use substituteInPlace

configs/admin-essentials.nix

@@ -85,7 +85,7 @@ in {
     '';
   in
     {
-      nixi = "nix repl '<nixpkgs>'";
+      nixi = "nix repl nixpkgs";
       take = "source ${take}";
       wcd = "source ${wcd}";
       where = "source ${where}";

configs/aerc.nix

@@ -4,9 +4,11 @@
   lib,
   niveumPackages,
   ...
-}: let
+}:
+let
   inherit (import ../lib/email.nix) defaults thunderbirdProfile;
-in {
+in
+{
   age.secrets = {
     email-password-ical-ephemeris = {
       file = ../secrets/email-password-ical-ephemeris.age;
@@ -50,7 +52,8 @@ in {
 
     programs.mbsync = {
       enable = true;
-      extraConfig = lib.concatStringsSep "\n\n" (lib.mapAttrsToList (name: account: ''
+      extraConfig = lib.concatStringsSep "\n\n" (
+        lib.mapAttrsToList (name: account: ''
           IMAPAccount ${name}
           CertificateFile /etc/ssl/certs/ca-certificates.crt
           Host ${account.imap.host}
@@ -74,30 +77,35 @@ in {
           Patterns *
           Remove None
           SyncState *
-        '')
+        '') config.home-manager.users.me.accounts.email.accounts
-        config.home-manager.users.me.accounts.email.accounts);
+      );
     };
 
     accounts.email.accounts = {
       cock =
-        lib.recursiveUpdate defaults
+        let
-        rec {
+          mailhost = "mail.cock.li";
           address = "2210@cock.li";
+        in
+        lib.recursiveUpdate defaults {
+          address = address;
           userName = address;
           passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-cock.path}";
           realName = "2210";
-          imap.host = "mail.cock.li";
+          imap.host = mailhost;
           imap.port = 993;
-          smtp.host = imap.host;
+          smtp.host = mailhost;
           smtp.port = 25;
           smtp.tls.useStartTls = true;
         };
       ical-ephemeris =
-        lib.recursiveUpdate defaults
+        let
-        rec {
+          address = "ical.ephemeris@web.de";
-          userName = "ical.ephemeris@web.de";
+        in
+        lib.recursiveUpdate defaults {
+          userName = address;
           realName = "Kieran from iCal Ephemeris";
-          address = userName;
+          address = address;
           passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-ical-ephemeris.path}";
           imap.host = "imap.web.de";
           imap.port = 993;
@@ -106,15 +114,18 @@ in {
           smtp.tls.useStartTls = true;
         };
       posteo =
-        lib.recursiveUpdate defaults
+        let
-        rec {
+          mailhost = "posteo.de";
           address = "kieran.meinhardt@posteo.net";
-          aliases = ["kmein@posteo.de"];
+        in
+        lib.recursiveUpdate defaults {
+          address = address;
+          aliases = [ "kmein@posteo.de" ];
           userName = address;
-          imap.host = "posteo.de";
+          imap.host = mailhost;
           imap.port = 993;
           imap.tls.enable = true;
-          smtp.host = imap.host;
+          smtp.host = mailhost;
           smtp.port = 465;
           smtp.tls.enable = true;
           primary = true;
@@ -141,10 +152,8 @@ in {
           "msgcompose.text_color" = config.lib.stylix.colors.withHashtag.base00;
           "msgcompose.background_color" = config.lib.stylix.colors.withHashtag.base05;
         };
-        userChrome = ''
+        userChrome = '''';
-        '';
+        userContent = '''';
-        userContent = ''
-        '';
         withExternalGnupg = false;
       };
     };
@@ -279,7 +288,9 @@ in {
         ui.spinner = ". , .";
         general.unsafe-accounts-conf = true;
         general.pgp-provider = "gpg";
-        viewer = {pager = "${pkgs.less}/bin/less -R";};
+        viewer = {
+          pager = "${pkgs.less}/bin/less -R";
+        };
         compose = {
           # address-book-cmd = "khard email --remove-first-line --parsable '%s'";
           no-attachment-warning = "(attach|attached|attachments?|anbei|Anhang|angehängt|beigefügt)";
@@ -296,24 +307,26 @@ in {
           "message/rfc822" = "${pkgs.aerc}/libexec/aerc/filters/colorize";
           "application/x-sh" = "${pkgs.bat}/bin/bat -fP -l sh";
         };
-        openers = let
+        openers =
-          as-pdf = pkgs.writers.writeDash "as-pdf" ''
+          let
-            d=$(mktemp -d)
+            as-pdf = pkgs.writers.writeDash "as-pdf" ''
-            trap clean EXIT
+              d=$(mktemp -d)
-            clean() {
+              trap clean EXIT
-              rm -rf "$d"
+              clean() {
-            }
+                rm -rf "$d"
-            ${pkgs.libreoffice}/bin/libreoffice --headless --convert-to pdf "$1" --outdir "$d"
+              }
-            ${pkgs.zathura}/bin/zathura "$d"/*.pdf
+              ${pkgs.libreoffice}/bin/libreoffice --headless --convert-to pdf "$1" --outdir "$d"
-          '';
+              ${pkgs.zathura}/bin/zathura "$d"/*.pdf
-        in {
+            '';
-          "image/*" = "${pkgs.nsxiv}/bin/nsxiv";
+          in
-          "application/pdf" = "${pkgs.zathura}/bin/zathura";
+          {
-          "application/vnd.openxmlformats-officedocument.wordprocessingml.document" = toString as-pdf;
+            "image/*" = "${pkgs.nsxiv}/bin/nsxiv";
-          "application/vnd.oasis.opendocument.text" = toString as-pdf;
+            "application/pdf" = "${pkgs.zathura}/bin/zathura";
-          "video/*" = "${pkgs.mpv}/bin/mpv";
+            "application/vnd.openxmlformats-officedocument.wordprocessingml.document" = toString as-pdf;
-          "audio/*" = "${pkgs.mpv}/bin/mpv";
+            "application/vnd.oasis.opendocument.text" = toString as-pdf;
-        };
+            "video/*" = "${pkgs.mpv}/bin/mpv";
+            "audio/*" = "${pkgs.mpv}/bin/mpv";
+          };
       };
 
       templates = {

configs/ccc.nix

@@ -1,8 +1,9 @@
 {pkgs, ...}:
 # https://paste.sr.ht/~erictapen/11716989e489b600f237041b6d657fdf0ee17b34
 let
-  certificate = pkgs.stdenv.mkDerivation rec {
+  name = "dst-root-ca-x3.pem";
-    name = "dst-root-ca-x3.pem";
+  certificate = pkgs.stdenv.mkDerivation {
+    inherit name;
     src = builtins.toFile "${name}.sed" ''
       1,/DST Root CA X3/d
       1,/-----END CERTIFICATE-----/p

configs/default.nix

@@ -140,9 +140,9 @@ in
         agent = {
           enable = true;
           pinentryPackage = pkgs.pinentry-qt;
-          settings = rec {
+          settings = let defaultCacheTtl = 2 * 60 * 60; in {
-            default-cache-ttl = 2 * 60 * 60;
+            default-cache-ttl = defaultCacheTtl;
-            max-cache-ttl = 4 * default-cache-ttl;
+            max-cache-ttl = 4 * defaultCacheTtl;
           };
         };
       };
@@ -258,15 +258,15 @@ in
     ./mastodon-bot.nix
     {
       home-manager.users.me = {
-        xdg.userDirs = rec {
+        xdg.userDirs = let pictures = "${config.users.users.me.home}/cloud/nextcloud/Bilder"; in {
           enable = true;
           documents = "${config.users.users.me.home}/cloud/nextcloud/Documents";
           desktop = "/tmp";
           download = "${config.users.users.me.home}/sync/Downloads";
           music = "${config.users.users.me.home}/mobile/audio";
-          pictures = "${config.users.users.me.home}/cloud/nextcloud/Bilder";
           publicShare = "${config.users.users.me.home}/cloud/nextcloud/tmp";
           videos = pictures;
+          pictures = pictures;
         };
       };
     }

configs/fonts.nix

@@ -119,11 +119,11 @@ in {
       vollkorn
       zilla-slab
     ]; # google-fonts league-of-moveable-type
-    fontconfig.defaultFonts = rec {
+    fontconfig.defaultFonts = let emoji = ["Noto Color Emoji"]; in {
       monospace = ["Noto Sans Mono"] ++ emoji;
       serif = ["Noto Serif" "Noto Naskh Arabic" "Noto Serif Devanagari"];
       sansSerif = ["Noto Sans Display" "Noto Naskh Arabic" "Noto Sans Hebrew" "Noto Sans Devanagari" "Noto Sans CJK JP" "Noto Sans Coptic" "Noto Sans Syriac Western"];
-      emoji = ["Noto Color Emoji"];
+      inherit emoji;
     };
     # xelatex fails with woff files
     # ref https://tex.stackexchange.com/questions/392144/xelatex-and-fontspec-crash-trying-to-find-woff-file-for-some-fonts-but-not-other

configs/fysi.nix

@@ -1,55 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: let
-  inherit (import ../lib/email.nix) defaults;
-  sshIdentity = name: "${config.users.users.me.home}/.ssh/${name}";
-in {
-  age.secrets = {
-    email-password-fysi = {
-      file = ../secrets/email-password-fysi.age;
-      owner = config.users.users.me.name;
-      group = config.users.users.me.group;
-      mode = "400";
-    };
-  };
-
-  home-manager.users.me = {
-    accounts.email.accounts = {
-      fysi =
-        lib.recursiveUpdate defaults
-        rec {
-          address = "kieran@fysi.tech";
-          userName = address;
-          passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-fysi.path}";
-          flavor = "fastmail.com";
-        };
-    };
-
-    programs.ssh.matchBlocks = rec {
-      "nextcloud.fysi.dev" = {
-        hostname = "116.203.82.203";
-        user = "root";
-      };
-      "lingua.miaengiadina.ch" = {
-        hostname = "135.181.85.233";
-        user = "root";
-      };
-      "cms-dev.woc2023.app".identityFile = sshIdentity "fysiweb";
-      "cms-master.woc2023.app".identityFile = sshIdentity "fysiweb";
-      "fysi-dev1" = {
-        hostname = "94.130.229.139";
-        user = "root";
-        identityFile = sshIdentity "fysiweb";
-      };
-      ${fysi-dev1.hostname} = fysi-dev1;
-      "fysi-shared0" = {
-        hostname = "49.12.205.235";
-        user = "root";
-        identityFile = sshIdentity "fysiweb";
-      };
-    };
-  };
-}

configs/fzf.nix

@@ -5,9 +5,11 @@
   };
 
   home-manager.users.me = {
-    programs.fzf = rec {
+    programs.fzf = let
-      enable = true;
       defaultCommand = "${pkgs.fd}/bin/fd --type f --strip-cwd-prefix --follow --no-ignore-vcs --exclude .git";
+    in {
+      enable = true;
+      defaultCommand = defaultCommand;
       defaultOptions = ["--height=40%"];
       changeDirWidgetCommand = "${pkgs.fd}/bin/fd --type d";
       changeDirWidgetOptions = [

configs/i3.nix

@@ -130,12 +130,12 @@ in {
       titlebar = false;
       border = 1;
     };
-    bars = [
+    bars = let position = "bottom"; in [
-      (config.home-manager.users.me.stylix.targets.i3.exportedBarConfig
+      (lib.recursiveUpdate config.home-manager.users.me.stylix.targets.i3.exportedBarConfig
-        // rec {
+        {
           workspaceButtons = true;
           mode = "hide"; # "dock";
-          position = "bottom";
+          inherit position;
           statusCommand = toString (pkgs.writers.writeDash "i3status-rust" ''
             export I3RS_GITHUB_TOKEN="$(cat ${config.age.secrets.github-token-i3status-rust.path})"
             export OPENWEATHERMAP_API_KEY="$(cat ${config.age.secrets.openweathermap-api-key.path})"

configs/keyboard.nix

@@ -94,9 +94,9 @@ in
   home-manager.users.me = {
     home.file =
       lib.mapAttrs' (name: path: lib.nameValuePair ".xkb/symbols/${name}" { source = path; })
-        (lib.filterAttrs (_: value: !(value ? "code")) languages) // {
+        (lib.recursiveUpdate (lib.filterAttrs (_: value: !(value ? "code")) languages) {
           ".xkb/symbols/ir".source = ../lib/keyboards/farsi;
-        };
+        });
   };
 
   console.keyMap = "de";

configs/khal.nix

@@ -10,11 +10,6 @@
     username = "kieran";
     passwordFile = config.age.secrets.nextcloud-password-kieran.path;
   };
-  fysiCloud = {
-    davEndpoint = "https://nextcloud.fysi.dev/remote.php/dav";
-    username = "kmein";
-    passwordFile = config.age.secrets.nextcloud-password-fysi.path;
-  };
 in {
   age.secrets = {
     nextcloud-password-kieran = {

configs/ssh.nix

@@ -12,33 +12,8 @@ in {
       eval $(${pkgs.gnome3.gnome-keyring}/bin/gnome-keyring-daemon --daemonize --components=ssh,secrets)
       export SSH_AUTH_SOCK
     '';
-    # services.gpg-agent = rec {
-    #   enable = false;
-    #   enableSshSupport = true;
-    #   defaultCacheTtlSsh = 2 * 60 * 60;
-    #   maxCacheTtlSsh = 4 * defaultCacheTtlSsh;
-    #   sshKeys = [
-    #     "568047C91DE03A23883E340F15A9C24D313E847C"
-    #     "BB3EE102DB8CD45540A78A6B18B511B67061F6B4" # kfm@manakish ed25519
-    #     "3F8986755818B5762A096BE212777EAAC441DD9D" # fysiweb rsa
-    #     "0E4ABD229432486CC432639BB0986B2CDE365105" # agenix ed25519
-    #     "A1E8D32CBFCDBD2DE798E2298D795CCFD785AE06" # kfm@kabsa ed25519
-    #   ];
-    # };
   };
 
-  # environment.extraInit = ''
-  # if [[ -z "$SSH_AUTH_SOCK" ]]; then
-  #   export SSH_AUTH_SOCK="$(${pkgs.gnupg}/bin/gpgconf --list-dirs agent-ssh-socket)"
-  # fi
-  # '';
-
-  # environment.interactiveShellInit = ''
-  # GPG_TTY="$(tty)"
-  # export GPG_TTY
-  # ${pkgs.gnupg}/bin/gpg-connect-agent updatestartuptty /bye > /dev/null
-  # '';
-
   home-manager.users.me.programs.ssh = {
     enable = true;
     enableDefaultConfig = false;

configs/uni.nix

@@ -7,11 +7,11 @@
   username = "meinhak99";
   inherit (import ../lib/email.nix) defaults pronouns;
   inherit (import ../lib) remoteDir;
-  fu-defaults = rec {
+  fu-defaults = let mailhost = "mail.zedat.fu-berlin.de"; in {
-    imap.host = "mail.zedat.fu-berlin.de";
+    imap.host = mailhost;
     imap.port = 993;
     imap.tls.enable = true;
-    smtp.host = imap.host;
+    smtp.host = mailhost;
     smtp.port = 465;
     smtp.tls.enable = true;
     folders.drafts = "Entwürfe";
@@ -45,8 +45,8 @@ in {
       fu =
         lib.recursiveUpdate defaults
         (lib.recursiveUpdate fu-defaults
-          rec {
+          (let userName = "meinhak99"; in {
-            userName = "meinhak99";
+            userName = userName;
             address = "kieran.meinhardt@fu-berlin.de";
             aliases = ["${userName}@fu-berlin.de"];
             passwordCommand = "${pkgs.coreutils}/bin/cat ${config.age.secrets.email-password-meinhak99.path}";
@@ -54,7 +54,7 @@ in {
               enable = true;
               settings.backend = "imap";
             };
-          });
+          }));
     };
   };
 

flake.lock

@@ -456,24 +456,7 @@
     },
     "flake-utils_3": {
       "inputs": {
-        "systems": "systems_3"
+        "systems": "systems_4"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "id": "flake-utils",
-        "type": "indirect"
-      }
-    },
-    "flake-utils_4": {
-      "inputs": {
-        "systems": "systems_5"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -1393,7 +1376,6 @@
         "agenix": "agenix",
         "autorenkalender": "autorenkalender",
         "coptic-dictionary": "coptic-dictionary",
-        "flake-utils": "flake-utils_3",
         "home-manager": "home-manager_2",
         "menstruation-backend": "menstruation-backend_2",
         "menstruation-telegram": "menstruation-telegram_2",
@@ -1611,7 +1593,7 @@
           "nixpkgs"
         ],
         "nur": "nur_3",
-        "systems": "systems_4",
+        "systems": "systems_3",
         "tinted-foot": "tinted-foot",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
@@ -1693,21 +1675,6 @@
         "type": "github"
       }
     },
-    "systems_5": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "telebots": {
       "inputs": {
         "flake-utils": "flake-utils_2",
@@ -1959,7 +1926,7 @@
     },
     "wallpaper-generator_2": {
       "inputs": {
-        "flake-utils": "flake-utils_4",
+        "flake-utils": "flake-utils_3",
         "nixpkgs": "nixpkgs_13"
       },
       "locked": {

flake.nix

@@ -78,61 +78,64 @@
             pkgs = nixpkgs.legacyPackages.x86_64-linux;
             lib = nixpkgs.lib;
           in
-          nixinate.nixinate.x86_64-linux self
+          lib.mergeAttrsList [
-          // {
+            nixinate.nixinate.x86_64-linux
-            mock-secrets = {
+            self
-              type = "app";
+            {
-              program = toString (
+              mock-secrets = {
-                pkgs.writers.writeDash "mock-secrets" ''
-                  ${pkgs.findutils}/bin/find secrets -not -path '*/.*' -type f  | ${pkgs.coreutils}/bin/sort > secrets.txt
-                ''
-              );
-            };
-          }
-          # the following error prevents remote building of ful: https://github.com/NixOS/nixpkgs/issues/177873
-          // builtins.listToAttrs (
-            map (
-              hostname:
-              let
-                targets = {
-                  ful = "root@ful";
-                  zaatar = "root@zaatar";
-                  makanek = "root@makanek";
-                  manakish = "root@manakish";
-                  tahina = "root@tahina";
-                  tabula = "root@tabula";
-                  kabsa = "root@kabsa";
-                  fatteh = "root@fatteh";
-                  kibbeh = "root@kibbeh";
-                };
-              in
-              lib.attrsets.nameValuePair "deploy-${hostname}" {
                 type = "app";
                 program = toString (
-                  pkgs.writers.writeDash "deploy-${hostname}" ''
+                  pkgs.writers.writeDash "mock-secrets" ''
-                    exec ${pkgs.nixos-rebuild}/bin/nixos-rebuild switch \
+                    ${pkgs.findutils}/bin/find secrets -not -path '*/.*' -type f  | ${pkgs.coreutils}/bin/sort > secrets.txt
-                      --max-jobs 2 \
+                  ''
-                      --log-format internal-json \
+                );
-                      --flake .#${hostname} \
+              };
-                      --target-host ${targets.${hostname}} 2>&1 \
+            }
+            # the following error prevents remote building of ful: https://github.com/NixOS/nixpkgs/issues/177873
+            (builtins.listToAttrs (
+              map (
+                hostname:
+                let
+                  targets = {
+                    ful = "root@ful";
+                    zaatar = "root@zaatar";
+                    makanek = "root@makanek";
+                    manakish = "root@manakish";
+                    tahina = "root@tahina";
+                    tabula = "root@tabula";
+                    kabsa = "root@kabsa";
+                    fatteh = "root@fatteh";
+                    kibbeh = "root@kibbeh";
+                  };
+                in
+                lib.attrsets.nameValuePair "deploy-${hostname}" {
+                  type = "app";
+                  program = toString (
+                    pkgs.writers.writeDash "deploy-${hostname}" ''
+                      exec ${pkgs.nixos-rebuild}/bin/nixos-rebuild switch \
+                        --max-jobs 2 \
+                        --log-format internal-json \
+                        --flake .#${hostname} \
+                        --target-host ${targets.${hostname}} 2>&1 \
+                        | ${pkgs.nix-output-monitor}/bin/nom --json
+                    ''
+                  );
+                }
+              ) (builtins.attrNames self.nixosConfigurations)
+            ))
+            {
+              deploy-ful = {
+                type = "app";
+                program = toString (
+                  pkgs.writers.writeDash "deploy-ful" ''
+                    exec ${pkgs.nix}/bin/nix run .#nixinate.ful \
+                      --log-format internal-json 2>&1 \
                       | ${pkgs.nix-output-monitor}/bin/nom --json
                   ''
                 );
-              }
+              };
-            ) (builtins.attrNames self.nixosConfigurations)
+            }
-          )
+          ];
-          // {
-            deploy-ful = {
-              type = "app";
-              program = toString (
-                pkgs.writers.writeDash "deploy-ful" ''
-                  exec ${pkgs.nix}/bin/nix run .#nixinate.ful \
-                    --log-format internal-json 2>&1 \
-                    | ${pkgs.nix-output-monitor}/bin/nom --json
-                ''
-              );
-            };
-          };
       };
 
       # TODO overlay for packages
@@ -152,260 +155,303 @@
         panoptikon = import lib/panoptikon.nix;
       };
 
-      nixosConfigurations = let
+      nixosConfigurations =
-        niveumSpecialArgs = system: {
+        let
-          unstablePackages = import nixpkgs-unstable {
+          niveumSpecialArgs = system: {
+            unstablePackages = import nixpkgs-unstable {
+              inherit system;
+              overlays = [];
+              config.allowUnfreePredicate =
+                pkg:
+                builtins.elem (nixpkgs-unstable.lib.getName pkg) [
+                  "obsidian"
+                  "zoom"
+                ];
+            };
+
+            niveumPackages = self.packages.${system};
+            niveumLib = self.lib;
+            inputs = {
+              inherit
+                tinc-graph
+                self
+                telebots
+                menstruation-telegram
+                menstruation-backend
+                scripts
+                agenix
+                recht
+                autorenkalender
+                nixpkgs
+                wallpaper-generator
+                ;
+            };
+          };
+        in
+        {
+          ful = nixpkgs.lib.nixosSystem rec {
+            system = "aarch64-linux";
+            specialArgs = niveumSpecialArgs system;
+            modules = [
+              systems/ful/configuration.nix
+              agenix.nixosModules.default
+              self.nixosModules.passport
+              self.nixosModules.panoptikon
+              self.nixosModules.go-webring
+              stockholm.nixosModules.reaktor2
+              retiolum.nixosModules.retiolum
+              nur.modules.nixos.default
+              { nixpkgs.overlays = [ stockholm.overlays.default ]; }
+              {
+                _module.args.nixinate = {
+                  host = "ful";
+                  sshUser = "root";
+                  buildOn = "remote";
+                  substituteOnTarget = true;
+                  hermetic = false;
+                };
+              }
+            ];
+          };
+          zaatar = nixpkgs.lib.nixosSystem rec {
+            system = "x86_64-linux";
+            specialArgs = niveumSpecialArgs system;
+            modules = [
+              systems/zaatar/configuration.nix
+              agenix.nixosModules.default
+              retiolum.nixosModules.retiolum
+            ];
+          };
+          kibbeh = nixpkgs.lib.nixosSystem rec {
+            system = "x86_64-linux";
+            specialArgs = niveumSpecialArgs system;
+            modules = [
+              systems/kibbeh/configuration.nix
+              agenix.nixosModules.default
+              retiolum.nixosModules.retiolum
+              home-manager.nixosModules.home-manager
+            ];
+          };
+          makanek = nixpkgs.lib.nixosSystem rec {
+            system = "x86_64-linux";
+            # for using inputs in other config files
+            specialArgs = niveumSpecialArgs system;
+            modules = [
+              systems/makanek/configuration.nix
+              self.nixosModules.telegram-bot
+              self.nixosModules.passport
+              agenix.nixosModules.default
+              retiolum.nixosModules.retiolum
+              nur.modules.nixos.default
+            ];
+          };
+          tahina = nixpkgs.lib.nixosSystem rec {
+            system = "x86_64-linux";
+            specialArgs = niveumSpecialArgs system;
+            modules = [
+              systems/tahina/configuration.nix
+              agenix.nixosModules.default
+              retiolum.nixosModules.retiolum
+            ];
+          };
+          tabula = nixpkgs.lib.nixosSystem rec {
+            system = "x86_64-linux";
+            specialArgs = niveumSpecialArgs system;
+            modules = [
+              systems/tabula/configuration.nix
+              agenix.nixosModules.default
+              retiolum.nixosModules.retiolum
+            ];
+          };
+          manakish = nixpkgs.lib.nixosSystem rec {
+            system = "x86_64-linux";
+            specialArgs = niveumSpecialArgs system;
+            modules = [
+              systems/manakish/configuration.nix
+              agenix.nixosModules.default
+              retiolum.nixosModules.retiolum
+              home-manager.nixosModules.home-manager
+              nix-index-database.nixosModules.default
+              nur.modules.nixos.default
+              stylix.nixosModules.stylix
+            ];
+          };
+          kabsa = nixpkgs.lib.nixosSystem rec {
+            system = "x86_64-linux";
+            specialArgs = niveumSpecialArgs system;
+            modules = [
+              systems/kabsa/configuration.nix
+              agenix.nixosModules.default
+              retiolum.nixosModules.retiolum
+              home-manager.nixosModules.home-manager
+              nur.modules.nixos.default
+              nix-index-database.nixosModules.default
+              stylix.nixosModules.stylix
+            ];
+          };
+          fatteh = nixpkgs.lib.nixosSystem rec {
+            system = "x86_64-linux";
+            specialArgs = niveumSpecialArgs system;
+            modules = [
+              systems/fatteh/configuration.nix
+              agenix.nixosModules.default
+              retiolum.nixosModules.retiolum
+              home-manager.nixosModules.home-manager
+              nur.modules.nixos.default
+              nix-index-database.nixosModules.default
+              stylix.nixosModules.stylix
+            ];
+          };
+        };
+
+      packages = eachSupportedSystem (
+        system:
+        let
+          pkgs = import nixpkgs {
             inherit system;
-            config.allowUnfreePredicate = pkg:
+            config.allowUnfree = true;
-              builtins.elem (nixpkgs-unstable.lib.getName pkg) [
+            overlays = [
-                "obsidian"
+              nur.overlays.default
-                "zoom"
+              (self: super: {
-              ];
+                mpv = super.mpv.override {
+                  scripts = [
+                    super.mpvScripts.visualizer
+                    super.mpvScripts.mpris
+                  ];
+                };
+                dmenu = super.writers.writeDashBin "dmenu" ''exec ${pkgs.rofi}/bin/rofi -dmenu "$@"'';
+              })
+            ];
           };
-
+          wrapScript =
-          niveumPackages = self.packages.${system};
-          niveumLib = self.lib;
-          inputs = {
-            inherit tinc-graph self telebots menstruation-telegram menstruation-backend scripts agenix recht autorenkalender nixpkgs wallpaper-generator;
-          };
-        };
-      in {
-        ful = nixpkgs.lib.nixosSystem rec {
-          system = "aarch64-linux";
-          specialArgs = niveumSpecialArgs system;
-          modules = [
-            systems/ful/configuration.nix
-            agenix.nixosModules.default
-            self.nixosModules.passport
-            self.nixosModules.panoptikon
-            self.nixosModules.go-webring
-            stockholm.nixosModules.reaktor2
-            retiolum.nixosModules.retiolum
-            nur.modules.nixos.default
-            { nixpkgs.overlays = [ stockholm.overlays.default ]; }
             {
-              _module.args.nixinate = {
+              packages ? [ ],
-                host = "ful";
+              name,
-                sshUser = "root";
+              script,
-                buildOn = "remote";
+            }:
-                substituteOnTarget = true;
+            pkgs.writers.writeDashBin name ''PATH=$PATH:${
-                hermetic = false;
+              nixpkgs.lib.makeBinPath (
-              };
+                packages
-            }
+                ++ [
-          ];
+                  pkgs.findutils
-        };
+                  pkgs.coreutils
-        zaatar = nixpkgs.lib.nixosSystem rec {
+                  pkgs.gnused
-          system = "x86_64-linux";
+                  pkgs.gnugrep
-          specialArgs = niveumSpecialArgs system;
+                ]
-          modules = [
+              )
-            systems/zaatar/configuration.nix
+            } ${script} "$@"'';
-            agenix.nixosModules.default
+        in
-            retiolum.nixosModules.retiolum
+        {
-          ];
+          # linguistics and ancient world
-        };
+          auc = pkgs.callPackage packages/auc.nix { };
-        kibbeh = nixpkgs.lib.nixosSystem rec {
+          betacode = pkgs.callPackage packages/betacode.nix { };
-          system = "x86_64-linux";
+          brassica = pkgs.callPackage packages/brassica.nix { }; # TODO upstream
-          specialArgs = niveumSpecialArgs system;
+          devanagari = pkgs.callPackage packages/devanagari { };
-          modules = [
+          stardict-tools = pkgs.callPackage packages/stardict-tools.nix { };
-            systems/kibbeh/configuration.nix
+          heuretes = pkgs.callPackage packages/heuretes.nix { };
-            agenix.nixosModules.default
+          ipa = pkgs.writers.writePython3Bin "ipa" { flakeIgnore = [ "E501" ]; } (
-            retiolum.nixosModules.retiolum
+            builtins.readFile packages/ipa.py
-            home-manager.nixosModules.home-manager
+          );
-          ];
+          jsesh = pkgs.callPackage packages/jsesh.nix { }; # TODO upstream
-        };
+          kirciuoklis = pkgs.callPackage packages/kirciuoklis.nix { };
-        makanek = nixpkgs.lib.nixosSystem rec {
+          polyglot = pkgs.callPackage packages/polyglot.nix { };
-          system = "x86_64-linux";
+          tocharian-font = pkgs.callPackage packages/tocharian-font.nix { };
-          # for using inputs in other config files
+          gfs-fonts = pkgs.callPackage packages/gfs-fonts.nix { };
-          specialArgs = niveumSpecialArgs system;
+          closest = pkgs.callPackage packages/closest { };
-          modules = [
-            systems/makanek/configuration.nix
-            self.nixosModules.telegram-bot
-            self.nixosModules.passport
-            agenix.nixosModules.default
-            retiolum.nixosModules.retiolum
-            nur.modules.nixos.default
-          ];
-        };
-        tahina = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          specialArgs = niveumSpecialArgs system;
-          modules = [
-            systems/tahina/configuration.nix
-            agenix.nixosModules.default
-            retiolum.nixosModules.retiolum
-          ];
-        };
-        tabula = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          specialArgs = niveumSpecialArgs system;
-          modules = [
-            systems/tabula/configuration.nix
-            agenix.nixosModules.default
-            retiolum.nixosModules.retiolum
-          ];
-        };
-        manakish = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          specialArgs = niveumSpecialArgs system;
-          modules = [
-            systems/manakish/configuration.nix
-            agenix.nixosModules.default
-            retiolum.nixosModules.retiolum
-            home-manager.nixosModules.home-manager
-            nix-index-database.nixosModules.default
-            nur.modules.nixos.default
-            stylix.nixosModules.stylix
-          ];
-        };
-        kabsa = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          specialArgs = niveumSpecialArgs system;
-          modules = [
-            systems/kabsa/configuration.nix
-            agenix.nixosModules.default
-            retiolum.nixosModules.retiolum
-            home-manager.nixosModules.home-manager
-            nur.modules.nixos.default
-            nix-index-database.nixosModules.default
-            stylix.nixosModules.stylix
-          ];
-        };
-        fatteh = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          specialArgs = niveumSpecialArgs system;
-          modules = [
-            systems/fatteh/configuration.nix
-            agenix.nixosModules.default
-            retiolum.nixosModules.retiolum
-            home-manager.nixosModules.home-manager
-            nur.modules.nixos.default
-            nix-index-database.nixosModules.default
-            stylix.nixosModules.stylix
-          ];
-        };
-      };
 
-      packages = eachSupportedSystem (system: let
+          # lit
-        pkgs = import nixpkgs {
+          random-zeno = pkgs.callPackage packages/random-zeno.nix { };
-          inherit system;
+          literature-quote = pkgs.callPackage packages/literature-quote.nix { };
-          config.allowUnfree = true;
-          overlays = [
-            nur.overlays.default
-            (self: super: {
-              mpv = super.mpv.override {scripts = [super.mpvScripts.visualizer super.mpvScripts.mpris];};
-              dmenu = super.writers.writeDashBin "dmenu" ''exec ${pkgs.rofi}/bin/rofi -dmenu "$@"'';
-            })
-          ];
-        };
-        wrapScript = {
-          packages ? [],
-          name,
-          script,
-        }:
-          pkgs.writers.writeDashBin name ''PATH=$PATH:${nixpkgs.lib.makeBinPath (packages ++ [pkgs.findutils pkgs.coreutils pkgs.gnused pkgs.gnugrep])} ${script} "$@"'';
-      in {
-        # linguistics and ancient world
-        auc = pkgs.callPackage packages/auc.nix {};
-        betacode = pkgs.callPackage packages/betacode.nix {};
-        brassica = pkgs.callPackage packages/brassica.nix {}; # TODO upstream
-        devanagari = pkgs.callPackage packages/devanagari {};
-        stardict-tools = pkgs.callPackage packages/stardict-tools.nix {};
-        heuretes = pkgs.callPackage packages/heuretes.nix {};
-        ipa = pkgs.writers.writePython3Bin "ipa" {flakeIgnore = ["E501"];} (builtins.readFile packages/ipa.py);
-        jsesh = pkgs.callPackage packages/jsesh.nix {}; # TODO upstream
-        kirciuoklis = pkgs.callPackage packages/kirciuoklis.nix {};
-        polyglot = pkgs.callPackage packages/polyglot.nix {};
-        tocharian-font = pkgs.callPackage packages/tocharian-font.nix {};
-        gfs-fonts = pkgs.callPackage packages/gfs-fonts.nix {};
-        closest = pkgs.callPackage packages/closest {};
 
-        # lit
+          # krebs
-        random-zeno = pkgs.callPackage packages/random-zeno.nix {};
+          brainmelter = pkgs.callPackage packages/brainmelter.nix { };
-        literature-quote = pkgs.callPackage packages/literature-quote.nix {};
+          cyberlocker-tools = pkgs.callPackage packages/cyberlocker-tools.nix { };
+          hc = pkgs.callPackage packages/hc.nix { };
+          kpaste = pkgs.callPackage packages/kpaste.nix { };
+          pls = pkgs.callPackage packages/pls.nix { };
+          untilport = pkgs.callPackage packages/untilport.nix { };
+          radio-news = pkgs.callPackage packages/radio-news.nix { };
 
-        # krebs
+          # window manager
-        brainmelter = pkgs.callPackage packages/brainmelter.nix {};
+          swallow = pkgs.callPackage packages/swallow.nix { };
-        cyberlocker-tools = pkgs.callPackage packages/cyberlocker-tools.nix {};
+          devour = pkgs.callPackage packages/devour.nix { };
-        hc = pkgs.callPackage packages/hc.nix {};
-        kpaste = pkgs.callPackage packages/kpaste.nix {};
-        pls = pkgs.callPackage packages/pls.nix {};
-        untilport = pkgs.callPackage packages/untilport.nix {};
-        radio-news = pkgs.callPackage packages/radio-news.nix {};
 
-        # window manager
+          cheat-sh = pkgs.callPackage packages/cheat-sh.nix { };
-        swallow = pkgs.callPackage packages/swallow.nix {};
+          vimPlugins-cheat-sh-vim = pkgs.callPackage packages/vimPlugins/cheat-sh.nix { }; # TODO upstream
-        devour = pkgs.callPackage packages/devour.nix {};
+          cro = pkgs.callPackage packages/cro.nix { };
+          default-gateway = pkgs.callPackage packages/default-gateway.nix { };
+          depp = pkgs.callPackage packages/depp.nix { };
+          fkill = pkgs.callPackage packages/fkill.nix { };
+          fzfmenu = pkgs.callPackage packages/fzfmenu.nix { };
+          gpt35 = pkgs.callPackage packages/gpt.nix { model = "gpt-3.5-turbo"; };
+          gpt4 = pkgs.callPackage packages/gpt.nix { model = "gpt-4"; };
+          image-convert-favicon = pkgs.callPackage packages/image-convert-favicon.nix { };
+          image-convert-tolino = pkgs.callPackage packages/image-convert-tolino.nix { };
+          k-lock = pkgs.callPackage packages/k-lock.nix { };
+          klem = pkgs.callPackage packages/klem.nix { };
+          man-pandoc = pkgs.callPackage packages/man/pandoc.nix { }; # TODO upstream
+          man-pdf = pkgs.callPackage packages/man-pdf.nix { };
+          mansplain = pkgs.callPackage packages/mansplain.nix { };
+          manual-sort = pkgs.callPackage packages/manual-sort.nix { };
+          menu-calc = pkgs.callPackage packages/menu-calc.nix { };
+          noise-waves = pkgs.callPackage packages/noise-waves.nix { };
+          mpv-radio = pkgs.callPackage packages/mpv-radio.nix { di-fm-key-file = "/dev/null"; };
+          mpv-tuner = pkgs.callPackage packages/mpv-tuner.nix { di-fm-key-file = "/dev/null"; };
+          mpv-tv = pkgs.callPackage packages/mpv-tv.nix { };
+          mpv-iptv = pkgs.callPackage packages/mpv-iptv.nix { };
+          new-mac = pkgs.callPackage packages/new-mac.nix { };
+          nix-git = pkgs.callPackage packages/nix-git.nix { };
+          notemenu = pkgs.callPackage packages/notemenu.nix { niveumPackages = self.packages.${system}; };
+          opustags = pkgs.callPackage packages/opustags.nix { }; # TODO upstream
+          q = pkgs.callPackage packages/q.nix { };
+          qrpaste = pkgs.callPackage packages/qrpaste.nix { };
+          go-webring = pkgs.callPackage packages/go-webring.nix { }; # TODO upstream
+          rfc = pkgs.callPackage packages/rfc.nix { };
+          gimp = pkgs.callPackage packages/gimp.nix { };
+          scanned = pkgs.callPackage packages/scanned.nix { };
+          text2pdf = pkgs.callPackage packages/text2pdf.nix { }; # TODO upstream
+          timer = pkgs.callPackage packages/timer.nix { };
+          trans = pkgs.callPackage packages/trans.nix { }; # TODO upstream
+          ttspaste = pkgs.callPackage packages/ttspaste.nix { };
+          unicodmenu = pkgs.callPackage packages/unicodmenu.nix { };
+          emailmenu = pkgs.callPackage packages/emailmenu.nix { };
+          stag = pkgs.callPackage packages/stag.nix { }; # TODO upstream
+          vg = pkgs.callPackage packages/vg.nix { };
+          vim = pkgs.callPackage packages/vim.nix { niveumPackages = self.packages.${system}; };
+          obsidian-vim = pkgs.callPackage packages/obsidian-vim.nix { };
+          vimPlugins-icalendar-vim = pkgs.callPackage packages/vimPlugins/icalendar-vim.nix { }; # TODO upstream
+          vimPlugins-jq-vim = pkgs.callPackage packages/vimPlugins/jq-vim.nix { }; # TODO upstream
+          vimPlugins-typst-vim = pkgs.callPackage packages/vimPlugins/typst-vim.nix { }; # TODO upstream
+          vimPlugins-mdwa-nvim = pkgs.callPackage packages/vimPlugins/mdwa-nvim.nix { }; # TODO upstream
+          vimPlugins-vim-ernest = pkgs.callPackage packages/vimPlugins/vim-ernest.nix { }; # TODO upstream
+          vimPlugins-vim-256noir = pkgs.callPackage packages/vimPlugins/vim-256noir.nix { }; # TODO upstream
+          vimPlugins-vim-colors-paramount =
+            pkgs.callPackage packages/vimPlugins/vim-colors-paramount.nix
+              { }; # TODO upstream
+          vimPlugins-vim-fetch = pkgs.callPackage packages/vimPlugins/vim-fetch.nix { }; # TODO upstream
+          vimPlugins-vim-fsharp = pkgs.callPackage packages/vimPlugins/vim-fsharp.nix { }; # TODO upstream
+          vimPlugins-vim-mail = pkgs.callPackage packages/vimPlugins/vim-mail.nix { }; # TODO upstream
+          vimPlugins-vim-reason-plus = pkgs.callPackage packages/vimPlugins/vim-reason-plus.nix { }; # TODO upstream
+          vimv = pkgs.callPackage packages/vimv.nix { };
+          weechat-declarative = pkgs.callPackage packages/weechat-declarative.nix { }; # TODO upstream
+          weechatScripts-hotlist2extern = pkgs.callPackage packages/weechatScripts/hotlist2extern.nix { }; # TODO upstream
+          dmenu-randr = pkgs.callPackage packages/dmenu-randr.nix { };
+          wttr = pkgs.callPackage packages/wttr.nix { }; # TODO upstream
 
-        cheat-sh = pkgs.callPackage packages/cheat-sh.nix {};
+          booksplit = wrapScript {
-        vimPlugins-cheat-sh-vim = pkgs.callPackage packages/vimPlugins/cheat-sh.nix {}; # TODO upstream
+            script = voidrice.outPath + "/.local/bin/booksplit";
-        cro = pkgs.callPackage packages/cro.nix {};
+            name = "booksplit";
-        default-gateway = pkgs.callPackage packages/default-gateway.nix {};
+            packages = [
-        depp = pkgs.callPackage packages/depp.nix {};
+              pkgs.ffmpeg
-        fkill = pkgs.callPackage packages/fkill.nix {};
+              pkgs.glibc.bin
-        fzfmenu = pkgs.callPackage packages/fzfmenu.nix {};
+            ];
-        gpt35 = pkgs.callPackage packages/gpt.nix {model = "gpt-3.5-turbo";};
+          };
-        gpt4 = pkgs.callPackage packages/gpt.nix {model = "gpt-4";};
+          tag = wrapScript {
-        image-convert-favicon = pkgs.callPackage packages/image-convert-favicon.nix {};
+            script = voidrice.outPath + "/.local/bin/tag";
-        image-convert-tolino = pkgs.callPackage packages/image-convert-tolino.nix {};
+            name = "tag";
-        k-lock = pkgs.callPackage packages/k-lock.nix {};
+            packages = [ pkgs.ffmpeg ];
-        klem = pkgs.callPackage packages/klem.nix {};
+          };
-        man-pandoc = pkgs.callPackage packages/man/pandoc.nix {}; # TODO upstream
+        }
-        man-pdf = pkgs.callPackage packages/man-pdf.nix {};
+      );
-        mansplain = pkgs.callPackage packages/mansplain.nix {};
-        manual-sort = pkgs.callPackage packages/manual-sort.nix {};
-        menu-calc = pkgs.callPackage packages/menu-calc.nix {};
-        noise-waves = pkgs.callPackage packages/noise-waves.nix {};
-        mpv-radio = pkgs.callPackage packages/mpv-radio.nix {di-fm-key-file = "/dev/null";};
-        mpv-tuner = pkgs.callPackage packages/mpv-tuner.nix {di-fm-key-file = "/dev/null";};
-        mpv-tv = pkgs.callPackage packages/mpv-tv.nix {};
-        mpv-iptv = pkgs.callPackage packages/mpv-iptv.nix {};
-        new-mac = pkgs.callPackage packages/new-mac.nix {};
-        nix-git = pkgs.callPackage packages/nix-git.nix {};
-        notemenu = pkgs.callPackage packages/notemenu.nix {niveumPackages = self.packages.${system};};
-        opustags = pkgs.callPackage packages/opustags.nix {}; # TODO upstream
-        q = pkgs.callPackage packages/q.nix {};
-        qrpaste = pkgs.callPackage packages/qrpaste.nix {};
-        go-webring = pkgs.callPackage packages/go-webring.nix {}; # TODO upstream
-        rfc = pkgs.callPackage packages/rfc.nix {};
-        gimp = pkgs.callPackage packages/gimp.nix {};
-        scanned = pkgs.callPackage packages/scanned.nix {};
-        text2pdf = pkgs.callPackage packages/text2pdf.nix {}; # TODO upstream
-        timer = pkgs.callPackage packages/timer.nix {};
-        trans = pkgs.callPackage packages/trans.nix {}; # TODO upstream
-        ttspaste = pkgs.callPackage packages/ttspaste.nix {};
-        unicodmenu = pkgs.callPackage packages/unicodmenu.nix {};
-        emailmenu = pkgs.callPackage packages/emailmenu.nix {};
-        stag = pkgs.callPackage packages/stag.nix {}; # TODO upstream
-        vg = pkgs.callPackage packages/vg.nix {};
-        vim = pkgs.callPackage packages/vim.nix {niveumPackages = self.packages.${system};};
-        obsidian-vim = pkgs.callPackage packages/obsidian-vim.nix {};
-        vimPlugins-icalendar-vim = pkgs.callPackage packages/vimPlugins/icalendar-vim.nix {}; # TODO upstream
-        vimPlugins-jq-vim = pkgs.callPackage packages/vimPlugins/jq-vim.nix {}; # TODO upstream
-        vimPlugins-typst-vim = pkgs.callPackage packages/vimPlugins/typst-vim.nix {}; # TODO upstream
-        vimPlugins-mdwa-nvim = pkgs.callPackage packages/vimPlugins/mdwa-nvim.nix {}; # TODO upstream
-        vimPlugins-vim-ernest = pkgs.callPackage packages/vimPlugins/vim-ernest.nix {}; # TODO upstream
-        vimPlugins-vim-256noir = pkgs.callPackage packages/vimPlugins/vim-256noir.nix {}; # TODO upstream
-        vimPlugins-vim-colors-paramount = pkgs.callPackage packages/vimPlugins/vim-colors-paramount.nix {}; # TODO upstream
-        vimPlugins-vim-fetch = pkgs.callPackage packages/vimPlugins/vim-fetch.nix {}; # TODO upstream
-        vimPlugins-vim-fsharp = pkgs.callPackage packages/vimPlugins/vim-fsharp.nix {}; # TODO upstream
-        vimPlugins-vim-mail = pkgs.callPackage packages/vimPlugins/vim-mail.nix {}; # TODO upstream
-        vimPlugins-vim-reason-plus = pkgs.callPackage packages/vimPlugins/vim-reason-plus.nix {}; # TODO upstream
-        vimv = pkgs.callPackage packages/vimv.nix {};
-        weechat-declarative = pkgs.callPackage packages/weechat-declarative.nix {}; # TODO upstream
-        weechatScripts-hotlist2extern = pkgs.callPackage packages/weechatScripts/hotlist2extern.nix {}; # TODO upstream
-        dmenu-randr = pkgs.callPackage packages/dmenu-randr.nix {};
-        wttr = pkgs.callPackage packages/wttr.nix {}; # TODO upstream
-
-        booksplit = wrapScript {
-          script = voidrice.outPath + "/.local/bin/booksplit";
-          name = "booksplit";
-          packages = [pkgs.ffmpeg pkgs.glibc.bin];
-        };
-        tag = wrapScript {
-          script = voidrice.outPath + "/.local/bin/tag";
-          name = "tag";
-          packages = [pkgs.ffmpeg];
-        };
-      });
     };
 }

lib/default-applications.nix

@@ -1,4 +1,4 @@
-pkgs: rec {
+pkgs: {
   terminal = "alacritty";
   browser = "${pkgs.firefox}/bin/firefox";
   fileManager = "${pkgs.pcmanfm}/bin/pcmanfm";

lib/default.nix

@@ -9,9 +9,8 @@
     argument ? "-",
   }: "${type} '${path}' ${mode} ${user} ${group} ${age} ${argument}";
 
-  restic = rec {
+  restic = let host = "zaatar.r"; port = 3571; in {
-    port = 3571;
+    inherit host port;
-    host = "zaatar.r";
     repository = "rest:http://${host}:${toString port}/";
   };
 

lib/email.nix

@@ -1,5 +1,8 @@
-rec {
+let
   thunderbirdProfile = "donnervogel";
+in
+{
+  inherit thunderbirdProfile;
   pronouns = builtins.concatStringsSep "/" [
     "er"
     "he"
@@ -14,7 +17,7 @@ rec {
   defaults = {
     thunderbird = {
       enable = true;
-      profiles = [thunderbirdProfile];
+      profiles = [ thunderbirdProfile ];
     };
     aerc.enable = true;
     realName = "Kierán Meinhardt";

modules/power-action.nix

@@ -56,7 +56,7 @@ with lib; let
 
   imp = {
     systemd.services.power-action = {
-      serviceConfig = rec {
+      serviceConfig = {
         ExecStart = startScript;
         User = cfg.user;
       };

packages/auc.nix

@@ -3,33 +3,33 @@
   fetchFromGitHub,
   lib,
   pandoc,
-}: let
+}:
-  owner = "kamalist";
+stdenv.mkDerivation (finalAttrs: {
-in
+  pname = "auc";
-  stdenv.mkDerivation rec {
+  version = "2019-04-02";
-    pname = "auc";
-    version = "2019-04-02";
 
-    src = fetchFromGitHub {
+  src = fetchFromGitHub {
-      inherit owner;
+    owner = "kamalist";
-      repo = "AUC";
+    repo = "AUC";
-      rev = "66d1cd57472442b4bf3c1ed12ca5cadd57d076b3";
+    rev = "66d1cd57472442b4bf3c1ed12ca5cadd57d076b3";
-      sha256 = "0gb4asmlfr19h42f3c5wg9c9i3014if3ymrqan6w9klgzgfyh2la";
+    sha256 = "0gb4asmlfr19h42f3c5wg9c9i3014if3ymrqan6w9klgzgfyh2la";
-    };
+  };
 
-    installPhase = ''
+  installPhase = ''
-      mkdir -p $out/{bin,man/man1}
+    mkdir -p $out/{bin,man/man1}
-      install auc $out/bin
+    install auc $out/bin
-      ${pandoc}/bin/pandoc -V title=${lib.escapeShellArg pname} -V section=1 $src/README.md -s -t man -o $out/man/man1/auc.1
+    ${pandoc}/bin/pandoc -V title=${lib.escapeShellArg finalAttrs.pname} -V section=1 $src/README.md -s -t man -o $out/man/man1/auc.1
+  '';
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "Command-line Roman calendar";
+    longDescription = ''
+      AUC (Ab Urbe condita) is a command-line Roman calendar tool. Currently it shows the specified date in the format of the Ancient Romans.
     '';
-
+    license = licenses.mit;
-    meta = with lib; {
+    maintainers = [ maintainers.kmein ];
-      description = "Command-line Roman calendar";
+    platforms = platforms.all;
-      longDescription = ''
+  };
-        AUC (Ab Urbe condita) is a command-line Roman calendar tool. Currently it shows the specified date in the format of the Ancient Romans.
+})
-      '';
-      license = licenses.mit;
-      maintainers = [maintainers.kmein];
-      platforms = platforms.all;
-    };
-  }

packages/devanagari/default.nix

@@ -1,7 +1,13 @@
-{yarn2nix-moretea}:
+{yarn2nix-moretea, lib}:
 yarn2nix-moretea.mkYarnPackage {
   name = "devanagari";
-  src = ./.;
+  src = lib.fileset.toSource {
+    root = ./.;
+    fileset = lib.fileset.unions [
+      ./devanagari.js
+      ./package.json
+    ];
+  };
   packageJson = ./package.json;
   yarnLock = ./yarn.lock;
 }

packages/hc.nix

@@ -12,16 +12,17 @@
   util-linux,
   zbar,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
-  name = "hc-${meta.version}";
+  name = "hc-${finalAttrs.version}";
+  version = "1.0.0";
 
   src = fetchgit {
     url = "https://cgit.krebsco.de/hc";
-    rev = "refs/tags/v${meta.version}";
+    rev = "refs/tags/v${finalAttrs.version}";
     sha256 = "09349gja22p0j3xs082kp0fnaaada14bafszn4r3q7rg1id2slfb";
   };
 
-  nativeBuildInputs = [makeWrapper];
+  nativeBuildInputs = [ makeWrapper ];
 
   buildPhase = null;
 
@@ -31,19 +32,21 @@ stdenv.mkDerivation rec {
     cp $src/bin/hc $out/bin/hc
 
     wrapProgram $out/bin/hc \
-      --prefix PATH : ${lib.makeBinPath [
+      --prefix PATH : ${
-      coreutils
+        lib.makeBinPath [
-      findutils
+          coreutils
-      gawk
+          findutils
-      gnugrep
+          gawk
-      qrencode
+          gnugrep
-      texlive.combined.scheme-full
+          qrencode
-      util-linux
+          texlive.combined.scheme-full
-      zbar
+          util-linux
-    ]}
+          zbar
+        ]
+      }
   '';
 
   meta = {
-    version = "1.0.0";
+    version = finalAttrs.version;
   };
-}
+})

packages/jsesh.nix

@@ -1,7 +1,13 @@
-{pkgs ? import <nixpkgs> {}}:
+{
-pkgs.writers.writeDashBin "jsesh" ''
+  writers,
-  ${pkgs.jre}/bin/java -jar ${pkgs.fetchzip {
+  jre,
-    url = "https://github.com/rosmord/jsesh/releases/download/release-7.5.5/JSesh-7.5.5.zip";
+  fetchzip,
-    sha256 = "1z7ln51cil9pypz855x9a8p9ip2aflvknh566wcaah1kmz3fp57r";
+}:
-  }}/lib/jseshAppli-7.5.5.jar
+writers.writeDashBin "jsesh" ''
+  ${jre}/bin/java -jar ${
+    fetchzip {
+      url = "https://github.com/rosmord/jsesh/releases/download/release-7.5.5/JSesh-7.5.5.zip";
+      sha256 = "1z7ln51cil9pypz855x9a8p9ip2aflvknh566wcaah1kmz3fp57r";
+    }
+  }/lib/jseshAppli-7.5.5.jar
 ''

packages/opustags.nix

@@ -6,14 +6,14 @@
   libogg,
   fetchFromGitHub,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   name = "opustags";
   version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "fmang";
     repo = "opustags";
-    rev = version;
+    rev = finalAttrs.version;
     sha256 = "09z0cdg20algaj2yyhfz3hxh1biwjjvzx1pc2vdc64n8lkswqsc1";
   };
 
@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
     "-DCMAKE_INSTALL_PREFIX=$out"
   ];
 
+  doCheck = true;
+
   buildInputs = [libogg];
 
   nativeBuildInputs = [cmake pkg-config];
@@ -30,4 +32,4 @@ stdenv.mkDerivation rec {
     description = "Ogg Opus tags editor";
     platforms = platforms.all;
   };
-}
+})

packages/python3Packages/indic-transliteration/default.nix

@@ -6,11 +6,11 @@
   regex,
   ...
 }:
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "indic_transliteration";
   version = "unstable-2020-12-15";
   src = fetchFromGitHub {
-    repo = pname;
+    repo = finalAttrs.pname;
     owner = "sanskrit-coders";
     rev = "2ea25a03af15937916b6768835e056166986c567";
     sha256 = "1pcf800hl0zkcffc47mkjq9mizsxdi0hwxlnij5bvbqdshd3w9ll";
@@ -18,4 +18,4 @@ buildPythonPackage rec {
   patches = [./regex-version.patch];
   propagatedBuildInputs = [backports_functools_lru_cache selenium regex];
   doCheck = false;
-}
+})

packages/stag.nix

@@ -6,14 +6,14 @@
   taglib,
   zlib,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "stag";
   version = "1.0";
 
   src = fetchFromGitHub {
     owner = "smabie";
     repo = "stag";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-IWb6ZbPlFfEvZogPh8nMqXatrg206BTV2DYg7BMm7R4=";
   };
 
@@ -27,6 +27,8 @@ stdenv.mkDerivation rec {
     make all
   '';
 
+  doCheck = true;
+
   installPhase = ''
     mkdir -p $out/bin
     cp stag $out/bin/
@@ -40,6 +42,5 @@ stdenv.mkDerivation rec {
     license = lib.licenses.publicDomain;
     maintainers = [ lib.maintainers.kmein ];
     platforms = lib.platforms.unix;
-    source = src;
   };
-}
+})

packages/stardict-tools.nix

@@ -27,8 +27,9 @@ stdenv.mkDerivation {
   env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=format-security"
   ];
-  patchPhase = ''
+  postPatch = ''
-    ${gnused}/bin/sed -i s/noinst_PROGRAMS/bin_PROGRAMS/ tools/src/Makefile.am
+    substituteInPlace tools/src/Makefile.am \
+      --replace-fail noinst_PROGRAMS bin_PROGRAMS
   '';
   installFlags = ["INSTALL_PREFIX=$(out)"];
   autoreconfPhase = ''
@@ -39,6 +40,7 @@ stdenv.mkDerivation {
     mkdir $out
     make install
   '';
+  doCheck = true;
   src = fetchFromGitHub {
     owner = "huzheng001";
     repo = "stardict-3";

packages/text2pdf.nix

@@ -2,15 +2,14 @@
   stdenv,
   fetchurl,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
-  name = "${pname}-${version}";
   pname = "text2pdf";
   version = "1.1";
   src = fetchurl {
     url = "http://www.eprg.org/pdfcorner/text2pdf/text2pdf.c";
     sha256 = "002nyky12vf1paj7az6j6ra7lljwkhqzz238v7fyp7sfgxw0f7d1";
   };
-  phases = ["buildPhase"];
+  phases = [ "buildPhase" ];
   buildPhase = ''
     mkdir -p $out/bin
     gcc -o $out/bin/text2pdf $src

packages/vim.nix

@@ -64,10 +64,9 @@
         vim-repeat
         vim-sensible
         vim-surround
-        (vimUtils.buildVimPlugin rec {
+        (vimUtils.buildVimPlugin {
           pname = "vim-dim";
           version = "1.1.0";
-          name = "${pname}-${version}";
           src = fetchFromGitHub {
             owner = "jeffkreeftmeijer";
             repo = pname;

packages/weechat-declarative.nix

@@ -9,8 +9,8 @@
   config = args.config or {};
 
   lib =
-    args.lib
+    lib.recursiveUpdate args.lib
-    // rec {
+    (let
       attrPaths = let
         recurse = path: value:
           if builtins.isAttrs value
@@ -18,6 +18,8 @@
           else [(lib.nameValuePair path value)];
       in
         attrs: lib.flatten (recurse [] attrs);
+    in {
+      inherit attrPaths;
 
       attrPathsSep = sep: attrs: lib.listToAttrs (map (x: x // {name = lib.concatStringsSep sep x.name;}) (attrPaths attrs));
 
@@ -33,7 +35,7 @@
       setCommand = name: value: "/set ${name} \"${toWeechatValue value}\"";
 
       filterAddreplace = name: filter: "/filter addreplace ${name} ${filter.buffer} ${toWeechatValue filter.tags} ${filter.regex}";
-    };
+    });
 
   cfg = eval.config;
 

systems/makanek/oracle/default.nix

@@ -49,10 +49,10 @@ in
   };
 
   niveum.passport.services = [
-    rec {
+    {
       link = "https://tarot.kmein.de";
       title = "Tarot";
-      description = "draws Tarot cards for you. See <a href=\"${link}/files/key.pdf\">here</a> for information on how to interpret them.";
+      description = "draws Tarot cards for you.";
     }
     {
       link = "https://iching.kmein.de";

systems/zaatar/spotifyd.nix

@@ -1,47 +0,0 @@
-{config, ...}: {
-  nixpkgs.config.packageOverrides = pkgs: {
-    # mpris is a dbus service for controlling all music players with e.g. playerctl
-    # I do not need this, because I only interact with the service via Spotify Connect
-    # otherẃise it will pull in DBus which fails without X11
-    spotifyd = pkgs.spotifyd.overrideAttrs {
-      withMpris = false;
-      withKeyring = false;
-    };
-  };
-
-  services.spotifyd = {
-    enable = true;
-    settings = {
-      global = {
-        username_cmd = "cat $CREDENTIALS_DIRECTORY/username";
-        password_cmd = "cat $CREDENTIALS_DIRECTORY/password";
-        bitrate = 320;
-        use_mpris = false;
-        device_type = "s_t_b"; # set-top box
-        device_name = config.networking.hostName;
-      };
-    };
-  };
-
-  systemd.services.spotifyd = {
-    serviceConfig.LoadCredential = [
-      "username:${config.age.secrets.spotify-username.path}"
-      "password:${config.age.secrets.spotify-password.path}"
-    ];
-    serviceConfig.RuntimeMaxSec = "${toString (5 * 60 * 60)}s";
-    serviceConfig.SupplementaryGroups = ["pipewire"];
-  };
-
-  networking.firewall.allowedTCPPorts = [4713];
-
-  age.secrets = {
-    spotify-username.file = ../../secrets/spotify-username.age;
-    spotify-password.file = ../../secrets/spotify-password.age;
-  };
-
-  # ref https://github.com/NixOS/nixpkgs/issues/71362#issuecomment-753461502
-  hardware.pulseaudio.extraConfig = ''
-    unload-module module-native-protocol-unix
-    load-module module-native-protocol-unix auth-anonymous=1
-  '';
-}