nix flake update: 2025-08-12 01:40:30 UTC

Run `man nix.conf` for more information on the `substituters` configuration option.
Run `man nix.conf` for more information on the `substituters` configuration option.
unpacking 'https://flakehub.com/f/DeterminateSystems/determinate/%2A' into the Git cache...
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/fc756aa6f5d3e2e5666efcf865d190701fef150a?narHash=sha256-eogqv6FqZXHgqrbZzHnq43GalnRbLTkbBbFtEfm1RSc%3D' (2025-08-08)
  → 'github:NixOS/nixpkgs/c5f08b62ed75415439d48152c2a784e36909b1bc?narHash=sha256-8OnUzRQZkqtUol9vuUuQC30hzpMreKptNyET2T9lB6g%3D' (2025-08-09)
• Updated input 'nixpkgs-master':
    'github:NixOS/nixpkgs/b29d970aa1216b84d794d41c734e33646e074c08?narHash=sha256-7Oicb60A4oNTvfz2mLeR2k%2B5/jgS/xDmL%2BNi2td1peQ%3D' (2025-08-10)
  → 'github:NixOS/nixpkgs/de0c5475c4299ab3f15456fcbe232ebf11565ccd?narHash=sha256-vyyKZ9/iaVldKKR%2BYlg8draCirwMydUz6KXA3eX/MEY%3D' (2025-08-12)
• Updated input 'nixpkgs-unstable':
    'github:NixOS/nixpkgs/c2ae88e026f9525daf89587f3cbee584b92b6134?narHash=sha256-erbiH2agUTD0Z30xcVSFcDHzkRvkRXOQ3lb887bcVrs%3D' (2025-08-06)
  → 'github:NixOS/nixpkgs/85dbfc7aaf52ecb755f87e577ddbe6dbbdbc1054?narHash=sha256-iAcj9T/Y%2B3DBy2J0N%2ByF9XQQQ8IEb5swLFzs23CdP88%3D' (2025-08-09)
• Updated input 'stylix':
    'github:danth/stylix/312dec38b2231b21f36903d1bdce96daa11548ff?narHash=sha256-AzAYdZlat002vCjCKWdFpGi2xUaiOU4DtIPnv1nomD8%3D' (2025-08-07)
  → 'github:danth/stylix/61ffae2453d00cb63a133b750232804b209db4d1?narHash=sha256-M%2BCDFvZ4ZuKK3mlbxv%2B37yAwL6X3tIklYgurqbhO7Q4%3D' (2025-08-10)

.envrc

@@ -1,5 +0,0 @@
-if has lorri; then
-  eval "$(lorri direnv)"
-else
-  use nix
-fi

.github/workflows/cachix.yml

@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
-    - uses: cachix/install-nix-action@v30
+    - uses: cachix/install-nix-action@v31
       with:
         nix_path: nixpkgs=channel:nixos-unstable
-    - uses: cachix/cachix-action@v15
+    - uses: cachix/cachix-action@v16
       with:
         name: davegallant
         authToken: '${{ secrets.CACHIX_API_KEY }}'

.gitignore

@@ -1,4 +1,3 @@
 .pre-commit-config.yaml
 .vscode
-git-crypt-key
 result

README.md

@@ -1,17 +1,17 @@
 # nix-config
 
-This repo stores nix to manage my machines running [NixOS](https://nixos.org/) and macOS.
+This repo stores nix configuration to manage my hosts running [NixOS](https://nixos.org/) and macOS.
 
 The configuration is very specific to my own machines and setup, but it may be a useful reference for anyone else learning or experimenting with nix, whether it be on a personal workstation or a server environment.
 
-## Setup
+## Prerequisites
 
-> on macOS: install the latest unstable nix from https://github.com/numtide/nix-unstable-installer (for nix flakes),
+- [Determinate Nix](https://determinate.systems/nix-installer)
-> and nix-darwin: https://github.com/LnL7/nix-darwin
+- [just](https://github.com/casey/just)
 
-Recipes are stored in a justfile. [just](https://github.com/casey/just) is required.
+## Build
 
-To run a rebuild:
+To run a build/rebuild:
 
 ```sh
 just rebuild
@@ -45,4 +45,4 @@ just clean
 
 ## Pre-commit hooks
 
-Pre-commit hooks are automatically activated when [direnv](https://github.com/direnv/direnv) is installed.
+Run `nix develop` to install the pre-commit hooks.

common-packages.nix

@@ -1,13 +1,8 @@
 {
-  config,
-  lib,
   pkgs,
   unstable,
   ...
 }:
-let
-  inherit (pkgs) stdenv;
-in
 {
   environment.systemPackages = with pkgs; [
     # essentials
@@ -21,37 +16,30 @@ in
     zip
 
     # modern cli
+    atuin
     bat
     cd-fzf
     doggo
     eza
     fd
+    github-cli
     hadolint
-    nodePackages.eslint
-    oha
     pre-commit
     progress
     ripgrep
     shellcheck
     shfmt
-    tldr
-    atuin
-
-    github-cli
     viddy
     yq-go
 
     # containers
-    krew
+    unstable.k9s
-    kubecolor
+    unstable.krew
-    kubectl
+    unstable.kubecolor
-    kubectx
+    unstable.kubectl
-    minikube
+    unstable.kubectx
-    stern
+    unstable.kubernetes-helm
-    dive
+    unstable.stern
-    helm-docs
-    k9s
-    kubernetes-helm
 
     # cloud
     awscli2
@@ -60,12 +48,12 @@ in
 
     # lsp
     nodePackages.bash-language-server
+    nodePackages.eslint
     nodePackages.yaml-language-server
     terraform-ls
 
     # monitoring
-    htop
+    btop
-    procs
 
     # golang
     gofumpt
@@ -88,7 +76,6 @@ in
     openssl
     openvpn
     tcpdump
-    vpngate
 
     # rice
     fastfetch
@@ -100,10 +87,16 @@ in
 
     # python
     poetry
-    python313
+    (unstable.python3.withPackages (ps: [
+      ps.llm
+      ps.llm-ollama
+    ]))
     virtualenv
 
     # media
     yt-dlp
+
+    # llm
+    llm
   ];
 }

default.nix

@@ -1,13 +0,0 @@
-let
-  nix-pre-commit-hooks = import (
-    builtins.fetchTarball "https://github.com/cachix/git-hooks.nix/tarball/master"
-  );
-in
-{
-  pre-commit-check = nix-pre-commit-hooks.run {
-    src = ./.;
-    hooks = {
-      shellcheck.enable = true;
-    };
-  };
-}

flake.lock

@@ -5,11 +5,11 @@
         "fromYaml": "fromYaml"
       },
       "locked": {
-        "lastModified": 1732200724,
+        "lastModified": 1746562888,
-        "narHash": "sha256-+R1BH5wHhfnycySb7Sy5KbYEaTJZWm1h+LW1OtyhiTs=",
+        "narHash": "sha256-YgNJQyB5dQiwavdDFBMNKk1wyS77AtdgDk/VtU6wEaI=",
         "owner": "SenchoPens",
         "repo": "base16.nix",
-        "rev": "153d52373b0fb2d343592871009a286ec8837aec",
+        "rev": "806a1777a5db2a1ef9d5d6f493ef2381047f2b89",
         "type": "github"
       },
       "original": {
@@ -37,11 +37,11 @@
     "base16-helix": {
       "flake": false,
       "locked": {
-        "lastModified": 1736852337,
+        "lastModified": 1748408240,
-        "narHash": "sha256-esD42YdgLlEh7koBrSqcT7p2fsMctPAcGl/+2sYJa2o=",
+        "narHash": "sha256-9M2b1rMyMzJK0eusea0x3lyh3mu5nMeEDSc4RZkGm+g=",
         "owner": "tinted-theming",
         "repo": "base16-helix",
-        "rev": "03860521c40b0b9c04818f2218d9cc9efc21e7a5",
+        "rev": "6c711ab1a9db6f51e2f6887cc3345530b33e152e",
         "type": "github"
       },
       "original": {
@@ -74,49 +74,89 @@
         ]
       },
       "locked": {
-        "lastModified": 1739553546,
+        "lastModified": 1749744770,
-        "narHash": "sha256-L4ou3xfOr17EAe836djRoQ7auVkYOREMtiQa82wVGqU=",
+        "narHash": "sha256-MEM9XXHgBF/Cyv1RES1t6gqAX7/tvayBC1r/KPyK1ls=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "353846417f985e74fdc060555f17939e4472ea2c",
+        "rev": "536f951efb1ccda9b968e3c9dee39fbeb6d3fdeb",
         "type": "github"
       },
       "original": {
         "owner": "lnl7",
-        "ref": "nix-darwin-24.11",
+        "ref": "nix-darwin-25.05",
         "repo": "nix-darwin",
         "type": "github"
       }
     },
-    "devshell": {
+    "determinate": {
       "inputs": {
-        "nixpkgs": [
+        "determinate-nixd-aarch64-darwin": "determinate-nixd-aarch64-darwin",
-          "nixvim",
+        "determinate-nixd-aarch64-linux": "determinate-nixd-aarch64-linux",
-          "nixpkgs"
+        "determinate-nixd-x86_64-darwin": [
-        ]
+          "determinate",
+          "determinate-nixd-aarch64-darwin"
+        ],
+        "determinate-nixd-x86_64-linux": "determinate-nixd-x86_64-linux",
+        "nix": "nix",
+        "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1735644329,
+        "lastModified": 1754347137,
-        "narHash": "sha256-tO3HrHriyLvipc4xr+Ewtdlo7wM1OjXNjlWRgmM7peY=",
+        "narHash": "sha256-IxwxFY1vD3K1lNi7zKb3O31K/gjB0QRs5G+66R5uKXc=",
-        "owner": "numtide",
+        "rev": "7afeca4a33051c0b132d42ffef66c1cfb10291e0",
-        "repo": "devshell",
+        "revCount": 265,
-        "rev": "f7795ede5b02664b57035b3b757876703e2c3eac",
+        "type": "tarball",
-        "type": "github"
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.8.5/01987740-2f8d-724e-be76-f9fdc4169391/source.tar.gz"
       },
       "original": {
-        "owner": "numtide",
+        "type": "tarball",
-        "repo": "devshell",
+        "url": "https://flakehub.com/f/DeterminateSystems/determinate/%2A"
-        "type": "github"
+      }
+    },
+    "determinate-nixd-aarch64-darwin": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-qZLIbSP6ic9/ozzFP0QqSk5CcQdbQ4iJHuCd03wV4i8=",
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.8.5/macOS"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.8.5/macOS"
+      }
+    },
+    "determinate-nixd-aarch64-linux": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-QK06CsX8jhocJlUmv+LGJL+67OqkaFutt4kyU9VYshE=",
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.8.5/aarch64-linux"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.8.5/aarch64-linux"
+      }
+    },
+    "determinate-nixd-x86_64-linux": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-WewOOmK0rZ7yDBaA1xie1wHYTMkB96scY4Fjt6MPxfQ=",
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.8.5/x86_64-linux"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.8.5/x86_64-linux"
       }
     },
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1739223196,
+        "lastModified": 1748383148,
-        "narHash": "sha256-vAxN2f3rvl5q62gQQjZGVSvF93nAsOxntuFz+e/655w=",
+        "narHash": "sha256-pGvD/RGuuPf/4oogsfeRaeMm6ipUIznI2QSILKjKzeA=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "a89108e6272426f4eddd93ba17d0ea101c34fb21",
+        "rev": "4eb2714fbed2b80e234312611a947d6cb7d70caf",
         "type": "github"
       },
       "original": {
@@ -126,27 +166,29 @@
       }
     },
     "flake-compat": {
+      "flake": false,
       "locked": {
-        "lastModified": 1733328505,
+        "lastModified": 1696426674,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "owner": "edolstra",
-        "revCount": 69,
+        "repo": "flake-compat",
-        "type": "tarball",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
-        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.1.0/01948eb7-9cba-704f-bbf3-3fa956735b52/source.tar.gz"
+        "type": "github"
       },
       "original": {
-        "type": "tarball",
+        "owner": "edolstra",
-        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
+        "repo": "flake-compat",
+        "type": "github"
       }
     },
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1733328505,
+        "lastModified": 1747046372,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
         "type": "github"
       },
       "original": {
@@ -156,6 +198,27 @@
       }
     },
     "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "determinate",
+          "nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1748821116,
+        "narHash": "sha256-F82+gS044J1APL0n4hH50GYdPRv/5JWm34oCJYmVKdE=",
+        "rev": "49f0870db23e8c1ca0b5259734a02cd9e1e371a1",
+        "revCount": 377,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/hercules-ci/flake-parts/0.1.377%2Brev-49f0870db23e8c1ca0b5259734a02cd9e1e371a1/01972f28-554a-73f8-91f4-d488cc502f08/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/hercules-ci/flake-parts/0.1"
+      }
+    },
+    "flake-parts_2": {
       "inputs": {
         "nixpkgs-lib": [
           "nixvim",
@@ -163,11 +226,32 @@
         ]
       },
       "locked": {
-        "lastModified": 1738453229,
+        "lastModified": 1754091436,
-        "narHash": "sha256-7H9XgNiGLKN1G1CgRh0vUL4AheZSYzPm+zmZ7vxbJdo=",
+        "narHash": "sha256-XKqDMN1/Qj1DKivQvscI4vmHfDfvYR2pfuFOJiCeewM=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "32ea77a06711b758da0ad9bd6a844c5740a87abd",
+        "rev": "67df8c627c2c39c41dbec76a1f201929929ab0bd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "stylix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1749398372,
+        "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
         "type": "github"
       },
       "original": {
@@ -196,10 +280,7 @@
     },
     "flake-utils_2": {
       "inputs": {
-        "systems": [
+        "systems": "systems_4"
-          "stylix",
-          "systems"
-        ]
       },
       "locked": {
         "lastModified": 1731533236,
@@ -231,85 +312,36 @@
         "type": "github"
       }
     },
-    "git-hooks": {
+    "git-hooks-nix": {
       "inputs": {
-        "flake-compat": [
+        "flake-compat": "flake-compat",
-          "nixvim",
+        "gitignore": [
-          "flake-compat"
+          "determinate",
+          "nix"
         ],
-        "gitignore": "gitignore",
         "nixpkgs": [
-          "nixvim",
+          "determinate",
+          "nix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1737465171,
+        "lastModified": 1747372754,
-        "narHash": "sha256-R10v2hoJRLq8jcL4syVFag7nIGE7m13qO48wRIukWNg=",
+        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
-        "owner": "cachix",
+        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
-        "repo": "git-hooks.nix",
+        "revCount": 1026,
-        "rev": "9364dc02281ce2d37a1f55b6e51f7c0f65a75f17",
+        "type": "tarball",
-        "type": "github"
+        "url": "https://api.flakehub.com/f/pinned/cachix/git-hooks.nix/0.1.1026%2Brev-80479b6ec16fefd9c1db3ea13aeb038c60530f46/0196d79a-1b35-7b8e-a021-c894fb62163d/source.tar.gz"
       },
       "original": {
-        "owner": "cachix",
+        "type": "tarball",
-        "repo": "git-hooks.nix",
+        "url": "https://flakehub.com/f/cachix/git-hooks.nix/0.1.941"
-        "type": "github"
-      }
-    },
-    "git-hooks_2": {
-      "inputs": {
-        "flake-compat": [
-          "stylix",
-          "flake-compat"
-        ],
-        "gitignore": "gitignore_2",
-        "nixpkgs": [
-          "stylix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1737465171,
-        "narHash": "sha256-R10v2hoJRLq8jcL4syVFag7nIGE7m13qO48wRIukWNg=",
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
-        "rev": "9364dc02281ce2d37a1f55b6e51f7c0f65a75f17",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "git-hooks.nix",
-        "type": "github"
       }
     },
     "gitignore": {
       "inputs": {
         "nixpkgs": [
-          "nixvim",
+          "pre-commit-hooks",
-          "git-hooks",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1709087332,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "type": "github"
-      }
-    },
-    "gitignore_2": {
-      "inputs": {
-        "nixpkgs": [
-          "stylix",
-          "git-hooks",
           "nixpkgs"
         ]
       },
@@ -330,81 +362,35 @@
     "gnome-shell": {
       "flake": false,
       "locked": {
-        "lastModified": 1732369855,
+        "lastModified": 1744584021,
-        "narHash": "sha256-JhUWbcYPjHO3Xs3x9/Z9RuqXbcp5yhPluGjwsdE2GMg=",
+        "narHash": "sha256-0RJ4mJzf+klKF4Fuoc8VN8dpQQtZnKksFmR2jhWE1Ew=",
         "owner": "GNOME",
         "repo": "gnome-shell",
-        "rev": "dadd58f630eeea41d645ee225a63f719390829dc",
+        "rev": "52c517c8f6c199a1d6f5118fae500ef69ea845ae",
         "type": "github"
       },
       "original": {
         "owner": "GNOME",
-        "ref": "47.2",
+        "ref": "48.1",
         "repo": "gnome-shell",
         "type": "github"
       }
     },
     "home-manager": {
       "inputs": {
-        "nixpkgs": [
+        "nixpkgs": "nixpkgs_3"
-          "nixpkgs"
-        ]
       },
       "locked": {
-        "lastModified": 1739757849,
+        "lastModified": 1753592768,
-        "narHash": "sha256-Gs076ot1YuAAsYVcyidLKUMIc4ooOaRGO0PqTY7sBzA=",
+        "narHash": "sha256-oV695RvbAE4+R9pcsT9shmp6zE/+IZe6evHWX63f2Qg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "9d3d080aec2a35e05a15cedd281c2384767c2cfe",
+        "rev": "fc3add429f21450359369af74c2375cb34a2d204",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-24.11",
+        "ref": "release-25.05",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
-    "home-manager_2": {
-      "inputs": {
-        "nixpkgs": [
-          "nixvim",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1739757849,
-        "narHash": "sha256-Gs076ot1YuAAsYVcyidLKUMIc4ooOaRGO0PqTY7sBzA=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "9d3d080aec2a35e05a15cedd281c2384767c2cfe",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "release-24.11",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
-    "home-manager_3": {
-      "inputs": {
-        "nixpkgs": [
-          "stylix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1739757849,
-        "narHash": "sha256-Gs076ot1YuAAsYVcyidLKUMIc4ooOaRGO0PqTY7sBzA=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "9d3d080aec2a35e05a15cedd281c2384767c2cfe",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "release-24.11",
         "repo": "home-manager",
         "type": "github"
       }
@@ -423,65 +409,78 @@
         ]
       },
       "locked": {
-        "lastModified": 1729958008,
+        "lastModified": 1748294338,
-        "narHash": "sha256-EiOq8jF4Z/zQe0QYVc3+qSKxRK//CFHMB84aYrYGwEs=",
+        "narHash": "sha256-FVO01jdmUNArzBS7NmaktLdGA5qA3lUMJ4B7a05Iynw=",
         "owner": "NuschtOS",
         "repo": "ixx",
-        "rev": "9fd01aad037f345350eab2cd45e1946cc66da4eb",
+        "rev": "cc5f390f7caf265461d4aab37e98d2292ebbdb85",
         "type": "github"
       },
       "original": {
         "owner": "NuschtOS",
-        "ref": "v0.0.6",
+        "ref": "v0.0.8",
         "repo": "ixx",
         "type": "github"
       }
     },
-    "nix-darwin": {
+    "nix": {
       "inputs": {
-        "nixpkgs": [
+        "flake-parts": "flake-parts",
-          "nixvim",
+        "git-hooks-nix": "git-hooks-nix",
-          "nixpkgs"
+        "nixpkgs": "nixpkgs",
-        ]
+        "nixpkgs-23-11": "nixpkgs-23-11",
+        "nixpkgs-regression": "nixpkgs-regression"
       },
       "locked": {
-        "lastModified": 1739553546,
+        "lastModified": 1754344628,
-        "narHash": "sha256-L4ou3xfOr17EAe836djRoQ7auVkYOREMtiQa82wVGqU=",
+        "narHash": "sha256-xVsqhMfsQzjf4XDO/GHVyk/D760uqlnOQ1NZ8Iyvpr0=",
-        "owner": "lnl7",
+        "rev": "55219f9b36914a19b45a7989ad664f3fd8dfbc35",
-        "repo": "nix-darwin",
+        "revCount": 21608,
-        "rev": "353846417f985e74fdc060555f17939e4472ea2c",
+        "type": "tarball",
-        "type": "github"
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.8.5/0198772e-696e-72c6-9382-7ad2a9198f03/source.tar.gz"
       },
       "original": {
-        "owner": "lnl7",
+        "type": "tarball",
-        "ref": "nix-darwin-24.11",
+        "url": "https://flakehub.com/f/DeterminateSystems/nix-src/%2A"
-        "repo": "nix-darwin",
-        "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1740603184,
+        "lastModified": 1747179050,
-        "narHash": "sha256-t+VaahjQAWyA+Ctn2idyo1yxRIYpaDxMgHkgCNiMJa4=",
+        "narHash": "sha256-qhFMmDkeJX9KJwr5H32f1r7Prs7XbQWtO0h3V0a0rFY=",
+        "rev": "adaa24fbf46737f3f1b5497bf64bae750f82942e",
+        "revCount": 799423,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.799423%2Brev-adaa24fbf46737f3f1b5497bf64bae750f82942e/0196d1c3-1974-7bf1-bcf6-06620ac40c8c/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/NixOS/nixpkgs/%3D0.1.799423"
+      }
+    },
+    "nixpkgs-23-11": {
+      "locked": {
+        "lastModified": 1717159533,
+        "narHash": "sha256-oamiKNfr2MS6yH64rUn99mIZjc45nGJlj9eGth/3Xuw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f44bd8ca21e026135061a0a57dcf3d0775b67a49",
+        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.11",
         "repo": "nixpkgs",
+        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
         "type": "github"
       }
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1740796638,
+        "lastModified": 1754962191,
-        "narHash": "sha256-pl/9E/1vgwRg5FUVxDd+1FW16txvTj4N6n1wt81tZyo=",
+        "narHash": "sha256-vyyKZ9/iaVldKKR+Ylg8draCirwMydUz6KXA3eX/MEY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "96011017f75e788f4bf532c49a4010ec79d53d01",
+        "rev": "de0c5475c4299ab3f15456fcbe232ebf11565ccd",
         "type": "github"
       },
       "original": {
@@ -491,13 +490,91 @@
         "type": "github"
       }
     },
-    "nixpkgs-unstable": {
+    "nixpkgs-regression": {
       "locked": {
-        "lastModified": 1740547748,
+        "lastModified": 1643052045,
-        "narHash": "sha256-Ly2fBL1LscV+KyCqPRufUBuiw+zmWrlJzpWOWbahplg=",
+        "narHash": "sha256-uGJ0VXIhWKGXxkeNnq4TvV3CIOkUJ3PAoLZ3HMzNVMw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3a05eebede89661660945da1f151959900903b6a",
+        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
+        "type": "github"
+      }
+    },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1754725699,
+        "narHash": "sha256-iAcj9T/Y+3DBy2J0N+yF9XQQQ8IEb5swLFzs23CdP88=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "85dbfc7aaf52ecb755f87e577ddbe6dbbdbc1054",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1753722563,
+        "narHash": "sha256-FK8iq76wlacriq3u0kFCehsRYTAqjA9nfprpiSWRWIc=",
+        "rev": "648f70160c03151bc2121d179291337ad6bc564b",
+        "revCount": 836323,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.836323%2Brev-648f70160c03151bc2121d179291337ad6bc564b/019854b4-edf3-7ab3-ba79-b30d6017d043/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/DeterminateSystems/nixpkgs-weekly/0.1"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1753345091,
+        "narHash": "sha256-CdX2Rtvp5I8HGu9swBmYuq+ILwRxpXdJwlpg8jvN4tU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "3ff0e34b1383648053bba8ed03f201d3466f90c9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1754767907,
+        "narHash": "sha256-8OnUzRQZkqtUol9vuUuQC30hzpMreKptNyET2T9lB6g=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "c5f08b62ed75415439d48152c2a784e36909b1bc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1754340878,
+        "narHash": "sha256-lgmUyVQL9tSnvvIvBp7x1euhkkCho7n3TMzgjdvgPoU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "cab778239e705082fe97bb4990e0d24c50924c04",
         "type": "github"
       },
       "original": {
@@ -507,51 +584,88 @@
         "type": "github"
       }
     },
-    "nixpkgs_2": {
+    "nixpkgs_6": {
       "locked": {
-        "lastModified": 1740339700,
+        "lastModified": 1751211869,
-        "narHash": "sha256-cbrw7EgQhcdFnu6iS3vane53bEagZQy/xyIkDWpCgVE=",
+        "narHash": "sha256-1Cu92i1KSPbhPCKxoiVG5qnoRiKTgR5CcGSRyLpOd7Y=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "04ef94c4c1582fd485bbfdb8c4a8ba250e359195",
+        "rev": "b43c397f6c213918d6cfe6e3550abfe79b5d1c51",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.11",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_7": {
+      "locked": {
+        "lastModified": 1743814133,
+        "narHash": "sha256-drDyYyUmjeYGiHmwB9eOPTQRjmrq3Yz26knwmMPLZFk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "250b695f41e0e2f5afbf15c6b12480de1fe0001b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixvim": {
       "inputs": {
-        "devshell": "devshell",
+        "flake-parts": "flake-parts_2",
-        "flake-compat": "flake-compat",
-        "flake-parts": "flake-parts",
-        "git-hooks": "git-hooks",
-        "home-manager": "home-manager_2",
-        "nix-darwin": "nix-darwin",
         "nixpkgs": [
           "nixpkgs"
         ],
         "nuschtosSearch": "nuschtosSearch",
-        "treefmt-nix": "treefmt-nix"
+        "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1740416728,
+        "lastModified": 1754262585,
-        "narHash": "sha256-RNT0py9/iF8JIBYLaMAL0H52wt2TIyc0uLmyz7tmfkc=",
+        "narHash": "sha256-Yz5dJ0VzGRzSRHdHldsWQbuFYmtP3NWNreCvPfCi9CI=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "92a97c5e4170b1509dc598fc2d63160eb48095c7",
+        "rev": "ab1b5962e1ca90b42de47e1172e0d24ca80e6256",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "nixos-24.11",
+        "ref": "nixos-25.05",
         "repo": "nixvim",
         "type": "github"
       }
     },
+    "nur": {
+      "inputs": {
+        "flake-parts": [
+          "stylix",
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "stylix",
+          "nixpkgs"
+        ],
+        "treefmt-nix": "treefmt-nix"
+      },
+      "locked": {
+        "lastModified": 1751320053,
+        "narHash": "sha256-3m6RMw0FbbaUUa01PNaMLoO7D99aBClmY5ed9V3vz+0=",
+        "owner": "nix-community",
+        "repo": "NUR",
+        "rev": "cbde1735782f9c2bb2c63d5e05fba171a14a4670",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "NUR",
+        "type": "github"
+      }
+    },
     "nuschtosSearch": {
       "inputs": {
         "flake-utils": "flake-utils",
@@ -562,11 +676,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1739738736,
+        "lastModified": 1753771532,
-        "narHash": "sha256-Rl4Fw+3PsLTEzzUGlB8kePaiIersDbv5voAif3D6LoM=",
+        "narHash": "sha256-Pmpke0JtLRzgdlwDC5a+aiLVZ11JPUO5Bcqkj0nHE/k=",
         "owner": "NuschtOS",
         "repo": "search",
-        "rev": "9ff62c8e1fbe5dc649dee680c7eb4935936c8ac3",
+        "rev": "2a65adaf2c0c428efb0f4a2bc406aab466e96a06",
         "type": "github"
       },
       "original": {
@@ -575,15 +689,38 @@
         "type": "github"
       }
     },
+    "pre-commit-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "gitignore": "gitignore",
+        "nixpkgs": "nixpkgs_5"
+      },
+      "locked": {
+        "lastModified": 1754416808,
+        "narHash": "sha256-c6yg0EQ9xVESx6HGDOCMcyRSjaTpNJP10ef+6fRcofA=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "9c52372878df6911f9afc1e2a1391f55e4dfc864",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "darwin": "darwin",
+        "determinate": "determinate",
         "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_4",
         "nixpkgs-master": "nixpkgs-master",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "nixvim": "nixvim",
-        "stylix": "stylix"
+        "pre-commit-hooks": "pre-commit-hooks",
+        "stylix": "stylix",
+        "vpngate": "vpngate"
       }
     },
     "stylix": {
@@ -593,28 +730,28 @@
         "base16-helix": "base16-helix",
         "base16-vim": "base16-vim",
         "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-compat": "flake-compat_2",
+        "flake-parts": "flake-parts_3",
-        "flake-utils": "flake-utils_2",
-        "git-hooks": "git-hooks_2",
         "gnome-shell": "gnome-shell",
-        "home-manager": "home-manager_3",
+        "nixpkgs": "nixpkgs_6",
-        "nixpkgs": "nixpkgs_2",
+        "nur": "nur",
-        "systems": "systems_2",
+        "systems": "systems_3",
         "tinted-foot": "tinted-foot",
         "tinted-kitty": "tinted-kitty",
-        "tinted-tmux": "tinted-tmux"
+        "tinted-schemes": "tinted-schemes",
+        "tinted-tmux": "tinted-tmux",
+        "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1740520580,
+        "lastModified": 1754852587,
-        "narHash": "sha256-QRlcA8rtfNdyKpBE+ptjiB9717Tzum4/sKBSbsyqL6k=",
+        "narHash": "sha256-M+CDFvZ4ZuKK3mlbxv+37yAwL6X3tIklYgurqbhO7Q4=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "aaa2eb8956770c096f9c46fb163bb26602e20e56",
+        "rev": "61ffae2453d00cb63a133b750232804b209db4d1",
         "type": "github"
       },
       "original": {
         "owner": "danth",
-        "ref": "release-24.11",
+        "ref": "release-25.05",
         "repo": "stylix",
         "type": "github"
       }
@@ -649,6 +786,36 @@
         "type": "github"
       }
     },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "tinted-foot": {
       "flake": false,
       "locked": {
@@ -669,28 +836,43 @@
     "tinted-kitty": {
       "flake": false,
       "locked": {
-        "lastModified": 1716423189,
+        "lastModified": 1735730497,
-        "narHash": "sha256-2xF3sH7UIwegn+2gKzMpFi3pk5DlIlM18+vj17Uf82U=",
+        "narHash": "sha256-4KtB+FiUzIeK/4aHCKce3V9HwRvYaxX+F1edUrfgzb8=",
         "owner": "tinted-theming",
         "repo": "tinted-kitty",
-        "rev": "eb39e141db14baef052893285df9f266df041ff8",
+        "rev": "de6f888497f2c6b2279361bfc790f164bfd0f3fa",
         "type": "github"
       },
       "original": {
         "owner": "tinted-theming",
         "repo": "tinted-kitty",
-        "rev": "eb39e141db14baef052893285df9f266df041ff8",
+        "type": "github"
+      }
+    },
+    "tinted-schemes": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1750770351,
+        "narHash": "sha256-LI+BnRoFNRa2ffbe3dcuIRYAUcGklBx0+EcFxlHj0SY=",
+        "owner": "tinted-theming",
+        "repo": "schemes",
+        "rev": "5a775c6ffd6e6125947b393872cde95867d85a2a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "schemes",
         "type": "github"
       }
     },
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1740272597,
+        "lastModified": 1751159871,
-        "narHash": "sha256-/etfUV3HzAaLW3RSJVwUaW8ULbMn3v6wbTlXSKbcoWQ=",
+        "narHash": "sha256-UOHBN1fgHIEzvPmdNMHaDvdRMgLmEJh2hNmDrp3d3LE=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "b6c7f46c8718cc484f2db8b485b06e2a98304cd0",
+        "rev": "bded5e24407cec9d01bd47a317d15b9223a1546c",
         "type": "github"
       },
       "original": {
@@ -699,19 +881,36 @@
         "type": "github"
       }
     },
+    "tinted-zed": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1751158968,
+        "narHash": "sha256-ksOyv7D3SRRtebpXxgpG4TK8gZSKFc4TIZpR+C98jX8=",
+        "owner": "tinted-theming",
+        "repo": "base16-zed",
+        "rev": "86a470d94204f7652b906ab0d378e4231a5b3384",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-zed",
+        "type": "github"
+      }
+    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
-          "nixvim",
+          "stylix",
+          "nur",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1739829690,
+        "lastModified": 1733222881,
-        "narHash": "sha256-mL1szCeIsjh6Khn3nH2cYtwO5YXG6gBiTw1A30iGeDU=",
+        "narHash": "sha256-JIPcz1PrpXUCbaccEnrcUS8jjEb/1vJbZz5KkobyFdM=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "3d0579f5cc93436052d94b73925b48973a104204",
+        "rev": "49717b5af6f80172275d47a418c9719a31a78b53",
         "type": "github"
       },
       "original": {
@@ -719,6 +918,25 @@
         "repo": "treefmt-nix",
         "type": "github"
       }
+    },
+    "vpngate": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": "nixpkgs_7"
+      },
+      "locked": {
+        "lastModified": 1753748785,
+        "narHash": "sha256-IPdoF8KSFbAKp9gpTWi9qQv5+9qPjGDVPZKawIE0H+8=",
+        "owner": "davegallant",
+        "repo": "vpngate",
+        "rev": "0167804252a2297c1f81b5cbf1fbb772d26d3e1f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "davegallant",
+        "repo": "vpngate",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -2,35 +2,62 @@
   description = "nixos and macos configurations";
 
   inputs = {
-    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    determinate.url = "https://flakehub.com/f/DeterminateSystems/determinate/*";
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
     nixpkgs-master.url = "github:NixOS/nixpkgs/master";
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+    pre-commit-hooks.url = "github:cachix/git-hooks.nix";
     darwin = {
-      url = "github:lnl7/nix-darwin/nix-darwin-24.11";
+      url = "github:lnl7/nix-darwin/nix-darwin-25.05";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    home-manager = {
-      url = "github:nix-community/home-manager/release-24.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    home-manager.url = "github:nix-community/home-manager/release-25.05";
     nixvim = {
-      url = "github:nix-community/nixvim/nixos-24.11";
+      url = "github:nix-community/nixvim/nixos-25.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    stylix.url = "github:danth/stylix/release-24.11";
+    stylix.url = "github:danth/stylix/release-25.05";
+    vpngate.url = "github:davegallant/vpngate";
   };
 
   outputs =
     {
+      self,
       darwin,
+      determinate,
       home-manager,
       nixpkgs,
       nixpkgs-unstable,
       nixpkgs-master,
       stylix,
+      vpngate,
       ...
     }@inputs:
+    let
+      supportedSystems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+
+      forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
+    in
     {
+      checks = forAllSystems (system: {
+        pre-commit-check = inputs.pre-commit-hooks.lib.${system}.run {
+          src = ./.;
+          hooks = {
+            nixfmt-rfc-style.enable = true;
+          };
+        };
+      });
+      devShells = forAllSystems (system: {
+        default = nixpkgs.legacyPackages.${system}.mkShell {
+          inherit (self.checks.${system}.pre-commit-check) shellHook;
+          buildInputs = self.checks.${system}.pre-commit-check.enabledPackages;
+        };
+      });
       nixosConfigurations =
         let
           unstable = import nixpkgs-unstable {
@@ -47,13 +74,13 @@
             specialArgs = {
               inherit unstable;
               inherit master;
+              inherit vpngate;
             };
             modules = [
-              ./fonts.nix
+              ./hosts/hephaestus.nix
-              ./machines/hephaestus/configuration.nix
+              ./common-packages.nix
-              ./packages.nix
-              ./services/netdata/default.nix
               ./upgrade-diff.nix
+              determinate.nixosModules.default
               home-manager.nixosModules.home-manager
               stylix.nixosModules.stylix
               (
@@ -67,9 +94,10 @@
                         substituters = [ "https://davegallant.cachix.org" ];
                         trusted-users = [
                           "root"
-                          "dave"
                         ];
-                        trusted-public-keys = [ "davegallant.cachix.org-1:SsUMqL4+tF2R3/G6X903E9laLlY1rES2QKFfePegF08=" ];
+                        trusted-public-keys = [
+                          "davegallant.cachix.org-1:SsUMqL4+tF2R3/G6X903E9laLlY1rES2QKFfePegF08="
+                        ];
                       };
                       registry = {
                         nixpkgs.flake = nixpkgs;
@@ -87,7 +115,7 @@
                       useGlobalPkgs = true;
                       useUserPackages = true;
                       users.dave.imports = [
-                        ./home/default.nix
+                        ./home.nix
                         inputs.nixvim.homeManagerModules.nixvim
                       ];
                       extraSpecialArgs = {
@@ -125,8 +153,8 @@
             modules = [
               home-manager.darwinModules.home-manager
               stylix.darwinModules.stylix
-              ./machines/zelus/configuration.nix
+              ./hosts/zelus.nix
-              ./packages.nix
+              ./common-packages.nix
               ./upgrade-diff.nix
 
               (
@@ -138,7 +166,7 @@
                       useGlobalPkgs = true;
                       useUserPackages = true;
                       users."dave.gallant".imports = [
-                        ./home/default.nix
+                        ./home.nix
                         inputs.nixvim.homeManagerModules.nixvim
                       ];
                       extraSpecialArgs = {

fonts.nix

@@ -1,24 +0,0 @@
-{ pkgs, ... }:
-{
-  fonts.packages = with pkgs; [
-    dejavu_fonts
-    fira-code
-    fira-code-symbols
-    fira-mono
-    font-awesome
-    google-fonts
-    liberation_ttf
-    nerdfonts
-    noto-fonts
-    noto-fonts-cjk-sans
-    noto-fonts-emoji
-    noto-fonts-extra
-  ];
-
-  fonts.fontconfig.defaultFonts = {
-    sansSerif = [ "Noto Sans" ];
-    serif = [ "Noto Serif" ];
-    monospace = [ "Noto Sans Mono" ];
-    emoji = [ "Noto Color Emoji" ];
-  };
-}

home.nix

@@ -2,28 +2,19 @@
   lib,
   pkgs,
   unstable,
-  master,
   ...
 }:
 let
   inherit (pkgs) stdenv;
 in
 {
-  home.stateVersion = "24.11";
+  home.stateVersion = "25.05";
 
   home.packages = with pkgs; [ just ];
 
   stylix = {
     enable = true;
     base16Scheme = "${pkgs.base16-schemes}/share/themes/tokyo-night-dark.yaml";
-    targets = {
-      alacritty.enable = true;
-      vscode.enable = false; # overrides synced settings
-    };
-
-    opacity.terminal = 1.0;
-
-    fonts.sizes = if stdenv.isLinux then { terminal = 20; } else { terminal = 16; };
 
     fonts.monospace = {
       name = "FiraCode Nerd Font Mono";
@@ -59,12 +50,15 @@ in
 
       userName = "Dave Gallant";
 
+      diff-so-fancy.enable = true;
+
       lfs.enable = true;
 
       aliases = {
         aa = "add -A .";
         br = "branch";
         c = "commit -S";
+        cm = "commit -S -m";
         ca = "commit -S --amend";
         cane = "commit -S --amend --no-edit";
         cb = "checkout -b";
@@ -85,21 +79,6 @@ in
 
       includes = [ { path = "~/.gitconfig-work"; } ];
 
-      delta = {
-        enable = true;
-
-        options = {
-          features = "line-numbers decorations";
-          whitespace-error-style = "22 reverse";
-          plus-style = "green bold ul '#198214'";
-          decorations = {
-            commit-decoration-style = "bold yellow box ul";
-            file-style = "bold yellow ul";
-            file-decoration-style = "none";
-          };
-        };
-      };
-
       extraConfig = {
         push = {
           default = "current";
@@ -116,7 +95,6 @@ in
 
       settings = {
         add_newline = false;
-        scan_timeout = 10;
         gcloud = {
           format = "";
         };
@@ -158,7 +136,7 @@ in
         export PATH=$PATH:$GOBIN
       '';
 
-      initExtra = ''
+      initContent = ''
         setopt noincappendhistory
 
         source $HOME/.zsh-work
@@ -197,7 +175,6 @@ in
         l = "eza -la --git --group-directories-first";
         m = "make";
         nix-install = "nix-env -iA";
-        ps = "procs";
         t = "cd-fzf";
         tf = "terraform";
         tree = "eza --tree";
@@ -299,10 +276,6 @@ in
         };
         cmp.enable = true;
         nvim-tree.enable = true;
-        packer = {
-          enable = true;
-          plugins = [ ];
-        };
         rainbow-delimiters.enable = true;
         treesitter.enable = true;
         telescope = {
@@ -401,10 +374,10 @@ in
     };
 
     vscode = {
-      enable = true;
+      enable = stdenv.isLinux;
-      package = pkgs.vscode;
+      package = unstable.vscode;
-      extensions =
+      profiles.default.extensions =
-        with pkgs.vscode-extensions;
+        with unstable.vscode-extensions;
         [
           bbenoist.nix
           github.vscode-pull-request-github

hosts/hephaestus.nix

@@ -1,23 +1,18 @@
 {
   config,
   lib,
+  master,
   modulesPath,
   pkgs,
   unstable,
-  master,
+  vpngate,
   ...
 }:
 let
   gnomeExtensions = with pkgs.gnomeExtensions; [
-    appindicator
-    bluetooth-quick-connect
-    blur-my-shell
     caffeine
+    clipboard-history
     grand-theft-focus
-    notification-banner-reloaded
-    quick-settings-tweaker
-    tailscale-status
-    tray-icons-reloaded
   ];
 in
 {
@@ -35,9 +30,24 @@ in
     fonts.sizes.desktop = 24;
   };
 
+  security.sudo-rs = {
+    enable = true;
+    execWheelOnly = true;
+    wheelNeedsPassword = true;
+  };
+
   boot = {
-    kernelModules = [ "kvm-amd" ];
+    kernelModules = [
-    kernelPackages = pkgs.linuxPackages;
+      "kvm-amd"
+      "vfio_pci"
+      "vfio"
+      "vfio_iommu_type1"
+      "vfio_virqfd"
+    ];
+    kernelPackages = pkgs.linuxPackages_latest;
+    kernelParams = [
+      "amd_iommu=on"
+    ];
 
     loader = {
       efi.canTouchEfiVariables = true;
@@ -75,66 +85,51 @@ in
     };
   };
 
-  console = {
-    font = "Lat2-Terminus16";
-    keyMap = "us";
-  };
-
   environment.systemPackages =
     with pkgs;
     [
-      albert
       android-studio
       android-tools
       bleachbit
-      blender
       calibre
+      chromium
       cryptsetup
       discord
-      docker
       docker-compose
       freefilesync
-      ghostscript
       gimp-with-plugins
-      glibcLocales
-      httpie-desktop
       gnome-tweaks
       google-chrome
+      httpie-desktop
       iputils
-      kazam
       libation
-      lm_sensors
-      logseq
       mission-center
-      mitmproxy
+      mupen64plus
-      netdata
       nfs-utils
       onlyoffice-desktopeditors
       opensnitch-ui
       pavucontrol
+      pciutils
       pika-backup
       pinentry-curses
-      podman
       protonvpn-gui
       qemu
-      ryujinx
+      terminator
-      strace
       traceroute
       unityhub
-      unstable.burpsuite
+      unstable.beszel
-      unstable.dotnet-sdk_8
+      unstable.obsidian
-      unstable.ghostty
+      unstable.ryubing
-      unstable.signal-desktop
+      unstable.signal-desktop-bin
+      unstable.spotify
       unstable.tailscale
       unstable.zoom-us
-      unstable.zulip
       usbutils
       virt-manager
       vlc
-      virtiofsd
+      vpngate.packages.x86_64-linux.default
       whois
       wine
-      wireshark-qt
     ]
     ++ gnomeExtensions;
 
@@ -156,16 +151,39 @@ in
       fsType = "nfs";
     };
     "/mnt/truenas/home/backups" = {
-      device = "192.168.1.32:/mnt/wd4t/data/home/backup/";
+      device = "192.168.1.132:/mnt/wd4t/data/home/backup/";
       fsType = "nfs";
     };
   };
 
+  fonts.packages = with pkgs; [
+    dejavu_fonts
+    fira-mono
+    font-awesome
+    google-fonts
+    liberation_ttf
+    nerd-fonts.droid-sans-mono
+    nerd-fonts.fira-code
+    nerd-fonts.symbols-only
+    nerd-fonts.ubuntu
+    nerd-fonts.ubuntu-mono
+    noto-fonts
+    noto-fonts-cjk-sans
+    noto-fonts-emoji
+    noto-fonts-extra
+  ];
+
+  fonts.fontconfig.defaultFonts = {
+    sansSerif = [ "Noto Sans" ];
+    serif = [ "Noto Serif" ];
+    monospace = [ "Noto Sans Mono" ];
+    emoji = [ "Noto Color Emoji" ];
+  };
+
   nixpkgs = {
     hostPlatform = "x86_64-linux";
     config = {
       allowUnfree = true;
-      permittedInsecurePackages = [ "electron-27.3.11" ];
     };
   };
 
@@ -188,13 +206,38 @@ in
     };
   };
 
+  users.users.beszel = {
+    isSystemUser = true;
+    group = "beszel";
+    description = "Beszel Agent service user";
+  };
+  users.groups.beszel = { };
+
   systemd.services = {
     NetworkManager-wait-online.enable = false;
+
+    beszel-agent = {
+      description = "Beszel Agent Service";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Environment = [
+          "PORT=45876"
+          ''KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEaNtnkc+3+fJU+bTO6fibID9FHgFjei0sjJNqvcYtG8"''
+        ];
+        ExecStart = "${lib.getBin unstable.beszel}/bin/beszel-agent";
+        User = "beszel";
+        Restart = "always";
+        RestartSec = 5;
+      };
+    };
   };
 
   system = {
     autoUpgrade.enable = true;
-    stateVersion = "24.11";
+    stateVersion = "25.05";
   };
 
   nix = {
@@ -222,12 +265,14 @@ in
 
   time.timeZone = "America/Toronto";
 
-  hardware.graphics.enable = true;
+  hardware.graphics = {
-  hardware.graphics.extraPackages32 = with pkgs.pkgsi686Linux; [ libva ];
+    enable = true;
+    enable32Bit = true;
+  };
+
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 
   programs = {
-    corectrl.enable = true;
     gnupg.agent = {
       enable = true;
       enableSSHSupport = true;
@@ -281,21 +326,23 @@ in
   };
 
   services.ollama = {
-    package = unstable.ollama;
+    package = master.ollama;
     enable = true;
     acceleration = "rocm";
+    host = "0.0.0.0";
     environmentVariables = {
       HSA_OVERRIDE_GFX_VERSION = "11.0.2";
     };
     loadModels = [
-      "deepseek-r1:8b"
       "dolphin3:8b"
+      "llama3.1"
+      "llava"
     ];
   };
 
   services.open-webui = {
     enable = true;
-    package = unstable.open-webui;
+    package = pkgs.open-webui;
     host = "0.0.0.0";
     environment = {
       ANONYMIZED_TELEMETRY = "False";
@@ -452,7 +499,10 @@ in
 
   virtualisation = {
     docker.enable = true;
-    libvirtd.enable = true;
     podman.enable = true;
+    libvirtd = {
+      enable = true;
+      qemu.swtpm.enable = true;
+    };
   };
 }

hosts/zelus.nix

@@ -0,0 +1,137 @@
+{ pkgs, ... }:
+{
+  nixpkgs = {
+    config = {
+      allowUnfree = true;
+    };
+  };
+
+  networking = {
+    hostName = "zelus";
+  };
+
+  nix.enable = false;
+
+  programs.zsh = {
+    enable = true;
+    # https://github.com/nix-community/home-manager/issues/108#issuecomment-340397178
+    enableCompletion = false;
+  };
+
+  system.stateVersion = 4;
+
+  users.users."dave.gallant".home = "/Users/dave.gallant";
+
+  system.primaryUser = "dave.gallant";
+
+  system.defaults = {
+
+    trackpad = {
+      ActuationStrength = 0;
+      Clicking = true;
+      FirstClickThreshold = 1;
+      SecondClickThreshold = 1;
+      TrackpadRightClick = true;
+    };
+
+    dock = {
+      autohide = true;
+      tilesize = 50;
+      orientation = "bottom";
+      persistent-apps = [
+        "/Applications/iTerm.app"
+        "/Applications/Google Chrome.app"
+        "/Applications/LibreWolf.app"
+        "/Applications/Obsidian.app"
+        "/Applications/Slack.app"
+        "/Applications/Visual Studio Code.app"
+        "/Applications/zoom.us.app"
+      ];
+    };
+
+    NSGlobalDomain.AppleShowAllExtensions = true;
+    NSGlobalDomain.AppleShowScrollBars = "Always";
+    NSGlobalDomain.NSUseAnimatedFocusRing = false;
+    NSGlobalDomain.NSNavPanelExpandedStateForSaveMode = true;
+    NSGlobalDomain.NSNavPanelExpandedStateForSaveMode2 = true;
+    NSGlobalDomain.PMPrintingExpandedStateForPrint = true;
+    NSGlobalDomain.PMPrintingExpandedStateForPrint2 = true;
+    NSGlobalDomain.NSDocumentSaveNewDocumentsToCloud = false;
+    NSGlobalDomain.ApplePressAndHoldEnabled = false;
+    NSGlobalDomain.InitialKeyRepeat = 25;
+    NSGlobalDomain.KeyRepeat = 2;
+    NSGlobalDomain."com.apple.mouse.tapBehavior" = 1;
+    NSGlobalDomain.NSWindowShouldDragOnGesture = true;
+    NSGlobalDomain.NSAutomaticSpellingCorrectionEnabled = false;
+    LaunchServices.LSQuarantine = false; # disables "Are you sure?" for new apps
+    loginwindow.GuestEnabled = false;
+    finder.FXPreferredViewStyle = "Nlsv";
+  };
+
+  security.pam.services.sudo_local.touchIdAuth = true;
+
+  homebrew = {
+    enable = true;
+    onActivation = {
+      cleanup = "zap";
+      autoUpdate = true;
+      upgrade = true;
+    };
+    global = {
+      brewfile = true;
+    };
+
+    brews = [
+      "argocd"
+      "azure-cli"
+      "coreutils"
+      "gnu-sed"
+      "gnu-tar"
+      "k6"
+      "node"
+      "oras"
+      "vault"
+    ];
+
+    casks = [
+      "discord"
+      "dbeaver-community"
+      "font-fira-code-nerd-font"
+      "font-hack-nerd-font"
+      "fork"
+      "freelens"
+      "iterm2"
+      "karabiner-elements"
+      "knockknock"
+      "librewolf"
+      "lulu"
+      "notunes"
+      "obsidian"
+      "ollama"
+      "raycast"
+      "rectangle"
+      "signal"
+      "slack"
+      "spotify"
+      "stats"
+      "steam"
+      "taskexplorer"
+      "tailscale"
+      "vlc"
+    ];
+
+    taps = [
+      "hashicorp/tap"
+      "homebrew/bundle"
+      "homebrew/cask-fonts"
+      "homebrew/cask-versions"
+      "homebrew/services"
+    ];
+  };
+
+  stylix = {
+    enable = true;
+    image = "/Library/tokyo-night.jpg";
+  };
+
+}

justfile

@@ -8,7 +8,7 @@ arch := `uname -s`
 cmd := if arch == "Linux" { "nixos-rebuild --use-remote-sudo" } else { "darwin-rebuild" }
 
 rebuild:
-  $cmd switch --flake . -I nixos-config="machines/$(hostname)/configuration.nix"
+  sudo $cmd switch --flake . -I nixos-config="hosts/$(hostname).nix"
 
 rollback:
   $cmd switch --rollback --flake .
@@ -18,10 +18,10 @@ channel-update:
   sudo nix-channel --update
 
 update:
-  @./nix-flake-update.sh
+  @./update-flake.sh
 
 fmt:
-  nixfmt .
+  nixfmt *.nix
 
 clean:
   echo 'Cleaning user...'

machines/zelus/configuration.nix

@@ -1,120 +0,0 @@
-{ pkgs, ... }:
-{
-  nixpkgs = {
-    config = {
-      allowUnfree = true;
-      permittedInsecurePackages = [ ];
-    };
-  };
-
-  networking = {
-    hostName = "zelus";
-  };
-
-  services.nix-daemon.enable = true;
-
-  nix.extraOptions = "experimental-features = nix-command flakes";
-  nix.package = pkgs.nixVersions.stable;
-
-  programs.zsh = {
-    enable = true;
-    # https://github.com/nix-community/home-manager/issues/108#issuecomment-340397178
-    enableCompletion = false;
-  };
-
-  system.stateVersion = 4;
-  users.users."dave.gallant".home = "/Users/dave.gallant";
-
-  environment = {
-    variables = {
-      LANG = "en_US.UTF-8";
-    };
-  };
-
-  system.defaults = {
-
-    trackpad = {
-      ActuationStrength = 0;
-      Clicking = true;
-      FirstClickThreshold = 1;
-      SecondClickThreshold = 1;
-      TrackpadRightClick = true;
-    };
-
-    dock = {
-      autohide = true;
-      autohide-delay = 0.0;
-      autohide-time-modifier = 1.0;
-      tilesize = 50;
-      static-only = false;
-      showhidden = false;
-      show-recents = false;
-      show-process-indicators = true;
-      orientation = "bottom";
-      mru-spaces = false;
-    };
-
-    NSGlobalDomain = {
-      "com.apple.sound.beep.feedback" = 0;
-      "com.apple.sound.beep.volume" = 0.0;
-      ApplePressAndHoldEnabled = false;
-      InitialKeyRepeat = 10;
-      KeyRepeat = 2;
-      AppleShowAllExtensions = true;
-      AppleShowScrollBars = "Automatic";
-    };
-  };
-
-  homebrew = {
-    enable = true;
-    onActivation.autoUpdate = false;
-    onActivation.upgrade = false;
-    global = {
-      brewfile = true;
-    };
-
-    brews = [
-      "azure-cli"
-      "coreutils"
-      "gnu-sed"
-      "gnu-tar"
-      "netdata"
-      "node"
-      "podman"
-      "podman-compose"
-    ];
-
-    casks = [
-      "karabiner-elements"
-      "dbeaver-community"
-      "font-fira-code-nerd-font"
-      "font-hack-nerd-font"
-      "fork"
-      "iterm2"
-      "knockknock"
-      "librewolf"
-      "logseq"
-      "lulu"
-      "mitmproxy"
-      "notunes"
-      "postman"
-      "raycast"
-      "rectangle"
-      "stats"
-      "taskexplorer"
-    ];
-
-    taps = [
-      "homebrew/bundle"
-      "homebrew/cask-fonts"
-      "homebrew/cask-versions"
-      "homebrew/services"
-    ];
-  };
-
-  stylix = {
-    # enable = true;
-    image = "/Library/tokyo-night.jpg";
-  };
-
-}

overlays/default.nix

@@ -1,4 +1,3 @@
 final: prev: {
   cd-fzf = prev.callPackage ./cd-fzf { };
-  vpngate = prev.callPackage ./vpngate { };
 }

overlays/vpngate/default.nix

@@ -1,28 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  buildGoModule,
-}:
-buildGoModule rec {
-  pname = "vpngate";
-  version = "v0.3.0";
-
-  vendorHash = "sha256-4JeVXLoiXdZoQM76cHOt5i31ZZGTId0rt8RkMH62/EM=";
-
-  src = fetchFromGitHub {
-    owner = "davegallant";
-    repo = "vpngate";
-    rev = version;
-    sha256 = "sha256-P3eQvdUfjpq4a0Q2Hxby4zZ2uTSPjG1oXHxt8cW6fTQ=";
-  };
-
-  doCheck = false;
-
-  meta = with lib; {
-    homepage = "https://www.vpngate.net";
-    description = "a client for vpngate.net";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ davegallant ];
-    platforms = platforms.linux ++ platforms.darwin;
-  };
-}

services/netdata/default.nix

@@ -1,43 +0,0 @@
-{ config, pkgs, ... }:
-let
-  netdata = pkgs.netdata;
-  netdataConf = ./netdata.conf;
-  netdataDir = "/var/lib/netdata";
-in
-{
-  users.extraGroups.netdata.gid = 220008;
-  users.users.netdata.group = "netdata";
-  users.extraUsers.netdata = {
-    description = "Netdata server user";
-    isSystemUser = true;
-    name = "netdata";
-    uid = 200008;
-  };
-  systemd.services.netdata = {
-    wantedBy = [ "multi-user.target" ];
-    after = [ "network.target" ];
-    preStart = ''
-      mkdir -p ${netdataDir}/config
-      mkdir -p ${netdataDir}/logs
-      cp -r ${netdata}/share/netdata/web ${netdataDir}/web
-      chmod -R 700 ${netdataDir}
-      chown -R netdata:netdata ${netdataDir}
-    '';
-    serviceConfig = {
-      Type = "forking";
-      ExecStart = "${netdata}/bin/netdata -c ${netdataConf} -u netdata";
-      Restart = "on-failure";
-    };
-  };
-
-  services.nginx.httpConfig = ''
-    server {
-      server_name netdata.thume.net;
-      location / {
-        proxy_set_header Host $http_host;
-        proxy_redirect off;
-        proxy_pass http://127.0.0.1:19999;
-      }
-    }
-  '';
-}

services/netdata/netdata.conf

@@ -1,21 +0,0 @@
-[global]
-  run as user = netdata
-
-  config directory = /var/lib/netdata/config
-  web files directory = /var/lib/netdata/web
-  cache directory = /var/lib/netdata
-  log directory = /var/lib/netdata/logs
-
-  # the default database size - 1 hour
-  history = 3600
-
-  # some defaults to run netdata with least priority
-  process scheduling policy = idle
-  OOM score = 1000
-
-[web]
-  # web files owner = root
-  web files group = netdata
-
-  # by default do not expose the netdata port
-  bind to = localhost

shell.nix

@@ -1,13 +0,0 @@
-let
-  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/tarball/nixos-24.11";
-  pkgs = import nixpkgs {
-    config = { };
-    overlays = [ ];
-  };
-
-in
-pkgs.mkShell {
-  shellHook = ''
-    ${(import ./default.nix).pre-commit-check.shellHook}
-  '';
-}