✨🚧 working on the 'apple' system (might move to new refactored version)

Signed-off-by: Xaiya Schumin <[e-mail]>

.devenv/bootstrap/bootstrapLib.nix

···
+# Shared library functions for devenv evaluation
+{ inputs }:
+
+rec {
+  # Helper to get overlays for a given input
+  getOverlays =
+    inputName: inputAttrs:
+    let
+      lib = inputs.nixpkgs.lib;
+    in
+    map
+      (
+        overlay:
+        let
+          input =
+            inputs.${inputName} or (throw "No such input `${inputName}` while trying to configure overlays.");
+        in
+          input.overlays.${overlay}
+            or (throw "Input `${inputName}` has no overlay called `${overlay}`. Supported overlays: ${lib.concatStringsSep ", " (builtins.attrNames input.overlays)}")
+      ) inputAttrs.overlays or [ ];
+
+  # Main function to create devenv configuration for a specific system with profiles support
+  # This is the full-featured version used by default.nix
+  mkDevenvForSystem =
+    { version
+    , is_development_version ? false
+    , system
+    , devenv_root
+    , git_root ? null
+    , devenv_dotfile
+    , devenv_dotfile_path
+    , devenv_tmpdir
+    , devenv_runtime
+    , devenv_state ? null
+    , devenv_istesting ? false
+    , devenv_direnvrc_latest_version
+    , container_name ? null
+    , active_profiles ? [ ]
+    , hostname
+    , username
+    , cli_options ? [ ]
+    , skip_local_src ? false
+    , secretspec ? null
+    , devenv_inputs ? { }
+    , devenv_imports ? [ ]
+    , impure ? false
+    , nixpkgs_config ? { }
+    , lock_fingerprint ? null
+    , primops ? { }
+    }:
+    let
+      inherit (inputs) nixpkgs;
+      lib = nixpkgs.lib;
+      targetSystem = system;
+
+      overlays = lib.flatten (lib.mapAttrsToList getOverlays devenv_inputs);
+
+      # Helper to create pkgs for a given system with nixpkgs_config
+      mkPkgsForSystem =
+        evalSystem:
+        import nixpkgs {
+          system = evalSystem;
+          config = nixpkgs_config // {
+            allowUnfreePredicate =
+              if nixpkgs_config.allowUnfree or false then
+                (_: true)
+              else if (nixpkgs_config.permittedUnfreePackages or [ ]) != [ ] then
+                (pkg: builtins.elem (lib.getName pkg) (nixpkgs_config.permittedUnfreePackages or [ ]))
+              else
+                (_: false);
+          };
+          inherit overlays;
+        };
+
+      pkgsBootstrap = mkPkgsForSystem targetSystem;
+
+      # Helper to import a path, trying .nix first then /devenv.nix
+      # Returns a list of modules, including devenv.local.nix when present
+      tryImport =
+        resolvedPath: basePath:
+        if lib.hasSuffix ".nix" basePath then
+          [ (import resolvedPath) ]
+        else
+          let
+            devenvpath = resolvedPath + "/devenv.nix";
+            localpath = resolvedPath + "/devenv.local.nix";
+          in
+          if builtins.pathExists devenvpath then
+            [ (import devenvpath) ] ++ lib.optional (builtins.pathExists localpath) (import localpath)
+          else
+            throw (basePath + "/devenv.nix file does not exist");
+
+      importModule =
+        path:
+        if lib.hasPrefix "path:" path then
+        # path: prefix indicates a local filesystem path - strip it and import directly
+          let
+            actualPath = builtins.substring 5 999999 path;
+          in
+          tryImport (/. + actualPath) path
+        else if lib.hasPrefix "/" path then
+        # Absolute path - import directly (avoids input resolution and NAR hash computation)
+          tryImport (/. + path) path
+        else if lib.hasPrefix "./" path then
+        # Relative paths are relative to devenv_root, not bootstrap directory
+          let
+            relPath = builtins.substring 1 255 path;
+          in
+          tryImport (/. + devenv_root + relPath) path
+        else if lib.hasPrefix "../" path then
+        # Parent relative paths also relative to devenv_root
+          tryImport (/. + devenv_root + "/${path}") path
+        else
+          let
+            paths = lib.splitString "/" path;
+            name = builtins.head paths;
+            input = inputs.${name} or (throw "Unknown input ${name}");
+            subpath = "/${lib.concatStringsSep "/" (builtins.tail paths)}";
+            devenvpath = input + subpath;
+          in
+          tryImport devenvpath path;
+
+      # Common modules shared between main evaluation and cross-system evaluation
+      mkCommonModules =
+        evalPkgs:
+        [
+          (
+            { config, ... }:
+            {
+              _module.args.pkgs = evalPkgs.appendOverlays (config.overlays or [ ]);
+              _module.args.secretspec = secretspec;
+              _module.args.devenvPrimops = primops;
+            }
+          )
+          (inputs.devenv.modules + /top-level.nix)
+          (
+            { options, ... }:
+            {
+              config.devenv = lib.mkMerge [
+                {
+                  root = devenv_root;
+                  dotfile = devenv_dotfile;
+                }
+                (
+                  if builtins.hasAttr "cli" options.devenv then
+                    {
+                      cli.version = version;
+                      cli.isDevelopment = is_development_version;
+                    }
+                  else
+                    {
+                      cliVersion = version;
+                    }
+                )
+                (lib.optionalAttrs (builtins.hasAttr "tmpdir" options.devenv) {
+                  tmpdir = devenv_tmpdir;
+                })
+                (lib.optionalAttrs (builtins.hasAttr "isTesting" options.devenv) {
+                  isTesting = devenv_istesting;
+                })
+                (lib.optionalAttrs (builtins.hasAttr "runtime" options.devenv) {
+                  runtime = devenv_runtime;
+                })
+                (lib.optionalAttrs (builtins.hasAttr "state" options.devenv && devenv_state != null) {
+                  state = lib.mkForce devenv_state;
+                })
+                (lib.optionalAttrs (builtins.hasAttr "direnvrcLatestVersion" options.devenv) {
+                  direnvrcLatestVersion = devenv_direnvrc_latest_version;
+                })
+              ];
+            }
+          )
+          (
+            { options, ... }:
+            {
+              config = lib.mkMerge [
+                (lib.optionalAttrs (builtins.hasAttr "git" options) {
+                  git.root = git_root;
+                })
+              ];
+            }
+          )
+          (lib.optionalAttrs (container_name != null) {
+            container.isBuilding = lib.mkForce true;
+            containers.${container_name}.isBuilding = true;
+          })
+        ]
+        ++ (lib.flatten (map importModule devenv_imports))
+        ++ (if !skip_local_src then (importModule (devenv_root + "/devenv.nix")) else [ ])
+        ++ [
+          (
+            let
+              localPath = devenv_root + "/devenv.local.nix";
+            in
+            if builtins.pathExists localPath then import localPath else { }
+          )
+          cli_options
+        ];
+
+      # Phase 1: Base evaluation to extract profile definitions
+      baseProject = lib.evalModules {
+        specialArgs = inputs // {
+          inherit inputs secretspec primops;
+        };
+        modules = mkCommonModules pkgsBootstrap;
+      };
+
+      # Phase 2: Extract and apply profiles using extendModules with priority overrides
+      project =
+        let
+          # Build ordered list of profile names: hostname -> user -> manual
+          manualProfiles = active_profiles;
+          currentHostname = hostname;
+          currentUsername = username;
+          hostnameProfiles = lib.optional
+            (
+              currentHostname != null
+              && currentHostname != ""
+              && builtins.hasAttr currentHostname (baseProject.config.profiles.hostname or { })
+            ) "hostname.${currentHostname}";
+          userProfiles = lib.optional
+            (
+              currentUsername != null
+              && currentUsername != ""
+              && builtins.hasAttr currentUsername (baseProject.config.profiles.user or { })
+            ) "user.${currentUsername}";
+
+          # Ordered list of profiles to activate
+          orderedProfiles = hostnameProfiles ++ userProfiles ++ manualProfiles;
+
+          # Resolve profile extends with cycle detection
+          resolveProfileExtends =
+            profileName: visited:
+            if builtins.elem profileName visited then
+              throw "Circular dependency detected in profile extends: ${lib.concatStringsSep " -> " visited} -> ${profileName}"
+            else
+              let
+                profile = getProfileConfig profileName;
+                extends = profile.extends or [ ];
+                newVisited = visited ++ [ profileName ];
+                extendedProfiles = lib.flatten (map (name: resolveProfileExtends name newVisited) extends);
+              in
+              extendedProfiles ++ [ profileName ];
+
+          # Get profile configuration by name from baseProject
+          getProfileConfig =
+            profileName:
+            if lib.hasPrefix "hostname." profileName then
+              let
+                name = lib.removePrefix "hostname." profileName;
+              in
+              baseProject.config.profiles.hostname.${name}
+            else if lib.hasPrefix "user." profileName then
+              let
+                name = lib.removePrefix "user." profileName;
+              in
+              baseProject.config.profiles.user.${name}
+            else
+              let
+                availableProfiles = builtins.attrNames (baseProject.config.profiles or { });
+                hostnameProfiles = map (n: "hostname.${n}") (
+                  builtins.attrNames (baseProject.config.profiles.hostname or { })
+                );
+                userProfiles = map (n: "user.${n}") (builtins.attrNames (baseProject.config.profiles.user or { }));
+                allAvailableProfiles = availableProfiles ++ hostnameProfiles ++ userProfiles;
+              in
+                baseProject.config.profiles.${profileName}
+                  or (throw "Profile '${profileName}' not found. Available profiles: ${lib.concatStringsSep ", " allAvailableProfiles}");
+
+          # Fold over ordered profiles to build final list with extends
+          expandedProfiles = lib.foldl'
+            (
+              acc: profileName:
+                let
+                  allProfileNames = resolveProfileExtends profileName [ ];
+                in
+                acc ++ allProfileNames
+            ) [ ]
+            orderedProfiles;
+
+          # Map over expanded profiles and apply priorities
+          allPrioritizedModules = lib.imap0
+            (
+              index: profileName:
+                let
+                  profilePriority = (lib.modules.defaultOverridePriority - 1) - index;
+                  profileConfig = getProfileConfig profileName;
+
+                  typeNeedsOverride =
+                    type:
+                    if type == null then
+                      false
+                    else
+                      let
+                        typeName = type.name or type._type or "";
+
+                        isLeafType = builtins.elem typeName [
+                          "str"
+                          "int"
+                          "bool"
+                          "enum"
+                          "path"
+                          "package"
+                          "float"
+                          "anything"
+                        ];
+                      in
+                      if isLeafType then
+                        true
+                      else if typeName == "nullOr" then
+                        let
+                          innerType =
+                            type.elemType
+                              or (if type ? nestedTypes && type.nestedTypes ? elemType then type.nestedTypes.elemType else null);
+                        in
+                        if innerType != null then typeNeedsOverride innerType else false
+                      else
+                        false;
+
+                  pathNeedsOverride =
+                    optionPath:
+                    let
+                      directOption = lib.attrByPath optionPath null baseProject.options;
+                    in
+                    if directOption != null && lib.isOption directOption then
+                      typeNeedsOverride directOption.type
+                    else if optionPath != [ ] then
+                      let
+                        parentPath = lib.init optionPath;
+                        parentOption = lib.attrByPath parentPath null baseProject.options;
+                      in
+                      if parentOption != null && lib.isOption parentOption then
+                        let
+                          freeformType = parentOption.type.freeformType or parentOption.type.nestedTypes.freeformType or null;
+                          elementType =
+                            if freeformType ? elemType then
+                              freeformType.elemType
+                            else if freeformType ? nestedTypes && freeformType.nestedTypes ? elemType then
+                              freeformType.nestedTypes.elemType
+                            else
+                              freeformType;
+                        in
+                        typeNeedsOverride elementType
+                      else
+                        false
+                    else
+                      false;
+
+                  applyModuleOverride =
+                    config:
+                    if builtins.isFunction config then
+                      let
+                        wrapper = args: applyOverrideRecursive (config args) [ ];
+                      in
+                      lib.mirrorFunctionArgs config wrapper
+                    else
+                      applyOverrideRecursive config [ ];
+
+                  applyOverrideRecursive =
+                    config: optionPath:
+                    if lib.isAttrs config && config ? _type then
+                      config
+                    else if lib.isAttrs config then
+                      lib.mapAttrs (name: value: applyOverrideRecursive value (optionPath ++ [ name ])) config
+                    else if pathNeedsOverride optionPath then
+                      lib.mkOverride profilePriority config
+                    else
+                      config;
+
+                  prioritizedConfig = (
+                    profileConfig.module
+                    // {
+                      imports = lib.map
+                        (
+                          importItem:
+                          importItem
+                          // {
+                            imports = lib.map (nestedImport: applyModuleOverride nestedImport) (importItem.imports or [ ]);
+                          }
+                        )
+                        (profileConfig.module.imports or [ ]);
+                    }
+                  );
+                in
+                prioritizedConfig
+            )
+            expandedProfiles;
+        in
+        if allPrioritizedModules == [ ] then
+          baseProject
+        else
+          baseProject.extendModules { modules = allPrioritizedModules; };
+
+      config = project.config;
+
+      # Apply config overlays to pkgs
+      pkgs = pkgsBootstrap.appendOverlays (config.overlays or [ ]);
+
+      options = pkgs.nixosOptionsDoc {
+        options = builtins.removeAttrs project.options [ "_module" ];
+        warningsAreErrors = false;
+        transformOptions =
+          let
+            isDocType =
+              v:
+              builtins.elem v [
+                "literalDocBook"
+                "literalExpression"
+                "literalMD"
+                "mdDoc"
+              ];
+          in
+          lib.attrsets.mapAttrs (
+            _: v:
+              if v ? _type && isDocType v._type then
+                v.text
+              else if v ? _type && v._type == "derivation" then
+                v.name
+              else
+                v
+          );
+      };
+
+      build =
+        options: config:
+        lib.concatMapAttrs
+          (
+            name: option:
+            if lib.isOption option then
+              let
+                typeName = option.type.name or "";
+              in
+              if
+                builtins.elem typeName [
+                  "output"
+                  "outputOf"
+                ]
+              then
+                {
+                  ${name} = config.${name};
+                }
+              else
+                { }
+            else if builtins.isAttrs option && !lib.isDerivation option then
+              let
+                v = build option config.${name};
+              in
+              if v != { } then { ${name} = v; } else { }
+            else
+              { }
+          )
+          options;
+
+      # Helper to evaluate devenv for a specific system (for cross-compilation, e.g. macOS building Linux containers)
+      evalForSystem =
+        evalSystem:
+        let
+          evalPkgs = mkPkgsForSystem evalSystem;
+          evalProject = lib.evalModules {
+            specialArgs = inputs // {
+              inherit inputs secretspec primops;
+            };
+            modules = mkCommonModules evalPkgs;
+          };
+        in
+        {
+          config = evalProject.config;
+        };
+
+      # All supported systems for cross-compilation (lazily evaluated)
+      allSystems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+
+      # Generate perSystem entries for all systems (only evaluated when accessed)
+      perSystemConfigs = lib.genAttrs allSystems (
+        perSystem: if perSystem == targetSystem then { config = config; } else evalForSystem perSystem
+      );
+    in
+    {
+      inherit
+        pkgs
+        config
+        options
+        project
+        ;
+      bash = pkgs.bash;
+      shell = config.shell;
+      optionsJSON = options.optionsJSON;
+      info = config.info;
+      ci = config.ciDerivation;
+      build = build project.options config;
+      devenv = {
+        # Backwards compatibility: wrap config in devenv attribute for code expecting devenv.config.*
+        config = config;
+        # perSystem structure for cross-compilation (e.g. macOS building Linux containers)
+        perSystem = perSystemConfigs;
+      };
+    };
+
+  # Simplified devenv evaluation for inputs
+  # This is a lightweight version suitable for evaluating an input's devenv.nix
+  mkDevenvForInput =
+    {
+      # The input to evaluate (must have outPath and sourceInfo)
+      input
+    , # All resolved inputs (for specialArgs)
+      allInputs
+    , # System to evaluate for
+      system ? builtins.currentSystem
+    , # Nixpkgs to use (defaults to allInputs.nixpkgs)
+      nixpkgs ? allInputs.nixpkgs or (throw "nixpkgs input required")
+    , # Devenv modules (defaults to allInputs.devenv)
+      devenv ? allInputs.devenv or (throw "devenv input required")
+    ,
+    }:
+    let
+      devenvPath = input.outPath + "/devenv.nix";
+      hasDevenv = builtins.pathExists devenvPath;
+    in
+    if !hasDevenv then
+      throw ''
+        Input does not have a devenv.nix file.
+        Expected file at: ${devenvPath}
+
+        To use this input's devenv configuration, the input must provide a devenv.nix file.
+      ''
+    else
+      let
+        pkgs = import nixpkgs {
+          inherit system;
+          config = { };
+        };
+        lib = pkgs.lib;
+
+        project = lib.evalModules {
+          specialArgs = allInputs // {
+            inputs = allInputs;
+            secretspec = null;
+          };
+          modules = [
+            (
+              { config, ... }:
+              {
+                _module.args.pkgs = pkgs.appendOverlays (config.overlays or [ ]);
+              }
+            )
+            (devenv.outPath + "/src/modules/top-level.nix")
+            (import devenvPath)
+          ];
+        };
+      in
+      {
+        inherit pkgs;
+        config = project.config;
+        options = project.options;
+        inherit project;
+      };
+}

.devenv/bootstrap/default.nix

···
+args@{ system
+, # The project root (location of devenv.nix)
+  devenv_root
+, ...
+}:
+
+let
+  inherit
+    (import ./resolve-lock.nix {
+      src = devenv_root;
+      inherit system;
+    })
+    inputs
+    ;
+
+  bootstrapLib = import ./bootstrapLib.nix { inherit inputs; };
+in
+
+bootstrapLib.mkDevenvForSystem args

.devenv/bootstrap/resolve-lock.nix

···
+# Adapted from https://git.lix.systems/lix-project/flake-compat/src/branch/main/default.nix
+{ src
+, system ? builtins.currentSystem or "unknown-system"
+,
+}:
+
+let
+  lockFilePath = src + "/devenv.lock";
+
+  lockFile = builtins.fromJSON (builtins.readFile lockFilePath);
+
+  rootSrc = {
+    lastModified = 0;
+    lastModifiedDate = formatSecondsSinceEpoch 0;
+    # *hacker voice*: it's definitely a store path, I promise (actually a
+    # nixlang path value, likely not pointing at the store).
+    outPath = src;
+  };
+
+  # Format number of seconds in the Unix epoch as %Y%m%d%H%M%S.
+  formatSecondsSinceEpoch =
+    t:
+    let
+      rem = x: y: x - x / y * y;
+      days = t / 86400;
+      secondsInDay = rem t 86400;
+      hours = secondsInDay / 3600;
+      minutes = (rem secondsInDay 3600) / 60;
+      seconds = rem t 60;
+
+      # Courtesy of https://stackoverflow.com/a/32158604.
+      z = days + 719468;
+      era = (if z >= 0 then z else z - 146096) / 146097;
+      doe = z - era * 146097;
+      yoe = (doe - doe / 1460 + doe / 36524 - doe / 146096) / 365;
+      y = yoe + era * 400;
+      doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
+      mp = (5 * doy + 2) / 153;
+      d = doy - (153 * mp + 2) / 5 + 1;
+      m = mp + (if mp < 10 then 3 else -9);
+      y' = y + (if m <= 2 then 1 else 0);
+
+      pad = s: if builtins.stringLength s < 2 then "0" + s else s;
+    in
+    "${toString y'}${pad (toString m)}${pad (toString d)}${pad (toString hours)}${pad (toString minutes)}${pad (toString seconds)}";
+
+  allNodes = builtins.mapAttrs
+    (
+      key: node:
+        let
+          sourceInfo =
+            if key == lockFile.root then
+              rootSrc
+            # Path inputs pointing to project root (path = ".") should use rootSrc
+            # to avoid fetchTree hashing the entire project directory
+            else if node.locked.type or null == "path" && node.locked.path or null == "." then
+              rootSrc
+            else
+              let
+                locked = node.locked;
+                isRelativePath = p: p != null && (builtins.substring 0 2 p == "./" || builtins.substring 0 3 p == "../");
+                # Resolve relative paths against src
+                resolvedLocked = locked
+                  // (if locked.type or null == "path" && isRelativePath (locked.path or null)
+                then { path = toString src + "/${locked.path}"; }
+                else { })
+                  // (if locked.type or null == "git" && isRelativePath (locked.url or null)
+                then { url = toString src + "/${locked.url}"; }
+                else { });
+              in
+              builtins.fetchTree (node.info or { } // removeAttrs resolvedLocked [ "dir" ]);
+
+          subdir = if key == lockFile.root then "" else node.locked.dir or "";
+
+          outPath = sourceInfo + ((if subdir == "" then "" else "/") + subdir);
+
+          # Resolve a input spec into a node name. An input spec is
+          # either a node name, or a 'follows' path from the root
+          # node.
+          resolveInput =
+            inputSpec: if builtins.isList inputSpec then getInputByPath lockFile.root inputSpec else inputSpec;
+
+          # Follow an input path (e.g. ["dwarffs" "nixpkgs"]) from the
+          # root node, returning the final node.
+          getInputByPath =
+            nodeName: path:
+            if path == [ ] then
+              nodeName
+            else
+              getInputByPath
+                # Since this could be a 'follows' input, call resolveInput.
+                (resolveInput lockFile.nodes.${nodeName}.inputs.${builtins.head path})
+                (builtins.tail path);
+
+          inputs = builtins.mapAttrs (inputName: inputSpec: allNodes.${resolveInput inputSpec}) (
+            node.inputs or { }
+          );
+
+          # Only import flake.nix for non-root nodes (root doesn't need it)
+          flake = if key == lockFile.root then null else import (outPath + "/flake.nix");
+
+          outputs = if key == lockFile.root then { } else flake.outputs (inputs // { self = result; });
+
+          # Lazy devenv evaluation for this input
+          devenvEval =
+            let
+              bootstrapLib = import ./bootstrapLib.nix { inputs = inputs; };
+            in
+            bootstrapLib.mkDevenvForInput {
+              input = { inherit outPath sourceInfo; };
+              allInputs = inputs;
+              inherit system;
+            };
+
+          result =
+            outputs
+            // sourceInfo
+            // {
+              inherit outPath;
+              inherit inputs;
+              inherit outputs;
+              inherit sourceInfo;
+              _type = "flake";
+              devenv = devenvEval;
+            };
+
+          nonFlakeResult = sourceInfo // {
+            inherit outPath;
+            inherit inputs;
+            inherit sourceInfo;
+            _type = "flake";
+            devenv = devenvEval;
+          };
+
+        in
+        if node.flake or true && key != lockFile.root then
+          assert builtins.isFunction flake.outputs;
+          result
+        else
+          nonFlakeResult
+    )
+    lockFile.nodes;
+
+  result =
+    if !(builtins.pathExists lockFilePath) then
+      throw "${lockFilePath} does not exist"
+    else if lockFile.version >= 5 && lockFile.version <= 7 then
+      allNodes.${lockFile.root}
+    else
+      throw "lock file '${lockFilePath}' has unsupported version ${toString lockFile.version}";
+
+in
+{
+  inputs = result.inputs or { } // {
+    self = result;
+  };
+}

.devenv/nixpkgs-config-c7c9559ef5bdea25.nix

···
+let cfg = {}; in cfg // {
+  allowUnfreePredicate =
+    if cfg.allowUnfree or false then
+      (_: true)
+    else if (cfg.permittedUnfreePackages or []) != [] then
+      (pkg: builtins.elem ((builtins.parseDrvName (pkg.name or pkg.pname or pkg)).name) (cfg.permittedUnfreePackages or []))
+    else
+      (_: false);
+}

flake.lock

···
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1772290697,
-        "narHash": "sha256-MyLNx13P+pv1RszO1rMd3144NEeU/oU4iL+xOTpRoaU=",
+        "lastModified": 1774186997,
+        "narHash": "sha256-hyNVlhAqmwcBPl7XRkxbGcMt1BfCOdvuEfBDUf0k8Oo=",
         "owner": "ezKEa",
         "repo": "aagl-gtk-on-nix",
-        "rev": "dcb53a4cb4cb09ef7f08328428ba559be5b9f01b",
+        "rev": "546e95f7ec74892a31f883a10b1723c35f2c2edd",
         "type": "github"
       },
       "original": {
···
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1772478757,
-        "narHash": "sha256-OZ/rD87JVagLiHCz5M/kfu5n3+32G+kvoZ3F5xmzVng=",
+        "lastModified": 1774522439,
+        "narHash": "sha256-GvINrdGznE7mGlDNjW0/PMgOJlC+Nl9MkfxALB4QvWs=",
         "owner": "oddlama",
         "repo": "agenix-rekey",
-        "rev": "4b0b511675cc368956a3917f0710dd62ba7b4043",
+        "rev": "8b9c179bc1300ab130c90f2d25426bf0e7a2b58d",
         "type": "github"
       },
       "original": {
···
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1773403535,
-        "narHash": "sha256-47MZaFrHxNO8tVUAmtVnerXUw2WWVluBOiU9MulN/yM=",
+        "lastModified": 1774616169,
+        "narHash": "sha256-fP4bU3SOH5sefSl6EagqULFs+bXoo3h3VLQCCyJplo4=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "d45b5665cc638bad1b794350de02f4dd41b0bb47",
+        "rev": "e616c61cd9f7b05b32af266bc005fa266860dacf",
         "type": "github"
       },
       "original": {
···
         ]
       },
       "locked": {
-        "lastModified": 1772893680,
-        "narHash": "sha256-JDqZMgxUTCq85ObSaFw0HhE+lvdOre1lx9iI6vYyOEs=",
+        "lastModified": 1774104215,
+        "narHash": "sha256-EAtviqz0sEAxdHS4crqu7JGR5oI3BwaqG0mw7CmXkO8=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "8baab586afc9c9b57645a734c820e4ac0a604af9",
+        "rev": "f799ae951fde0627157f40aec28dec27b22076d0",
         "type": "github"
       },
       "original": {
···
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1773681856,
-        "narHash": "sha256-+bRqxoFCJFO9ZTFhcCkzNXbDT3b8AEk88fyjB7Is6eo=",
+        "lastModified": 1774647770,
+        "narHash": "sha256-UNNi14XiqRWWjO8ykbFwA5wRwx7EscsC+GItOVpuGjc=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "57d5560ee92a424fb71fde800acd6ed2c725dfce",
+        "rev": "02371c05a04a2876cf92e2d67a259e8f87399068",
         "type": "github"
       },
       "original": {
···
         "pre-commit-hooks": "pre-commit-hooks_2"
       },
       "locked": {
-        "lastModified": 1773731400,
-        "narHash": "sha256-cHoNqN9+QypmqSq+ht0jbHGVdeKyR6nz9BsZK3CnDXY=",
-        "rev": "f87d753987bf19553bab6e94db7356e80cdd8259",
+        "lastModified": 1774608105,
+        "narHash": "sha256-JBiiKbsJ0Mtq7AKJuQGD8V2jRRVeThwiIIDTGdh+rr4=",
+        "rev": "001e3fde8f5d3e81ede2c95eab414fcaf83a9233",
         "type": "tarball",
-        "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/f87d753987bf19553bab6e94db7356e80cdd8259.tar.gz?rev=f87d753987bf19553bab6e94db7356e80cdd8259"
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/001e3fde8f5d3e81ede2c95eab414fcaf83a9233.tar.gz?rev=001e3fde8f5d3e81ede2c95eab414fcaf83a9233"
       },
       "original": {
         "type": "tarball",
···
         ]
       },
       "locked": {
-        "lastModified": 1773715019,
-        "narHash": "sha256-bJ2f57E9rEMdNc6hFIVvtWFF/WpIRCGJvT7HTnls/rg=",
+        "lastModified": 1774665675,
+        "narHash": "sha256-GT3cOq5rmmjIqUDGj3vo7sVjyF8rJ2y7+bhMPVakAXY=",
         "owner": "fufexan",
         "repo": "nix-gaming",
-        "rev": "25efde53dc1b554e912bda2be1dc2508850dbe68",
+        "rev": "f2644f0aebb5805ca0ff778f9241ab8f69cd6675",
         "type": "github"
       },
       "original": {
···
         "rust-overlay": "rust-overlay_3"
       },
       "locked": {
-        "lastModified": 1773729530,
-        "narHash": "sha256-JdUZr+5F/eVZNSiu9Ysu9MDeahf01sqTVgG+WeBs9+k=",
+        "lastModified": 1774680845,
+        "narHash": "sha256-Rkkp/6kTbrM2GSCRKzdy3sYvLyaCQPAbnGR+icvfA+A=",
         "owner": "Janrupf",
         "repo": "nix-jetbrains-plugin-repository",
-        "rev": "45265243222d9939f877bc64a4c60fba163a2bc3",
+        "rev": "f7821c097e718a93b35b3f5b533c0408ccdbf18b",
         "type": "github"
       },
       "original": {
···
         "nixpkgs-nixcord": "nixpkgs-nixcord"
       },
       "locked": {
-        "lastModified": 1773707837,
-        "narHash": "sha256-TFK0EXOTihtOiqdipVuUWnA3O+2XALosoFGXgMmnRM0=",
+        "lastModified": 1774685703,
+        "narHash": "sha256-MQhm3HEVv9xHWQNIx/xp++q2+SUeH8hLohKZFIO7DZM=",
         "owner": "KaylorBen",
         "repo": "nixcord",
-        "rev": "a917a4b7ddd13539ecc0a4b5094f015ba7b192dc",
+        "rev": "60c5476d52d668dc5b8f89eddb687d988921fc93",
         "type": "github"
       },
       "original": {
···
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1773533765,
-        "narHash": "sha256-qonGfS2lzCgCl59Zl63jF6dIRRpvW3AJooBGMaXjHiY=",
+        "lastModified": 1774567711,
+        "narHash": "sha256-uVlOHBvt6Vc/iYNJXLPa4c3cLXwMllOCVfAaLAcphIo=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "f8e82243fd601afb9f59ad230958bd073795cbfe",
+        "rev": "3f6f874dfc34d386d10e434c48ad966c4832243e",
         "type": "github"
       },
       "original": {
···
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1773122722,
-        "narHash": "sha256-FIqHByVqxCprNjor1NqF80F2QQoiiyqanNNefdlvOg4=",
+        "lastModified": 1773821835,
+        "narHash": "sha256-TJ3lSQtW0E2JrznGVm8hOQGVpXjJyXY2guAxku2O9A4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "62dc67aa6a52b4364dd75994ec00b51fbf474e50",
+        "rev": "b40629efe5d6ec48dd1efba650c797ddbd39ace0",
         "type": "github"
       },
       "original": {
···
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1773389992,
-        "narHash": "sha256-wvfdLLWJ2I9oEpDd9PfMA8osfIZicoQ5MT1jIwNs9Tk=",
+        "lastModified": 1774106199,
+        "narHash": "sha256-US5Tda2sKmjrg2lNHQL3jRQ6p96cgfWh3J1QBliQ8Ws=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c06b4ae3d6599a672a6210b7021d699c351eebda",
+        "rev": "6c9a78c09ff4d6c21d0319114873508a6ec01655",
         "type": "github"
       },
       "original": {
···
     },
     "nixpkgs_6": {
       "locked": {
-        "lastModified": 1773646010,
-        "narHash": "sha256-iYrs97hS7p5u4lQzuNWzuALGIOdkPXvjz7bviiBjUu8=",
+        "lastModified": 1774386573,
+        "narHash": "sha256-4hAV26quOxdC6iyG7kYaZcM3VOskcPUrdCQd/nx8obc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5b2c2d84341b2afb5647081c1386a80d7a8d8605",
+        "rev": "46db2e09e1d3f113a13c0d7b81e2f221c63b8ce9",
         "type": "github"
       },
       "original": {
···
     },
     "nixpkgs_8": {
       "locked": {
-        "lastModified": 1773597492,
-        "narHash": "sha256-hfwXTZODckRv5CdezNotB9NgF/6y7j2K0DRoPwMXpFQ=",
-        "rev": "a07d4ce6bee67d7c838a8a5796e75dff9caa21ef",
+        "lastModified": 1774273680,
+        "narHash": "sha256-WLxi1vfcykjq9Yb2umqBJs6lVM6MpV2tXfcrAjroxUk=",
+        "rev": "fdc7b8f7b30fdbedec91b71ed82f36e1637483ed",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre963717.a07d4ce6bee6/nixexprs.tar.xz?lastModified=1773597492&rev=a07d4ce6bee67d7c838a8a5796e75dff9caa21ef"
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre968305.fdc7b8f7b30f/nixexprs.tar.xz?lastModified=1774273680&rev=fdc7b8f7b30fdbedec91b71ed82f36e1637483ed"
       },
       "original": {
         "type": "tarball",
···
         "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1772402258,
-        "narHash": "sha256-3DmCFOdmbkFML1/G9gj8Wb+rCCZFPOQtNoMCpqOF8SA=",
+        "lastModified": 1774612943,
+        "narHash": "sha256-hRhq5cpDyBm/ZQyuzI+/YzQEVt35d/M6ko7ADfodw9s=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "21ae25e13b01d3b4cdc750b5f9e7bad68b150c10",
+        "rev": "2b9f8e1d659d1c7664e1b85ab1620c219672696c",
         "type": "github"
       },
       "original": {
···
         "sqlite-lib-src": "sqlite-lib-src"
       },
       "locked": {
-        "lastModified": 1773741732,
-        "narHash": "sha256-tx954p87D99JB9Xju6ye9Gwfsak84A+fvq0ceLmP2XI=",
+        "lastModified": 1774691944,
+        "narHash": "sha256-oZS+XQlxOHSmey93fd9q7F64bYDEG2Uxeivae1Vcjms=",
         "ref": "refs/heads/master",
-        "rev": "2302ce917997e532c1db5b913d5820383156ac26",
-        "revCount": 2070,
+        "rev": "2677d2b115aceea71bc759f6f391972e34579e80",
+        "revCount": 2121,
         "type": "git",
         "url": "https://tangled.org/@tangled.org/core"
       },
···
         "nixpkgs": "nixpkgs_8"
       },
       "locked": {
-        "lastModified": 1773740618,
-        "narHash": "sha256-gjfCl+KAEjpbDsN6bFYIp5KvGSDqhbxFb8jwHy+36ug=",
+        "lastModified": 1774574103,
+        "narHash": "sha256-tV82vKeyilWo95hfZ97Fx3mf//mEf3d28E987FlOjkQ=",
         "owner": "tgirlcloud",
         "repo": "pkgs",
-        "rev": "9b1d470a3c164d3d572b109bba892540d9df4df2",
+        "rev": "d6b5a263845e9c28ae30f378c673fc4a0843ea9e",
         "type": "github"
       },
       "original": {
···
         "nixpkgs": "nixpkgs_9"
       },
       "locked": {
-        "lastModified": 1773139928,
-        "narHash": "sha256-N6B+pB2VDkHbFn9xCmR0MnTbG/jWQyNj0Ad49JbP2lQ=",
+        "lastModified": 1774686616,
+        "narHash": "sha256-lq5hR4DGZBPpm6u8yC9KfbAqTGYfdb6+gESlBevvC7s=",
         "owner": "Inrixia",
         "repo": "TidaLuna",
-        "rev": "e5ee58c6a79e54aa914d95e774e551ee295f2cc4",
+        "rev": "a7cca8269d1ae95f8e8ed24732e0bf247f250fa4",
         "type": "github"
       },
       "original": {
···
         "systems": "systems_7"
       },
       "locked": {
-        "lastModified": 1773692852,
-        "narHash": "sha256-rVzZeR2gsPCgft+SHbxlxldejpOBI6bwj6gC24XpEIk=",
+        "lastModified": 1774616856,
+        "narHash": "sha256-ztKS2b29Lp0tJ29KxSir2GYhhJexGROzz6sIFsmfh4Y=",
         "owner": "vicinaehq",
         "repo": "vicinae",
-        "rev": "f3dc9cb4696dda1218f00f2756cf25882fa5df9b",
+        "rev": "9947898ef0a87feb257c6f8254ed96f7321abf3a",
         "type": "github"
       },
       "original": {

modules/nixos/services/nextcloud.nix

···
   config = (mkMerge [
     (mkIf cfg.enable {
       # Create secrets
-      #age.secrets."nextcloud-adminpass".rekeyFile = "${self}/secrets/nextcloud-adminpass.age";
+      age.secrets."nextcloud-adminpass".rekeyFile = "${self}/secrets/nextcloud-adminpass.age";
 
       services = {
         nextcloud = {
···
           database.createLocally = true;
 
           config = {
-            #adminpassFile = config.age.secrets."nextcloud-adminpass".path;
+            adminpassFile = config.age.secrets."nextcloud-adminpass".path;
 
             dbhost = "postgresql://nextcloud?host=/run/postgresql";
           };

systems/apple/default.nix

···
 }:
 {
   imports = [
-    # ./fileSystem.nix TODO
+    ./fileSystem.nix
   ];
 
   networking.hostName = "apple";

systems/apple/fileSystem.nix

···
+{
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/bd81acdf-e2c7-41bb-92e1-ddcdd46e2da9";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/6023-7222";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/358f4ce3-9e14-4cf8-ab79-435ebb109db6"; }
+    ];
+}

systems/apple/key.pub

···
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN5sgA7jPn0E2tPCBhrIZqliItfVloJzUyUuRdXa34bi root@apricot
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH5FxHEqMMrhRolSjbas5LnKO6aAzR2tjDPvPCzianb5 root@nixos

systems/apricot/key.pub

···
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN5sgA7jPn0E2tPCBhrIZqliItfVloJzUyUuRdXa34bi root@apricot

systems/apricot/secrets/316fdabd78add2a2906fbabe7f0de2b0-semiko-passwd.age

···
-age-encryption.org/v1
--> ssh-ed25519 1a/qJw LyTQvqCwraMVTYkCfh5x7IMHv/X5GmPefz0caCQXyy0
-/glNOsQ4F+FkCJMtM9Hg68FByhPIsbAmK8cVX5TsAHA
--> (o;~}U-grease L\ %Hv^' vZ/ N|CSJ
-votex75SRJfS8BjM7+w
---- Pcn8JzlSGwWcEwiQMoAWFmmuSiVGihSrgLOEGqJhEh4
-�f"�چM��<��N�m�\�1��L����_���v�t*�dqDT�8W~���d!�Qer��F���^"T���IT?����4��k뼸�m^g���wm��

systems/pineapple/default.nix

···
 
   networking.hostName = "pineapple";
 
+  # TODO
+  virtualisation.waydroid.enable = true;
+  virtualisation.waydroid.package = pkgs.waydroid-nftables;
+
+  # Network configuration for Waydroid
+  networking.firewall.trustedInterfaces = [ "waydroid0" ];
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+    "net.ipv4.conf.all.forwarding" = 1;
+    "net.ipv6.conf.all.forwarding" = 1;
+  };
+
   sylveon = {
     profiles = {
       graphical.enable = true;