flake.lock: Update

Flake lock file updates:

• Updated input 'agenix':
    'github:ryantm/agenix/96e078c646b711aee04b82ba01aefbff87004ded' (2025-04-26)
  → 'github:ryantm/agenix/4835b1dc898959d8547a871ef484930675cb47f1' (2025-05-18)
• Updated input 'catppuccin':
    'github:catppuccin/nix/a5db9e41a4dccfa5ffe38e6f1841a5f9ad5c5c04' (2025-05-02)
  → 'github:catppuccin/nix/3ba714046ee32373e88166e6e9474d6ae6a5b734' (2025-05-17)
• Updated input 'disko':
    'github:nix-community/disko/d0c543d740fad42fe2c035b43c9d41127e073c78' (2025-04-28)
  → 'github:nix-community/disko/cec44d77d9dacf0c91d3d51aff128fefabce06ee' (2025-05-19)
• Updated input 'dream2nix':
    'github:nix-community/dream2nix/8ce6284ff58208ed8961681276f82c2f8f978ef4' (2024-12-25)
  → 'github:nix-community/dream2nix/6fd6d9188f32efd1e1656b3c3e63a67f9df7b636' (2025-05-19)
• Updated input 'emacs-overlay':
    'github:nix-community/emacs-overlay/66bb2d7a4df96d0c1e63648850b7aed1b2e8d683' (2025-05-03)
  → 'github:nix-community/emacs-overlay/1b2bc802bbac29f4695e39fbf982944c0999b45d' (2025-05-19)
• Updated input 'emacs-overlay/nixpkgs':
    'github:NixOS/nixpkgs/f02fddb8acef29a8b32f10a335d44828d7825b78' (2025-05-01)
  → 'github:NixOS/nixpkgs/292fa7d4f6519c074f0a50394dbbe69859bb6043' (2025-05-18)
• Updated input 'emacs-overlay/nixpkgs-stable':
    'github:NixOS/nixpkgs/bf3287dac860542719fe7554e21e686108716879' (2025-05-02)
  → 'github:NixOS/nixpkgs/9b5ac7ad45298d58640540d0323ca217f32a6762' (2025-05-17)
• Updated input 'git-hooks-nix':
    'github:cachix/git-hooks.nix/dcf5072734cb576d2b0c59b2ac44f5050b5eac82' (2025-03-22)
  → 'github:cachix/git-hooks.nix/80479b6ec16fefd9c1db3ea13aeb038c60530f46' (2025-05-16)
• Updated input 'homeManager':
    'github:nix-community/home-manager/c0962eeeabfb8127713f859ec8a5f0e86dead0f2' (2025-05-03)
  → 'github:nix-community/home-manager/97118a310eb8e13bc1b9b12d67267e55b7bee6c8' (2025-05-18)
• Updated input 'lanzaboote':
    'github:nix-community/lanzaboote/995637eb3ab78eac33f8ee6b45cc2ecd5ede12ba' (2025-04-21)
  → 'github:nix-community/lanzaboote/2e425f3da6ce7f5b34fa6eaf7a2a7f78dbabcc85' (2025-05-12)
• Updated input 'lanzaboote/crane':
    'github:ipetkov/crane/bb1c9567c43e4434f54e9481eb4b8e8e0d50f0b5' (2025-03-09)
  → 'github:ipetkov/crane/dfd9a8dfd09db9aad544c4d3b6c47b12562544a5' (2025-05-03)
• Updated input 'lanzaboote/flake-parts':
    'github:hercules-ci/flake-parts/f4330d22f1c5d2ba72d3d22df5597d123fdb60a9' (2025-03-07)
  → 'github:hercules-ci/flake-parts/c621e8422220273271f52058f618c94e405bb0f5' (2025-04-01)
• Updated input 'lanzaboote/pre-commit-hooks-nix':
    'github:cachix/pre-commit-hooks.nix/b5a62751225b2f62ff3147d0a334055ebadcd5cc' (2025-03-07)
  → 'github:cachix/pre-commit-hooks.nix/fa466640195d38ec97cf0493d6d6882bc4d14969' (2025-05-06)
• Updated input 'lanzaboote/rust-overlay':
    'github:oxalica/rust-overlay/c777dc8a1e35407b0e80ec89817fe69970f4e81a' (2025-03-10)
  → 'github:oxalica/rust-overlay/5b07506ae89b025b14de91f697eba23b48654c52' (2025-05-12)
• Updated input 'lix':
    'git+https://git@git.lix.systems/lix-project/lix?ref=refs/heads/main&rev=4e84fd9a0061a04627ec6962c0ed08c2ad0b8a7f' (2025-05-02)
  → 'git+https://git@git.lix.systems/lix-project/lix?ref=refs/heads/main&rev=eb18a90afbe0ade000d957cda344a5bcb3d565d4' (2025-05-19)
• Updated input 'lix-module':
    'git+https://git.lix.systems/lix-project/nixos-module?ref=refs/heads/main&rev=fa69ae26cc32dda178117b46487c2165c0e08316' (2025-03-25)
  → 'git+https://git.lix.systems/lix-project/nixos-module?ref=refs/heads/main&rev=58baedd53f9da81fd728a4f3b08c378e5ba9ae58' (2025-05-10)
• Updated input 'nix-on-droid':
    'github:nix-community/nix-on-droid/5d88ff2519e4952f8d22472b52c531bb5f1635fc' (2024-09-06)
  → 'github:nix-community/nix-on-droid/40b8c7465f78887279a0a3c743094fa6ea671ab1' (2025-05-16)
• Updated input 'nixosHardware':
    'github:NixOS/nixos-hardware/72081c9fbbef63765ae82bff9727ea79cc86bd5b' (2025-04-29)
  → 'github:NixOS/nixos-hardware/e81fd167b33121269149c57806599045fd33eeed' (2025-05-13)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/f02fddb8acef29a8b32f10a335d44828d7825b78' (2025-05-01)
  → 'github:NixOS/nixpkgs/292fa7d4f6519c074f0a50394dbbe69859bb6043' (2025-05-18)
• Updated input 'treefmt-nix':
    'github:numtide/treefmt-nix/29ec5026372e0dec56f890e50dbe4f45930320fd' (2025-05-02)
  → 'github:numtide/treefmt-nix/ab0378b61b0d85e73a8ab05d5c6029b5bd58c9fb' (2025-05-17)

.forgejo/workflows/build.yaml

@@ -9,7 +9,13 @@ jobs:
         name: Checkout repository
       - name: Attic login
         run: attic login nixfleet http://sisko.wg.aciceri.dev:8081 ${{secrets.ATTIC_NIXFLEET_TOKEN}}
-      - name: Build with nix
+      - name: Setup SSH
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{secrets.FORGEJO_SSH_KEY}}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan github.com >> ~/.ssh/known_hosts
+      - name: Build with nix (x86_64-linux)
         run: nix-fast-build --no-nom --systems "x86_64-linux aarch64-linux" --attic-cache "nixfleet" --skip-cached --result-file result.json || true
       - name: Report checks
         run: report-checks

.forgejo/workflows/update-flake-lock.yaml

@@ -1,7 +1,7 @@
 name: update-flake-lock
 on:
   schedule:
-    - cron: "0 15 * * *" # daily at 15:00
+    - cron: "0 15 * * 1" # weekly on Monday at 15:00
 
 jobs:
   lockfile:

checks/default.nix

@@ -49,7 +49,7 @@
       build = _: nc: nc.config.system.build.toplevel;
     in
     {
-      x86_64-linux = lib.mapAttrs build { inherit (self.nixosConfigurations) picard; };
+      x86_64-linux = lib.mapAttrs build { inherit (self.nixosConfigurations) picard pike kirk; };
       aarch64-linux = lib.mapAttrs build {
         inherit (self.nixosConfigurations) sisko; # pbp;
       };

flake.lock

@@ -8,11 +8,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1745630506,
+        "lastModified": 1747575206,
-        "narHash": "sha256-bHCFgGeu8XjWlVuaWzi3QONjDW3coZDqSHvnd4l7xus=",
+        "narHash": "sha256-NwmAFuDUO/PFcgaGGr4j3ozG9Pe5hZ/ogitWhY+D81k=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "96e078c646b711aee04b82ba01aefbff87004ded",
+        "rev": "4835b1dc898959d8547a871ef484930675cb47f1",
         "type": "github"
       },
       "original": {
@@ -26,11 +26,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1746175539,
+        "lastModified": 1747519437,
-        "narHash": "sha256-/wjcn1CDQqOhwOoYKS8Xp0KejrdXSJZQMF1CbbrVtMw=",
+        "narHash": "sha256-uv9Wv59d+mckS2CkorOF484wp2G5TNGijdoBZ5RkAk0=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "a5db9e41a4dccfa5ffe38e6f1841a5f9ad5c5c04",
+        "rev": "3ba714046ee32373e88166e6e9474d6ae6a5b734",
         "type": "github"
       },
       "original": {
@@ -41,11 +41,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1741481578,
+        "lastModified": 1746291859,
-        "narHash": "sha256-JBTSyJFQdO3V8cgcL08VaBUByEU6P5kXbTJN6R0PFQo=",
+        "narHash": "sha256-DdWJLA+D5tcmrRSg5Y7tp/qWaD05ATI4Z7h22gd1h7Q=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "bb1c9567c43e4434f54e9481eb4b8e8e0d50f0b5",
+        "rev": "dfd9a8dfd09db9aad544c4d3b6c47b12562544a5",
         "type": "github"
       },
       "original": {
@@ -83,11 +83,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745812220,
+        "lastModified": 1747621015,
-        "narHash": "sha256-hotBG0EJ9VmAHJYF0yhWuTVZpENHvwcJ2SxvIPrXm+g=",
+        "narHash": "sha256-j0fo1rNxZvmFLMaE945UrbLJZAHTlQmq0/QMgOP4GTs=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "d0c543d740fad42fe2c035b43c9d41127e073c78",
+        "rev": "cec44d77d9dacf0c91d3d51aff128fefabce06ee",
         "type": "github"
       },
       "original": {
@@ -103,11 +103,11 @@
         "pyproject-nix": "pyproject-nix"
       },
       "locked": {
-        "lastModified": 1735160684,
+        "lastModified": 1747658429,
-        "narHash": "sha256-n5CwhmqKxifuD4Sq4WuRP/h5LO6f23cGnSAuJemnd/4=",
+        "narHash": "sha256-qZWuEdxmPx818qR61t3mMozJOvZSmTRUDPU4L3JeGgE=",
         "owner": "nix-community",
         "repo": "dream2nix",
-        "rev": "8ce6284ff58208ed8961681276f82c2f8f978ef4",
+        "rev": "6fd6d9188f32efd1e1656b3c3e63a67f9df7b636",
         "type": "github"
       },
       "original": {
@@ -122,11 +122,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1746240489,
+        "lastModified": 1747618089,
-        "narHash": "sha256-DWMG7jkpxrEGzTZZerDqaxT8X983tibFGfNeoWtX1yU=",
+        "narHash": "sha256-mbzwxQlxNamIMErEfwWRZ+ECmlQzxJ4eJvOM6/fxV5s=",
         "owner": "nix-community",
         "repo": "emacs-overlay",
-        "rev": "66bb2d7a4df96d0c1e63648850b7aed1b2e8d683",
+        "rev": "1b2bc802bbac29f4695e39fbf982944c0999b45d",
         "type": "github"
       },
       "original": {
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1741352980,
+        "lastModified": 1743550720,
-        "narHash": "sha256-+u2UunDA4Cl5Fci3m7S643HzKmIDAe+fiXrLqYsR2fs=",
+        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f4330d22f1c5d2ba72d3d22df5597d123fdb60a9",
+        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
         "type": "github"
       },
       "original": {
@@ -282,11 +282,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742649964,
+        "lastModified": 1747372754,
-        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
+        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
+        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
         "type": "github"
       },
       "original": {
@@ -387,11 +387,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746243165,
+        "lastModified": 1747565775,
-        "narHash": "sha256-DQycVmlyLQNLjLJ/FzpokVmbxGQ8HjQQ4zN4nyq2vII=",
+        "narHash": "sha256-B6jmKHUEX1jxxcdoYHl7RVaeohtAVup8o3nuVkzkloA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c0962eeeabfb8127713f859ec8a5f0e86dead0f2",
+        "rev": "97118a310eb8e13bc1b9b12d67267e55b7bee6c8",
         "type": "github"
       },
       "original": {
@@ -448,11 +448,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1745271491,
+        "lastModified": 1747056319,
-        "narHash": "sha256-4GAHjus6JRpYHVROMIhFIz/sgLDF/klBM3UHulbSK9s=",
+        "narHash": "sha256-qSKcBaISBozadtPq6BomnD+wIYTZIkiua3UuHLaD52c=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "995637eb3ab78eac33f8ee6b45cc2ecd5ede12ba",
+        "rev": "2e425f3da6ce7f5b34fa6eaf7a2a7f78dbabcc85",
         "type": "github"
       },
       "original": {
@@ -464,11 +464,11 @@
     "lix": {
       "flake": false,
       "locked": {
-        "lastModified": 1746186329,
+        "lastModified": 1747664434,
-        "narHash": "sha256-MLz0MjeVCaqvIvf5szUwNwYEiXC/lKWL0I2VS+6V/e0=",
+        "narHash": "sha256-ph9fCCvzgZ1PNOu82SSoceX/tYZ5MfmX3PkBxBiNxwA=",
         "ref": "refs/heads/main",
-        "rev": "4e84fd9a0061a04627ec6962c0ed08c2ad0b8a7f",
+        "rev": "eb18a90afbe0ade000d957cda344a5bcb3d565d4",
-        "revCount": 17824,
+        "revCount": 17900,
         "type": "git",
         "url": "https://git@git.lix.systems/lix-project/lix"
       },
@@ -489,11 +489,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742945498,
+        "lastModified": 1746839253,
-        "narHash": "sha256-MB/b/xcDKqaVBxJIIxwb81r8ZiGLeKEcqokATRRroo8=",
+        "narHash": "sha256-pRwi8Wn8Yofj459gq+3oIRy8F3SXeEJ6mzfIAUgM9nA=",
         "ref": "refs/heads/main",
-        "rev": "fa69ae26cc32dda178117b46487c2165c0e08316",
+        "rev": "58baedd53f9da81fd728a4f3b08c378e5ba9ae58",
-        "revCount": 138,
+        "revCount": 142,
         "type": "git",
         "url": "https://git.lix.systems/lix-project/nixos-module"
       },
@@ -554,11 +554,11 @@
         "nmd": "nmd"
       },
       "locked": {
-        "lastModified": 1725658585,
+        "lastModified": 1747382160,
-        "narHash": "sha256-P29z4Gt89n5ps1U7+qmIrj0BuRXGZQSIaOe2+tsPgfw=",
+        "narHash": "sha256-nlHPjA5GH4wdwnAoOzCt7BVLUKtIAAW2ClNGz2OxTrs=",
         "owner": "nix-community",
         "repo": "nix-on-droid",
-        "rev": "5d88ff2519e4952f8d22472b52c531bb5f1635fc",
+        "rev": "40b8c7465f78887279a0a3c743094fa6ea671ab1",
         "type": "github"
       },
       "original": {
@@ -569,11 +569,11 @@
     },
     "nixosHardware": {
       "locked": {
-        "lastModified": 1745955289,
+        "lastModified": 1747129300,
-        "narHash": "sha256-mmV2oPhQN+YF2wmnJzXX8tqgYmUYXUj3uUUBSTmYN5o=",
+        "narHash": "sha256-L3clA5YGeYCF47ghsI7Tcex+DnaaN/BbQ4dR2wzoiKg=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "72081c9fbbef63765ae82bff9727ea79cc86bd5b",
+        "rev": "e81fd167b33121269149c57806599045fd33eeed",
         "type": "github"
       },
       "original": {
@@ -647,11 +647,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1746183838,
+        "lastModified": 1747485343,
-        "narHash": "sha256-kwaaguGkAqTZ1oK0yXeQ3ayYjs8u/W7eEfrFpFfIDFA=",
+        "narHash": "sha256-YbsZyuRE1tobO9sv0PUwg81QryYo3L1F3R3rF9bcG38=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bf3287dac860542719fe7554e21e686108716879",
+        "rev": "9b5ac7ad45298d58640540d0323ca217f32a6762",
         "type": "github"
       },
       "original": {
@@ -663,17 +663,17 @@
     },
     "nixpkgsSisko": {
       "locked": {
-        "lastModified": 1742288794,
+        "lastModified": 1747542820,
-        "narHash": "sha256-Txwa5uO+qpQXrNG4eumPSD+hHzzYi/CdaM80M9XRLCo=",
+        "narHash": "sha256-GaOZntlJ6gPPbbkTLjbd8BMWaDYafhuuYRNrxCGnPJw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b6eaf97c6960d97350c584de1b6dcff03c9daf42",
+        "rev": "292fa7d4f6519c074f0a50394dbbe69859bb6043",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b6eaf97c6960d97350c584de1b6dcff03c9daf42",
+        "rev": "292fa7d4f6519c074f0a50394dbbe69859bb6043",
         "type": "github"
       }
     },
@@ -711,11 +711,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1746141548,
+        "lastModified": 1747542820,
-        "narHash": "sha256-IgBWhX7A2oJmZFIrpRuMnw5RAufVnfvOgHWgIdds+hc=",
+        "narHash": "sha256-GaOZntlJ6gPPbbkTLjbd8BMWaDYafhuuYRNrxCGnPJw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f02fddb8acef29a8b32f10a335d44828d7825b78",
+        "rev": "292fa7d4f6519c074f0a50394dbbe69859bb6043",
         "type": "github"
       },
       "original": {
@@ -742,11 +742,11 @@
     },
     "nixpkgs_6": {
       "locked": {
-        "lastModified": 1746141548,
+        "lastModified": 1747542820,
-        "narHash": "sha256-IgBWhX7A2oJmZFIrpRuMnw5RAufVnfvOgHWgIdds+hc=",
+        "narHash": "sha256-GaOZntlJ6gPPbbkTLjbd8BMWaDYafhuuYRNrxCGnPJw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f02fddb8acef29a8b32f10a335d44828d7825b78",
+        "rev": "292fa7d4f6519c074f0a50394dbbe69859bb6043",
         "type": "github"
       },
       "original": {
@@ -821,11 +821,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1741379162,
+        "lastModified": 1746537231,
-        "narHash": "sha256-srpAbmJapkaqGRE3ytf3bj4XshspVR5964OX5LfjDWc=",
+        "narHash": "sha256-Wb2xeSyOsCoTCTj7LOoD6cdKLEROyFAArnYoS+noCWo=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "b5a62751225b2f62ff3147d0a334055ebadcd5cc",
+        "rev": "fa466640195d38ec97cf0493d6d6882bc4d14969",
         "type": "github"
       },
       "original": {
@@ -906,11 +906,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1741573199,
+        "lastModified": 1747017456,
-        "narHash": "sha256-A2sln1GdCf+uZ8yrERSCZUCqZ3JUlOv1WE2VFqqfaLQ=",
+        "narHash": "sha256-C/U12fcO+HEF071b5mK65lt4XtAIZyJSSJAg9hdlvTk=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "c777dc8a1e35407b0e80ec89817fe69970f4e81a",
+        "rev": "5b07506ae89b025b14de91f697eba23b48654c52",
         "type": "github"
       },
       "original": {
@@ -1009,11 +1009,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746216483,
+        "lastModified": 1747469671,
-        "narHash": "sha256-4h3s1L/kKqt3gMDcVfN8/4v2jqHrgLIe4qok4ApH5x4=",
+        "narHash": "sha256-bo1ptiFoNqm6m1B2iAhJmWCBmqveLVvxom6xKmtuzjg=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "29ec5026372e0dec56f890e50dbe4f45930320fd",
+        "rev": "ab0378b61b0d85e73a8ab05d5c6029b5bd58c9fb",
         "type": "github"
       },
       "original": {

flake.nix

@@ -3,7 +3,7 @@
 
   inputs = {
     flakeParts.url = "github:hercules-ci/flake-parts";
-    nixpkgsSisko.url = "github:NixOS/nixpkgs/b6eaf97c6960d97350c584de1b6dcff03c9daf42";
+    nixpkgsSisko.url = "github:NixOS/nixpkgs/292fa7d4f6519c074f0a50394dbbe69859bb6043";
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     nixosHardware.url = "github:NixOS/nixos-hardware";
     homeManager = {

hmModules/emacs/init.el

@@ -566,13 +566,16 @@
   :mode "\\.hs\\'"
   :config
   (add-to-list 'eglot-server-programs
-	       '(haskell-ts-mode . ("haskell-language-server-wrapper" "--lsp"))))
+	           '(haskell-ts-mode . ("haskell-language-server" "--lsp"))))
+
+(use-package tidal
+  :custom ((tidal-interpreter "tidal")))
 
 (use-package purescript-mode
   :custom ((project-vc-extra-root-markers '("spago.dhall")))
   :hook ((purescript-mode . eglot-ensure)
-	 (purescript-mode . turn-on-purescript-indentation)
+	     (purescript-mode . turn-on-purescript-indentation)
-	 (purescript-mode . (lambda () (setq project-vc-extra-root-markers '("spago.dhall"))))))
+	     (purescript-mode . (lambda () (setq project-vc-extra-root-markers '("spago.dhall"))))))
 
 (use-package terraform-mode
   :after eglot
@@ -596,6 +599,15 @@
 (use-package gptscript-mode
   :mode "\\.gpt\\'")
 
+(use-package gptscript-mode
+  :mode "\\.gpt\\'")
+
+(use-package typst-ts-mode
+  :config
+  (add-to-list 'eglot-server-programs
+	           '(typst-ts-mode . ("tinymist" "lsp")))
+  :mode "\\.typ\\'")
+
 ;; FIXME
 ;; (use-package mmm-mode
 ;;   :config
@@ -613,7 +625,7 @@
 (use-package paredit
   :delight
   :hook ((lisp-mode . enable-paredit-mode)
-	 (emacs-lisp-mode . enable-paredit-mode)))
+	     (emacs-lisp-mode . enable-paredit-mode)))
 
 (use-package aggressive-indent
   :hook ((lisp-mode . aggressive-indent-mode)
@@ -1019,15 +1031,15 @@ This is meant to be an helper to be called from the window manager."
   :custom
   (gptel-model 'google/gemini-2.5-flash-preview)
   (gptel-backend (gptel-make-openai "OpenRouter"
-		   :host "openrouter.ai"
+		           :host "openrouter.ai"
-		   :endpoint "/api/v1/chat/completions"
+		           :endpoint "/api/v1/chat/completions"
-		   :key (lambda () (require 'f) (f-read-text (getenv "OPENAI_API_KEY_PATH")))
+		           :key (lambda () (require 'f) (f-read-text (getenv "OPENAI_API_KEY_PATH")))
-		   :stream t
+		           :stream t
-		   :models '(google/gemini-2.5-flash-preview))
+		           :models '(google/gemini-2.5-flash-preview))
-		 )
+		         )
   (gptel-default-mode 'org-mode)
   (gptel-org-branching-context nil) ;; this is cool but I don't feel comfortable with it
-  (gptel-use-tools nil)
+  (gptel-use-tools 't)
   
   :bind
   ("C-c a a" . gptel-add)
@@ -1042,80 +1054,163 @@ This is meant to be an helper to be called from the window manager."
   ;; (add-hook 'gptel-post-response-functions 'gptel-end-of-response)
   ;; (add-hook 'gptel-post-stream-hook 'gptel-auto-scroll)
 
-  (setq gptel-tools (mapcar (lambda (tool) (apply #'gptel-make-tool tool))
+  (defun ccr/edit-buffer (buffer-name old-string new-string)
-			    '((
+    "In BUFFER-NAME, replace OLD-STRING with NEW-STRING."
-			       :name "create_file"
+    (with-current-buffer buffer-name
-			       :function (lambda (path filename content)
+      (let ((case-fold-search nil))  ;; Case-sensitive search
-					   (let ((full-path (expand-file-name filename path)))
+        (save-excursion
-					     (with-temp-buffer
+          (goto-char (point-min))
-					       (insert content)
+          (let ((count 0))
-					       (write-file full-path))
+            (while (search-forward old-string nil t)
-					     (format-read "Created file %s in %s" filename path)))
+              (setq count (1+ count)))
-			       :description "Create a new file with the specified content"
+            (if (= count 0)
-			       :args (list '(:name "path"
+                (format "Error: Could not find text to replace in buffer %s" buffer-name)
-						   :type string
+              (if (> count 1)
-						   :description "The directory where to create the file")
+                  (format "Error: Found %d matches for the text to replace in buffer %s" count buffer-name)
-					   '(:name "filename"
+                (goto-char (point-min))
-						   :type string
+                (search-forward old-string)
-						   :description "The name of the file to create")
+                (replace-match new-string t t)
-					   '(:name "content"
+                (format "Successfully edited buffer %s" buffer-name))))))))
-						   :type string
+
-						   :description "The content to write to the file"))
+  (defun ccr/replace-buffer (buffer-name content)
-			       :category "filesystem"
+    "Completely replace contents of BUFFER-NAME with CONTENT."
-			       )
+    (with-current-buffer buffer-name
-			      ;; (
+      (erase-buffer)
-			      ;;  :name "run_command"
+      (insert content)
-			      ;;  :confirm 't
+      (format "Buffer replaced: %s" buffer-name)))
-			      ;;  :function (lambda (command)
+  
-			      ;; 		   (shell-command-to-string command))
+  (setq gptel-tools `(
-			      ;;  :description "Run arbitrary commands"
+                      ,(gptel-make-tool
-			      ;;  :args (list '(:name "command"
+                        :function (lambda (url)
-			      ;; 			   :type string
+                                    (with-current-buffer (url-retrieve-synchronously url)
-			      ;; 			   :description "The content to run e.g. 'ls *' or 'fd <pattern> <path>'"))
+                                      (goto-char (point-min))
-			      ;;  )
+                                      (forward-paragraph)
-			      (
+                                      (let ((dom (libxml-parse-html-region (point) (point-max))))
-			       :name "get_weather"
+                                        (run-at-time 0 nil #'kill-buffer (current-buffer))
-			       :function (lambda (location)
+                                        (with-temp-buffer
-					   (url-retrieve-synchronously "api.weather.com/..."
+                                          (shr-insert-document dom)
-								       location unit))
+                                          (buffer-substring-no-properties (point-min) (point-max))))))
-			       :description "Get the current weather in a given location"
+                        :name "read_url"
-			       :args (list '(:name "location"
+                        :description "Fetch and read the contents of a URL"
-						   :type string
+                        :args (list '(:name "url"
-						   :description "The city and state, e.g. San Francisco, CA")
+                                            :type string
-					   '(:name "unit"
+                                            :description "The URL to read"))
-						   :type string
+                        :category "web")
-						   :enum ["celsius" "farenheit"]
+                      ,(gptel-make-tool
-						   :description
+                        :function (lambda (filepath)
-						   "The unit of temperature, either 'celsius' or 'fahrenheit"
+                                    (with-temp-buffer
-						   :optional t
+                                      (insert-file-contents (expand-file-name filepath))
-						   ))
+                                      (buffer-string)))
-			       )
+                        :name "read_file"
-			      ))
+                        :description "Read and display the contents of a file"
-	)
+                        :args (list '(:name "filepath"
+                                            :type string
+                                            :description "Path to the file to read. Supports relative paths and ~."))
+                        :category "filesystem")
+                      ,(gptel-make-tool
+                        :function (lambda (directory)
+                                    (mapconcat #'identity
+                                               (directory-files directory)
+                                               "\n"))
+                        :name "list_directory"
+                        :description "List the contents of a given directory"
+                        :args (list '(:name "directory"
+                                            :type string
+                                            :description "The path to the directory to list"))
+                        :category "filesystem")
+                      ,(gptel-make-tool
+                        :function (lambda () (mapcar 'buffer-name (buffer-list)))
+                        :name "list_buffers"
+                        :description "Return a list containing all the Emacs buffers"
+                        :category "emacs")
+                      ,(gptel-make-tool
+                        :function (lambda (buffer)
+                                    (unless (buffer-live-p (get-buffer buffer))
+                                      (error "Error: buffer %s is not live." buffer))
+                                    (with-current-buffer buffer
+                                      (buffer-substring-no-properties (point-min) (point-max))))
+                        :name "read_buffer"
+                        :description "Return the contents of an Emacs buffer"
+                        :args (list '(:name "buffer"
+                                            :type string
+                                            :description "The name of the buffer whose contents are to be retrieved"))
+                        :category "emacs")
+                      ,(gptel-make-tool
+                        :function (lambda (buffer text)
+                                    (with-current-buffer (get-buffer-create buffer)
+                                      (save-excursion
+                                        (goto-char (point-max))
+                                        (insert text)))
+                                    (format "Appended text to buffer %s" buffer))
+                        :name "append_to_buffer"
+                        :description "Append text to an Emacs buffer. If the buffer does not exist, it will be created."
+                        :confirm t
+                        :args (list '(:name "buffer"
+                                            :type string
+                                            :description "The name of the buffer to append text to.")
+                                    '(:name "text"
+                                            :type string
+                                            :description "The text to append to the buffer."))
+                        :category "emacs")
+                      ,(gptel-make-tool
+                        :name "EditBuffer"
+                        :function #'ccr/edit-buffer
+                        :description "Edits Emacs buffers"
+                        :confirm t
+                        :args '((:name "buffer_name"
+                                       :type string
+                                       :description "Name of the buffer to modify"
+                                       :required t)
+                                (:name "old_string"
+                                       :type string
+                                       :description "Text to replace (must match exactly)"
+                                       :required t)
+                                (:name "new_string"
+                                       :type string
+                                       :description "Text to replace old_string with"
+                                       :required t))
+                        :category "edit")
+                      ,
+                      (gptel-make-tool
+                       :name "ReplaceBuffer"
+                       :function #'ccr/replace-buffer
+                       :description "Completely overwrites buffer contents"
+                       :confirm t
+                       :args '((:name "buffer_name"
+                                      :type string
+                                      :description "Name of the buffer to overwrite"
+                                      :required t)
+                               (:name "content"
+                                      :type string
+                                      :description "Content to write to the buffer"
+                                      :required t))
+                       :category "edit")
+                      ))
+
   
   (defun ccr/suggest-eshell-command ()
     (interactive)
     (save-excursion
       (eshell-bol)
       (let ((start-pos (point))
-	    (end-pos (line-end-position)))
+	        (end-pos (line-end-position)))
-	(gptel-request
+	    (gptel-request
-	    (buffer-substring-no-properties start-pos end-pos) ;the prompt
+	        (buffer-substring-no-properties start-pos end-pos) ;the prompt
-	  :system "You are proficient with emacs shell (eshell), translate the following to something I could directly prompt to the shell. Your responses should only be code, without explanation or formatting or quoting."
+	      :system "You are proficient with emacs shell (eshell), translate the following to something I could directly prompt to the shell. Your responses should only be code, without explanation or formatting or quoting."
-	  :buffer (current-buffer)
+	      :buffer (current-buffer)
-	  :context (cons (set-marker (make-marker) start-pos)
+	      :context (cons (set-marker (make-marker) start-pos)
-			 (set-marker (make-marker) end-pos))
+			             (set-marker (make-marker) end-pos))
-	  :callback
+	      :callback
-	  (lambda (response info)
+	      (lambda (response info)
-	    (if (not response)
+	        (if (not response)
-		(message "ChatGPT response failed with: %s" (plist-get info :status))
+		        (message "ChatGPT response failed with: %s" (plist-get info :status))
-	      (kill-region start-pos end-pos)
+	          (kill-region start-pos end-pos)
-	      (insert response)))))))
+	          (insert response)))))))
 
   (add-to-list 'display-buffer-alist
                '("^\\*ChatGPT\\*"
-		 (display-buffer-full-frame)
+		         (display-buffer-full-frame)
-		 (name . "floating")))
+		         (name . "floating")))
 
   (defun ccr/start-chatgpt () ;; Used from outside Emacs by emacsclient --eval
     (display-buffer (gptel "*ChatGPT*"))
@@ -1131,9 +1226,9 @@ This is meant to be an helper to be called from the window manager."
   (require 'password-store-otp) ;; FIXME use `use-pacakge' idiomatic way
   
   :bind (("C-c p p" . password-store-copy)
-	 ("C-c p o" . password-store-otp-token-copy)
+	     ("C-c p o" . password-store-otp-token-copy)
-	 ("C-c p e" . password-store-edit)
+	     ("C-c p e" . password-store-edit)
-	 ("C-c p i" . password-store-insert)))
+	     ("C-c p i" . password-store-insert)))
 
 (use-package with-editor
   :init (shell-command-with-editor-mode +1))

hmModules/gpg/default.nix

@@ -2,7 +2,7 @@
 {
   services.gpg-agent = {
     enable = true;
-    pinentryPackage = pkgs.pinentry-rofi.override {
+    pinentry.package = pkgs.pinentry-rofi.override {
       rofi = pkgs.rofi-wayland;
     };
     extraConfig = ''

hmModules/jellyfin/default.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.jellyfin-media-player ];
+}

hmModules/niri/config.kdl

@@ -19,7 +19,7 @@ input {
     touchpad {
         // off
         tap
-        // dwt
+        dwt
         // dwtp
         natural-scroll
         // accel-speed 0.2

hmModules/shell/catppuccin_mocha.omp.json

@@ -0,0 +1,61 @@
+{
+  "$schema": "https://raw.githubusercontent.com/JanDeDobbeleer/oh-my-posh/main/themes/schema.json",
+  "palette": {
+    "os": "#ACB0BE",
+    "closer": "p:os",
+    "pink": "#F5C2E7",
+    "lavender": "#B4BEFE",
+    "blue": "#89B4FA"
+  },
+  "blocks": [
+    {
+      "alignment": "left",
+      "segments": [
+        {
+          "foreground": "p:blue",
+          "style": "plain",
+          "template": "{{ .UserName }}@{{ .HostName }} ",
+          "type": "session"
+        },
+        {
+          "foreground": "p:pink",
+          "properties": {
+            "folder_icon": "..\ue5fe..",
+            "home_icon": "~",
+            "style": "agnoster_short"
+          },
+          "style": "plain",
+          "template": "{{ .Path }} ",
+          "type": "path"
+        },
+        {
+          "foreground": "p:lavender",
+          "properties": {
+            "branch_icon": "\ue725 ",
+            "cherry_pick_icon": "\ue29b ",
+            "commit_icon": "\uf417 ",
+            "fetch_status": false,
+            "fetch_upstream_icon": false,
+            "merge_icon": "\ue727 ",
+            "no_commits_icon": "\uf0c3 ",
+            "rebase_icon": "\ue728 ",
+            "revert_icon": "\uf0e2 ",
+            "tag_icon": "\uf412 "
+          },
+          "template": "{{ .HEAD }} ",
+          "style": "plain",
+          "type": "git"
+        },
+        {
+          "style": "plain",
+          "foreground": "p:closer",
+          "template": "\uf105",
+          "type": "text"
+        }
+      ],
+      "type": "prompt"
+    }
+  ],
+  "final_space": true,
+  "version": 3
+}

hmModules/shell/default.nix

@@ -84,7 +84,12 @@
   programs.thefuck.enable = true;
   programs.oh-my-posh = {
     enable = true;
-    useTheme = "catppuccin_mocha";
+    # same as "captuccin_mocha" but without the OS logo
+    settings = lib.mkForce (
+      builtins.fromJSON (
+        builtins.unsafeDiscardStringContext (builtins.readFile ./catppuccin_mocha.omp.json)
+      )
+    );
   };
 
   programs.zellij.enableBashIntegration = false;

hmModules/spotify/default.nix

@@ -9,18 +9,18 @@ in
 {
   home.packages = [ spotify-adblocked ];
 
-  systemd.user.services.spotify-adblocked = {
+  # systemd.user.services.spotify-adblocked = {
-    Install.WantedBy = [ "graphical-session.target" ];
+  #   Install.WantedBy = [ "graphical-session.target" ];
 
-    Unit = {
+  #   Unit = {
-      Description = "Spotify";
+  #     Description = "Spotify";
-      PartOf = [ "graphical-session.target" ];
+  #     PartOf = [ "graphical-session.target" ];
-    };
+  #   };
 
-    Service = {
+  #   Service = {
-      ExecStart = lib.getExe spotify-adblocked;
+  #     ExecStart = lib.getExe spotify-adblocked;
-      Restart = "on-failure";
+  #     Restart = "on-failure";
-      RestartSec = 3;
+  #     RestartSec = 3;
-    };
+  #   };
-  };
+  # };
 }

hosts/default.nix

@@ -109,6 +109,7 @@
           "home-assistant-token".owner = "prometheus";
           "grafana-password".owner = "grafana";
           "cloudflare-dyndns-api-token" = { };
+          "cloudflare-api-tokens" = { };
           "restic-hetzner-password" = { };
           "hass-ssh-key".owner = "hass";
           "sisko-attic-environment-file".owner = "atticd";

hosts/pike/default.nix

@@ -89,6 +89,7 @@
       "zoom"
       "pantalaimon"
       "gimp"
+      "jellyfin"
     ];
     extraGroups = [ "plugdev" ];
     backupPaths = [ ];

hosts/sisko/default.nix

@@ -36,6 +36,8 @@
       "amule"
       "adguard-home"
       "garmin-grafana"
+      # "dump1090"
+      "arbi"
     ]
     ++ [
       ./disko.nix

lib/default.nix

@@ -4,6 +4,7 @@
       ccr-ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIm9Sl/I+5G4g4f6iE4oCUJteP58v+wMIew9ZuLB+Gea";
       oneplus8t = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO8da1Mf11vXFF0kVDgxocVoGwpHHMEs9emS9T+v8hLb oneplus8t";
       hercules-ci-agent = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGPupm00BiveTIYF6CNwuMijF5VvEaPDMjvt+vMlAy+N hercules-ci-agent";
+      forgejo-ci = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH5mbqLoZ/0J45J7J+17XMGv/dXs3DGABJsnvDv4rgC9 forgjeo-ci";
     };
     hosts = {
       kirk = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAH49KzayIro3L1bteR7nwupMM/vKlDh05t5/DFD9/uz";

modules/amule/default.nix

@@ -1,34 +1,46 @@
-{ config, lib, ... }:
+{ config, pkgs, ... }:
+let
+  rev = "966199fe1dccc9c6c7016bdb1d9582f27797bc02";
+  amule-flake = builtins.getFlake "github:NixOS/nixpkgs/${rev}";
+  inherit (amule-flake.legacyPackages.${pkgs.system}) amule-daemon amule-web;
+in
 {
-  users.users.amule = {
+  disabledModules = [ "services/networking/amuled.nix" ];
-    isSystemUser = true;
+  documentation.nixos.enable = false;
-    group = "amule";
+
-    extraGroups = [ "amule" ];
+  imports = [ "${amule-flake}/nixos/modules/services/networking/amuled.nix" ];
-    home = config.services.amule.dataDir;
-  };
 
-  users.groups.amule = { };
   services.amule = {
-    dataDir = "/mnt/hd/amule";
     enable = true;
-    user = "amule";
+    package = amule-daemon;
+    amuleWebPackage = amule-web;
+    openPeerPorts = true;
+    openWebServerPort = true;
+    # TODO the service is accessible only from the VPN
+    # however better using agenix
+    ExternalConnectPasswordFile = pkgs.writeText "password" "pippo";
+    WebServerPasswordFile = pkgs.writeText "password" "pippo";
+    settings = {
+      eMule = {
+        IncomingDir = "/mnt/hd/amule";
+        TempDir = "/mnt/hd/amule/Temp";
+      };
+      WebServer = {
+        Enabled = 1;
+      };
+    };
   };
 
-  # sometimes the service crashes with a segfeault without any reason...
-  systemd.services.amuled.serviceConfig.Restart = lib.mkForce "always";
-
   environment.persistence."/persist".directories = [
     config.services.amule.dataDir
   ];
 
-  networking.firewall = {
+  services.nginx.virtualHosts."amule.sisko.wg.aciceri.dev" = {
-    allowedTCPPorts = [ 4662 ];
+    forceSSL = true;
-    allowedUDPPortRanges = [
+    useACMEHost = "aciceri.dev";
-      {
+    locations."/" = {
-        from = 4665;
+      proxyPass = "http://localhost:${builtins.toString config.services.amule.settings.WebServer.Port}";
-        to = 4672;
+    };
-      }
+    serverAliases = [ "amule.sisko.zt.aciceri.dev" ];
-    ];
   };
-
 }

modules/arbi/default.nix

@@ -0,0 +1,22 @@
+{ config, pkgs, ... }:
+let
+  rev = "d531730d9640160f0519ef4b3640f8da49dd96f8";
+  arbi-flake = builtins.getFlake "git+ssh://git@github.com/aciceri/arbi.git?rev=${rev}";
+in
+{
+  imports = [ arbi-flake.nixosModules.arbi ];
+
+  services.arbi = {
+    enable = true;
+    log_level = "debug";
+    configFile = pkgs.writeText "arbi-config.kdl" ''
+      endpoint "wss://eth-mainnet.g.alchemy.com/v2/<REDACTED>"
+      pairs_file "pairs.json"
+      concurrency 4
+    '';
+  };
+
+  environment.persistence."/persist".directories = [
+    config.services.arbi.dataDir
+  ];
+}

modules/common/default.nix

@@ -18,9 +18,10 @@
   nixpkgs.config.allowUnfree = true; # Forgive me Mr. Stallman :(
   system.switch.enableNg = true;
 
-  environment.systemPackages = [
+  environment.systemPackages = with pkgs; [
-    pkgs.btop
+    btop
-    pkgs.ncdu
+    ncdu
+    git
   ];
 
   # FIXME not the best place

modules/dump1090/default.nix

@@ -0,0 +1,31 @@
+{
+  pkgs,
+  ...
+}:
+let
+  dump1090-flake = builtins.getFlake "github:NixOS/nixpkgs/541f05042033467730fb8cedb08355dc91b94c74";
+  inherit (dump1090-flake.legacyPackages.${pkgs.system}) dump1090-fa;
+in
+{
+  imports = [ "${dump1090-flake}/nixos/modules/services/misc/dump1090-fa.nix" ];
+
+  hardware.rtl-sdr.enable = true;
+
+  disabledModules = [ "services/misc/dump10190-fa.nix" ];
+  documentation.nixos.enable = false;
+
+  services.dump1090-fa = {
+    enable = true;
+    package = dump1090-fa;
+  };
+
+  services.nginx.virtualHosts."dump1090.sisko.wg.aciceri.dev" = {
+    forceSSL = true;
+    useACMEHost = "aciceri.dev";
+    locations = {
+      "/".alias = "${dump1090-fa}/share/dump1090/";
+      "/data/".alias = "/run/dump1090-fa/";
+    };
+    serverAliases = [ "dump1090.sisko.zt.aciceri.dev" ];
+  };
+}

modules/forgejo-runners/default.nix

@@ -17,6 +17,7 @@ let
         gnugrep
         gawk
         git
+        openssh
         nix
         bash
         jq
@@ -38,15 +39,6 @@ let
     cp -a "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" $out/etc/ssl/certs/ca-bundle.crt
   '';
   numInstances = 1;
-  pushToCache = pkgs.writeScript "push-to-cache.sh" ''
-    #!/bin/sh
-    set -eu
-    set -f # disable globbing
-    export IFS=' '
-
-    echo "Uploading paths" $OUT_PATHS
-    exec nix copy --to "s3://cache?profile=default&region=eu-south-1&scheme=https&endpoint=cache.aciceri.dev" $OUT_PATHS
-  '';
 in
 lib.mkMerge [
   {
@@ -80,7 +72,6 @@ lib.mkMerge [
         cat <<NIX_CONFIG > etc/nix/nix.conf
         accept-flake-config = true
         experimental-features = nix-command flakes
-        post-build-hook = ${pushToCache}
         include access-tokens
         NIX_CONFIG
 
@@ -121,22 +112,9 @@ lib.mkMerge [
     nix.settings.trusted-users = [ "nixuser" ];
   }
   {
-    # Format of the token file:
     virtualisation = {
       podman.enable = true;
     };
-
-    # virtualisation.containers.storage.settings = {
-    #   storage.driver = "zfs";
-    #   storage.graphroot = "/var/lib/containers/storage";
-    #   storage.runroot = "/run/containers/storage";
-    #   storage.options.zfs.fsname = "zroot/root/podman";
-    # };
-
-    # virtualisation.containers.containersConf.settings = {
-    #   # podman seems to not work with systemd-resolved
-    #   containers.dns_servers = [ "8.8.8.8" "8.8.4.4" ];
-    # };
   }
   {
     systemd.services =

modules/garmin-grafana/default.nix

@@ -5,7 +5,8 @@
   ...
 }:
 let
-  garmin-grafana-flake = builtins.getFlake "github:NixOS/nixpkgs/1f03fefb44665cd2377912033de22ffaba2be48d";
+  rev = "f24579d13ee035af96d4a68b765af2aa4b1018b6";
+  garmin-grafana-flake = builtins.getFlake "github:NixOS/nixpkgs/${rev}";
   inherit (garmin-grafana-flake.legacyPackages.${pkgs.system}) garmin-grafana;
 in
 {

modules/nginx-base/default.nix

@@ -14,7 +14,7 @@
         dnsProvider = "cloudflare";
         dnsPropagationCheck = true;
         group = config.services.nginx.group;
-        environmentFile = config.age.secrets.cloudflare-dyndns-api-token.path;
+        environmentFile = config.age.secrets.cloudflare-api-tokens.path;
       };
     };
   };

modules/nix/default.nix

@@ -92,7 +92,7 @@
         ];
         protocol = "ssh-ng";
         sshUser = "root";
-        sshKey = "/home/${config.ccr.username}/.ssh/id_rsa";
+        sshKey = "/home/${config.ccr.username}/.ssh/id_ed25519";
       }
       ++ (lib.lists.optional (config.networking.hostName == "picard") {
         hostName = "mac.staging.mlabs.city?remote-program=/run/current-system/sw/bin/nix-store";

packages/emacs/packages.nix

@@ -206,6 +206,7 @@ let
           mixed-pitch
           visual-replace
           org-super-agenda
+          tidal
           # org-re-reveal # FIXME very not nice hash mismatch when building
         ]
       )
@@ -222,6 +223,9 @@ let
       eat
       corfu-terminal
       haskell-ts-mode
+    ])
+    ++ (with epkgs; [
+      typst-ts-mode # why this doesn't seem to be in elpaPackages?
     ]);
 in
 mainPackages ++ (builtins.attrValues extraPackages)

secrets/cloudflare-api-tokens.age

@@ -0,0 +1,17 @@
+age-encryption.org/v1
+-> ssh-rsa /AagBw
+hD7PDjueXimBVI/rjcYxN77LHV2eGytKcUbmh17aSL1CNM+eriURFao3tj52Hiaz
+3VMB6FxWUk9kzgjMPvf5WZukuZ2WbpPH8xlDV+6ZH7e/IzmjIfx8Ny14Mr1IF/Rx
+TBiCIAM19/1/mR9MiIBW85bb+Bb/waWIZAgxW3N1RpqH5+vAVqx0iY3XRF5+0gOq
+blP3yEw3QaL6FuY0+a+d/TnCsrz2Gi1Rba9oCUmkzOP96TsJYdN58Ut6nrHFkURK
+mShL2xBMLmfA8Z5ep+D8ueyQbcYpeU3KHcIcRM6dRTwQKvWXAVkRt1nUGasKrO9Y
+oJT9BrcxjtqgF/xhHRjWpamjFSI3mlJnJNEbruddDwQUccrJOvEzvqZ7GK0WoFX2
+HmhdDOiocMGWFeBPAKlNtU3+QmtZvhvOIgbjKhNxmCt1A/qxfvRk7Y2IDIBo+CFo
+sKMrT1tCo4UYaJdZYl64XYNCQb3C2EfO7Exrq3d2urNidzUbr9OBx7CCI1nu375c
+Qol9Kr28fLtxRuSZlrqIe9vKVYyLDPznrRlh6TmgqmMLIW70Y8cZwMtT8L8sOkcm
+A8MoxpWFzK4BKo0Iqmw6eZ3nx/0LAzkz005ZEwrmi2W/XxOWJgBiaLmu7YwnoGq0
+gzwwvA5V5MT6Iy7FzkQpMi0h/H4MZ0mcbihKdPun85Q
+-> ssh-ed25519 +vdRnA 23Gviu8hfWCEBPHP7xYIaOx34kFsxJJgJ/BNUDlb9Cg
+ROiMY2gw/rpNBmJnlRVb7Qhi5+8TY3Velj8gEZcaedI
+--- dhmvfQoCjuRUJtvXNI/eCjH0W+IeJm8bFRvYk1JihD0
+qMCÐ,݈½Ô<C2BD>êì‹9-\‘K<E28098>J¡ã]Á­ÿJ ð½(¡SnŸ°.ñQpá~Z$ó±eØ"êí”’\ù£'rS’l‰ÿuÜ
+UD <äÕ<C3A4>vÐÚáÓ]|
/g[†	W_“È>-fl•›8|w­ÊÙŠÈlš–¢ÜõB•[\òá.k(W±{=w 3N}¤qGÏ-w´Mb^‰ŒQ{

secrets/secrets.nix

@@ -92,6 +92,10 @@ with keys.users;
     deltaflyer
     pike
   ];
+  "cloudflare-api-tokens.age".publicKeys = [
+    ccr-ssh
+    sisko
+  ];
   "cloudflare-dyndns-api-token.age".publicKeys = [
     ccr-ssh
     sisko