chore(deps): lock file maintenance

.github/actions/update-flake-input/action.yaml

@@ -1,260 +0,0 @@
-name: Update Flake Input
-description: Update one GitHub-backed Nix flake input and create a pull request
-inputs:
-  input-name:
-    description: Name of the flake input to update
-    required: true
-  github-token:
-    description: Token used to query GitHub, push the update branch, and manage the pull request
-    required: true
-  base-branch:
-    description: Branch targeted by the pull request
-    required: false
-    default: main
-  minimum-release-age-days:
-    description: Minimum age of the target commit in days
-    required: false
-    default: "3"
-  skip-delay:
-    description: Update to the latest revision without applying the minimum age
-    required: false
-    default: "false"
-  auto-merge:
-    description: Enable squash auto-merge on the pull request
-    required: false
-    default: "true"
-  pr-labels:
-    description: Comma-separated labels to add when they already exist in the repository
-    required: false
-    default: dependencies,automated
-outputs:
-  updated:
-    description: Whether flake.lock changed
-    value: ${{ steps.update.outputs.updated }}
-  current-version:
-    description: Previous locked revision
-    value: ${{ steps.update.outputs.current_version }}
-  new-version:
-    description: New locked revision
-    value: ${{ steps.update.outputs.new_version }}
-  pr-url:
-    description: URL of the created or updated pull request
-    value: ${{ steps.pull-request.outputs.pr_url }}
-runs:
-  using: composite
-  steps:
-    - name: Update flake input
-      id: update
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.github-token }}
-        INPUT_NAME: ${{ inputs.input-name }}
-        MINIMUM_RELEASE_AGE_DAYS: ${{ inputs.minimum-release-age-days }}
-        SKIP_DELAY: ${{ inputs.skip-delay }}
-      run: |
-        set -euo pipefail
-
-        if [[ ! "$MINIMUM_RELEASE_AGE_DAYS" =~ ^[0-9]+$ ]]; then
-          echo "::error::minimum-release-age-days must be a non-negative integer"
-          exit 1
-        fi
-
-        node_key="$(
-          jq -er --arg input "$INPUT_NAME" '
-            .nodes.root.inputs[$input]
-            | if type == "array" then .[0] else . end
-          ' flake.lock
-        )"
-        input_type="$(jq -r --arg node "$node_key" '.nodes[$node].locked.type // ""' flake.lock)"
-        input_owner="$(jq -r --arg node "$node_key" '.nodes[$node].locked.owner // ""' flake.lock)"
-        input_repo="$(jq -r --arg node "$node_key" '.nodes[$node].locked.repo // ""' flake.lock)"
-        input_ref="$(jq -r --arg node "$node_key" '.nodes[$node].original.ref // ""' flake.lock)"
-        current_rev="$(jq -er --arg node "$node_key" '.nodes[$node].locked.rev' flake.lock)"
-
-        if [ "$input_type" != "github" ] || [ -z "$input_owner" ] || [ -z "$input_repo" ]; then
-          echo "::error::${INPUT_NAME} is not a GitHub-backed flake input"
-          exit 1
-        fi
-
-        echo "Input: $INPUT_NAME"
-        echo "Repository: ${input_owner}/${input_repo}"
-        echo "Current revision: $current_rev"
-
-        if [ "$SKIP_DELAY" = "true" ]; then
-          nix flake update "$INPUT_NAME"
-        else
-          cutoff="$(date --utc --date="${MINIMUM_RELEASE_AGE_DAYS} days ago" +%Y-%m-%dT%H:%M:%SZ)"
-          api_args=(
-            --method GET
-            "repos/${input_owner}/${input_repo}/commits"
-            -f "until=$cutoff"
-            -f per_page=1
-          )
-          if [ -n "$input_ref" ]; then
-            api_args+=(-f "sha=$input_ref")
-          fi
-
-          echo "Selecting the newest commit no later than $cutoff"
-          target_data="$(gh api "${api_args[@]}" --jq '.[0] | {sha: .sha, date: .commit.committer.date}')"
-          target_rev="$(jq -er '.sha' <<< "$target_data")"
-          target_date="$(jq -er '.date' <<< "$target_data")"
-
-          if [ "$target_rev" = "$current_rev" ]; then
-            echo "The input is already at the newest eligible revision"
-            {
-              echo "updated=false"
-              echo "current_version=$current_rev"
-              echo "new_version=$current_rev"
-            } >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          current_date="$(
-            gh api "repos/${input_owner}/${input_repo}/commits/${current_rev}" \
-              --jq '.commit.committer.date'
-          )"
-          current_timestamp="$(date --date="$current_date" +%s)"
-          target_timestamp="$(date --date="$target_date" +%s)"
-
-          if [ "$target_timestamp" -lt "$current_timestamp" ]; then
-            echo "The newest eligible revision is older than the current revision; skipping"
-            {
-              echo "updated=false"
-              echo "current_version=$current_rev"
-              echo "new_version=$current_rev"
-            } >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          nix flake update "$INPUT_NAME" \
-            --override-input "$INPUT_NAME" "github:${input_owner}/${input_repo}/${target_rev}"
-        fi
-
-        if git diff --quiet -- flake.lock; then
-          echo "No lock file changes were produced"
-          {
-            echo "updated=false"
-            echo "current_version=$current_rev"
-            echo "new_version=$current_rev"
-          } >> "$GITHUB_OUTPUT"
-          exit 0
-        fi
-
-        new_node_key="$(
-          jq -er --arg input "$INPUT_NAME" '
-            .nodes.root.inputs[$input]
-            | if type == "array" then .[0] else . end
-          ' flake.lock
-        )"
-        new_rev="$(jq -er --arg node "$new_node_key" '.nodes[$node].locked.rev' flake.lock)"
-
-        echo "New revision: $new_rev"
-        {
-          echo "updated=true"
-          echo "current_version=$current_rev"
-          echo "new_version=$new_rev"
-          echo "input_owner=$input_owner"
-          echo "input_repo=$input_repo"
-        } >> "$GITHUB_OUTPUT"
-    - name: Create or update pull request
-      id: pull-request
-      if: steps.update.outputs.updated == 'true'
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.github-token }}
-        INPUT_NAME: ${{ inputs.input-name }}
-        BASE_BRANCH: ${{ inputs.base-branch }}
-        CURRENT_REV: ${{ steps.update.outputs.current_version }}
-        NEW_REV: ${{ steps.update.outputs.new_version }}
-        INPUT_OWNER: ${{ steps.update.outputs.input_owner }}
-        INPUT_REPO: ${{ steps.update.outputs.input_repo }}
-        MINIMUM_RELEASE_AGE_DAYS: ${{ inputs.minimum-release-age-days }}
-        SKIP_DELAY: ${{ inputs.skip-delay }}
-        AUTO_MERGE: ${{ inputs.auto-merge }}
-        PR_LABELS: ${{ inputs.pr-labels }}
-      run: |
-        set -euo pipefail
-
-        branch_suffix="$(tr -c 'A-Za-z0-9._-' '-' <<< "$INPUT_NAME" | sed 's/-$//')"
-        branch="update-flake-${branch_suffix}"
-        current_short="${CURRENT_REV:0:8}"
-        new_short="${NEW_REV:0:8}"
-        title="chore(nix): update ${INPUT_NAME} to ${new_short}"
-
-        if [ "$SKIP_DELAY" = "true" ]; then
-          age_note="The minimum release age check was skipped for this manually requested update."
-        else
-          age_note="The target commit is at least ${MINIMUM_RELEASE_AGE_DAYS} days old."
-        fi
-
-        body="$(
-          printf '%s\n' \
-            "Automated update of the \`${INPUT_NAME}\` flake input." \
-            "" \
-            "- Previous revision: [\`${current_short}\`](https://github.com/${INPUT_OWNER}/${INPUT_REPO}/commit/${CURRENT_REV})" \
-            "- New revision: [\`${new_short}\`](https://github.com/${INPUT_OWNER}/${INPUT_REPO}/commit/${NEW_REV})" \
-            "- Changes: [compare](https://github.com/${INPUT_OWNER}/${INPUT_REPO}/compare/${CURRENT_REV}...${NEW_REV})" \
-            "" \
-            "$age_note"
-        )"
-
-        git config user.name "github-actions[bot]"
-        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-        git add flake.lock
-        git switch -C "$branch"
-        git commit -m "$title"
-
-        git fetch origin "refs/heads/${branch}:refs/remotes/origin/${branch}" || true
-        git push --force-with-lease origin "HEAD:refs/heads/${branch}"
-
-        label_args=()
-        available_labels="$(gh label list --limit 100 --json name --jq '.[].name')"
-        IFS=',' read -ra requested_labels <<< "$PR_LABELS"
-        for label in "${requested_labels[@]}"; do
-          label="$(xargs <<< "$label")"
-          if [ -n "$label" ] && grep -Fxq "$label" <<< "$available_labels"; then
-            label_args+=(--add-label "$label")
-          elif [ -n "$label" ]; then
-            echo "::warning::Skipping missing pull request label: $label"
-          fi
-        done
-
-        pr_number="$(
-          gh pr list \
-            --state open \
-            --head "$branch" \
-            --json number \
-            --jq '.[0].number // empty'
-        )"
-
-        if [ -n "$pr_number" ]; then
-          gh pr edit "$pr_number" \
-            --title "$title" \
-            --body "$body" \
-            "${label_args[@]}"
-        else
-          gh pr create \
-            --base "$BASE_BRANCH" \
-            --head "$branch" \
-            --title "$title" \
-            --body "$body"
-          pr_number="$(
-            gh pr list \
-              --state open \
-              --head "$branch" \
-              --json number \
-              --jq '.[0].number'
-          )"
-          if [ "${#label_args[@]}" -gt 0 ]; then
-            gh pr edit "$pr_number" "${label_args[@]}"
-          fi
-        fi
-
-        if [ "$AUTO_MERGE" = "true" ]; then
-          gh pr merge "$pr_number" --auto --squash ||
-            echo "::warning::Auto-merge could not be enabled; check the repository merge settings"
-        fi
-
-        pr_url="$(gh pr view "$pr_number" --json url --jq '.url')"
-        echo "pr_url=$pr_url" >> "$GITHUB_OUTPUT"
-        echo "Pull request: $pr_url"

.github/workflows/nixos-ci.yml

@@ -21,7 +21,7 @@ jobs:
       hosts: ${{ steps.hosts.outputs.hosts }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Install Nix
@@ -51,7 +51,7 @@ jobs:
         host: ${{ fromJSON(needs.validate.outputs.hosts) }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Install Nix

.github/workflows/publish-nixcache.yml

@@ -0,0 +1,64 @@
+name: Publish Nix cache
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+permissions:
+  contents: write
+  packages: write
+concurrency:
+  group: publish-nixcache-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  publish:
+    name: Build and publish uncached paths
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: true
+      - name: Install Nix
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            accept-flake-config = true
+            access-tokens = github.com=${{ github.token }}
+      - name: Configure cache signing
+        env:
+          NIX_SIGNING_KEY: ${{ secrets.NIX_SIGNING_KEY }}
+        run: |
+          set -euo pipefail
+          test -n "$NIX_SIGNING_KEY" || {
+            echo "NIX_SIGNING_KEY is required; refusing to publish unsigned cache paths." >&2
+            exit 1
+          }
+          signing_key="$RUNNER_TEMP/nixcache-signing-key"
+          umask 077
+          printf '%s' "$NIX_SIGNING_KEY" > "$signing_key"
+          nix key convert-secret-to-public < "$signing_key" > nixcache-public-key.txt
+          echo "NIXCACHE_SIGNING_KEY_FILE=$signing_key" >> "$GITHUB_ENV"
+      - name: Commit cache public key
+        run: |
+          set -euo pipefail
+          if git diff --quiet -- nixcache-public-key.txt; then
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add nixcache-public-key.txt
+          git commit -m "chore: publish Nix cache signing key"
+          git push
+      - name: Build and publish uncached store paths
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          NIXCACHE_REPO: ${{ github.repository }}
+          NIXCACHE_CONFIG_DIR: .
+        run: |
+          set -euo pipefail
+          nixcache_source="$(nix flake archive --json --no-write-lock-file github:cmspam/nixcache-oci/fb6006b5575da494dbbfc582e841d976ec06be6e | jq -r .path)"
+          source "$nixcache_source/lib/cache-builder.sh"
+          full_pipeline

.github/workflows/renovate.yml

@@ -11,17 +11,17 @@ concurrency:
   cancel-in-progress: false
 jobs:
   renovate:
-    name: Update GitHub Actions dependencies
+    name: Update Nix flake inputs
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       # Use a PAT or GitHub App token so Renovate PRs trigger the other workflows.
       - name: Run Renovate
-        uses: renovatebot/github-action@1a96852b0384df1837619d04c60b2d10d1f9ff08 # v46.1.21
+        uses: renovatebot/github-action@22e0a16091fc706b04affe6ae53d5e3358ac4023 # v46.1.19
         with:
           renovate-version: 43.262.1
           token: ${{ secrets.RENOVATE_TOKEN }}

.github/workflows/update-flake-inputs.yml

@@ -1,106 +0,0 @@
-name: Update Flake Inputs
-on:
-  schedule:
-    # Every day at 03:30 JST (18:30 UTC on the previous day).
-    - cron: "30 18 * * *"
-  workflow_dispatch:
-    inputs:
-      input:
-        description: Update only this flake input (empty updates all inputs)
-        required: false
-        type: string
-      skip-delay:
-        description: Update to the latest revision without the three-day delay
-        required: false
-        default: false
-        type: boolean
-      auto-merge:
-        description: Enable auto-merge after required checks pass
-        required: false
-        default: true
-        type: boolean
-permissions:
-  contents: write
-  pull-requests: write
-concurrency:
-  group: update-flake-inputs
-  cancel-in-progress: false
-jobs:
-  discover:
-    name: Discover flake inputs
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    outputs:
-      matrix: ${{ steps.inputs.outputs.matrix }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Build update matrix
-        id: inputs
-        env:
-          REQUESTED_INPUT: ${{ inputs.input }}
-        run: |
-          set -euo pipefail
-
-          github_inputs="$(
-            jq -c '
-              . as $lock
-              | [
-                  $lock.nodes.root.inputs
-                  | to_entries[]
-                  | .key as $name
-                  | (
-                      .value
-                      | if type == "array" then .[0] else . end
-                    ) as $node
-                  | select($lock.nodes[$node].locked.type == "github")
-                  | $name
-                ]
-              | sort
-            ' flake.lock
-          )"
-
-          if [ -n "$REQUESTED_INPUT" ]; then
-            if ! jq -e --arg input "$REQUESTED_INPUT" 'index($input) != null' <<< "$github_inputs" >/dev/null; then
-              echo "::error::Unknown or unsupported flake input: $REQUESTED_INPUT"
-              exit 1
-            fi
-            matrix="$(jq -cn --arg input "$REQUESTED_INPUT" '{input: [$input]}')"
-          else
-            matrix="$(jq -cn --argjson inputs "$github_inputs" '{input: $inputs}')"
-          fi
-
-          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
-          echo "Update matrix: $matrix"
-  update:
-    name: Update ${{ matrix.input }}
-    needs: discover
-    if: ${{ needs.discover.outputs.matrix != '{"input":[]}' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      max-parallel: 4
-      matrix: ${{ fromJSON(needs.discover.outputs.matrix) }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.RENOVATE_TOKEN }}
-      - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
-        with:
-          extra_nix_config: |
-            experimental-features = nix-command flakes
-            accept-flake-config = true
-            access-tokens = github.com=${{ secrets.RENOVATE_TOKEN }}
-      - name: Update input
-        uses: ./.github/actions/update-flake-input
-        with:
-          input-name: ${{ matrix.input }}
-          github-token: ${{ secrets.RENOVATE_TOKEN }}
-          skip-delay: ${{ github.event_name == 'workflow_dispatch' && inputs.skip-delay }}
-          auto-merge: ${{ github.event_name != 'workflow_dispatch' || inputs.auto-merge }}

README.md

@@ -179,6 +179,27 @@ sudo nixos-rebuild switch --flake .#<host> # Apply config
 sudo nixos-rebuild build --flake .#<host>  # Build without applying
 ```
 
+## Nix Binary Cache
+
+All normal hosts run `nixcache-oci` as a local proxy for
+`ghcr.io/moons-14/dotfiles/nix-cache`. The `Publish Nix cache` workflow builds
+the flake on pushes to `main` and uploads only store paths that were built by
+the runner rather than substituted from an existing cache. Nix still uses the
+official cache and configured Cachix caches for all other paths.
+
+The cache must remain public and signed:
+
+1. Generate a signing key outside this repository and save its contents as the
+   `NIX_SIGNING_KEY` GitHub Actions secret.
+2. Run the `Publish Nix cache` workflow. It commits `nixcache-public-key.txt`,
+   which clients trust on their next configuration rebuild.
+3. In GitHub Packages, make the `nix-cache` container package public.
+
+```sh
+nix key generate-secret > /tmp/nixcache-signing-key
+# Copy the contents into the NIX_SIGNING_KEY GitHub Actions secret, then delete the local file.
+```
+
 ## Inspired
 
 - [Zaney/zaneyos](https://gitlab.com/Zaney/zaneyos)

flake.lock

@@ -88,11 +88,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784665499,
+        "lastModified": 1782772816,
-        "narHash": "sha256-9BMxlTxCCDAeoNLtb1a/st7udtTIJep+wpUzquA29VU=",
+        "narHash": "sha256-s9BuFv0mRuZx9C1MF8qPHRdcAK14ONi0A5m6E2wqOoM=",
         "owner": "nix-community",
         "repo": "bun2nix",
-        "rev": "0f2a1f0b6f42cebe3b149bf62d38754c5e0e9729",
+        "rev": "5a39d717029e94163ac223aee8d5c9946cafed1c",
         "type": "github"
       },
       "original": {
@@ -104,14 +104,16 @@
     "codex-desktop-linux": {
       "inputs": {
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ]
       },
       "locked": {
-        "lastModified": 1784823421,
+        "lastModified": 1784389652,
-        "narHash": "sha256-/EM7Cr2Ai0VjNbKv+eIW0+iXT/NBW6WbPkCbf9w+u/o=",
+        "narHash": "sha256-LRnL+bLyHwyaOVwM3p1UZOAeFlwsWAXdhmbJCIXX2e4=",
         "owner": "ilysenko",
         "repo": "codex-desktop-linux",
-        "rev": "efcf40b5ab41323c8fa8eef5526c6a50c45fd8cd",
+        "rev": "bf6e6be58f7fbf1ea90a2a27ebbff12c4989e5a1",
         "type": "github"
       },
       "original": {
@@ -122,11 +124,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1784407669,
+        "lastModified": 1783203018,
-        "narHash": "sha256-gcFMcRjw0ZSn380Rx2QLlU1goUQeSrKX/DF12omI6+o=",
+        "narHash": "sha256-G6R9IT/xwFuu+CYBWDUAok6AdC4ERC4ZfPPFtEpxnZE=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "1316b7d278ad77a16aec024b71d971366e123bec",
+        "rev": "80db5bdc391be8a1794f6d8a2d56e3a84ebcede2",
         "type": "github"
       },
       "original": {
@@ -158,11 +160,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1782007937,
+        "lastModified": 1779670703,
-        "narHash": "sha256-PbnJr+eB+9Czol3ReI83dUgEhcn0sDK6TSy6ODTQm88=",
+        "narHash": "sha256-UdfMivNMwCCqQsYDg5pSz8X2IOaOrIZLIIy+Bg3CO2o=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "981bd332015397fb1ca033fa982bd61635160c78",
+        "rev": "942159e73e40bf785816f7f1f5feed9ef3d7c8f9",
         "type": "github"
       },
       "original": {
@@ -174,11 +176,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1767039857,
+        "lastModified": 1761588595,
-        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
         "type": "github"
       },
       "original": {
@@ -319,11 +321,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1778716662,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
         "type": "github"
       },
       "original": {
@@ -370,17 +372,17 @@
       "inputs": {
         "flake-compat": "flake-compat",
         "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs",
         "systems": "systems_2",
         "zig": "zig",
         "zon2nix": "zon2nix"
       },
       "locked": {
-        "lastModified": 1784838920,
+        "lastModified": 1783580960,
-        "narHash": "sha256-MTNHCKPqwjVcYh+DglaR3cQugMCz1kWDajV/nx2PDhw=",
+        "narHash": "sha256-41eBs4g66qLFEa6esgaCAs1hp1et5551Tqs/jriyI3c=",
         "owner": "moons-14",
         "repo": "ghostty",
-        "rev": "5c258c2530878166893d805fba7079b9742f1fc5",
+        "rev": "6260e9da0baba6c94c3e8f537558bc69085229b9",
         "type": "github"
       },
       "original": {
@@ -392,7 +394,7 @@
     "git-hooks-nix": {
       "inputs": {
         "flake-compat": "flake-compat_2",
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": "nixpkgs_2"
       },
       "locked": {
         "lastModified": 1784288435,
@@ -411,20 +413,18 @@
     "gnome-shell": {
       "flake": false,
       "locked": {
-        "host": "gitlab.gnome.org",
+        "lastModified": 1767737596,
-        "lastModified": 1776175984,
+        "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
-        "narHash": "sha256-RJFlFW8GiMei6oqUGrMkGEvVqOH8U7Q8abc1yK4VKD8=",
         "owner": "GNOME",
         "repo": "gnome-shell",
-        "rev": "e0fdc4c13250e9a9b8ea9594c83925274f4a5dca",
+        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
-        "type": "gitlab"
+        "type": "github"
       },
       "original": {
-        "host": "gitlab.gnome.org",
         "owner": "GNOME",
-        "ref": "50.1",
         "repo": "gnome-shell",
-        "type": "gitlab"
+        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
+        "type": "github"
       }
     },
     "home-manager": {
@@ -435,11 +435,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782657028,
+        "lastModified": 1770586272,
-        "narHash": "sha256-PHTCpYZCMzJYS3phhywqRAZphKVr2zjvlGYa+H20ZZ4=",
+        "narHash": "sha256-Ucci8mu8QfxwzyfER2DQDbvW9t1BnTUJhBmY7ybralo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "4ad9aaae70c9aaab504127f926c0fa9cfbc2b365",
+        "rev": "b1f916ba052341edc1f80d4b2399f1092a4873ca",
         "type": "github"
       },
       "original": {
@@ -500,11 +500,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1784568171,
+        "lastModified": 1783496806,
-        "narHash": "sha256-t17AqLEhPG6m27ipkp8mJd8Ug0XkdANFDVsgyIFBZcQ=",
+        "narHash": "sha256-6B6CQUk1dPc8l/+otaGiYbuX8qeX/0VmSUQ+qSn0/uA=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "f4b0aef3dba28677a5ca4b3416827aade60b5a0b",
+        "rev": "6183ac79eadb079a1e72fa2c60915601be669100",
         "type": "github"
       },
       "original": {
@@ -517,16 +517,18 @@
       "inputs": {
         "bun2nix": "bun2nix",
         "flake-parts": "flake-parts_2",
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ],
         "systems": "systems_3",
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1784838505,
+        "lastModified": 1784363791,
-        "narHash": "sha256-v9wgz4KSm259C+Yb9/Y/tPyylXto/bTyOQyiV599Ads=",
+        "narHash": "sha256-p9LRSnyqaiaOItDf3rMjWxlPsmLO7YhgBg4zd6nB0lA=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "b358b1d5b458d6bd9814d02b70fcd3c0cd61886f",
+        "rev": "a76249be5f5c1ce95c3a0e74930cb015d66718a0",
         "type": "github"
       },
       "original": {
@@ -539,17 +541,17 @@
       "inputs": {
         "niri-stable": "niri-stable",
         "niri-unstable": "niri-unstable",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": "nixpkgs_3",
         "nixpkgs-stable": "nixpkgs-stable",
         "xwayland-satellite-stable": "xwayland-satellite-stable",
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
       },
       "locked": {
-        "lastModified": 1784686714,
+        "lastModified": 1784380193,
-        "narHash": "sha256-6HCWRBQq/U2NPY2msnnysnWczZYzEzhS1UZURmrr2f0=",
+        "narHash": "sha256-XnpNipcSNWg+l9aHV/Ha3W1ot/r5FC7OT3//zZ9Vjbs=",
         "owner": "sodiboo",
         "repo": "niri-flake",
-        "rev": "4dfd38bad6150c07be6cc3fd7682787765092eea",
+        "rev": "26e0cddf2447ab5ec0824b1c9a076aa1480fc57a",
         "type": "github"
       },
       "original": {
@@ -578,11 +580,11 @@
     "niri-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1784570726,
+        "lastModified": 1783522755,
-        "narHash": "sha256-9EMn69JBcFWFgUM7f0VBAX+jBby5b9H3M59U75+5yI4=",
+        "narHash": "sha256-dI0HkX1djETia7cD/Y64h8BNIsSOfTRMzfNum2J6UhE=",
         "owner": "YaLTeR",
         "repo": "niri",
-        "rev": "7f26c3ee804fb6ed458ef7fb0e3c794f14e0b3bc",
+        "rev": "0777769e719b7c9b7c980d4ea66288bfbb4da5b3",
         "type": "github"
       },
       "original": {
@@ -619,11 +621,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784440659,
+        "lastModified": 1783864904,
-        "narHash": "sha256-Q5kNLlWngt7TaIIZoxDKWMHjiSaNRVqr70FqWCRRfr4=",
+        "narHash": "sha256-BQxN5UMg9FOevAsgBRwPxfxlh51Puj+dNn/8Dsi3sPM=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "4f8d52a3598b0dc7db7a5e7b419e3edd9d1ecfdb",
+        "rev": "1111b9bc836afb7e31a7014e8d1272de9b1c917d",
         "type": "github"
       },
       "original": {
@@ -632,16 +634,36 @@
         "type": "github"
       }
     },
-    "nixos-hardware": {
+    "nixcache-oci": {
       "inputs": {
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1784723954,
+        "lastModified": 1784393281,
-        "narHash": "sha256-1CfD8ZUjCkTgjsneLZ/lxCHhgDfqxxE7/GX0MmsgiqA=",
+        "narHash": "sha256-dlj3uQdaSpJzCxATrfGRlEX3i0UMbk2H0eVJdO2hTZY=",
+        "owner": "cmspam",
+        "repo": "nixcache-oci",
+        "rev": "7db80f3bc7e63645f655e6c66578088ffe4a1f97",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cmspam",
+        "repo": "nixcache-oci",
+        "type": "github"
+      }
+    },
+    "nixos-hardware": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_4"
+      },
+      "locked": {
+        "lastModified": 1784310968,
+        "narHash": "sha256-rkSPTePrKqs4dg+i7ZFCq93+HrClac6oSwXX927SVjA=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "a017f5b72210026af5b3ac5949f08d94380a6fbd",
+        "rev": "779c32a00155994c86cde8213a8dd4df139d4355",
         "type": "github"
       },
       "original": {
@@ -654,14 +676,14 @@
     "nixos-wsl": {
       "inputs": {
         "flake-compat": "flake-compat_4",
-        "nixpkgs": "nixpkgs_7"
+        "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1784642409,
+        "lastModified": 1784058842,
-        "narHash": "sha256-hcbDqFuySAJawljt5r0sKBCJKYnbtGD0T/ZIozH1Dq0=",
+        "narHash": "sha256-3u3tvbCIAid3Mv7RrJx13jusIEQC/HeKYhO/SUSxR3A=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "eaeb18da90024448a60eb1ec7132eafa4003404e",
+        "rev": "24c8dc8e0f2170e1a377be24dfadc7d9d21dc1ad",
         "type": "github"
       },
       "original": {
@@ -672,18 +694,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1772773019,
+        "lastModified": 1770537093,
-        "narHash": "sha256-E1bxHxNKfDoQUuvriG71+f+s/NT0qWkImXsYZNFFfCs=",
+        "narHash": "sha256-XV30uo8tXuxdzuV8l3sojmlPRLd/8tpMsOp4lNzLGUo=",
-        "owner": "NixOS",
+        "rev": "fef9403a3e4d31b0a23f0bacebbec52c248fbb51",
-        "repo": "nixpkgs",
+        "type": "tarball",
-        "rev": "aca4d95fce4914b3892661bcb80b8087293536c6",
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre942631.fef9403a3e4d/nixexprs.tar.xz"
-        "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "type": "tarball",
-        "ref": "nixos-unstable",
+        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
-        "repo": "nixpkgs",
-        "type": "github"
       }
     },
     "nixpkgs-lib": {
@@ -735,11 +754,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1784835677,
+        "lastModified": 1784364478,
-        "narHash": "sha256-99n/+kX5HRtEouTsNNyz5pMfIpNMp4Um/6nCEDQ9YDs=",
+        "narHash": "sha256-CdItYNdYUlm7NxqMVyQKqT2IxTwvapiPuRLWOyHTrbY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d4221905ef70b7f4a40701ce98e3e25c3d95d082",
+        "rev": "20535e48e12c86043b577b8518234ff5dbb26957",
         "type": "github"
       },
       "original": {
@@ -749,52 +768,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_10": {
-      "locked": {
-        "lastModified": 1772542754,
-        "narHash": "sha256-WGV2hy+VIeQsYXpsLjdr4GvHv5eECMISX1zKLTedhdg=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "8c809a146a140c5c8806f13399592dbcb1bb5dc4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_11": {
-      "locked": {
-        "lastModified": 1778869304,
-        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1782545840,
-        "narHash": "sha256-CAi8oAZaE6pTkcYQBnnOlvmfMgG/p1AO0FohKKN3J7I=",
-        "rev": "3d46470bb3030020f7e1361f33514854f5bfa86d",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1023445.3d46470bb303/nixexprs.tar.xz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
-      }
-    },
-    "nixpkgs_3": {
       "locked": {
         "lastModified": 1782918843,
         "narHash": "sha256-ETYnV9U7Sr+A45dohzZdfCZKOss4qrTkO+wgNZNvEc0=",
@@ -810,29 +784,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_3": {
       "locked": {
-        "lastModified": 1784555310,
+        "lastModified": 1784356753,
-        "narHash": "sha256-/FCliTPgiuV1owejZFNx3Ch9irdvkOfOFl+HHZ+DrtM=",
+        "narHash": "sha256-12KrbMiWLcf8m7pCvAtZh1ZrgF85ZXDXvfR/fWTKy84=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "421eebfd0ec7bccd4abe826ce62d7e6e83129493",
+        "rev": "61b7c44c4073f0b827768aff0049561b5110ea5a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_5": {
-      "locked": {
-        "lastModified": 1784497964,
-        "narHash": "sha256-vlHUuqAcbcH2RKmHbPiuQzbv1pnzzavXnI62RD0bqCU=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "241313f4e8e508cb9b13278c2b0fa25b9ca27163",
         "type": "github"
       },
       "original": {
@@ -842,7 +800,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_6": {
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1767892417,
         "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
@@ -855,7 +813,7 @@
         "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
       }
     },
-    "nixpkgs_7": {
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1783776592,
         "narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
@@ -871,13 +829,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_8": {
+    "nixpkgs_6": {
       "locked": {
-        "lastModified": 1784835692,
+        "lastModified": 1784280462,
-        "narHash": "sha256-yPpild1rF2EqcvlzprUlTbtZxJ44KsjEuDRtctIybOQ=",
+        "narHash": "sha256-DtoqIqM7VkR6NxAkcLpMwmi02USwWb3JdmNGLyhthc0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c76cb9d6c25d19547d892782bd84b22fc7b04d5f",
+        "rev": "293d6abedf0478e681a4dfcfcb35b30fc796a32f",
         "type": "github"
       },
       "original": {
@@ -887,7 +845,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_9": {
+    "nixpkgs_7": {
       "locked": {
         "lastModified": 1770107345,
         "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=",
@@ -903,6 +861,38 @@
         "type": "github"
       }
     },
+    "nixpkgs_8": {
+      "locked": {
+        "lastModified": 1772542754,
+        "narHash": "sha256-WGV2hy+VIeQsYXpsLjdr4GvHv5eECMISX1zKLTedhdg=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "8c809a146a140c5c8806f13399592dbcb1bb5dc4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_9": {
+      "locked": {
+        "lastModified": 1778869304,
+        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixvim": {
       "inputs": {
         "flake-parts": "flake-parts_3",
@@ -933,11 +923,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784838755,
+        "lastModified": 1784390676,
-        "narHash": "sha256-aTAnFf29sIVE9hpolWePKscnJfkJRdyFxEkdeP4y9YQ=",
+        "narHash": "sha256-d6YSbdMQM3A3+X0BU7NFX506U/CaRgyh2Jwe9WhiBg0=",
         "owner": "noctalia-dev",
         "repo": "noctalia",
-        "rev": "45ec7e33885540427d766c4a54e8f813dfdc9db9",
+        "rev": "5a20c9cf0ecc398c9391aa52ac075a0401f720c9",
         "type": "github"
       },
       "original": {
@@ -958,11 +948,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783439237,
+        "lastModified": 1780281641,
-        "narHash": "sha256-WUr8JF2v3n4Y30E5dxv4sAgNJXpVDBoCQNoQ/V4+n4o=",
+        "narHash": "sha256-M/+hUKoKbHXpV0xGVfELbN1Ds1aoe3pL5p5/t46YhVo=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "b70bb66c7bcd162642f3a609bc16843c7059f503",
+        "rev": "30f9ae2f04174de63ba8bcf3580ca90843b28a01",
         "type": "github"
       },
       "original": {
@@ -980,11 +970,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784288435,
+        "lastModified": 1783008725,
-        "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=",
+        "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9",
+        "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe",
         "type": "github"
       },
       "original": {
@@ -1006,9 +996,10 @@
         "niri-flake": "niri-flake",
         "nix-hazkey": "nix-hazkey",
         "nix-index-database": "nix-index-database",
+        "nixcache-oci": "nixcache-oci",
         "nixos-hardware": "nixos-hardware",
         "nixos-wsl": "nixos-wsl",
-        "nixpkgs": "nixpkgs_8",
+        "nixpkgs": "nixpkgs_6",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "nixvim": "nixvim",
         "noctalia": "noctalia",
@@ -1029,11 +1020,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784438913,
+        "lastModified": 1783488441,
-        "narHash": "sha256-NYF7ZM5ip0u+w1pBFDpIGEbrbgN/wpnLFAmBkWkYMXw=",
+        "narHash": "sha256-jmWf+H3iC/0z7/mmvTovaJx1E/LME1QyHkyk+AFfJPk=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "afacd6819d3765a05814ee8e3de74c77d42ac799",
+        "rev": "7dc3a177a239ed879c5581a80f6dc246c7e102f1",
         "type": "github"
       },
       "original": {
@@ -1044,11 +1035,11 @@
     },
     "services-flake": {
       "locked": {
-        "lastModified": 1784799366,
+        "lastModified": 1783213527,
-        "narHash": "sha256-aK4fmqmGbk0J2sUhex79NAZTd1002DNWNsfubO6aic0=",
+        "narHash": "sha256-yIVKacNpTvEY+xQf2MzNn6jerRrazrkXxTwmwTK4N7M=",
         "owner": "juspay",
         "repo": "services-flake",
-        "rev": "eed1ab55413afbb8fd7bc929076c73894e5104e0",
+        "rev": "1c9142a3d74abc53aed62687106ee15e873dc3ff",
         "type": "github"
       },
       "original": {
@@ -1079,7 +1070,7 @@
     },
     "soulver-cpp": {
       "inputs": {
-        "nixpkgs": "nixpkgs_11",
+        "nixpkgs": "nixpkgs_9",
         "nixpkgs-libxml2": "nixpkgs-libxml2"
       },
       "locked": {
@@ -1116,11 +1107,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1784676123,
+        "lastModified": 1784059683,
-        "narHash": "sha256-ndyanKzw90yX2nUVFmTuYqXidUNymtMfgmIHyNdhht0=",
+        "narHash": "sha256-q5MZrmKlg9A4ORx3EQcr7qkuidMU1gVZ+xJ3nCK+xgc=",
         "owner": "nix-community",
         "repo": "stylix",
-        "rev": "66714e5ce44269ecc58c20d9196da8dbe1b27a31",
+        "rev": "c8ccc31f3ea29dc3eb5b54945e5eb549529491d6",
         "type": "github"
       },
       "original": {
@@ -1269,11 +1260,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1781968807,
+        "lastModified": 1777806186,
-        "narHash": "sha256-yYO3Vw2M0y3TAUqt+9+Mj0zwP3XDTF5/PXcPhhFQ1ZM=",
+        "narHash": "sha256-PDF0/wObw4nIsSBeXVYLsloXOiphXCgIdsrNcVXguKs=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "2ccef2f4b22e3cab5a9292811f7133a07eeba4a7",
+        "rev": "0c94645546f4f3ddac77a1a5fce54eb95bf50795",
         "type": "github"
       },
       "original": {
@@ -1285,11 +1276,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1782012462,
+        "lastModified": 1778379944,
-        "narHash": "sha256-2iDiD8DQLwS1lGuD9TS8WlvNyDoTs6krWntJbtB2zGo=",
+        "narHash": "sha256-wPDFzMGSlARlw0Sfsn48Q2+jPSfk6N0Ng6BC/d+7Q24=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "8c4e750f738a742bd73377ee41d3dadedebedef4",
+        "rev": "fe0203a198690e71a5ff11e08812a4673de3678d",
         "type": "github"
       },
       "original": {
@@ -1301,11 +1292,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1782009766,
+        "lastModified": 1778378178,
-        "narHash": "sha256-VUhBjpGvWqHI7rWeyMYb/u87YJSXHKfVV6S+IelWeO8=",
+        "narHash": "sha256-OXPXRIQgGwV77HjYRryOHguh4ALX96jkg+tseLkGgHA=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "5e8350bcd354e3241ab681a265fa6ef060c40be1",
+        "rev": "9cd816033ff969415b190722cddf134e78a5665f",
         "type": "github"
       },
       "original": {
@@ -1322,11 +1313,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784369104,
+        "lastModified": 1780220602,
-        "narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=",
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "df3c0640565d04a0261253cdd89fce78ec50168a",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
         "type": "github"
       },
       "original": {
@@ -1337,7 +1328,7 @@
     },
     "treefmt-nix_2": {
       "inputs": {
-        "nixpkgs": "nixpkgs_9"
+        "nixpkgs": "nixpkgs_7"
       },
       "locked": {
         "lastModified": 1784369104,
@@ -1355,16 +1346,16 @@
     },
     "vicinae": {
       "inputs": {
-        "nixpkgs": "nixpkgs_10",
+        "nixpkgs": "nixpkgs_8",
         "soulver-cpp": "soulver-cpp",
         "systems": "systems_7"
       },
       "locked": {
-        "lastModified": 1784839524,
+        "lastModified": 1784388228,
-        "narHash": "sha256-B87U5HDB/6JPxSnNQwnIiwtqUWvyxzqs7lV/GPzva68=",
+        "narHash": "sha256-/5fGvMWlLlyd5ibK7y1dqIK1MTpLABj3v1M0r/VArww=",
         "owner": "vicinaehq",
         "repo": "vicinae",
-        "rev": "632ca79e9f8fc9721384921f28ec069ff48aaf53",
+        "rev": "c55e85716e3e7a68f4b0f6ef6299d02a49623c7c",
         "type": "github"
       },
       "original": {
@@ -1383,11 +1374,11 @@
         "vicinae": "vicinae_2"
       },
       "locked": {
-        "lastModified": 1784504910,
+        "lastModified": 1784400781,
-        "narHash": "sha256-fzPBEJZiRvc/FNMdpbdcfaZzF01U4IQenHW9IQFzhos=",
+        "narHash": "sha256-awe35tis3VZCfQVhivpduehT/5IV5LHmOsd2YSxECRQ=",
         "owner": "vicinaehq",
         "repo": "extensions",
-        "rev": "ca74eede9a778a9373c8f5fd221b0a5026dcd1ef",
+        "rev": "67beba7a8e79b817552e4a95f835b8cc697ca08b",
         "type": "github"
       },
       "original": {
@@ -1441,11 +1432,11 @@
     "xwayland-satellite-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1784679892,
+        "lastModified": 1783895132,
-        "narHash": "sha256-Mb7jpqnrcYCfNSItIkkHpuR3YxWFxPuIBfcwNKlRBkk=",
+        "narHash": "sha256-Dl0Gvrig3EpE962hzF3ETPhUztlfuRhcmlpd8ioHN54=",
         "owner": "Supreeeme",
         "repo": "xwayland-satellite",
-        "rev": "8d135d3b2854b30fd01ea6cd6c27e523dd50a839",
+        "rev": "a2b5c635d8c8c99b286967658d0d177044887eb8",
         "type": "github"
       },
       "original": {
@@ -1470,11 +1461,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782609341,
+        "lastModified": 1776789209,
-        "narHash": "sha256-OfCPJFS/2Z2ZyjE4adR7PL+ZEqvDQFi2XNI1L8s6wKU=",
+        "narHash": "sha256-G6B7Q4TXn7MZ1mB+f9rymjsYF5PLWoSvmbxijb/99bw=",
         "owner": "mitchellh",
         "repo": "zig-overlay",
-        "rev": "5386fea92c45b154bbeb52d14ef5504f82eda86c",
+        "rev": "14fe971844e841297ddd2ce9783d6892b467af39",
         "type": "github"
       },
       "original": {
@@ -1483,19 +1474,42 @@
         "type": "github"
       }
     },
+    "zig_2": {
+      "inputs": {
+        "nixpkgs": [
+          "ghostty",
+          "zon2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1777234348,
+        "narHash": "sha256-fKw44a4qbUuI5eTG8k0gPbqMV5TOrjYF35PBzsYgd2U=",
+        "ref": "refs/heads/main",
+        "rev": "2c781c0609ecda600ab98f98cca417bbd981bd53",
+        "revCount": 1677,
+        "type": "git",
+        "url": "https://codeberg.org/jcollie/zig-overlay.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://codeberg.org/jcollie/zig-overlay.git"
+      }
+    },
     "zon2nix": {
       "inputs": {
         "nixpkgs": [
           "ghostty",
           "nixpkgs"
-        ]
+        ],
+        "zig": "zig_2"
       },
       "locked": {
-        "lastModified": 1784117571,
+        "lastModified": 1777314365,
-        "narHash": "sha256-Hvnmnuu0VpHiZl+8z+UkMoxC7JZJvRYBqu2Asb0ZJOE=",
+        "narHash": "sha256-eLxQaD0wc96Neqkln8wHS0rNq/chPODifFkhwrwilEU=",
         "owner": "jcollie",
         "repo": "zon2nix",
-        "rev": "0ce628fb78309cdb13d098ae9c6fdbf87c75d25b",
+        "rev": "a5a1d412ad1ab6305511997bbc92b3a9dd6cb784",
         "type": "github"
       },
       "original": {

flake.nix

@@ -78,10 +78,12 @@
     # LLM agents
     llm-agents = {
       url = "github:numtide/llm-agents.nix";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
 
     codex-desktop-linux = {
       url = "github:ilysenko/codex-desktop-linux";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
 
     # Index / Search
@@ -90,6 +92,12 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    # Binary cache
+    nixcache-oci = {
+      url = "github:cmspam/nixcache-oci";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # Systems
     systems.url = "github:nix-systems/default-linux";
 

modules/applications/default.nix

@@ -38,7 +38,6 @@
     ./vscode
     ./wayland.nix
     ./yazi.nix
-    ./zed
     ./zellij
     ./zoom.nix
     ./zoxide.nix

modules/applications/swaylock/system.nix

@@ -15,12 +15,5 @@ in
     services.systemd-lock-handler.enable = true;
 
     security.pam.services.swaylock.fprintAuth = true;
-
-    # PAM authentication is serial.  Let a supplied password succeed before
-    # starting fprintd, whose scan otherwise blocks password verification until
-    # its timeout expires.  Submit an empty password to start fingerprint
-    # authentication in upstream swaylock.
-    security.pam.services.swaylock.rules.auth.fprintd.order =
-      config.security.pam.services.swaylock.rules.auth.unix.order + 50;
   };
 }

modules/applications/wayland.nix

@@ -19,13 +19,19 @@ in
     # modules do not each append their own portal backends.
     xdg.portal = {
       enable = true;
+      wlr.enable = true;
       extraPortals = [
         pkgs.xdg-desktop-portal-gnome
         pkgs.xdg-desktop-portal-gtk
+        pkgs.xdg-desktop-portal-wlr
       ];
       xdgOpenUsePortal = true;
       config = {
         common.default = [ "gtk" ];
+        niri.default = lib.mkForce [
+          "wlr"
+          "gtk"
+        ];
         gnome.default = [
           "gnome"
           "gtk"

modules/applications/zed/default.nix

@@ -1,21 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-let
-  cfg = config.my.applications.zed;
-in
-{
-  imports = [
-    ./home.nix
-  ];
-
-  options.my.applications.zed = {
-    enable = lib.mkEnableOption "Zed code editor";
-  };
-
-  config = lib.mkIf cfg.enable {
-    my.applications.zed.homeManager.enable = lib.mkDefault true;
-  };
-}

modules/applications/zed/home.nix

@@ -1,66 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-let
-  cfg = config.my.applications.zed.homeManager;
-in
-{
-  options.my.applications.zed.homeManager = {
-    enable = lib.mkEnableOption "Zed home-manager configuration";
-  };
-
-  config.home-manager.sharedModules = [
-    {
-      config = lib.mkIf cfg.enable {
-        programs.zed-editor = {
-          enable = true;
-          extensions = [
-            "catppuccin"
-            "nix"
-          ];
-          mutableUserSettings = false;
-
-          userSettings = {
-            agent = {
-              flexible = true;
-              favorite_models = [ ];
-              model_parameters = [ ];
-            };
-
-            project_panel.dock = "left";
-
-            telemetry = {
-              diagnostics = false;
-              metrics = false;
-            };
-
-            vim_mode = true;
-
-            agent_servers = {
-              github-copilot-cli.type = "registry";
-              codex-acp.type = "registry";
-              claude-acp.type = "registry";
-            };
-
-            icon_theme = {
-              mode = "dark";
-              light = "Zed (Default)";
-              dark = "Zed (Default)";
-            };
-
-            ui_font_size = 16;
-            buffer_font_size = 16;
-
-            theme = {
-              mode = "dark";
-              light = "Catppuccin Latte";
-              dark = "Catppuccin Mocha";
-            };
-          };
-        };
-      };
-    }
-  ];
-}

modules/applications/zoom.nix

@@ -1,10 +1,19 @@
 {
+  pkgs,
   lib,
   config,
   ...
 }:
 let
   cfg = config.my.applications.zoom;
+  zoomX11 = pkgs.zoom-us.overrideAttrs (old: {
+    nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.makeWrapper ];
+
+    postFixup = (old.postFixup or "") + ''
+      wrapProgram $out/bin/zoom \
+        --set QT_QPA_PLATFORM xcb
+    '';
+  });
 in
 {
   options.my.applications.zoom = {
@@ -12,6 +21,12 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    programs.zoom-us.enable = true;
+    home-manager.sharedModules = [
+      {
+        home.packages = with pkgs; [
+          zoomX11 # Video conferencing application with XWayland startup for GNOME stability
+        ];
+      }
+    ];
   };
 }

modules/features/cli/base.nix

@@ -33,7 +33,6 @@ in
       unzip # Tool For Handling .zip Files
       unrar # Tool For Handling .rar Files
       ripgrep # Fast Search Tool
-      jq # Lightweight JSON processor
       nurl # CLI tool for generating Nix fetcher calls from URLs
       eza # ls alternative
       bat # cat alternative

modules/features/dev/default.nix

@@ -3,7 +3,6 @@
     ./agent.nix
     ./arduino.nix
     ./bun.nix
-    ./dns.nix
     ./drawio.nix
     ./java.nix
     ./nix.nix

modules/features/dev/dns.nix

@@ -1,20 +0,0 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-let
-  cfg = config.my.features.dev.dns;
-in
-{
-  options.my.features.dev.dns = {
-    enable = lib.mkEnableOption "DNS development tools (dig)";
-  };
-
-  config = lib.mkIf cfg.enable {
-    environment.systemPackages = with pkgs; [
-      bind # DNS lookup utilities (dig, host, nslookup)
-    ];
-  };
-}

modules/features/gui/editor.nix

@@ -4,13 +4,10 @@ let
 in
 {
   options.my.features.gui.editor = {
-    enable = lib.mkEnableOption "GUI code editors (VSCode and Zed)";
+    enable = lib.mkEnableOption "GUI code editor (VSCode)";
   };
 
   config = lib.mkIf cfg.enable {
-    my.applications = {
+    my.applications.vscode.enable = true;
-      vscode.enable = true;
-      zed.enable = true;
-    };
   };
 }

modules/features/services/default.nix

@@ -2,6 +2,7 @@
   imports = [
     ./container.nix
     ./kde.nix
+    ./nixcache-oci.nix
     ./quem-guest.nix
   ];
 }

modules/features/services/nixcache-oci.nix

@@ -0,0 +1,17 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.features.services.nixcacheOci;
+in
+{
+  options.my.features.services.nixcacheOci = {
+    enable = lib.mkEnableOption "Nix binary cache backed by public GHCR";
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.system.nixcacheOci.enable = true;
+  };
+}

modules/system/default.nix

@@ -1,3 +1,4 @@
+{ inputs, ... }:
 {
   imports = [
     ./audio.nix
@@ -11,6 +12,7 @@
     ./locale.nix
     ./network
     ./nix.nix
+    ./nixcache-oci.nix
     ./power.nix
     ./quem.nix
     ./secure-boot.nix
@@ -18,5 +20,6 @@
     ./user
     ./version.nix
     ./secret.nix
+    inputs.nixcache-oci.nixosModules.default
   ];
 }

modules/system/nix.nix

@@ -7,7 +7,6 @@ _: {
       "https://noctalia.cachix.org"
       "https://vicinae.cachix.org"
       "https://cache.numtide.com"
-      "https://codex-desktop-linux.cachix.org"
     ];
 
     extra-trusted-public-keys = [
@@ -17,7 +16,6 @@ _: {
       "noctalia.cachix.org-1:pCOR47nnMEo5thcxNDtzWpOxNFQsBRglJzxWPp3dkU4="
       "vicinae.cachix.org-1:1kDrfienkGHPYbkpNj1mWTr7Fm1+zcenzgTizIcI3oc="
       "niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
-      "codex-desktop-linux.cachix.org-1:nX/xy6AdK9hQE24A8ALGjkCKj2ObFmcnemiL5Cid4nk="
     ];
 
     experimental-features = [

modules/system/nixcache-oci.nix

@@ -0,0 +1,27 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.system.nixcacheOci;
+  publicKeyFile = ../../nixcache-public-key.txt;
+  publicKey =
+    if builtins.pathExists publicKeyFile then
+      lib.strings.trim (builtins.readFile publicKeyFile)
+    else
+      "";
+in
+{
+  options.my.system.nixcacheOci = {
+    enable = lib.mkEnableOption "Nix binary cache backed by the public GitHub Container Registry";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.nixcache-proxy = {
+      enable = true;
+      repo = "moons-14/dotfiles";
+      inherit publicKey;
+    };
+  };
+}

overlays/default.nix

@@ -1,6 +1,6 @@
 { inputs, ... }:
 {
-  flake.overlays.default = final: {
+  flake.overlays = {
-    llm-agents = inputs.llm-agents.packages.${final.stdenv.hostPlatform.system};
+    default = inputs.llm-agents.overlays.shared-nixpkgs;
   };
 }

profiles/interfaces/cli-minimal.nix

@@ -5,5 +5,6 @@
       shell.enable = true;
     };
     identity.sshDefaultKey.enable = true;
+    services.nixcacheOci.enable = true;
   };
 }

profiles/workloads/dev.nix

@@ -6,7 +6,6 @@
       nix.enable = true;
       python.enable = true;
       bun.enable = true;
-      dns.enable = true;
       drawio.enable = true;
       java.enable = true;
     };

renovate.json

@@ -1,13 +1,31 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
-  "enabledManagers": ["github-actions"],
+  "enabledManagers": ["github-actions", "nix"],
 
   "prHourlyLimit": 0,
 
+  "nix": {
+    "enabled": true
+  },
+
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": ["at any time"]
+  },
+
   "prCreation": "immediate",
 
   "semanticCommits": "enabled",
   "semanticCommitType": "chore",
-  "semanticCommitScope": "deps"
+  "semanticCommitScope": "deps",
+
+  "packageRules": [
+    {
+      "description": "Group Nix flake input updates",
+      "matchManagers": ["nix"],
+      "groupName": "Nix flake inputs",
+      "groupSlug": "nix-flake-inputs"
+    }
+  ]
 }