fix: auto check now requires check permission

for when keyd dies or power scripts are failing

.github/workflows/update.yml

@@ -31,8 +31,32 @@ jobs:
             dependencies
             automated
       - name: Check the Flake
+        id: check
         run: nix flake check
+      - name: Update Check Status
+        uses: LouisBrunner/checks-action@v1.6.1
+        if: always()
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          name: Update Flake
+          conclusion: ${{ job.status }}
+          output: |
+            {"summary":"${{ steps.check.outputs.stdout }}"}
       - name: Enable Pull Request Automerge
-        run: gh pr merge --rebase --auto ${{ steps.update.outputs.pull-request-number }}
+        if: success()
+        run: |
+          gh pr merge \
+            --rebase \
+            --auto \
+            ${{ steps.update.outputs.pull-request-number }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+      - name: Close Pull Request If Failed
+        if: failure()
+        run: |
+          gh pr close \
+            --comment "Auto-closing pull request" \
+            --delete-branch \
+            ${{ steps.update.outputs.pull-request-number }}
         env:
           GH_TOKEN: ${{ github.token }}

flake.lock

@@ -17,6 +17,23 @@
         "type": "github"
       }
     },
+    "age": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1672087018,
+        "narHash": "sha256-LRxxJQLQkzoCNYGS/XBixVmYXoZ1mPHKvFicPGXYLcw=",
+        "owner": "FiloSottile",
+        "repo": "age",
+        "rev": "c6dcfa1efcaa27879762a934d5bea0d1b83a894c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "FiloSottile",
+        "ref": "v1.1.1",
+        "repo": "age",
+        "type": "github"
+      }
+    },
     "baleia-nvim-src": {
       "flake": false,
       "locked": {
@@ -73,11 +90,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1691275315,
-        "narHash": "sha256-9WN0IA0vNZSNxKHpy/bYvPnCw4VH/nr5iBv7c+7KUts=",
+        "lastModified": 1698429334,
+        "narHash": "sha256-Gq3+QabboczSu7RMpcy79RSLMSqnySO3wsnHQk4DfbE=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "829041cf10c4f6751a53c0a11ca2fd22ff0918d6",
+        "rev": "afe83cbc2e673b1f08d32dd0f70df599678ff1e7",
         "type": "github"
       },
       "original": {
@@ -94,11 +111,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1690739034,
-        "narHash": "sha256-roW02IaiQ3gnEEDMCDWL5YyN+C4nBf/te6vfL7rG0jk=",
+        "lastModified": 1699099781,
+        "narHash": "sha256-2WAs839yL6xmIPBLNVwbft46BDh0/RAjq1bAKNRqeR4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "4015740375676402a2ee6adebc3c30ea625b9a94",
+        "rev": "548962c50b8afad7b8c820c1d6e21dc8394d6e65",
         "type": "github"
       },
       "original": {
@@ -114,11 +131,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1691196340,
-        "narHash": "sha256-b1haFWCbFJkiUkeTQCkNjr8hFq/8JlMPaQwNpGlcvxI=",
+        "lastModified": 1699058439,
+        "narHash": "sha256-fvvrdBQ9vLb3TZRB3nMUaCLvBPVGnIgTqX6vPCFRv2o=",
         "owner": "bandithedoge",
         "repo": "nixpkgs-firefox-darwin",
-        "rev": "6081c33185dba05da784d9f2a392861af025bf1a",
+        "rev": "9edd9209798cb115ebadfb5424d49b79b257ebea",
         "type": "github"
       },
       "original": {
@@ -130,11 +147,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1673956053,
-        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
@@ -144,12 +161,15 @@
       }
     },
     "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
       "locked": {
-        "lastModified": 1678901627,
-        "narHash": "sha256-U02riOqrKKzwjsxc/400XnElV+UtPUQWpANPlyazjH0=",
+        "lastModified": 1687709756,
+        "narHash": "sha256-Y5wKlQSkgEK2weWdOu4J3riRd+kV/VCgHsqLNTTWQ/0=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "93a2b84fc4b70d9e089d029deacc3583435c2ed6",
+        "rev": "dbabf0ca0c0c4bce6ea5eaf65af5cb694d2082c7",
         "type": "github"
       },
       "original": {
@@ -160,7 +180,7 @@
     },
     "flake-utils_2": {
       "inputs": {
-        "systems": "systems"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1685518550,
@@ -178,14 +198,14 @@
     },
     "flake-utils_3": {
       "inputs": {
-        "systems": "systems_2"
+        "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1689068808,
-        "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
+        "lastModified": 1694529238,
+        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
+        "rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
         "type": "github"
       },
       "original": {
@@ -197,11 +217,11 @@
     "hmts-nvim-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1691223193,
-        "narHash": "sha256-Zsl4s3e4upWiU2mXKqiQcUGxslPzzebKKXfzaHiNq48=",
+        "lastModified": 1693226725,
+        "narHash": "sha256-jUuztOqNBltC3axa7s3CPJz9Cmukfwkf846+Z/gAxCU=",
         "owner": "calops",
         "repo": "hmts.nvim",
-        "rev": "1d40963804925754672940d07ddb250d19efec2e",
+        "rev": "14fd941d7ec2bb98314a1aacaa2573d97f1629ab",
         "type": "github"
       },
       "original": {
@@ -217,11 +237,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1691225770,
-        "narHash": "sha256-O5slH8nW8msTAqVAS5rkvdHSkjmrO+JauuSDzZCmv2M=",
+        "lastModified": 1699025595,
+        "narHash": "sha256-e+o4PoSu2Z6Ww8y/AVUmMU200rNZoRK+p2opQ7Db8Rg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0a014a729cdd54d9919ff36b714d047909d7a4c8",
+        "rev": "8765d4e38aa0be53cdeee26f7386173e6c65618d",
         "type": "github"
       },
       "original": {
@@ -246,25 +266,25 @@
     "nextcloud-external": {
       "flake": false,
       "locked": {
-        "narHash": "sha256-gY1nxqK/pHfoxW/9mE7DFtNawgdEV7a4OXpscWY14yk=",
+        "narHash": "sha256-X7eC8T8wSZGVwCQp6U/WxjMC7aIj39osgHotaUoRNSQ=",
         "type": "tarball",
-        "url": "https://github.com/nextcloud-releases/external/releases/download/v5.2.0/external-v5.2.0.tar.gz"
+        "url": "https://github.com/nextcloud-releases/external/releases/download/v5.2.1/external-v5.2.1.tar.gz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://github.com/nextcloud-releases/external/releases/download/v5.2.0/external-v5.2.0.tar.gz"
+        "url": "https://github.com/nextcloud-releases/external/releases/download/v5.2.1/external-v5.2.1.tar.gz"
       }
     },
     "nextcloud-news": {
       "flake": false,
       "locked": {
-        "narHash": "sha256-hhXPEITSbCiFs0o+TOsQnSasXBpjU9mA/OFsbzuaCPw=",
+        "narHash": "sha256-cfJkKRNSz15L4E3w1tnEb+t4MrVwVzb8lb6vCOA4cK4=",
         "type": "tarball",
-        "url": "https://github.com/nextcloud/news/releases/download/22.0.0/news.tar.gz"
+        "url": "https://github.com/nextcloud/news/releases/download/24.0.0/news.tar.gz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://github.com/nextcloud/news/releases/download/22.0.0/news.tar.gz"
+        "url": "https://github.com/nextcloud/news/releases/download/24.0.0/news.tar.gz"
       }
     },
     "nil": {
@@ -276,16 +296,16 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1680544266,
-        "narHash": "sha256-d/TusDXmIo8IT5DNRA21lN+nOVSER8atIx9TJteR6LQ=",
+        "lastModified": 1691372739,
+        "narHash": "sha256-fZ8KfBMcIFO/R7xaWtB85SFeuUjb9SCH8fxYBnY8068=",
         "owner": "oxalica",
         "repo": "nil",
-        "rev": "56a1fa87b98a9508920f4b0ab8fe36d5b54b2362",
+        "rev": "97abe7d3d48721d4e0fcc1876eea83bb4247825b",
         "type": "github"
       },
       "original": {
         "owner": "oxalica",
-        "ref": "2023-04-03",
+        "ref": "2023-08-09",
         "repo": "nil",
         "type": "github"
       }
@@ -313,11 +333,11 @@
     },
     "nixlib": {
       "locked": {
-        "lastModified": 1689469483,
-        "narHash": "sha256-2SBhY7rZQ/iNCxe04Eqxlz9YK9KgbaTMBssq3/BgdWY=",
+        "lastModified": 1693701915,
+        "narHash": "sha256-waHPLdDYUOHSEtMKKabcKIMhlUOHPOOPQ9UyFeEoovs=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "02fea408f27186f139153e1ae88f8ab2abd9c22c",
+        "rev": "f5af57d3ef9947a70ac86e42695231ac1ad00c25",
         "type": "github"
       },
       "original": {
@@ -334,11 +354,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1690133435,
-        "narHash": "sha256-YNZiefETggroaTLsLJG2M+wpF0pJPwiauKG4q48ddNU=",
+        "lastModified": 1696058303,
+        "narHash": "sha256-eNqKWpF5zG0SrgbbtljFOrRgFgRzCc4++TMFADBMLnc=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "b1171de4d362c022130c92d7c8adc4bf2b83d586",
+        "rev": "150f38bd1e09e20987feacb1b0d5991357532fb5",
         "type": "github"
       },
       "original": {
@@ -349,11 +369,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1691186842,
-        "narHash": "sha256-wxBVCvZUwq+XS4N4t9NqsHV4E64cPVqQ2fdDISpjcw0=",
+        "lastModified": 1699099776,
+        "narHash": "sha256-X09iKJ27mGsGambGfkKzqvw5esP1L/Rf8H3u3fCqIiU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "18036c0be90f4e308ae3ebcab0e14aae0336fe42",
+        "rev": "85f1ba3e51676fa8cc604a3d863d729026a6b8eb",
         "type": "github"
       },
       "original": {
@@ -365,11 +385,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1690470004,
-        "narHash": "sha256-l57RmPhPz9r1LGDg/0v8bYgJO8R+GGTQZtkIxE7negU=",
+        "lastModified": 1697851979,
+        "narHash": "sha256-lJ8k4qkkwdvi+t/Xc6Fn74kUuobpu9ynPGxNZR6OwoA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9462344318b376e157c94fa60c20a25b913b2381",
+        "rev": "5550a85a087c04ddcace7f892b0bdc9d8bb080c8",
         "type": "github"
       },
       "original": {
@@ -382,11 +402,11 @@
     "null-ls-nvim-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1688652536,
-        "narHash": "sha256-6KJtj9pbvBm6fOVpnyzO2fEVC+cVrw2XtZHOgq9ieIw=",
+        "lastModified": 1691810493,
+        "narHash": "sha256-cWA0rzkOp/ekVKaFee7iea1lhnqKtWUIU+fW5M950wI=",
         "owner": "jose-elias-alvarez",
         "repo": "null-ls.nvim",
-        "rev": "db09b6c691def0038c456551e4e2772186449f35",
+        "rev": "0010ea927ab7c09ef0ce9bf28c2b573fc302f5a7",
         "type": "github"
       },
       "original": {
@@ -397,11 +417,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1691289987,
-        "narHash": "sha256-sbbDlVzxlP+bBTdhyyzJ6C0APUNU/sChuLmNU9ehkmg=",
+        "lastModified": 1699186655,
+        "narHash": "sha256-OFoCxYaQrA1VB/30Mj/ArzronpY42DWLBSIIH1mnX60=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "cf2f5d8ad452795e5aca290c95eedc829d3da7ec",
+        "rev": "8d9f20f147c17d62d16025e9769adbd76245591e",
         "type": "github"
       },
       "original": {
@@ -430,11 +450,11 @@
     "nvim-tree-lua-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1691292370,
-        "narHash": "sha256-YQRirmp8QerxwF9qdrSrUKJZiVrBb6ZWpUTfM8H7fl4=",
+        "lastModified": 1698632253,
+        "narHash": "sha256-jIbe+XXvc2H3GVYT+2vuwLE3MtE/fpArEopmuxW4I4s=",
         "owner": "kyazdani42",
         "repo": "nvim-tree.lua",
-        "rev": "904f95cd9db31d1800998fa428e78e418a50181d",
+        "rev": "7e3c0bee7b246ca835d5f7453db6fa19de359bab",
         "type": "github"
       },
       "original": {
@@ -446,23 +466,36 @@
     "nvim-treesitter-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1681121236,
-        "narHash": "sha256-iPsPDLhVKJ14iP1/2cCgcY9SCKK/DQz9Y0mQB1DqNiM=",
+        "lastModified": 1699083795,
+        "narHash": "sha256-XaZ14s4F7Sc2MQNzHMUl7lvqbGK0xfhi0I0zIN/M63U=",
         "owner": "nvim-treesitter",
         "repo": "nvim-treesitter",
-        "rev": "cc360a9beb1b30d172438f640e2c3450358c4086",
+        "rev": "bef2c24e23d0da62a8542b1f08b1ac87ec43e93f",
         "type": "github"
       },
       "original": {
         "owner": "nvim-treesitter",
-        "ref": "v0.9.0",
+        "ref": "master",
         "repo": "nvim-treesitter",
         "type": "github"
       }
     },
+    "proton-ge": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-75A0VCVdYkiMQ1duE9r2+DLBJzV02vUozoVLeo/TIWQ=",
+        "type": "tarball",
+        "url": "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/GE-Proton8-16/GE-Proton8-16.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/GE-Proton8-16/GE-Proton8-16.tar.gz"
+      }
+    },
     "root": {
       "inputs": {
         "Comment-nvim-src": "Comment-nvim-src",
+        "age": "age",
         "baleia-nvim-src": "baleia-nvim-src",
         "bufferline-nvim-src": "bufferline-nvim-src",
         "cmp-nvim-lsp-src": "cmp-nvim-lsp-src",
@@ -483,11 +516,13 @@
         "nvim-lspconfig-src": "nvim-lspconfig-src",
         "nvim-tree-lua-src": "nvim-tree-lua-src",
         "nvim-treesitter-src": "nvim-treesitter-src",
+        "proton-ge": "proton-ge",
         "telescope-nvim-src": "telescope-nvim-src",
         "telescope-project-nvim-src": "telescope-project-nvim-src",
         "toggleterm-nvim-src": "toggleterm-nvim-src",
         "tree-sitter-bash": "tree-sitter-bash",
         "tree-sitter-ini": "tree-sitter-ini",
+        "tree-sitter-lua": "tree-sitter-lua",
         "tree-sitter-puppet": "tree-sitter-puppet",
         "tree-sitter-python": "tree-sitter-python",
         "tree-sitter-rasi": "tree-sitter-rasi",
@@ -509,11 +544,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1680488274,
-        "narHash": "sha256-0vYMrZDdokVmPQQXtFpnqA2wEgCCUXf5a3dDuDVshn0=",
+        "lastModified": 1688783586,
+        "narHash": "sha256-HHaM2hk2azslv1kH8zmQxXo2e7i5cKgzNIuK4yftzB0=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "7ec2ff598a172c6e8584457167575b3a1a5d80d8",
+        "rev": "7a29283cc242c2486fc67f60b431ef708046d176",
         "type": "github"
       },
       "original": {
@@ -552,6 +587,21 @@
         "type": "github"
       }
     },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "telescope-nvim-src": {
       "flake": false,
       "locked": {
@@ -605,17 +655,17 @@
     "tree-sitter-bash": {
       "flake": false,
       "locked": {
-        "lastModified": 1688032601,
-        "narHash": "sha256-gl5F3IeZa2VqyH/qFj8ey2pRbGq4X8DL5wiyvRrH56U=",
+        "lastModified": 1696959291,
+        "narHash": "sha256-VP7rJfE/k8KV1XN1w5f0YKjCnDMYU1go/up0zj1mabM=",
         "owner": "tree-sitter",
         "repo": "tree-sitter-bash",
-        "rev": "493646764e7ad61ce63ce3b8c59ebeb37f71b841",
+        "rev": "7331995b19b8f8aba2d5e26deb51d2195c18bc94",
         "type": "github"
       },
       "original": {
         "owner": "tree-sitter",
+        "ref": "master",
         "repo": "tree-sitter-bash",
-        "rev": "493646764e7ad61ce63ce3b8c59ebeb37f71b841",
         "type": "github"
       }
     },
@@ -635,6 +685,23 @@
         "type": "github"
       }
     },
+    "tree-sitter-lua": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1694072484,
+        "narHash": "sha256-5t5w8KqbefInNbA12/jpNzmky/uOUhsLjKdEqpl1GEc=",
+        "owner": "MunifTanjim",
+        "repo": "tree-sitter-lua",
+        "rev": "9668709211b2e683f27f414454a8b51bf0a6bda1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "MunifTanjim",
+        "ref": "main",
+        "repo": "tree-sitter-lua",
+        "type": "github"
+      }
+    },
     "tree-sitter-puppet": {
       "flake": false,
       "locked": {
@@ -654,17 +721,17 @@
     "tree-sitter-python": {
       "flake": false,
       "locked": {
-        "lastModified": 1690493803,
-        "narHash": "sha256-2btd/NRE6NuGNlx4cq535OrwtWXihiP3VMCJjPCiDOk=",
+        "lastModified": 1696990675,
+        "narHash": "sha256-nQ4HU5ysQjht9USFGRmW/+PLFTzPgi+6G68/uupMMRk=",
         "owner": "tree-sitter",
         "repo": "tree-sitter-python",
-        "rev": "5af00f64af6bbf822f208243cce5cf75396fb6f5",
+        "rev": "82f5c9937fe4300b4bec3ee0e788d642c77aab2c",
         "type": "github"
       },
       "original": {
         "owner": "tree-sitter",
+        "ref": "master",
         "repo": "tree-sitter-python",
-        "rev": "5af00f64af6bbf822f208243cce5cf75396fb6f5",
         "type": "github"
       }
     },
@@ -723,11 +790,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1690553050,
-        "narHash": "sha256-pK3kF30OykL3v6P8UP6ipihlS34KoGq9SryCj3tHrFw=",
+        "lastModified": 1698222534,
+        "narHash": "sha256-iF9C7C7eT8LVVWx5IOZ/8KKJT8AIw9A5aBA6vqS18l8=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "f7a95a37306c46b42e9ce751977c44c752fd5eca",
+        "rev": "a058cff4b09b3a398d8caa379b4dc96cfedd98c9",
         "type": "github"
       },
       "original": {

flake.nix

@@ -9,7 +9,7 @@
 
     # Used for MacOS system config
     darwin = {
-      url = "github:/lnl7/nix-darwin/master";
+      url = "github:lnl7/nix-darwin/master";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
@@ -58,12 +58,13 @@
 
     # Nix language server
     nil = {
-      url = "github:oxalica/nil/2023-04-03";
+      url = "github:oxalica/nil/2023-08-09";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
     # Neovim plugins
     nvim-lspconfig-src = {
+      # https://github.com/neovim/nvim-lspconfig/tags
       url = "github:neovim/nvim-lspconfig/v0.1.6";
       flake = false;
     };
@@ -84,7 +85,8 @@
       flake = false;
     };
     nvim-treesitter-src = {
-      url = "github:nvim-treesitter/nvim-treesitter/v0.9.0";
+      # https://github.com/nvim-treesitter/nvim-treesitter/tags
+      url = "github:nvim-treesitter/nvim-treesitter/master";
       flake = false;
     };
     telescope-nvim-src = {
@@ -118,17 +120,15 @@
 
     # Tree-Sitter Grammars
     tree-sitter-bash = {
-      # Fix: bash highlighting doesn't work as of this commit:
-      # https://github.com/NixOS/nixpkgs/commit/49cce41b7c5f6b88570a482355d9655ca19c1029
-      url =
-        "github:tree-sitter/tree-sitter-bash/493646764e7ad61ce63ce3b8c59ebeb37f71b841";
+      url = "github:tree-sitter/tree-sitter-bash/master";
       flake = false;
     };
     tree-sitter-python = {
-      # Fix: invalid node in position. Broken as of this commit (replaced with newer):
-      # https://github.com/NixOS/nixpkgs/commit/8ec3627796ecc899e6f47f5bf3c3220856ead9c5
-      url =
-        "github:tree-sitter/tree-sitter-python/5af00f64af6bbf822f208243cce5cf75396fb6f5";
+      url = "github:tree-sitter/tree-sitter-python/master";
+      flake = false;
+    };
+    tree-sitter-lua = {
+      url = "github:MunifTanjim/tree-sitter-lua/main";
       flake = false;
     };
     tree-sitter-ini = {
@@ -150,18 +150,36 @@
       flake = false;
     };
 
+    # Age encryption (pin because of failed builds)
+    age = {
+      url = "github:FiloSottile/age/v1.1.1";
+      flake = false;
+    };
+
+    # GE version of Proton for game compatibility
+    # Alternatively, could consider using https://github.com/fufexan/nix-gaming
+    proton-ge = {
+      # https://github.com/GloriousEggroll/proton-ge-custom/releases
+      url =
+        "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/GE-Proton8-16/GE-Proton8-16.tar.gz";
+      flake = false;
+    };
+
     # Nextcloud Apps
     nextcloud-news = {
+      # https://github.com/nextcloud/news/releases
       url =
-        "https://github.com/nextcloud/news/releases/download/22.0.0/news.tar.gz";
+        "https://github.com/nextcloud/news/releases/download/24.0.0/news.tar.gz";
       flake = false;
     };
     nextcloud-external = {
+      # https://github.com/nextcloud-releases/external/releases
       url =
-        "https://github.com/nextcloud-releases/external/releases/download/v5.2.0/external-v5.2.0.tar.gz";
+        "https://github.com/nextcloud-releases/external/releases/download/v5.2.1/external-v5.2.1.tar.gz";
       flake = false;
     };
     nextcloud-cookbook = {
+      # https://github.com/nextcloud/cookbook/releases
       url =
         "https://github.com/nextcloud/cookbook/releases/download/v0.10.2/Cookbook-0.10.2.tar.gz";
       flake = false;
@@ -188,6 +206,7 @@
           git = "git.${baseName}";
           metrics = "metrics.${baseName}";
           prometheus = "prom.${baseName}";
+          paperless = "paper.${baseName}";
           secrets = "vault.${baseName}";
           stream = "stream.${baseName}";
           content = "cloud.${baseName}";
@@ -208,6 +227,8 @@
         (import ./overlays/mpv-scripts.nix inputs)
         (import ./overlays/nextcloud-apps.nix inputs)
         (import ./overlays/betterlockscreen.nix)
+        (import ./overlays/age.nix inputs)
+        (import ./overlays/proton-ge.nix inputs)
       ];
 
       # System types to support.

hosts/aws/main.tf

@@ -26,7 +26,7 @@ data "aws_iam_policy_document" "vmimport" {
     actions = [
       "s3:GetBucketLocation",
       "s3:GetObject",
-      "s3:ListBucket",
+        "s3:ListBucket",
     ]
     resources = [
       "arn:aws:s3:::${aws_s3_object.image.bucket}",

hosts/lookingglass/default.nix

@@ -37,6 +37,7 @@ inputs.darwin.lib.darwinSystem {
       nixlang.enable = true;
       terraform.enable = true;
       python.enable = true;
+      rust.enable = true;
       lua.enable = true;
       kubernetes.enable = true;
       _1password.enable = true;

hosts/swan/default.nix

@@ -79,6 +79,7 @@ inputs.nixpkgs.lib.nixosSystem {
       services.prometheus.enable = false;
       services.vmagent.enable = true;
       services.samba.enable = true;
+      services.paperless.enable = true;
 
       # Allows private remote access over the internet
       cloudflareTunnel = {

hosts/tempest/default.nix

@@ -99,12 +99,13 @@ inputs.nixpkgs.lib.nixosSystem {
       keybase.enable = true;
       mullvad.enable = false;
       nixlang.enable = true;
+      rust.enable = true;
       yt-dlp.enable = true;
       gaming = {
         dwarf-fortress.enable = true;
         enable = true;
         steam.enable = true;
-        legendary.enable = true;
+        legendary.enable = false; # Electron marked as insecure
         lutris.enable = true;
         leagueoflegends.enable = true;
         ryujinx.enable = true;

modules/common/applications/firefox.nix

@@ -16,6 +16,7 @@
     unfreePackages = [
       (lib.mkIf config._1password.enable "onepassword-password-manager")
       "okta-browser-plugin"
+      "wappalyzer"
     ];
 
     home-manager.users.${config.user} = {
@@ -73,6 +74,8 @@
             "media.ffmpeg.vaapi.enabled" =
               true; # Enable hardware video acceleration
             "cookiebanners.ui.desktop.enabled" = true; # Reject cookie popups
+            "devtools.command-button-screenshot.enabled" =
+              true; # Scrolling screenshot of entire page
             "svg.context-properties.content.enabled" = true; # Sidebery styling
           };
           userChrome = ''
@@ -114,7 +117,7 @@
               background-color: ${config.theme.colors.base00};
               color: ${config.theme.colors.base06} !important;
             }
-            .tab-content[selected=true] {
+            .tab-content[selected] {
               border-bottom: 2px solid color-mix(in srgb, var(--identity-tab-color) 25%, transparent);
               background-color: ${config.theme.colors.base01} !important;
               color: ${config.theme.colors.base07} !important;

modules/common/default.nix

@@ -75,6 +75,10 @@
         type = lib.types.str;
         description = "Hostname for metrics server.";
       };
+      paperless = lib.mkOption {
+        type = lib.types.str;
+        description = "Hostname for document server (paperless-ngx).";
+      };
       prometheus = lib.mkOption {
         type = lib.types.str;
         description = "Hostname for Prometheus server.";

modules/common/neovim/config/github.lua

@@ -0,0 +1,14 @@
+-- Keymap to open file in GitHub web
+vim.keymap.set("n", "<Leader>gr", ":!gh browse %<CR><CR>", { silent = true })
+
+-- Pop a terminal to watch the current run
+local gitwatch =
+    require("toggleterm.terminal").Terminal:new({ cmd = "fish --interactive --init-command 'gh run watch'" })
+
+-- Set a toggle for this terminal
+function GITWATCH_TOGGLE()
+    gitwatch:toggle()
+end
+
+-- Keymap to toggle the run
+vim.keymap.set("n", "<Leader>gw", GITWATCH_TOGGLE)

modules/common/neovim/config/kubernetes.lua

@@ -0,0 +1,6 @@
+local k9s = require("toggleterm.terminal").Terminal:new({ cmd = "k9s" })
+function K9S_TOGGLE()
+    k9s:toggle()
+end
+
+vim.keymap.set("n", "<Leader>9", K9S_TOGGLE)

modules/common/neovim/config/lsp.nix

@@ -1,76 +1,104 @@
-{ pkgs, dsl, ... }: {
+{ pkgs, lib, config, dsl, ... }: {
 
-  plugins = [
-    pkgs.vimPlugins.nvim-lspconfig
-    pkgs.vimPlugins.lsp-colors-nvim
-    pkgs.vimPlugins.null-ls-nvim
-  ];
+  # Terraform optional because non-free
+  options.terraform = lib.mkEnableOption "Whether to enable Terraform LSP";
+  options.github = lib.mkEnableOption "Whether to enable GitHub features";
+  options.kubernetes =
+    lib.mkEnableOption "Whether to enable Kubernetes features";
 
-  use.lspconfig.lua_ls.setup = dsl.callWith {
-    settings = { Lua = { diagnostics = { globals = [ "vim" "hs" ]; }; }; };
-    capabilities = dsl.rawLua "require('cmp_nvim_lsp').default_capabilities()";
-    cmd = [ "${pkgs.lua-language-server}/bin/lua-language-server" ];
-  };
+  config =
 
-  use.lspconfig.nil_ls.setup = dsl.callWith {
-    cmd = [ "${pkgs.nil}/bin/nil" ];
-    capabilities = dsl.rawLua "require('cmp_nvim_lsp').default_capabilities()";
-  };
+    let
 
-  use.lspconfig.pyright.setup = dsl.callWith {
-    cmd = [ "${pkgs.pyright}/bin/pyright-langserver" "--stdio" ];
-  };
+      terraformFormat = if config.terraform then ''
+        require("null-ls").builtins.formatting.terraform_fmt.with({
+            command = "${pkgs.terraform}/bin/terraform",
+            extra_filetypes = { "hcl" },
+        }),
+      '' else
+        "";
 
-  use.lspconfig.terraformls.setup =
-    dsl.callWith { cmd = [ "${pkgs.terraform-ls}/bin/terraform-ls" "serve" ]; };
+    in {
+      plugins = [ pkgs.vimPlugins.nvim-lspconfig pkgs.vimPlugins.null-ls-nvim ];
 
-  vim.api.nvim_create_augroup = dsl.callWith [ "LspFormatting" { } ];
+      use.lspconfig.lua_ls.setup = dsl.callWith {
+        settings = { Lua = { diagnostics = { globals = [ "vim" "hs" ]; }; }; };
+        capabilities =
+          dsl.rawLua "require('cmp_nvim_lsp').default_capabilities()";
+        cmd = [ "${pkgs.lua-language-server}/bin/lua-language-server" ];
+      };
 
-  lua = ''
-    ${builtins.readFile ./lsp.lua}
+      use.lspconfig.nil_ls.setup = dsl.callWith {
+        cmd = [ "${pkgs.nil}/bin/nil" ];
+        capabilities =
+          dsl.rawLua "require('cmp_nvim_lsp').default_capabilities()";
+      };
 
-    -- Prevent infinite log size (change this when debugging)
-    vim.lsp.set_log_level("off")
+      use.lspconfig.pyright.setup = dsl.callWith {
+        cmd = [ "${pkgs.pyright}/bin/pyright-langserver" "--stdio" ];
+      };
 
-    require("null-ls").setup({
-        sources = {
-            require("null-ls").builtins.formatting.stylua.with({ command = "${pkgs.stylua}/bin/stylua" }),
-            require("null-ls").builtins.formatting.black.with({ command = "${pkgs.black}/bin/black" }),
-            require("null-ls").builtins.diagnostics.ruff.with({ command = "${pkgs.ruff}/bin/ruff" }),
-            require("null-ls").builtins.formatting.fish_indent.with({ command = "${pkgs.fish}/bin/fish_indent" }),
-            require("null-ls").builtins.formatting.nixfmt.with({ command = "${pkgs.nixfmt}/bin/nixfmt" }),
-            require("null-ls").builtins.formatting.rustfmt.with({ command = "${pkgs.rustfmt}/bin/rustfmt" }),
-            require("null-ls").builtins.diagnostics.shellcheck.with({ command = "${pkgs.shellcheck}/bin/shellcheck" }),
-            require("null-ls").builtins.formatting.shfmt.with({
-                command = "${pkgs.shfmt}/bin/shfmt",
-                extra_args = { "-i", "4", "-ci" },
-            }),
-            require("null-ls").builtins.formatting.terraform_fmt.with({
-                command = "${pkgs.terraform}/bin/terraform",
-                extra_filetypes = { "hcl" },
-            }),
-        },
+      use.lspconfig.terraformls.setup = dsl.callWith {
+        cmd = if config.terraform then [
+          "${pkgs.terraform-ls}/bin/terraform-ls"
+          "serve"
+        ] else
+          [ "echo" ];
+      };
 
-        on_attach = function(client, bufnr)
-            if client.supports_method("textDocument/formatting") then
-                -- Auto-format on save
-                vim.api.nvim_clear_autocmds({ group = augroup, buffer = bufnr })
-                vim.api.nvim_create_autocmd("BufWritePre", {
-                    group = augroup,
-                    buffer = bufnr,
-                    callback = function()
-                        vim.lsp.buf.format({ bufnr = bufnr })
-                    end,
-                })
-                -- Use internal formatting for bindings like gq.
-                vim.api.nvim_create_autocmd("LspAttach", {
-                    callback = function(args)
-                        vim.bo[args.buf].formatexpr = nil
-                    end,
-                })
-            end
-        end,
-    })
-  '';
+      use.lspconfig.rust_analyzer.setup = dsl.callWith {
+        cmd = [ "${pkgs.rust-analyzer}/bin/rust-analyzer" ];
+        settings = {
+          "['rust-analyzer']" = { check = { command = "clippy"; }; };
+        };
+      };
+
+      vim.api.nvim_create_augroup = dsl.callWith [ "LspFormatting" { } ];
+
+      lua = ''
+        ${builtins.readFile ./lsp.lua}
+
+        -- Prevent infinite log size (change this when debugging)
+        vim.lsp.set_log_level("off")
+
+        require("null-ls").setup({
+            sources = {
+                require("null-ls").builtins.formatting.stylua.with({ command = "${pkgs.stylua}/bin/stylua" }),
+                require("null-ls").builtins.formatting.black.with({ command = "${pkgs.black}/bin/black" }),
+                require("null-ls").builtins.diagnostics.ruff.with({ command = "${pkgs.ruff}/bin/ruff" }),
+                require("null-ls").builtins.formatting.fish_indent.with({ command = "${pkgs.fish}/bin/fish_indent" }),
+                require("null-ls").builtins.formatting.nixfmt.with({ command = "${pkgs.nixfmt}/bin/nixfmt" }),
+                require("null-ls").builtins.formatting.rustfmt.with({ command = "${pkgs.rustfmt}/bin/rustfmt" }),
+                require("null-ls").builtins.diagnostics.shellcheck.with({ command = "${pkgs.shellcheck}/bin/shellcheck" }),
+                require("null-ls").builtins.formatting.shfmt.with({
+                    command = "${pkgs.shfmt}/bin/shfmt",
+                    extra_args = { "-i", "4", "-ci" },
+                }),
+                ${terraformFormat}
+            },
+
+            on_attach = function(client, bufnr)
+                if client.supports_method("textDocument/formatting") then
+                    -- Auto-format on save
+                    vim.api.nvim_clear_autocmds({ group = augroup, buffer = bufnr })
+                    vim.api.nvim_create_autocmd("BufWritePre", {
+                        group = augroup,
+                        buffer = bufnr,
+                        callback = function()
+                            vim.lsp.buf.format({ bufnr = bufnr })
+                        end,
+                    })
+                    -- Use internal formatting for bindings like gq.
+                    vim.api.nvim_create_autocmd("LspAttach", {
+                        callback = function(args)
+                            vim.bo[args.buf].formatexpr = nil
+                        end,
+                    })
+                end
+            end,
+        })
+      '';
+
+    };
 
 }

modules/common/neovim/config/syntax.nix

@@ -24,7 +24,7 @@
     pkgs.vimPlugins.vim-helm
     pkgs.baleia-nvim # Clean ANSI from kitty scrollback
     # pkgs.hmts-nvim # Tree-sitter injections for home-manager
-    (pkgs.vimUtils.buildVimPluginFrom2Nix {
+    (pkgs.vimUtils.buildVimPlugin {
       pname = "nmasur";
       version = "0.1";
       src = ../plugin;

modules/common/neovim/config/toggleterm.lua

@@ -26,17 +26,5 @@ function NIXPKGS_TOGGLE()
     nixpkgs:toggle()
 end
 
-local gitwatch = terminal:new({ cmd = "fish --interactive --init-command 'gh run watch'" })
-function GITWATCH_TOGGLE()
-    gitwatch:toggle()
-end
-
-local k9s = terminal:new({ cmd = "k9s" })
-function K9S_TOGGLE()
-    k9s:toggle()
-end
-
 vim.keymap.set("n", "<Leader>t", TERM_TOGGLE)
 vim.keymap.set("n", "<Leader>P", NIXPKGS_TOGGLE)
-vim.keymap.set("n", "<Leader>gw", GITWATCH_TOGGLE)
-vim.keymap.set("n", "<Leader>9", K9S_TOGGLE)

modules/common/neovim/config/toggleterm.nix

@@ -1,4 +1,4 @@
-{ pkgs, dsl, ... }: {
+{ pkgs, dsl, config, ... }: {
 
   # Toggleterm provides a floating terminal inside the editor for quick access
 
@@ -10,6 +10,10 @@
     direction = "float";
   };
 
-  lua = builtins.readFile ./toggleterm.lua;
+  lua = ''
+    ${builtins.readFile ./toggleterm.lua}
+    ${if config.github then (builtins.readFile ./github.lua) else ""}
+    ${if config.kubernetes then (builtins.readFile ./kubernetes.lua) else ""}
+  '';
 
 }

modules/common/neovim/config/tree.nix

@@ -63,7 +63,6 @@
     '';
     view = { # Set look and feel
       width = 30;
-      hide_root_folder = false;
       side = "left";
       number = false;
       relativenumber = false;

modules/common/neovim/default.nix

@@ -5,6 +5,9 @@ let
   neovim = import ./package {
     inherit pkgs;
     colors = config.theme.colors;
+    terraform = config.terraform.enable;
+    github = true;
+    kubernetes = config.kubernetes.enable;
   };
 
 in {

modules/common/neovim/lua/keybinds.lua

@@ -39,7 +39,6 @@ key("n", "<Leader>fs", ":write<CR>")
 key("n", "<Leader>fd", ":lcd %:p:h<CR>", { silent = true })
 key("n", "<Leader>fu", ":lcd ..<CR>", { silent = true })
 key("n", "<Leader><Tab>", ":b#<CR>", { silent = true })
-key("n", "<Leader>gr", ":!gh browse %<CR><CR>", { silent = true })
 key("n", "<Leader>tt", [[<Cmd>exe 'edit $NOTES_PATH/journal/'.strftime("%Y-%m-%d_%a").'.md'<CR>]])
 key("n", "<Leader>jj", ":!journal<CR>:e<CR>")
 
@@ -65,6 +64,12 @@ key("n", "<C-Down>", ":resize -2<CR>", { silent = true })
 key("n", "<C-Left>", ":vertical resize -2<CR>", { silent = true })
 key("n", "<C-Right>", ":vertical resize +2<CR>", { silent = true })
 
+-- Quickfix
+key("n", "]q", ":cnext<CR>")
+key("n", "[q", ":cprevious<CR>")
+key("n", "co", ":copen<CR>")
+key("n", "cq", ":cclose<CR>")
+
 -- Other
 key("n", "<A-CR>", ":noh<CR>", { silent = true })           --- Clear search in VimWiki
 key("n", "Y", "y$")                                         --- Copy to end of line

modules/common/neovim/package/default.nix

@@ -26,13 +26,13 @@
 #   ] ++ extraConfig;
 # }
 
-{ pkgs, colors, ... }:
+{ pkgs, colors, terraform ? false, github ? false, kubernetes ? false, ... }:
 
 # Comes from nix2vim overlay:
 # https://github.com/gytis-ivaskevicius/nix2vim/blob/master/lib/neovim-builder.nix
 pkgs.neovimBuilder {
   package = pkgs.neovim-unwrapped;
-  inherit colors;
+  inherit colors terraform github kubernetes;
   imports = [
     ../config/align.nix
     ../config/bufferline.nix

modules/common/programming/default.nix

@@ -6,6 +6,7 @@
     ./lua.nix
     ./nix.nix
     ./python.nix
+    ./rust.nix
     ./terraform.nix
   ];
 

modules/common/programming/rust.nix

@@ -0,0 +1,17 @@
+{ config, pkgs, lib, ... }: {
+
+  options.rust.enable = lib.mkEnableOption "Rust programming language.";
+
+  config = lib.mkIf config.rust.enable {
+
+    home-manager.users.${config.user} = {
+
+      programs.fish.shellAbbrs = { ca = "cargo"; };
+
+      home.packages = with pkgs; [ cargo rustc clippy gcc ];
+
+    };
+
+  };
+
+}

modules/common/programming/terraform.nix

@@ -3,6 +3,7 @@
   options.terraform.enable = lib.mkEnableOption "Terraform tools.";
 
   config = lib.mkIf config.terraform.enable {
+    unfreePackages = [ "terraform" ];
 
     home-manager.users.${config.user} = {
       programs.fish.shellAbbrs = {

modules/common/shell/charm.nix

@@ -10,6 +10,7 @@
       glow # Markdown previews
       skate # Key-value store
       charm # Manage account and filesystem
+      pop # Send emails from a TUI
     ];
 
   };

modules/common/shell/fish/default.nix

@@ -6,7 +6,7 @@
   home-manager.users.${config.user} = {
 
     # Packages used in abbreviations and aliases
-    home.packages = with pkgs; [ curl exa ];
+    home.packages = with pkgs; [ curl ];
 
     programs.fish = {
       enable = true;
@@ -15,8 +15,8 @@
         # Version of bash which works much better on the terminal
         bash = "${pkgs.bashInteractive}/bin/bash";
 
-        # Use exa instead of ls for fancier output
-        ls = "exa --group";
+        # Use eza (exa) instead of ls for fancier output
+        ls = "${pkgs.eza}/bin/eza --group";
 
         # Move files to XDG trash on the commandline
         trash = lib.mkIf pkgs.stdenv.isLinux "${pkgs.trash-cli}/bin/trash-put";
@@ -123,9 +123,6 @@
         dr = "docker run --rm -it";
         db = "docker build . -t";
 
-        # Rust
-        ca = "cargo";
-
       };
       shellInit = "";
     };

modules/darwin/hammerspoon/Spoons/MoveWindow.spoon/worklayout.lua

@@ -55,6 +55,15 @@ local function worklayout()
         local layout = concat(left, right, laptop)
         hs.layout.apply(layout)
     end)
+
+    -- Reload Hammerspoon whenever layout changes
+    hs.screen.watcher.new(function()
+        -- Pause for 5 seconds to give time for layout to change
+        hs.timer.doAfter(5, function()
+            -- Perform the actual reload
+            hs.reload()
+        end)
+    end)
 end
 
 return worklayout

modules/darwin/homebrew.nix

@@ -42,6 +42,7 @@
         "obsidian" # Obsidian packaging on Nix is not available for macOS
         "scroll-reverser" # Different scroll style for mouse vs. trackpad
         "steam" # Not packaged for Nix
+        "epic-games" # Not packaged for Nix
       ];
     };
 

modules/nixos/gaming/steam.nix

@@ -22,6 +22,11 @@
 
     ];
 
+    # Adapted in part from: https://github.com/Shawn8901/nix-configuration/blob/1c48be94238a9f463cf0bbd1e1842a4454286514/modules/nixos/steam-compat-tools/default.nix
+    # Based on: https://github.com/NixOS/nixpkgs/issues/73323
+    environment.sessionVariables.STEAM_EXTRA_COMPAT_TOOLS_PATHS =
+      lib.makeBinPath [ pkgs.proton-ge-custom ];
+
     # Seems like NetworkManager can help speed up Steam launch
     # https://www.reddit.com/r/archlinux/comments/qguhco/steam_startup_time_arch_1451_seconds_fedora_34/hi8opet/
     networking.networkmanager.enable = true;

modules/nixos/graphical/i3.nix

@@ -45,7 +45,7 @@ in {
               { class = "obsidian"; }
             ];
             "${ws3}" = [{ class = "discord"; }];
-            "${ws4}" = [{ class = "Steam"; }];
+            "${ws4}" = [ { class = "steam"; } { class = "Steam"; } ];
           };
           bars = [{ command = "echo"; }]; # Disable i3bar
           colors = let

modules/nixos/graphical/polybar.nix

@@ -36,7 +36,7 @@
             module-margin = 1;
             modules-left = "i3";
             modules-center = "xwindow";
-            modules-right = "mailcount network pulseaudio date power";
+            modules-right = "mailcount network pulseaudio date keyboard power";
             cursor-click = "pointer";
             cursor-scroll = "ns-resize";
             enable-ipc = true;
@@ -200,10 +200,17 @@
             label-foreground = config.theme.colors.base0A;
             # format-background = colors.background;
           };
+          "module/keyboard" = {
+            type = "custom/text";
+            content = "󰌌";
+            click-left = "doas systemctl restart keyd";
+            content-foreground = config.theme.colors.base04;
+          };
           "module/power" = {
             type = "custom/text";
             content = "  ";
             click-left = config.powerCommand;
+            click-right = "polybar-msg cmd restart";
             content-foreground = config.theme.colors.base04;
           };
           "settings" = {

modules/nixos/graphical/rofi.nix

@@ -59,7 +59,7 @@ in {
             border = mkLiteral "0px";
             border-radius = mkLiteral "0px";
             border-color = mkLiteral config.theme.colors.base04;
-            children = map mkLiteral [ "inputbar" "listview" ];
+            children = map mkLiteral [ "inputbar" "message" "listview" ];
             spacing = mkLiteral "10px";
             padding = mkLiteral "10px";
           };

modules/nixos/hardware/keyboard.nix

@@ -1,4 +1,4 @@
-{ config, ... }: {
+{ config, pkgs, ... }: {
 
   config = {
 
@@ -23,6 +23,10 @@
       };
     };
 
+    # For some reason, keyd doesn't restart properly when updating
+    system.activationScripts.keyd.text =
+      "${pkgs.systemd}/bin/systemctl restart keyd.service";
+
     # Enable num lock on login
     home-manager.users.${config.user}.xsession.numlock.enable = true;
 

modules/nixos/services/default.nix

@@ -19,6 +19,7 @@
     ./n8n.nix
     ./netdata.nix
     ./nextcloud.nix
+    ./paperless.nix
     ./prometheus.nix
     ./samba.nix
     ./secrets.nix

modules/nixos/services/paperless.nix

@@ -0,0 +1,48 @@
+{ config, lib, ... }: {
+
+  config = lib.mkIf config.services.paperless.enable {
+
+    services.paperless = {
+      mediaDir = "/data/generic/paperless";
+      passwordFile = config.secrets.paperless.dest;
+      extraConfig = {
+        PAPERLESS_OCR_USER_ARGS =
+          builtins.toJSON { invalidate_digital_signatures = true; };
+
+        # Enable if changing the path name in Caddy
+        # PAPERLESS_FORCE_SCRIPT_NAME = "/paperless";
+        # PAPERLESS_STATIC_URL = "/paperless/static/";
+      };
+    };
+
+    users.users.paperless.extraGroups = [ "generic" ];
+
+    caddy.routes = [{
+      match = [{
+        host = [ config.hostnames.paperless ];
+        # path = [ "/paperless*" ]; # Change path name in Caddy
+      }];
+      handle = [{
+        handler = "reverse_proxy";
+        upstreams = [{
+          dial =
+            "localhost:${builtins.toString config.services.paperless.port}";
+        }];
+      }];
+    }];
+
+    secrets.paperless = {
+      source = ../../../private/prometheus.age;
+      dest = "${config.secretsDirectory}/paperless";
+      owner = "paperless";
+      group = "paperless";
+      permissions = "0440";
+    };
+    systemd.services.paperless-secret = {
+      requiredBy = [ "paperless.service" ];
+      before = [ "paperless.service" ];
+    };
+
+  };
+
+}

modules/nixos/services/sshd.nix

@@ -1,4 +1,4 @@
-{ config, lib, ... }: {
+{ config, pkgs, lib, ... }: {
 
   options = {
     publicKey = lib.mkOption {
@@ -32,7 +32,10 @@
     services.sshguard.enable = true;
 
     # Add terminfo for SSH from popular terminal emulators
-    environment.enableAllTerminfo = true;
+    # Fix: terminfo now installs contour, which is broken on ARM
+    # - https://github.com/NixOS/nixpkgs/pull/253334
+    # - Will disable until fixed
+    environment.enableAllTerminfo = pkgs.stdenv.isLinux && pkgs.stdenv.isx86_64;
   };
 
 }

modules/nixos/system/doas.nix

@@ -26,9 +26,14 @@
       };
     };
 
-    # Alias sudo to doas for convenience
-    home-manager.users.${config.user}.programs.fish.shellAliases = {
-      sudo = "doas";
+    home-manager.users.${config.user}.programs = {
+
+      # Alias sudo to doas for convenience
+      fish.shellAliases = { sudo = "doas"; };
+
+      # Disable overriding our sudo alias with a TERMINFO alias
+      kitty.settings.shell_integration = "no-sudo";
+
     };
 
   };

overlays/age.nix

@@ -0,0 +1,9 @@
+# Pin age because it is failing to build
+# https://github.com/NixOS/nixpkgs/pull/265753
+
+inputs: _final: prev: {
+  age = prev.age.overrideAttrs (old: {
+    src = inputs.age;
+    doCheck = false; # https://github.com/FiloSottile/age/issues/517
+  });
+}

overlays/caddy.nix

@@ -22,7 +22,7 @@ let
   '';
 
 in {
-  caddy-cloudflare = prev.buildGo118Module {
+  caddy-cloudflare = prev.buildGo120Module {
     pname = "caddy-cloudflare";
     version = prev.caddy.version;
     runVend = true;
@@ -31,7 +31,7 @@ in {
 
     src = prev.caddy.src;
 
-    vendorSha256 = "sha256:CrHqJcJ0knX+txQ5qvzW4JrU8vfi3FO3M/xtislIC1M=";
+    vendorSha256 = "sha256:0KfMzTt4lNzVfoCfDHhC2ue3OWICkFCHuhREiM2JPMY=";
 
     overrideModAttrs = (_: {
       preBuild = ''

overlays/calibre-web-cloudflare.patch

@@ -1,8 +1,8 @@
 diff --git a/cps/__init__.py b/cps/__init__.py
-index 269e4aca..e2b828a9 100644
+index f4f8dbf2..7377acdf 100644
 --- a/cps/__init__.py
 +++ b/cps/__init__.py
-@@ -150,7 +150,6 @@ def create_app():
+@@ -151,7 +151,6 @@ def create_app():
  
      lm.login_view = 'web.login'
      lm.anonymous_user = ub.Anonymous
@@ -11,15 +11,17 @@ index 269e4aca..e2b828a9 100644
      db.CalibreDB.update_config(config)
      db.CalibreDB.setup_db(config.config_calibre_dir, cli_param.settings_path)
 diff --git a/cps/admin.py b/cps/admin.py
-index 20c58aac..99d2ad19 100644
+index 045a9523..825a28af 100644
 --- a/cps/admin.py
 +++ b/cps/admin.py
-@@ -101,8 +101,6 @@ def admin_required(f):
+@@ -102,10 +102,6 @@ def admin_required(f):
  
  @admi.before_app_request
  def before_request():
--    if not ub.check_user_session(current_user.id, flask_session.get('_id')) and 'opds' not in request.path:
+-    if not ub.check_user_session(current_user.id,
+-                                 flask_session.get('_id')) and 'opds' not in request.path \
+-      and config.config_session == 1:
 -        logout_user()
      g.constants = constants
-     g.google_site_verification = os.getenv('GOOGLE_SITE_VERIFICATION','')
+     g.google_site_verification = os.getenv('GOOGLE_SITE_VERIFICATION', '')
      g.allow_registration = config.config_public_reg

overlays/neovim-plugins.nix

@@ -9,7 +9,7 @@ let
 
   # Package plugin - for plugins not found in nixpkgs at all
   plugin = pname: src:
-    prev.vimUtils.buildVimPluginFrom2Nix {
+    prev.vimUtils.buildVimPlugin {
       inherit pname src;
       version = "master";
     };

overlays/nextcloud-apps.nix

@@ -4,14 +4,17 @@ inputs: _final: prev: {
     news = prev.fetchNextcloudApp {
       url = inputs.nextcloud-news.outPath;
       sha256 = inputs.nextcloud-news.narHash;
+      license = "agpl3Plus";
     };
     external = prev.fetchNextcloudApp {
       url = inputs.nextcloud-external.outPath;
       sha256 = inputs.nextcloud-external.narHash;
+      license = "agpl3Plus";
     };
     cookbook = prev.fetchNextcloudApp {
       url = inputs.nextcloud-cookbook.outPath;
       sha256 = inputs.nextcloud-cookbook.narHash;
+      license = "agpl3Plus";
     };
   };
 

overlays/proton-ge.nix

@@ -0,0 +1,15 @@
+# Adapted from:
+# https://github.com/Shawn8901/nix-configuration/blob/182a45a6b193143ff7ff8e78bb66f7b869ea48d4/packages/proton-ge-custom/default.nix
+# Based on: https://github.com/NixOS/nixpkgs/issues/73323
+
+inputs: _final: prev: {
+  proton-ge-custom = prev.stdenv.mkDerivation (finalAttrs: rec {
+    name = "proton-ge-custom";
+    version = "0.1"; # Made up
+    src = inputs.proton-ge;
+    installPhase = ''
+      mkdir -p $out/bin
+      cp -r ${src}/* -t $out/bin/
+    '';
+  });
+}

overlays/tree-sitter.nix

@@ -12,6 +12,10 @@ inputs: _final: prev: {
       prev.tree-sitter-grammars.tree-sitter-python.overrideAttrs
       (old: { src = inputs.tree-sitter-python; });
 
+    # Fix: invalid structure in position.
+    tree-sitter-lua = prev.tree-sitter-grammars.tree-sitter-lua.overrideAttrs
+      (old: { src = inputs.tree-sitter-lua; });
+
     # Add grammars not in nixpks
     tree-sitter-ini = prev.tree-sitter.buildGrammar {
       language = "ini";

private/paperless.age

@@ -0,0 +1,15 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBWY3N0
+VkY0Y2tLQnNhZWdRVzFxU0plWThveUthK2NjZWNhZDd5ZGtXVVZ3CjVPc3YxbnBM
+MmozZFlORVppQmJrQ2ovWEFVVm81ZlBpRCtQQmRiNnBCaVUKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIEtvRFJEQXJLNjlyRldpM2pMdXNxWVZmVFl2NVJjRUtuQzNtbmJq
+UTBDR2cKQ1J4cHVkWHJZU1M4dnFIekx2ejlua0NjUUtET0EwN24rY2NPcGQ5eEp1
+TQotPiBzc2gtZWQyNTUxOSBuanZYNUEgVnBQOHV5VUk0N2lyU2NkdXovQmJYVGhL
+dnUwTG9oZkZKOUxFWTNiZkhBbwo2WjgyNHBhaGtFREJGVDk5TzJhZjRzKytaLzZR
+TDQxeU9pY24zQnJBYmN3Ci0+IHNzaC1lZDI1NTE5IENxSU9VQSBQQ3I2YnNNZVlX
+TEhNbWhRSjJRbk9DYnJIRUFieDBMRUtBRVhxZ1RQcVNNClNzU0VPMnh5bUFGVTZm
+ekJLSzFjT3dHVVdoQ3A5ZStCUk83Qk5rcWZmN3MKLS0tIFdvRG1mYzdUenhndkY2
+amo0ZGpjQkdabUdNRUJwV29CRXByVk8ySEZzTzAKsDY+DVJqZb/jCn6Xa/OqNheR
+uNlV5vVKUaZu5F+MTZqZaRYdn66TJVXgz5GydbgwQGs3l0K67ikPiTOoln0FapnB
+TQ==
+-----END AGE ENCRYPTED FILE-----

templates/poetry/flake.nix

@@ -5,7 +5,7 @@
   inputs.nixpkgs.url = "github:NixOS/nixpkgs";
   inputs.poetry2nix.url = "github:nix-community/poetry2nix";
 
-  outputs = { nixpkgs, flake-utils, poetry2nix }:
+  outputs = { self, nixpkgs, flake-utils, poetry2nix }:
     flake-utils.lib.eachDefaultSystem (system:
       let
         pkgs = import nixpkgs {

templates/python/flake.nix

@@ -11,7 +11,7 @@
     inputs.pypi-deps-db.follows = "pypi-deps-db";
   };
 
-  outputs = { nixpkgs, mach-nix }:
+  outputs = { self, nixpkgs, mach-nix }:
     let
       supportedSystems = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" ];
       forAllSystems = f:

templates/rust/flake.nix

@@ -0,0 +1,20 @@
+{
+  description = "Basic Rust project";
+  inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+  outputs = { self, nixpkgs }:
+    let
+      forAllSystems = nixpkgs.lib.genAttrs [
+        "x86_64-linux"
+        "x86_64-darwin"
+        "aarch64-linux"
+        "aarch64-darwin"
+      ];
+    in {
+      devShells = forAllSystems (system:
+        let pkgs = import nixpkgs { inherit system; };
+        in {
+          default =
+            pkgs.mkShell { buildInputs = with pkgs; [ gcc rustc cargo ]; };
+        });
+    };
+}