update to 22.11

flake.lock

@@ -443,19 +443,20 @@
       "inputs": {
         "nixpkgs": [
           "nixos"
-        ]
+        ],
+        "utils": "utils_2"
       },
       "locked": {
-        "lastModified": 1656169755,
+        "lastModified": 1670156115,
-        "narHash": "sha256-Nlnm4jeQWEGjYrE6hxi/7HYHjBSZ/E0RtjCYifnNsWk=",
+        "narHash": "sha256-L2FKLedprp3AkQ+GS+2Br7CYWeCmLCjt3zUd87p0lNQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "4a3d01fb53f52ac83194081272795aa4612c2381",
+        "rev": "e704ef9ec7a8ccf8711bb11ff68da06f1917a26d",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-22.05",
+        "ref": "release-22.11",
         "repo": "home-manager",
         "type": "github"
       }
@@ -557,16 +558,16 @@
     },
     "nixos": {
       "locked": {
-        "lastModified": 1667327283,
+        "lastModified": 1670157845,
-        "narHash": "sha256-XEMEmRwv0lrhV8OFn1+dsEJovTDmn94zEjfxMfAoLIc=",
+        "narHash": "sha256-epO16PPDkhYicQWQkSYZxU3tJAML/rF0FESR6BMTpYw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c9a1090e19f93cb30c205682aab2d0989f8de91f",
+        "rev": "267a3d939c3aa4cea15d3b1ccac59f5e29c05bb3",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "release-22.05",
+        "ref": "release-22.11",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -804,7 +805,7 @@
         ],
         "superdirt-src": "superdirt-src",
         "tidal-src": "tidal-src",
-        "utils": "utils_2",
+        "utils": "utils_3",
         "vim-tidal-src": "vim-tidal-src",
         "vowel-src": "vowel-src"
       },
@@ -838,6 +839,21 @@
       }
     },
     "utils_2": {
+      "locked": {
+        "lastModified": 1667395993,
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "utils_3": {
       "locked": {
         "lastModified": 1653893745,
         "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",

flake.nix

@@ -4,10 +4,10 @@
   inputs =
     {
       # Nix
-      nixos.url = "github:nixos/nixpkgs/release-22.05";
+      nixos.url = "github:nixos/nixpkgs/release-22.11";
       latest.url = "github:nixos/nixpkgs/nixos-unstable";
       # Community
-      home.url = "github:nix-community/home-manager/release-22.05";
+      home.url = "github:nix-community/home-manager/release-22.11";
       home.inputs.nixpkgs.follows = "nixos";
       nixos-hardware.url = "github:nixos/nixos-hardware";
       # Lib
@@ -52,6 +52,9 @@
       # TODO not quite useful yet, since it needs secrets
       # dhyan.url = "git+ssh://gitea@git.sealight.xyz/aynish/dhyan?ref=main";
       # dhyan.inputs.nixpkgs.follows = "nixos";
+      # TODO needs secrets
+      # muneem.url = "git+ssh://gitea@git.sealight.xyz/aynish/muneem?ref=main";
+      # muneem.inputs.nixpkgs.follows = "nixos";
     };
 
   outputs =
@@ -91,7 +94,7 @@
               deploy.overlay
               ./pkgs/default.nix
               tidalcycles.overlays.default
-              neovim-nightly.overlay
+              # neovim-nightly.overlay
               rust-overlay.overlays.default
               eww.overlays.default
             ];
@@ -148,7 +151,7 @@
             };
             suites = with profiles; rec {
               base = [ core users.root users.anish ];
-              sealight = [ base server metrics gitea rss-bridge mount-mossnet ];
+              sealight = [ base server metrics gitea rss-bridge mount-mossnet freshrss ];
               lituus = [ base server metrics sealight-website matrix wireguard-server ];
               mossnet = [ base server taskd shaarli dns monitoring nfs gonic headphones radicale seafile syncthing dhyan calibre wallabag finance ]; # hpi sync.music muneem 
               cube = [ base site server ];

install-encrypted.sh

@@ -112,7 +112,7 @@ cat >> /mnt/etc/nixos/configuration.nix <<'endmsg'
   # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "21.05"; # Did you read the comment?
+  system.stateVersion = "22.11"; # Did you read the comment?
 }
 
 endmsg

install-yubikey.sh

@@ -162,7 +162,7 @@ cat > /mnt/etc/nixos/configuration.nix <<'endmsg'
   # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "21.05"; # Did you read the comment?
+  system.stateVersion = "22.11"; # Did you read the comment?
 }
 
 endmsg

profiles/cachix/default.nix

@@ -7,5 +7,5 @@ let
 in
 {
   inherit imports;
-  nix.binaryCaches = [ "https://cache.nixos.org/" ];
+  nix.settings.substituters = [ "https://cache.nixos.org/" ];
 }

profiles/cachix/nix-community.nix

@@ -1,10 +1,12 @@
 {
   nix = {
-    binaryCaches = [
+    settings = {
+      substituters = [
         "https://nix-community.cachix.org"
       ];
-    binaryCachePublicKeys = [
+      trusted-public-keys = [
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
       ];
     };
+  };
 }

profiles/cachix/nrdxp.nix

@@ -1,10 +1,12 @@
 {
   nix = {
-    binaryCaches = [
+    settings = {
+      substituters = [
         "https://nrdxp.cachix.org"
       ];
-    binaryCachePublicKeys = [
+      trusted-public-keys = [
         "nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4="
       ];
     };
+  };
 }

profiles/core/default.nix

@@ -4,7 +4,7 @@ in
 {
   imports = [ ../cachix ];
 
-  nix.systemFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
+  nix.settings.system-features = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
 
   fonts = {
     fonts = with pkgs; [ powerline-fonts dejavu_fonts ];
@@ -15,12 +15,14 @@ in
   };
 
   nix = {
-    autoOptimiseStore = true;
+    settings = {
+      sandbox = true;
+      trusted-users = [ "root" "@wheel" ];
+      allowed-users = [ "@wheel" ];
+      auto-optimise-store = true;
+    };
     gc.automatic = true;
     optimise.automatic = true;
-    useSandbox = true;
-    allowedUsers = [ "@wheel" ];
-    trustedUsers = [ "root" "@wheel" ];
     extraOptions = ''
       min-free = 536870912
       keep-outputs = true

profiles/freshrss/default.nix

@@ -1,14 +1,15 @@
 { config, lib, pkgs, ... }:
 
 {
+  age.secrets.freshrss-dbpass.file = "${self}/secrets/freshrss-dbpass.age";
+  age.secrets.freshrss-dbpass.owner = "freshrss";
   services.freshrss = {
     enable = true;
     virtualHost = "rss.sealight.xyz";
     baseUrl = "https://rss.sealight.xyz/";
     database = {
       type = "pgsql";
-      # passwordFile = "/run/secrets/gitea-dbpass"; # TODO supplied by agenix
+      passFile = "/run/agenix/freshrss-dbpass";
-      passFile = "/run/secrets/freshrss-dbpass";
     };
   };
 

users/anish/default.nix

@@ -5,7 +5,7 @@
 
   users.users.anish = {
     description = "Personal user for Anish";
-    hashedPassword = "MVHHpy9gbe3ow";
+    hashedPassword = "$y$j9T$y3DPt/dWaPE.gRazQqw1w0$1RMH5sl/Nu8kW3ZMywYCPRniHD/jF5qRh0VKrdJ.bV2";
     shell = pkgs.zsh;
     isNormalUser = true;
     extraGroups = [ "wheel" "audio" ];
@@ -17,6 +17,8 @@
     ];
   };
 
+  home-manager.users.anish.home.stateVersion = "22.05";
+
   # home-manager.users.anish.programs.git = {
   #   userName = "Anish Lakhwara";
   #   userEmail = "anish+git@lakhwara.com";

users/profiles/cli/default.nix

@@ -206,7 +206,6 @@
     tai = "task add +in";
     tn = "task-note";
     tp = "task limit:page";
-    te = "task edit";
     ts = "task sync";
 
     # keeping for posterity but now sxhkbd handles screenshot with <Super+O>