Fix vscode-server

unstable/26.11 broken for x86_64-darwin

.github/workflows/check.yaml

@@ -0,0 +1,19 @@
+name: Nix Flake Check
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Install Nix
+        uses: cachix/install-nix-action@v26
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+      - name: Run nix flake check
+        run: nix flake check

.gitignore

@@ -6,3 +6,6 @@ result
 
 # nix pre-commit autogenerated by devShell
 /.pre-commit-config.yaml
+
+# agy sessions
+.antigravitycli

flake.lock

@@ -3,16 +3,16 @@
     "brew-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1778146321,
+        "lastModified": 1781226006,
-        "narHash": "sha256-HeBwuJmuBioZHyZqDOcf7W/xsMFupSD583v6I5Cl7a8=",
+        "narHash": "sha256-w4ZTuOnhYiDxjaynrMTASzp802QblBWmo3wpB8wVN4Y=",
         "owner": "Homebrew",
         "repo": "brew",
-        "rev": "af835384ac574f76025adb38b292b04cecee1f1f",
+        "rev": "109191be4988470b51a60a5ef1998520aa24c01b",
         "type": "github"
       },
       "original": {
         "owner": "Homebrew",
-        "ref": "5.1.10",
+        "ref": "6.0.1",
         "repo": "brew",
         "type": "github"
       }
@@ -20,19 +20,20 @@
     "darwin": {
       "inputs": {
         "nixpkgs": [
-          "nixpkgs"
+          "nixpkgs-mars"
         ]
       },
       "locked": {
-        "lastModified": 1777780666,
+        "lastModified": 1783744694,
-        "narHash": "sha256-8wURyQMdDkGUarSTKOGdCuFfYiwa3HbzwscUfn3STDE=",
+        "narHash": "sha256-2cp6N3rrwnGYLTx9l6N+NI+kwrCWxvJUbj5WJhvB29A=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "8c62fba0854ba15c8917aed18894dbccb48a3777",
+        "rev": "c3e90c89649b07d1a96e4b9dd6cd0d6e44b91a74",
         "type": "github"
       },
       "original": {
         "owner": "nix-darwin",
+        "ref": "nix-darwin-26.05",
         "repo": "nix-darwin",
         "type": "github"
       }
@@ -96,11 +97,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1778705491,
+        "lastModified": 1783713126,
-        "narHash": "sha256-LOZbixhLsv2QbUbqH+I06eRMAI7FBDDkGoMWH523OkE=",
+        "narHash": "sha256-Q36Du9Ed1YwnQO1Mm9CHix/IcqAMkvSg34zExEfe8RI=",
         "ref": "refs/heads/main",
-        "rev": "b6fb4221bd5f54bc427de84230e0c95952399c21",
+        "rev": "56d3b6dfdd46efcfb0a6f4643116a8f54cf2f89e",
-        "revCount": 25,
+        "revCount": 45,
         "type": "git",
         "url": "https://github.com/futureware-tech/nix.git"
       },
@@ -112,18 +113,17 @@
     "git-hooks": {
       "inputs": {
         "flake-compat": "flake-compat",
-        "gitignore": "gitignore",
         "nixpkgs": [
           "fw_nix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1778507602,
+        "lastModified": 1783008725,
-        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
+        "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe",
         "type": "github"
       },
       "original": {
@@ -135,17 +135,16 @@
     "git-hooks_2": {
       "inputs": {
         "flake-compat": "flake-compat_2",
-        "gitignore": "gitignore_2",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1778507602,
+        "lastModified": 1783008725,
-        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
+        "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe",
         "type": "github"
       },
       "original": {
@@ -154,49 +153,6 @@
         "type": "github"
       }
     },
-    "gitignore": {
-      "inputs": {
-        "nixpkgs": [
-          "fw_nix",
-          "git-hooks",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1709087332,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "type": "github"
-      }
-    },
-    "gitignore_2": {
-      "inputs": {
-        "nixpkgs": [
-          "git-hooks",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1709087332,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "type": "github"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -204,11 +160,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778503501,
+        "lastModified": 1783823409,
-        "narHash": "sha256-08L/X4/do7nET4rzidJ76eV/1r+mB7DchVpdPypsghc=",
+        "narHash": "sha256-OI4IkRjRXa1e7hYmCGJDPDq5H/kPwhsyoS80cNUF9fI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "85ba629c79449badf4338117c27f0ee92b4b9f1a",
+        "rev": "7566825d4652a1b885bd4ce65bd9e8def432fec9",
         "type": "github"
       },
       "original": {
@@ -217,13 +173,34 @@
         "type": "github"
       }
     },
+    "home-manager-mars": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs-mars"
+        ]
+      },
+      "locked": {
+        "lastModified": 1783740085,
+        "narHash": "sha256-qajyHfZY29G2oEQk+uHxmsJcRoBUBXP9maTpFlwP/dI=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "3cd22efe6471dc7365c822bd9ad73a21e55f38fb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "release-26.05",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
     "jail-nix": {
       "locked": {
-        "lastModified": 1772137954,
+        "lastModified": 1776230864,
-        "narHash": "sha256-h4MGNbOo7L3RHi4uNFmsg5g17/DHXEfnv/xiG6BrNFQ=",
+        "narHash": "sha256-YsEjjdOsGEzTeD+iT7ONh071BqWAOQWpzYVei3okAXE=",
         "owner": "~alexdavid",
         "repo": "jail.nix",
-        "rev": "42b355c38ca63dab4904acc5c0d95f17954a8c9b",
+        "rev": "404e7da9da5ab9aa643666682b2ba1312fa5fbe8",
         "type": "sourcehut"
       },
       "original": {
@@ -237,11 +214,11 @@
         "brew-src": "brew-src"
       },
       "locked": {
-        "lastModified": 1778332591,
+        "lastModified": 1781389246,
-        "narHash": "sha256-ctJ3ADtugrnbMfMBobA645gCqXVIyHnsCNMkVaIuSiM=",
+        "narHash": "sha256-ORqLAo/hoJdsZC7UPAuEHev6S0+XIqKEC7vjo5prz1k=",
         "owner": "zhaofengli",
         "repo": "nix-homebrew",
-        "rev": "7d0038b5bb60568ec41f5f4ef5067cd221ca7c0d",
+        "rev": "de7953a08ed4bb9245be043e468561c17b89130d",
         "type": "github"
       },
       "original": {
@@ -252,11 +229,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1777954456,
+        "lastModified": 1783776592,
-        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
+        "narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
+        "rev": "e7a3ca8092b61ff85b6a45bf863ea2b2d6a661b3",
         "type": "github"
       },
       "original": {
@@ -266,15 +243,49 @@
         "type": "github"
       }
     },
+    "nixpkgs-mars": {
+      "locked": {
+        "lastModified": 1783788001,
+        "narHash": "sha256-ldd//kQFtHfGWLQd6deNXB6GnN6uLmwjPG6GGx/2vTA=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "572a2c2b6faebd71246e3162e4217d7ca63a9300",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixpkgs-26.05-darwin",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1784182977,
+        "narHash": "sha256-Hy8zg2HEcsk4WqowQK3UKRXz1fdQM7Z2un3nSyLbJaQ=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "29c22b7761070f37c4c2b0dd6a8777f0bd43e268",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixpkgs-26.05-darwin",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "darwin": "darwin",
         "fw_nix": "fw_nix",
         "git-hooks": "git-hooks_2",
         "home-manager": "home-manager",
+        "home-manager-mars": "home-manager-mars",
         "jail-nix": "jail-nix",
         "nix-homebrew": "nix-homebrew",
         "nixpkgs": "nixpkgs",
+        "nixpkgs-mars": "nixpkgs-mars",
         "systems": "systems_2",
         "vscode-server": "vscode-server"
       }
@@ -327,9 +338,7 @@
     "vscode-server": {
       "inputs": {
         "flake-utils": "flake-utils",
-        "nixpkgs": [
+        "nixpkgs": "nixpkgs_2"
-          "nixpkgs"
-        ]
       },
       "locked": {
         "lastModified": 1770124655,

flake.nix

@@ -3,22 +3,27 @@
 
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs-mars.url = "github:nixos/nixpkgs/nixpkgs-26.05-darwin";
     systems.url = "github:nix-systems/default";
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    home-manager-mars = {
+      url = "github:nix-community/home-manager/release-26.05";
+      inputs.nixpkgs.follows = "nixpkgs-mars";
+    };
     vscode-server = {
       url = "github:nix-community/nixos-vscode-server";
-      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-26.05-darwin";
     };
     fw_nix = {
       url = "git+https://github.com/futureware-tech/nix.git";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     darwin = {
-      url = "github:nix-darwin/nix-darwin";
+      url = "github:nix-darwin/nix-darwin/nix-darwin-26.05";
-      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs.follows = "nixpkgs-mars";
     };
     nix-homebrew.url = "github:zhaofengli/nix-homebrew";
     git-hooks = {
@@ -39,20 +44,30 @@
       ...
     }@inputs:
     let
-      trustedSSHKeys = [
+      homeManagerUser = "artem";
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBxRBsFGa8OFbviYDGSAKLgfm/K2XUxvCo+31FW37yab artem"
-        "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIPAtIXXHm58julnr7S0xzBTM1jN5JkKxOL4JpuWDOa2jAAAABHNzaDo= office-dock-usb-a"
-        "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHY1xx0huqV6Mcc2WngYDabITeNUbGamJ8//206MxxVTAAAABHNzaDo= keychain-usb-c"
-        "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHzY2eOz+JdaKOpIgZbF5FsZzQy0l8vPJjAQdTpBFGsoAAAABHNzaDo= safe"
-        "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJg7zQ4H0LQeQcILZBwCzQ+MYKtCgKm7HPe9oFeoyprKZXAvpm+HDHtaYdU39JF9f+nvRztzXuMhgETAQMAQCkc= fingerprint@macbook"
-      ];
       eachSystem = nixpkgs.lib.genAttrs (import systems);
+      nixpkgsFor = system: if system == "x86_64-darwin" then inputs.nixpkgs-mars else nixpkgs;
     in
     {
       checks = eachSystem (system: {
-        pre-commit-check = inputs.git-hooks.lib.${system}.run (
+        pre-commit-check =
+          let
+            # Once x86_64-darwin is removed and we are back to a single nixpkgs
+            # version, this can be simplified to:
+            #   gitHooksLib = inputs.git-hooks.lib.${system}
+            gitHooksLib = import "${inputs.git-hooks}/nix" {
+              nixpkgs = nixpkgsFor system;
+              inherit system;
+              isFlakes = true;
+            };
+          in
+          gitHooksLib.run (
             {
               src = ./.;
+              excludes = [
+                "^migrated/"
+                "^legacy/"
+              ];
             }
             // inputs.fw_nix.lib.pre-commit
           );
@@ -68,25 +83,34 @@
       nixosModules = {
         linux-headless = import ./modules/nixos/linux-headless.nix;
         linux-lxc = import ./modules/nixos/linux-lxc.nix;
+        jailed-agy = import ./modules/nixos/jailed-agy.nix;
       };
 
-      homeConfigurations."artem@deimos" = home-manager.lib.homeManagerConfiguration {
+      homeConfigurations."${homeManagerUser}@deimos" = home-manager.lib.homeManagerConfiguration {
-        pkgs = nixpkgs.legacyPackages.x86_64-linux;
+        pkgs = import nixpkgs {
-        extraSpecialArgs.primaryUser = "artem";
+          system = "x86_64-linux";
+        };
+        extraSpecialArgs.primaryUser = homeManagerUser;
         modules = [
+          inputs.fw_nix.nixosModules.identities
           vscode-server.homeModules.default
           self.homeModules.linux-headless
           ./hosts/deimos/home.nix
         ];
       };
 
-      homeConfigurations."artem@mars" = home-manager.lib.homeManagerConfiguration {
+      homeConfigurations."${homeManagerUser}@mars" =
-        pkgs = nixpkgs.legacyPackages.x86_64-darwin;
+        inputs.home-manager-mars.lib.homeManagerConfiguration
+          {
+            pkgs = import inputs.nixpkgs-mars {
+              system = "x86_64-darwin";
+              config.allowDeprecatedx86_64Darwin = true;
+            };
             extraSpecialArgs = {
-          primaryUser = "artem";
+              primaryUser = homeManagerUser;
-          inherit trustedSSHKeys;
             };
             modules = [
+              inputs.fw_nix.nixosModules.identities
               self.homeModules.mac-portable
               ./hosts/mars/home.nix
             ];
@@ -94,30 +118,33 @@
 
       darwinConfigurations.mars = darwin.lib.darwinSystem {
         system = "x86_64-darwin";
-        specialArgs.primaryUser = "artem";
+        specialArgs.primaryUser = homeManagerUser;
         modules = [
+          inputs.fw_nix.nixosModules.identities
           self.darwinModules.mac-portable
-          inputs.fw_nix.nixosModules.tools
+          inputs.fw_nix.nixosModules.nix-gc
           inputs.fw_nix.nixosModules.nix-settings
+          inputs.fw_nix.nixosModules.tools
           inputs.fw_nix.nixosModules.futureware
           inputs.nix-homebrew.darwinModules.nix-homebrew
           ./hosts/mars/darwin.nix
+          {
+            nixpkgs.config.allowDeprecatedx86_64Darwin = true;
+          }
         ];
       };
 
-      nixosConfigurations.deimos =
+      nixosConfigurations.deimos = nixpkgs.lib.nixosSystem {
-        let
         system = "x86_64-linux";
-        in
-        nixpkgs.lib.nixosSystem {
-          inherit system;
         specialArgs = {
-            inherit trustedSSHKeys;
+          primaryUser = homeManagerUser;
           inherit (inputs) jail-nix;
         };
         modules = [
+          inputs.fw_nix.nixosModules.identities
           self.nixosModules.linux-headless
           self.nixosModules.linux-lxc
+          self.nixosModules.jailed-agy
           inputs.fw_nix.nixosModules.nix-gc
           inputs.fw_nix.nixosModules.nix-settings
           inputs.fw_nix.nixosModules.tools
@@ -130,7 +157,10 @@
       devShells = eachSystem (
         system:
         let
-          pkgs = import nixpkgs { inherit system; };
+          pkgs = import (nixpkgsFor system) {
+            inherit system;
+            config.allowDeprecatedx86_64Darwin = true;
+          };
           inherit (self.checks.${system}.pre-commit-check) shellHook enabledPackages;
         in
         {

hosts/common/home.nix

@@ -0,0 +1,22 @@
+{
+  identities,
+  primaryUser,
+  ...
+}:
+let
+  user = identities.users.${primaryUser};
+in
+{
+  programs.git = {
+    signing = {
+      # Will be available on remote machines via SSH agent (Secretive).
+      key = "key::" + user.sign."sign@mars".publicKey;
+      signByDefault = true;
+    };
+
+    settings.user = {
+      name = "Artem Sheremet";
+      inherit (user) email;
+    };
+  };
+}

hosts/deimos/home.nix

@@ -1,5 +1,18 @@
-_: {
+{
-  home.homeDirectory = "/home/artem";
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  utils = import "${pkgs.path}/nixos/lib/utils.nix" { inherit lib pkgs config; };
+  haremote-path = "${config.home.homeDirectory}/src/haremote";
+  haremote-unit = utils.escapeSystemdPath haremote-path;
+in
+{
+  imports = [
+    ../common/home.nix
+  ];
 
   services.vscode-server.enable = true;
   services.vscode-server.installPath = [
@@ -7,17 +20,17 @@ _: {
     "$HOME/.antigravity-server"
   ];
 
-  systemd.user.mounts.home-artem-src-haremote = {
+  systemd.user.mounts."${haremote-unit}" = {
     Unit = {
-      Description = "Mount ~/src/haremote";
+      Description = "Mount ${haremote-path}";
       After = [ "network-online.target" ];
       Wants = [ "network-online.target" ];
     };
     Mount = {
       What = "root@homeassistant.home.arpa:/homeassistant";
-      Where = "/home/artem/src/haremote";
+      Where = haremote-path;
       Type = "fuse.sshfs";
-      Options = "reconnect,ServerAliveInterval=15,uid=1000,gid=1000,IdentityAgent=/home/artem/.ssh/ssh_auth_sock";
+      Options = "reconnect,ServerAliveInterval=15,uid=1000,gid=1000,IdentityAgent=${config.home.homeDirectory}/.ssh/ssh_auth_sock";
     };
     Install = {
       WantedBy = [ "default.target" ];
@@ -26,8 +39,8 @@ _: {
 
   programs.zsh.loginExtra = ''
     if [ -n "$SSH_AUTH_SOCK" ]; then
-      mkdir -p ~/src/haremote
+      mkdir -p ${haremote-path}
-      [ -z "$(ls -A ~/src/haremote 2>/dev/null)" ] && systemctl --user restart home-artem-src-haremote.mount
+      [ -z "$(ls -A ${haremote-path} 2>/dev/null)" ] && systemctl --user restart ${haremote-unit}.mount
     fi
   '';
 }

hosts/deimos/nixos.nix

@@ -1,77 +1,36 @@
 {
   pkgs,
-  trustedSSHKeys,
+  identities,
-  jail-nix,
+  primaryUser,
   ...
 }:
-let
-  jail = jail-nix.lib.init pkgs;
-in
 {
-  users.users.artem = {
+  users.users.${primaryUser} = {
     uid = 1000;
     isNormalUser = true;
     extraGroups = [
       "wheel"
       "docker"
+      "kvm"
     ];
-    openssh.authorizedKeys.keys = trustedSSHKeys;
+    openssh.authorizedKeys.keys = identities.getAccessKeys { user = primaryUser; };
     shell = pkgs.zsh;
     linger = true; # Keep sshfs mounted even on logout.
   };
 
   virtualisation.docker.enable = true;
 
+  nixpkgs.config.allowUnfree = true;
+
+  programs.fuse.enable = true; # for ~/src/haremote mount
+
   environment.systemPackages = with pkgs; [
     # TODO: move below into hosts/deimos/home.nix
     sshfs
     nixd
     home-assistant-cli
     yt-dlp
-
+    attic-client
-    # jailed-gemini --yolo
-    (jail "jailed-gemini" pkgs.gemini-cli (
-      with jail.combinators;
-      [
-        network
-        time-zone
-        no-new-session
-        mount-cwd
-
-        (readwrite (noescape "~/.gemini"))
-        # The above is a stow-controlled symlink to the following.
-        (readwrite (noescape "~/dotfiles/legacy/.gemini"))
-
-        (add-pkg-deps (
-          with pkgs;
-          [
-            bashInteractive
-            curl
-            wget
-            jq
-            git
-            which
-            ripgrep
-            gnugrep
-            gnused
-            gawkInteractive
-            ps
-            findutils
-            gzip
-            unzip
-            gnutar
-            diffutils
-            coreutils
-            procps
-
-            python3
-            esphome
-
-            nix
-          ]
-        ))
-      ]
-    ))
   ];
 
   # For building RPi configs. Extra steps are handled by the host (nas).

hosts/mars/darwin.nix

@@ -1,5 +1,12 @@
 _: {
   homebrew.casks = [
     "bambu-studio"
+
+    # Not available in nixpkgs-26.05, and latest doesn't support x86_64-darwin
+    "antigravity-cli"
+  ];
+  homebrew.brews = [
+    "libimobiledevice"
+    "ideviceinstaller"
   ];
 }

hosts/mars/home.nix

@@ -2,10 +2,15 @@
   pkgs,
   lib,
   config,
-  trustedSSHKeys,
+  identities,
+  primaryUser,
   ...
 }:
 {
+  imports = [
+    ../common/home.nix
+  ];
+
   home.packages = with pkgs; [
     dosbox-staging # dosbox appears broken on darwin
 
@@ -19,7 +24,11 @@
 
   home.activation.setupAuthorizedKeys = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
     run install -m 0600 -D \
-      ${pkgs.writeText "keys" (builtins.concatStringsSep "\n" trustedSSHKeys)} \
+      ${
+        pkgs.writeText "keys" (
+          builtins.concatStringsSep "\n" (identities.getAccessKeys { user = primaryUser; })
+        )
+      } \
       ${config.home.homeDirectory}/.ssh/ephemeral_sshd/authorized_keys
   '';
 
@@ -27,27 +36,4 @@
   # https://nest.pijul.com/yonkeltron/macOS-nix-config:main/ZLDSMIXK5XFW6.EIAAA
   # and
   # https://github.com/bgub/nix-macos-starter/tree/main
-
-  launchd.agents.keyboard-remap = {
-    # Remap top-left key (paragraph) to backquote and backslash like
-    # proper ISO keyboard does, and the key right to the LShift to
-    # Shift.
-    enable = true;
-    config = {
-      Label = "com.user.keyboard-remap";
-      ProgramArguments = [
-        "/usr/bin/hidutil"
-        "property"
-        "--set"
-        ''
-          {"UserKeyMapping":
-            [
-              {"HIDKeyboardModifierMappingSrc":0x700000035, "HIDKeyboardModifierMappingDst":0x7000000e1},
-              {"HIDKeyboardModifierMappingSrc":0x700000064, "HIDKeyboardModifierMappingDst":0x700000035},
-            ]
-          }''
-      ];
-      RunAtLoad = true;
-    };
-  };
 }

legacy/.gemini/config/mcp_config.json

@@ -0,0 +1,37 @@
+{
+  "mcpServers": {
+    "nix": {
+      "command": "nix",
+      "args": [
+        "run",
+        "github:utensils/mcp-nixos",
+        "--"
+      ]
+    },
+    "gitea": {
+      "command": "nix",
+      "args": [
+        "run",
+        "nixpkgs#gitea-mcp-server",
+        "--"
+      ]
+    },
+    "ha": {
+      "command": "nix",
+      "args": [
+        "shell",
+        "nixpkgs#uv",
+        "nixpkgs#python3",
+        "--command",
+        "uv",
+        "tool",
+        "run",
+        "ha-mcp"
+      ],
+      "env": {
+        "UV_PYTHON_DOWNLOADS": "never",
+        "UV_PYTHON_PREFERENCE": "system"
+      }
+    }
+  }
+}

legacy/.gemini/settings.json

@@ -1,35 +0,0 @@
-{
-  "mcpServers": {
-    "nix": {
-      "command": "nix",
-      "args": [
-        "run",
-        "github:utensils/mcp-nixos",
-        "--"
-      ]
-    },
-    "ha": {
-      "url": "${HASS_SERVER}/mcp_server/sse",
-      "headers": {
-        "Authorization": "Bearer ${HASS_TOKEN}"
-      },
-      "timeout": 5000
-    }
-  },
-  "security": {
-    "auth": {
-      "selectedType": "oauth-personal"
-    }
-  },
-  "general": {
-    "sessionRetention": {
-      "warningAcknowledged": true,
-      "enabled": true,
-      "maxAge": "30d"
-    },
-    "preferredEditor": "vim"
-  },
-  "model": {
-    "name": "auto-gemini-3"
-  }
-}

legacy/.gitconfig

@@ -1,45 +0,0 @@
-[color]
-	ui = auto
-[alias]
-	co = checkout
-	st = status
-	di = diff -w --no-prefix
-	df = diff
-	dc = diff --cached
-	ci = commit
-	br = branch
-	lg = log -p --decorate=full --show-signature
-	lol = log --graph --decorate=full --pretty=oneline --abbrev-commit
-	lola = log --graph --decorate=full --pretty=oneline --abbrev-commit --all
-	ls = ls-files
-	# Show files ignored by git:
-	ign = ls-files -o -i --exclude-standard
-[apply]
-	whitespace = nowarn
-[push]
-	default = tracking
-[rebase]
-	stat = yes
-[format]
-	pretty = fuller
-[fetch]
-	prune = yes
-[credential "https://source.developers.google.com"]
-	helper = gcloud.sh
-[core]
-	autocrlf = input
-[branch]
-	# 0 times I wanted this when doing "git checkout".
-	autoSetupMerge = false
-	# Set up new branches in a way that "git pull" does a rebase by default.
-	autoSetupRebase = always
-
-# Commit signing, currently using ssh@mars -- to be switched to sign@mars after 2026-05-15
-[gpg]
-	format = ssh
-[commit]
-	gpgsign = true
-[user]
-	signingkey = key::ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNwSX/Ib6kNzgRKqWfcb3HsAQQo++Gt9KeXSvP6NDk6YQPjDsi+//IiBovgLjQ34El+x8l8y3aYhfIGlCyX7aOM= sign@mars
-	name = Artem Sheremet
-	email = dot.doom@gmail.com

legacy/.ssh/config

@@ -1,25 +0,0 @@
-Host *
-	# Share SSH connection.
-	# If disabling, consider impact on ssh agent forwarding in screen
-	# sessions (see .ssh/rc file).
-	ControlMaster auto
-	ControlPath ~/.ssh/ctl/%r@%h:%p
-	ControlPersist 10m
-	# When a shared connection is broken (remote reboot), detect it faster.
-	ServerAliveInterval 11
-	ServerAliveCountMax 2
-
-	ConnectTimeout 10
-	AddKeysToAgent yes
-
-#Host custom-host-with-xorg
-#	HostName custom-hostname
-#	User crate
-#	ForwardX11 yes
-#	ForwardX11Trusted yes
-
-#Host always-changing-keys-dont-care
-#	StrictHostKeyChecking no
-#	UserKnownHostsFile=/dev/null
-
-Include config.d/*

legacy/.ssh/rc

@@ -1,11 +0,0 @@
-#!/bin/sh
-
-# When SSH-ing with agent forwarding enabled, this variable is set by sshd
-# itself. However, an existing screen session that we attach to will not have
-# its SSH_AUTH_SOCK environment variable updated, so we hardcode this path in
-# .screenrc and create a symlink to keep it alive.
-#
-# It WILL break if two sessions are opened to a machine, and a newer one is
-# terminated. ControlMaster in .ssh/config solves this problem by sharing the
-# connection (and as a result, sharing SSH agent socket).
-[ -n "$SSH_AUTH_SOCK" ] && ln -sf "$SSH_AUTH_SOCK" ~/.ssh/ssh_auth_sock

migrated/.vimrc

@@ -35,6 +35,9 @@ if exists("+undofile")
 	" Enable the persistent undo file(s)
 	set undodir=~/.vim/undo
 	set undofile
+	if !isdirectory(expand(&undodir))
+		call mkdir(expand(&undodir), "p")
+	endif
 endif
 
 set switchbuf+=usetab " Switch to existing tab; open a new tab for the new buf

migrated/.zshrc

@@ -62,7 +62,6 @@ alias grep='grep --line-buffered --color=auto'
 alias ipt='iptables -nvL --line-numbers'
 alias ip6t='ip6tables -nvL --line-numbers'
 alias tcpdump='tcpdump -l'
-alias ag='ag -C 2 --noaffinity --pager="$PAGER" --smart-case'
 alias mysql='mysql --select_limit=1000'
 alias logcat='adb logcat -v "color printable usec year zone" -T 10'
 alias readelf='readelf -W'
@@ -81,6 +80,10 @@ starttransfer: %{time_starttransfer} | \
 total: %{time_total} | \
 size: %{size_download}\n"'
 
+rg() {
+	command rg -C 2 --smart-case --pretty "$@" | pager
+}
+
 # nix-deploy # current host
 # nix-deploy nas # deploy nas
 # nix-deploy test secondary # deploy secondary but do not add to boot
@@ -125,7 +128,22 @@ nix-deploy() {
 	cmd=(nixos-rebuild)
 	command -v nixos-rebuild >/dev/null 2>&1 || cmd=(nix run "nixpkgs#nixos-rebuild" --)
 
-	"${cmd[@]}" "$action" --flake ".#$config" --target-host "$target" --sudo "$@" |& nom
+	nix build ".#nixosConfigurations.$config.config.system.build.toplevel" \
+		--out-link "result.$config" "$@" |& nom
+	local build_status=$pipestatus[1]
+	if (( build_status != 0 )); then
+		return $build_status
+	fi
+
+	if [[ "$action" != "build" ]]; then
+		# Bypass nixos-rebuild self-update check which errors in
+		# flake-only setups when --store-path is used.
+		_NIXOS_REBUILD_REEXEC=1 "${cmd[@]}" "$action" \
+			--store-path "$(readlink -f "result.$config")" \
+			--target-host "$target" \
+			--sudo \
+			"$@"
+	fi
 }
 
 myip() {
@@ -148,6 +166,15 @@ colordiff() {
 	cat "$file2" | git diff --no-prefix $gitarg --no-index "$file1" -
 }
 
+osh() {
+	local DEST="$1"
+	# TODO: loop to re-establish connection in case of network drop.
+	#       Kill the loop after mosh (below) finishes.
+	ssh -O check "$DEST" 2>/dev/null || ssh -A -f -o ControlPersist=yes "$DEST" "sleep 2592000"
+	# Disable agent forwarding on the bootstrap connection to prevent it from overwriting the symlink in .ssh/rc
+	mosh --ssh="ssh -a" "$@"
+}
+
 alias backup-home-explore='eval "ncdu $(grep -A1 -- --exclude $HOME/bin/backup-home | tr -d \|)"'
 
 # stderr redirect for if direnv is missing

modules/home/common.nix

@@ -1,24 +1,77 @@
 {
   pkgs,
   lib,
+  identities,
   primaryUser,
   ...
 }:
 {
   home.username = primaryUser;
-  home.packages = with pkgs; [
+
+  nixpkgs.config.allowUnfree = true;
+  home.packages =
+    with pkgs;
+    [
       stow
       wget
-    gemini-cli
-    silver-searcher
       yubikey-manager
-  ];
+    ]
+    ++ lib.optional (pkgs ? antigravity-cli) antigravity-cli;
+
   home.activation.stowLegacy = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
     if [ -d "$HOME/dotfiles/legacy" ]; then
       run ${pkgs.stow}/bin/stow -d $HOME/dotfiles -t $HOME legacy
     fi
   '';
 
+  home.activation.report-changes = lib.hm.dag.entryAnywhere ''
+    # oldGenPath can be undefined with home-manager used as part of NixOS config
+    if [ -n "''${oldGenPath+x}" ]; then
+      ${pkgs.nvd}/bin/nvd diff $oldGenPath $newGenPath
+    fi
+  '';
+
+  programs.git = {
+    enable = true;
+
+    settings = {
+      alias = {
+        co = "checkout";
+        st = "status";
+        di = "diff -w --no-prefix";
+        df = "diff";
+        dc = "diff --cached";
+        ci = "commit";
+        br = "branch";
+        lg = "log -p --decorate=full --show-signature";
+        lol = "log --graph --decorate=full --pretty=oneline --abbrev-commit";
+        lola = "log --graph --decorate=full --pretty=oneline --abbrev-commit --all";
+        ls = "ls-files";
+        # Show files ignored by git:
+        ign = "ls-files -o -i --exclude-standard";
+      };
+
+      color.ui = "auto";
+      apply.whitespace = "nowarn";
+      push.default = "tracking";
+      rebase.stat = "yes";
+      format.pretty = "fuller";
+      fetch.prune = "yes";
+      core.autocrlf = "input";
+      branch = {
+        # 0 times I wanted this when doing "git checkout".
+        autoSetupMerge = false;
+        # Set up new branches in a way that "git pull" does a rebase by default.
+        autoSetupRebase = "always";
+      };
+      gpg.format = "ssh";
+      gpg.ssh.allowedSignersFile = "${pkgs.writeText "allowed_signers" (
+        lib.concatStringsSep "\n" (identities.getSigningEntries { })
+      )}";
+      credential."https://source.developers.google.com".helper = "gcloud.sh";
+    };
+  };
+
   programs.zsh = {
     enable = true;
     initContent = ''
@@ -137,5 +190,49 @@
     '';
   };
 
+  programs.ssh = {
+    enable = true;
+    enableDefaultConfig = false;
+    includes = [ "config.d/*" ];
+
+    settings = {
+      "*" = {
+        # Share SSH connection.
+        # If disabling, consider impact on ssh agent forwarding in screen
+        # sessions (see .ssh/rc file).
+        ControlMaster = "auto";
+        ControlPath = "~/.ssh/ctl/%r@%h:%p";
+        ControlPersist = "10m";
+
+        # When a shared connection is broken (remote reboot), detect it faster.
+        ServerAliveInterval = 11;
+        ServerAliveCountMax = 2;
+
+        ConnectTimeout = 10;
+        AddKeysToAgent = "yes";
+      };
+    };
+  };
+
+  home.file = {
+    ".ssh/rc" = {
+      executable = true;
+      text = ''
+        #!/bin/sh
+
+        # When SSH-ing with agent forwarding enabled, this variable is set by sshd
+        # itself. However, an existing screen session that we attach to will not have
+        # its SSH_AUTH_SOCK environment variable updated, so we hardcode this path in
+        # .screenrc and create a symlink to keep it alive.
+        #
+        # It WILL break if two sessions are opened to a machine, and a newer one is
+        # terminated. ControlMaster in .ssh/config solves this problem by sharing the
+        # connection (and as a result, sharing SSH agent socket).
+        [ -n "$SSH_AUTH_SOCK" ] && ln -sf "$SSH_AUTH_SOCK" ~/.ssh/ssh_auth_sock
+      '';
+    };
+    ".ssh/ctl/.keep".text = "";
+  };
+
   home.stateVersion = "25.11"; # never modify
 }

modules/home/mac-portable.nix

@@ -35,6 +35,10 @@
     TripleClickSelectsFullWrappedLines = true;
     WordChars = "/-._~";
     PromptOnQuit = false;
+
+    # Use system browser to open links.
+    NoSyncBrowserUpsell = 1;
+    NoSyncBrowserUpsell_selection = 1;
   };
   home.file."Library/Application Support/iTerm2/DynamicProfiles/nix-profile.json".text =
     builtins.toJSON
@@ -47,6 +51,7 @@
 
             Columns = 160;
             Rows = 45;
+            "Scrollback Lines" = 1000000;
 
             # For tmux selection and moving borders.
             "Mouse Reporting" = true;
@@ -73,6 +78,10 @@
     export SSH_AUTH_SOCK=~/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
   '';
 
-  nixpkgs.config.allowUnfree = true;
+  # TODO: defaults read NSGlobalDomain
+  #       https://nix-darwin.github.io/nix-darwin/manual/index.html
+  #       -> set system.defaults.NSGlobalDomain
+  #          or  system.defaults.CustomSystemPreferences
+
   programs.vscode.enable = true;
 }

modules/nixos/jailed-agy.nix

@@ -0,0 +1,154 @@
+{
+  config,
+  lib,
+  pkgs,
+  jail-nix,
+  primaryUser,
+  ...
+}:
+let
+  jail = jail-nix.lib.init pkgs;
+  allPackages =
+    with pkgs;
+    [
+      bashInteractive
+      curl
+      wget
+      jq
+      git
+      which
+      ripgrep
+      gnugrep
+      gnused
+      gawkInteractive
+      ps
+      findutils
+      gzip
+      unzip
+      gnutar
+      diffutils
+      coreutils
+      procps
+
+      python3
+      python3Packages.pip
+      esphome
+
+      ruby
+      go
+      gcc
+      gnumake
+      pkg-config
+
+      nix
+    ]
+    ++ config.programs.jailed-agy.extraPackages;
+in
+{
+  options.programs.jailed-agy = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Whether to enable the jailed-agy wrapper.";
+    };
+
+    extraPackages = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      default = [ ];
+      description = "Extra packages to append to the jailed-agy environment.";
+    };
+  };
+
+  config = lib.mkIf config.programs.jailed-agy.enable {
+    environment.systemPackages = [
+      (jail "jailed-agy" pkgs.antigravity-cli (
+        with jail.combinators;
+        [
+          network
+          time-zone
+          no-new-session
+          mount-cwd
+
+          # Enforce that the wrapper is not run as root/privileged user
+          (add-runtime ''
+            if [ "$(id -u)" -eq 0 ]; then
+              echo "Error: jailed-agy must not be run as root/privileged user!" >&2
+              exit 1
+            fi
+          '')
+
+          # Automatically append --dangerously-skip-permissions to agy invocation
+          (set-argv [
+            "--dangerously-skip-permissions"
+            (noescape "\"$@\"")
+          ])
+
+          (readwrite (noescape "~/.gemini"))
+          # The above is a stow-controlled symlink to the following.
+          (readwrite (noescape "~/dotfiles/legacy/.gemini"))
+
+          # Enable easy installation of pip packages in the current directory.
+          (set-env "PYTHONPATH" (noescape "\"$PWD/.pip-packages\""))
+          (set-env "PIP_TARGET" (noescape "\"$PWD/.pip-packages\""))
+          (set-env "PIP_CACHE_DIR" (noescape "\"$PWD/.pip-cache\""))
+          (set-env "PIP_BREAK_SYSTEM_PACKAGES" "1")
+
+          # Enable easy installation and persistence of RubyGems in the current directory.
+          (set-env "GEM_HOME" (noescape "\"$PWD/.gem\""))
+
+          # Enable easy installation and persistence of Go modules and caches in the current directory.
+          (set-env "GOPATH" (noescape "\"$PWD/.go\""))
+          (set-env "GOCACHE" (noescape "\"$PWD/.go-cache\""))
+
+          # Preconfigure compiler and linker flags dynamically for all jail packages.
+          # This allows compiling Ruby gems (e.g. ffi, which requires libffi) and Go packages
+          # (e.g. YubiKey plugins, which require pcsclite) out-of-the-box.
+          (set-env "PKG_CONFIG_PATH" (
+            lib.concatStringsSep ":" (map (pkg: "${pkg.dev or pkg}/lib/pkgconfig") allPackages)
+          ))
+          (set-env "NIX_CFLAGS_COMPILE" (
+            lib.concatStringsSep " " (map (pkg: "-isystem ${pkg.dev or pkg}/include") allPackages)
+          ))
+          (set-env "NIX_LDFLAGS" (
+            lib.concatStringsSep " " (map (pkg: "-L${pkg.out or pkg}/lib") allPackages)
+          ))
+
+          # Mount system and user profiles so their packages are automatically available at runtime
+          (try-ro-bind "/run/current-system/sw" "/run/current-system/sw")
+          (try-ro-bind "/etc/profiles/per-user/${primaryUser}" "/etc/profiles/per-user/${primaryUser}")
+
+          # Mount Nix files and directories to support nix-shell and Nix operations in jail
+          (try-ro-bind "/nix/store" "/nix/store")
+          (try-ro-bind "/nix/var/nix/daemon-socket" "/nix/var/nix/daemon-socket")
+          (try-ro-bind "/nix/var/nix/profiles" "/nix/var/nix/profiles")
+          (try-ro-bind "/etc/nix" "/etc/nix")
+          (try-ro-bind "/etc/static" "/etc/static")
+
+          # Forward Nix environment variables
+          (try-fwd-env "NIX_REMOTE")
+          (try-fwd-env "NIX_PATH")
+          (try-fwd-env "NIX_SSL_CERT_FILE")
+
+          (add-pkg-deps allPackages)
+
+          # Prepend local project binary directories, system, and user bin paths to the jail's PATH.
+          # Note: We place this after `add-pkg-deps` so that local paths take highest precedence.
+          # We use explicit double quotes to allow bash to expand $PWD at runtime and handle spaces.
+          (
+            state:
+            state
+            // {
+              env = state.env // {
+                PATH =
+                  if state.env ? PATH && state.env.PATH != "" then
+                    "\"\$PWD/.gem/bin:\$PWD/.go/bin:\$PWD/.pip-packages/bin:/run/current-system/sw/bin:/etc/profiles/per-user/${primaryUser}/bin:${state.env.PATH}\""
+                  else
+                    "\"\$PWD/.gem/bin:\$PWD/.go/bin:\$PWD/.pip-packages/bin:/run/current-system/sw/bin:/etc/profiles/per-user/${primaryUser}/bin\"";
+              };
+            }
+          )
+        ]
+      ))
+    ];
+  };
+}

modules/nixos/linux-headless.nix

@@ -3,7 +3,7 @@
   ...
 }:
 {
-  # Create /etc/zshrc that loads the nix-darwin environment.
+  # Create /etc/zshrc that loads the nix environment.
   programs.zsh.enable = true;
   security.sudo.wheelNeedsPassword = false;
 

modules/nixos/linux-lxc.nix

@@ -1,6 +1,7 @@
 {
   modulesPath,
   pkgs,
+  lib,
   ...
 }:
 {
@@ -48,6 +49,7 @@
       for item in \
           "mkdir -p:/var/lib/nixos" \
           "mkdir -p:/var/lib/systemd" \
+          "mkdir -p:/var/lib/docker" \
           "touch:/etc/machine-id" \
           "touch:/etc/ssh/ssh_host_ed25519_key" \
       ; do
@@ -72,4 +74,7 @@
     capabilities = "cap_net_raw+p";
     source = "${pkgs.iputils.out}/bin/ping";
   };
+
+  # Our VMs usually have sufficient RAM, prefer to extend SSD lifetime.
+  boot.tmp.useTmpfs = lib.mkDefault true;
 }