Ruleset-Bypass' -f 'properties[][value]=']])
+            flash("Removed GitHub rule bypass")
+          '';
+          key = "ctrl+shift+b";
+          scope = "revisions";
+          desc = "Remove GitHub rule bypass";
+        }
+      ];
+    };
+
     home.packages = [
       # Required for the fsmonitor to auto-snapshot
       pkgs.stable.watchman

platforms/home-manager/modules/nmasur/presets/services/dock.nix

@@ -48,11 +48,15 @@ in
         tilesize = 44;
 
         persistent-apps = map mkDockApp [
-          "${pkgs._1password-gui}/Applications/1Password.app"
+          "/Applications/1Password.app"
+          "${pkgs.thunderbird}/Applications/Thunderbird.app"
           "${pkgs.slack}/Applications/Slack.app"
+          "/System/Applications/Reminders.app"
           "/System/Applications/Calendar.app"
+          "/Applications/Claude.app"
           "${pkgs.firefox-unwrapped}/Applications/Firefox.app"
           "/System/Applications/Messages.app"
+          "/System/Applications/Preview.app"
           "/System/Applications/Mail.app"
           "/Applications/zoom.us.app"
           "${config.programs.ghostty.package}/Applications/Ghostty.app"
@@ -61,7 +65,6 @@ in
           # refuses to launch it ("damaged"). See presets/programs/homebrew.nix.
           "/Applications/Discord.app"
           "${pkgs.obsidian}/Applications/Obsidian.app"
-          "${pkgs.thunderbird}/Applications/Thunderbird.app"
         ];
       };
     };

platforms/home-manager/modules/nmasur/presets/services/hammerspoon/default.nix

@@ -33,7 +33,7 @@ in
     xdg.configFile."hammerspoon/Spoons/Launcher.spoon/init.lua".source =
       pkgs.replaceVars ./Spoons/Launcher.spoon/init.lua
         {
-          discord = "${pkgs.discord}/Applications/Discord.app";
+          discord = "Discord.app";
           firefox = "${pkgs.firefox-unwrapped}/Applications/Firefox.app";
           ghostty = "${pkgs.ghostty-bin}/Applications/Ghostty.app";
           obsidian = "${pkgs.obsidian}/Applications/Obsidian.app";

platforms/home-manager/modules/nmasur/profiles/experimental.nix

@@ -21,6 +21,9 @@ in
 
     home.packages = [
 
+      pkgs.nmasur.ren-find # Rename files
+      pkgs.nmasur.rep-grep # Replace text in files
+
       # Charm tools
 
       pkgs.glow # Markdown previews

platforms/home-manager/modules/nmasur/profiles/power-user.nix

@@ -29,8 +29,6 @@ in
       pkgs.nixfmt # Format Nix code
       pkgs.nmasur.jqr # FZF fq JSON tool
       pkgs.nmasur.osc # Clipboard over SSH
-      pkgs.nmasur.ren-find # Rename files
-      pkgs.nmasur.rep-grep # Replace text in files
       pkgs.pandoc # Convert text documents
       pkgs.qrencode # Generate qr codes
       pkgs.spacer # Output lines in terminal

platforms/nixos/modules/nmasur/presets/services/calibre-web.nix

@@ -32,15 +32,11 @@ in
         reverseProxyAuth.enable = false;
         enableBookConversion = true;
         enableBookUploading = true;
+        # Point this directly to the folder containing your 'metadata.db' file
         calibreLibrary = libraryPath;
       };
     };
 
-    # metadata.db lives in /var/lib/calibre-web-db and is symlinked into the
-    # library dir; ProtectSystem=strict in the upstream module blocks writes
-    # through symlinks unless the real target path is also listed.
-    systemd.services.calibre-web.serviceConfig.ReadWritePaths = [ "/var/lib/calibre-web-db" ];
-
     # Allow web traffic to Caddy
     nmasur.presets.services.caddy.routes = [
       {
@@ -65,6 +61,13 @@ in
     # Grant user access to Calibre directories
     users.users.${username}.extraGroups = [ "calibre-web" ];
 
+    # Ensure the service has explicit filesystem read/write access to the library path
+    # This fixes the "sqlite3.OperationalError: unable to open database file" bug
+    systemd.services.calibre-web.serviceConfig.ReadWritePaths = [
+      libraryPath
+      "/var/lib/calibre-web-db"
+    ];
+
     # Run a backup on a schedule
     systemd.timers.calibre-backup = lib.mkIf config.nmasur.presets.services.litestream.enable {
       timerConfig = {