Rebase to flake parts #4

modules/hosts/14900k/_private/displays.nix

@@ -0,0 +1,92 @@
+# Monitor layout for 14900k (ported from NixOS-New `hosts/clients/14900k/home.nix`).
+# Niri: `chiasson.desktop.niri.extraSettings.extraConfig` (wrapper-modules / system package).
+# Hyprland: `chiasson.desktop.hyprland.settings` (merged in HM when `chiasson.desktop.hyprland.enable`).
+
+#TODO[epic=Moderate] Clean this up, move to host's configuration.nix.
+{ config, lib, ... }:
+let
+  gpuPassthrough = config.chiasson.system.vm.gpuPassthrough.enable;
+in
+{
+  chiasson.desktop.niri.extraSettings.extraConfig =
+    if gpuPassthrough then
+      ''
+        output "DP-1" {
+            mode "2560x1080@144"
+            scale 1.0
+            position x=1920 y=0
+            focus-at-startup
+        }
+        output "HDMI-A-2" {
+            mode "1920x1080@60"
+            scale 1.0
+            position x=0 y=0
+        }
+      ''
+    else
+      ''
+        output "DP-2" {
+            mode "2560x1080@144"
+            scale 1.0
+            position x=0 y=0
+            focus-at-startup
+        }
+        output "HDMI-A-3" {
+            mode "1920x1080@60"
+            scale 1.0
+            position x=-1920 y=0
+        }
+        output "DP-4" {
+            mode "1920x1080@144"
+            scale 1.0
+            position x=0 y=-1080
+        }
+
+      '';
+
+  chiasson.desktop.hyprland.settings = lib.mkIf config.chiasson.desktop.hyprland.enable (
+    let
+      monitorList =
+        if gpuPassthrough then
+          [
+            "DP-1, 2560x1080@144, 0x0, 1"
+            "HDMI-A-2, 1920x1080@60, auto-up, 1"
+          ]
+        else
+          [
+            "DP-2, 2560x1080@144, 0x0, 1"
+            "DP-4, 1920x1080@144, 0x-1080, 1"
+            "HDMI-A-3, 1920x1080@60, -1920x0, 1"
+          ];
+      workspaceList =
+        if gpuPassthrough then
+          [
+            "1, monitor:DP-1, default:true"
+            "2, monitor:DP-1"
+            "3, monitor:DP-1"
+            "4, monitor:DP-1"
+            "5, monitor:HDMI-A-2, default:true"
+            "6, monitor:HDMI-A-2"
+            "7, monitor:HDMI-A-2"
+            "8, monitor:HDMI-A-2"
+            "9, monitor:DP-1"
+          ]
+        else
+          [
+            "1, monitor:DP-3, default:true"
+            "2, monitor:DP-3"
+            "3, monitor:DP-3"
+            "4, monitor:Unknown-2, default:true"
+            "5, monitor:Unknown-2"
+            "6, monitor:Unknown-2"
+            "7, monitor:DP-4"
+            "8, monitor:DP-4"
+            "9, monitor:DP-4"
+          ];
+    in
+    {
+      monitor = lib.mkBefore monitorList;
+      workspace = workspaceList;
+    }
+  );
+}

modules/hosts/14900k/_private/nvidia.nix

@@ -0,0 +1,26 @@
+# NVIDIA for host desktop; when `chiasson.system.vm.gpuPassthrough` is enabled, drop NVIDIA for VFIO (port later).
+{ config, lib, pkgs, ... }:
+let
+  passthrough = config.chiasson.system.vm.gpuPassthrough.enable;
+in
+{
+  boot.kernelParams = [ "snd_hda_core.gpu_bind=0" ];
+  boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
+
+  services.xserver.videoDrivers = if passthrough then [ "modesetting" ] else [ "nvidia" ];
+
+  hardware.nvidia =
+    if passthrough then
+      lib.mkForce { }
+    else {
+      modesetting.enable = true;
+      powerManagement.enable = false;
+      powerManagement.finegrained = false;
+      open = true;
+      nvidiaSettings = true;
+      package = config.boot.kernelPackages.nvidiaPackages.stable;
+    };
+
+  # Needed for `docker compose` GPU passthrough (e.g. `--gpus all` / DEVICE=gpu).
+  hardware.nvidia-container-toolkit.enable = !passthrough;
+}

modules/hosts/14900k/_private/peripherals.nix

@@ -0,0 +1,12 @@
+# Logitech Unifying / Bolt receivers; Keychron VIA/VIAL on hidraw.
+{ ... }:
+{
+  hardware.logitech.wireless.enable = true;
+
+  services.udev.extraRules = ''
+    # Keychron VIA/VIAL on hidraw
+    KERNEL=="hidraw*", ATTRS{idVendor}=="3434", MODE="0660", GROUP="users", TAG+="uaccess", TAG+="udev-acl"
+    # PS5 DualSense & DualSense Edge controllers over USB hidraw
+    KERNEL=="hidraw*", ATTRS{idVendor}=="054c", ATTRS{idProduct}=="0ce6|0df2", MODE="0660", TAG+="uaccess"
+  '';
+}

modules/hosts/14900k/_private/platform.nix

@@ -0,0 +1,14 @@
+{ ... }: {
+  #TODO[epic=Moderate] Clean this up, move to host's configuration.nix.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  powerManagement.cpuFreqGovernor = "performance";
+
+  hardware.enableRedistributableFirmware = true;
+  hardware.enableAllFirmware = true;
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+  system.stateVersion = "25.11";
+}

modules/hosts/uConsole/_private/4g/default.nix

@@ -0,0 +1,37 @@
+{ lib, pkgs, ... }:
+let
+  uconsole4gRuntime = with pkgs; [
+    bash
+    coreutils
+    gnugrep
+    gnused
+    gawk
+    util-linux
+    usbutils
+    pciutils
+    lsb-release
+    libgpiod
+    modemmanager
+    iproute2
+    iputils
+    busybox
+    socat
+    systemd
+  ];
+
+  # Use a lightweight wrapper to avoid ShellCheck gating the build.
+  uconsole4gCm5 = pkgs.writeShellScriptBin "uconsole-4g-cm5" ''
+    export PATH=${lib.makeBinPath uconsole4gRuntime}:$PATH
+    exec ${pkgs.bash}/bin/bash ${./uconsole-4g-cm5.sh} "$@"
+  '';
+in
+{
+  networking.modemmanager.enable = true;
+
+  environment.systemPackages = with pkgs; [
+    libgpiod
+    uconsole4gCm5
+    socat
+    ripgrep
+  ];
+}

modules/hosts/uConsole/_private/activation.nix

@@ -0,0 +1,16 @@
+{ pkgs, ... }: {
+  # Keep Raspberry Pi kernel cmdline in sync with current system profile.
+  system.activationScripts.updateRpiCmdline.text = ''
+    export PATH="${pkgs.gnused}/bin:''${PATH}"
+    for cmdline in /boot/firmware/nixos/*/cmdline.txt; do
+      [ -e "$cmdline" ] || continue
+      current_init="$(readlink -f /nix/var/nix/profiles/system)/init"
+      if grep -q 'init=/nix/store/' "$cmdline"; then
+        sed -i "s#init=/nix/store/[^ ]*/init#init=$current_init#" "$cmdline"
+      fi
+      if ! grep -q 'root=' "$cmdline"; then
+        sed -i 's/ init=/ root=PARTUUID=4d44c78a-ee3c-4e3e-9eee-0f2eb10347b6 rootfstype=ext4 init=/' "$cmdline"
+      fi
+    done
+  '';
+}

modules/hosts/uConsole/_private/platform.nix

@@ -0,0 +1,48 @@
+{ ... }: {
+  #TODO[epic=Moderate] Clean this up, move to host's configuration.nix.
+  # Native Raspberry Pi boot flow.
+  boot.loader.raspberry-pi.bootloader = "kernel";
+  boot.loader.grub.enable = false;
+  boot.consoleLogLevel = 7;
+  boot.kernelModules = [ "nvme" ];
+
+  # Root device for kernel cmdline (NVMe boot).
+  boot.kernelParams = [
+    "root=PARTUUID=4d44c78a-ee3c-4e3e-9eee-0f2eb10347b6"
+    "rootfstype=ext4"
+  ];
+
+  console = {
+    earlySetup = true;
+    font = "ter-v32n";
+  };
+
+  # Enable PCIe x1 for CM5 NVMe adapter.
+  hardware.raspberry-pi.config.cm5.base-dt-params.pciex1 = {
+    enable = true;
+    value = "on";
+  };
+
+  powerManagement.cpuFreqGovernor = "powersave";
+
+  # Root + firmware as boot-critical mounts.
+  fileSystems."/".neededForBoot = true;
+  fileSystems."/boot/firmware".neededForBoot = true;
+
+  # Pi generational boot expects boot-firmware.mount to exist.
+  systemd.mounts = [
+    {
+      what = "/dev/disk/by-label/FIRMWARE";
+      where = "/boot/firmware";
+      type = "vfat";
+      options = "noatime,fmask=0022,dmask=0022";
+      wantedBy = [ "local-fs.target" ];
+      after = [ "local-fs-pre.target" ];
+    }
+  ];
+
+  # There is no serial console on uConsole CM5 by default.
+  systemd.services."serial-getty@ttyS0".enable = false;
+
+  system.stateVersion = "25.11";
+}

modules/hosts/uConsole/_private/services.nix

@@ -0,0 +1,6 @@
+{ ... }: {
+  #TODO[epic=Moderate] Clean this up, move to host's configuration.nix.
+  # Enable uinput for gamepad remap.
+  hardware.uinput.enable = true;
+  programs.mosh.enable = true;
+}

modules/lib/ssh-inventory.nix

@@ -0,0 +1,113 @@
+{ lib, ... }: {
+  flake.lib.sshInventory =
+    let
+      hosts = {
+        "14900k" = {
+          hostName = "192.168.2.25";
+          aliases = [ "14900k" "nixdesk" ];
+          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILwUevBGnf+Y/sL1ZsB4bt0c50a89iqwPRoYUGP4UHsL 14900k";
+        };
+
+        ideapad = {
+          hostName = "192.168.2.113";
+          aliases = [ "ideapad" ];
+          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQwaaI90xIMjZ46EcMyO8kBwGCxf7qVL75IYhw8Ssze ideapad";
+        };
+
+        t2mbp = {
+          hostName = "192.168.2.15";
+          aliases = [ "t2mbp" ];
+          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMhVWB9YXl/FuQvufle4VWUas/QM8qCKoRd5a83Tt3S6 t2mbp";
+        };
+
+        uConsole = {
+          hostName = "192.168.2.99";
+          aliases = [ "uConsole" "uconsole" ];
+          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAVPR0lRAcywPR7iTchM3+eO7NCdXAR6NPzYXxalr+dP uConsole";
+        };
+
+        test = {
+          hostName = "test";
+          aliases = [ "test" ];
+          publicKey = null;
+        };
+
+        nix-server = {
+          hostName = "192.168.2.238";
+          aliases = [ "nix-server" ];
+          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL3KDicMjtOFR6LfZrFzfAD1gdYUdwv6ZM4PSgtmIuzd nix-server";
+        };
+      };
+
+      mkIdentityFileName = hostName: ".ssh/id_ed25519_${lib.strings.toLower hostName}.pub";
+      activeHosts = builtins.removeAttrs hosts (
+        builtins.filter (name: hosts.${name}.publicKey == null) (builtins.attrNames hosts)
+      );
+
+      mkIdentityFiles = selectedHosts:
+        builtins.listToAttrs (
+          builtins.map
+            (hostName: {
+              name = mkIdentityFileName hostName;
+              value.text = "${selectedHosts.${hostName}.publicKey}\n";
+            })
+            (builtins.attrNames selectedHosts)
+        );
+
+      # Must come before inventory `Host` blocks and before `Host *`: LAN Gitea SSH is not a catalog PC,
+      # and `Host *` sets `IdentityAgent none` — without this, git@192.168.2.103 never sees rbw keys.
+      giteaSshBlock = identityAgent: ''
+        Host git.chiasson.cloud gitea casaos 192.168.2.103
+          HostName 192.168.2.103
+          Port 222
+          User git
+          IdentityAgent ${identityAgent}
+          IdentitiesOnly no
+      '';
+
+      mkSshConfigTemplate =
+        {
+          selectedHosts ? activeHosts,
+          user ? null,
+          identityAgent ? "__RBW_SSH_SOCK__",
+        }:
+        let
+          hostBlocks = builtins.map
+            (hostName:
+              let
+                entry = selectedHosts.${hostName};
+                hostPatterns = builtins.concatStringsSep " " (entry.aliases ++ [ entry.hostName ]);
+                userLine = if user == null then "" else "  User ${user}\n";
+              in
+              ''
+                Host ${hostPatterns}
+                  HostName ${entry.hostName}
+${userLine}              IdentityFile ~/${mkIdentityFileName hostName}
+                  IdentityAgent ${identityAgent}
+                  IdentitiesOnly yes
+              '')
+            (builtins.attrNames selectedHosts);
+        in
+        builtins.concatStringsSep "\n" (
+          [
+            (giteaSshBlock identityAgent)
+          ]
+          ++ hostBlocks
+          ++ [
+            ''
+              Host *
+                IdentitiesOnly yes
+                IdentityAgent none
+            ''
+          ]
+        );
+    in
+    {
+      inherit hosts activeHosts mkIdentityFiles mkSshConfigTemplate;
+      authorizedKeys = lib.unique (
+        builtins.map (entry: entry.publicKey) (builtins.attrValues activeHosts)
+      );
+      identityFiles = mkIdentityFiles activeHosts;
+      sshConfigTemplate = mkSshConfigTemplate { };
+    };
+}

modules/system/caching/attic.nix

@@ -0,0 +1,240 @@
+{ ... }: {
+  flake.nixosModules.systemCachingAttic =
+    { config, lib, pkgs, options, ... }:
+    let
+      cfg = config.chiasson.system.caching.attic;
+    in
+    {
+      options.chiasson.system.caching.attic = with lib; {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable Attic cache integration for this host (substituters + trusted key).";
+        };
+
+        cacheName = mkOption {
+          type = types.str;
+          default = "";
+          example = "nixos-new";
+          description = "Attic cache name; required when `chiasson.system.caching.attic.enable = true`.";
+        };
+
+        endpoint = mkOption {
+          type = types.str;
+          default = "";
+          example = "http://nix-server:8080";
+          description = "Attic API endpoint base URL (no cache segment).";
+        };
+
+        publicKey = mkOption {
+          type = types.str;
+          default = "";
+          example = "nixos-new:WcnO6s4aVkB6CKRaPPpKvHLZykWXASV6c+/Ssg8uQEY=";
+          description = "Cache public signing key from `attic cache info`.";
+        };
+
+        tokenFile = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          example = "/run/secrets/caching/attic/token";
+          description = ''
+            Default token path; push/cli token options override when set.
+          '';
+        };
+
+        push = {
+          enable = mkEnableOption ''
+            Post-build hook → Attic push (needs a token file somewhere).
+          '';
+
+          tokenFile = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = "/run/secrets/caching/attic/push-token";
+            description = ''
+              Push token file (sops path). Falls back to `chiasson.system.caching.attic.tokenFile`.
+            '';
+          };
+
+          excludedPatterns = mkOption {
+            type = types.listOf types.str;
+            default = [ ];
+            example = [ "wallpaper" "hm_wallpapers" ".iso" "-source" "large-assets" ];
+            description = "Substring patterns: closures matching any pattern are skipped for Attic push.";
+          };
+        };
+
+        userCli = {
+          enable = mkOption {
+            type = types.bool;
+            default = false;
+            description = ''
+              Install `attic-client` + HM `~/.config/attic/config.toml` when a token path resolves.
+            '';
+          };
+
+          serverName = mkOption {
+            type = types.str;
+            default = "attic";
+            description = "Local label for this Attic server (default-server and [servers.<name>] in config.toml).";
+          };
+
+          tokenFile = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = "/run/secrets/caching/attic/cli-token";
+            description = ''
+              CLI token file; falls back to `chiasson.system.caching.attic.tokenFile`. No file -> no config.toml.
+            '';
+          };
+
+        };
+      };
+
+      config = let
+        endpointBase = lib.strings.removeSuffix "/" cfg.endpoint;
+        enabled = cfg.enable && cfg.cacheName != "" && endpointBase != "" && cfg.publicKey != "";
+        cacheUrl = "${endpointBase}/${cfg.cacheName}";
+        pushTokenFile = if cfg.push.tokenFile != null then cfg.push.tokenFile else cfg.tokenFile;
+        hmAtticCliModule =
+          { lib, osConfig ? { }, ... }:
+          let
+            ac = osConfig.chiasson.system.caching.attic or { };
+            cli = ac.userCli or { };
+            cliTokenFile = if (cli.tokenFile or null) != null then cli.tokenFile else (ac.tokenFile or null);
+            hmEnabled =
+              (cli.enable or false)
+              && (ac.cacheName or "") != ""
+              && (lib.removeSuffix "/" (ac.endpoint or "")) != ""
+              && cliTokenFile != null;
+            srv = cli.serverName or "attic";
+            ep = lib.removeSuffix "/" ac.endpoint;
+          in
+          {
+            xdg.configFile."attic/config.toml" = lib.mkIf hmEnabled {
+              text = ''
+                default-server = ${builtins.toJSON srv}
+
+                [servers.${srv}]
+                endpoint = ${builtins.toJSON ep}
+                token-file = ${builtins.toJSON cliTokenFile}
+              '';
+            };
+          };
+      in
+      lib.mkMerge [
+        {
+          assertions = [
+            {
+              assertion = !cfg.push.enable || pushTokenFile != null;
+              message = "chiasson.system.caching.attic.push: when push.enable is true, set push.tokenFile or chiasson.system.caching.attic.tokenFile.";
+            }
+            {
+              assertion = !cfg.push.enable || enabled;
+              message = "chiasson.system.caching.attic.push.enable requires a fully configured chiasson.system.caching.attic (enable, cacheName, endpoint, publicKey).";
+            }
+          ];
+        }
+
+        (lib.mkIf enabled {
+          nix.settings = {
+            substituters = lib.mkAfter [ cacheUrl ];
+            trusted-public-keys = lib.mkAfter [ cfg.publicKey ];
+          };
+
+          nix.settings.post-build-hook = lib.mkIf cfg.push.enable (pkgs.writeShellScript "upload-to-attic" ''
+            set -eu
+            set -f
+
+            echo "attic: hook start drv=''${DRV_PATH:-<unknown>}" >&2
+            echo "attic: endpoint=${lib.escapeShellArg endpointBase} cache=${lib.escapeShellArg cfg.cacheName}" >&2
+
+            export PATH="${lib.makeBinPath [ pkgs.attic-client pkgs.nix pkgs.gnused ]}:$PATH"
+            ${lib.optionalString (pushTokenFile != null) ''
+            token_path=${lib.escapeShellArg pushTokenFile}
+            if [ ! -r "$token_path" ]; then
+              echo "attic: skipping push (token not readable at $token_path)" >&2
+              exit 0
+            fi
+
+            ATTIC_TOKEN="$(tr -d '\n' < "$token_path")"
+            ''}
+            if [ -z "$ATTIC_TOKEN" ]; then
+              echo "attic: skipping push (token is empty)" >&2
+              exit 0
+            fi
+
+            ATTIC_CONFIG_HOME="$(mktemp -d /tmp/attic-hook-XXXXXX)"
+            export XDG_CONFIG_HOME="$ATTIC_CONFIG_HOME"
+            cleanup() {
+              rm -rf "$ATTIC_CONFIG_HOME"
+            }
+            trap cleanup EXIT
+
+            if ! attic login --set-default ci ${lib.escapeShellArg endpointBase} "$ATTIC_TOKEN" >/dev/null 2>&1; then
+              echo "attic: login failed (build succeeded; check token/server URL)" >&2
+              exit 0
+            fi
+
+            push_paths=""
+            skipped_roots=0
+            pushed_roots=0
+            seen_roots=0
+            for path in $OUT_PATHS; do
+              seen_roots=$((seen_roots + 1))
+              echo "attic: evaluating OUT_PATH $path" >&2
+              skip=0
+              skip_reason=""
+
+              closure_paths="$(nix-store -qR "$path" 2>/dev/null || true)"
+              for candidate in "$path" $closure_paths; do
+                while IFS= read -r pat; do
+                  pat="$(printf '%s' "$pat" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+                  [ -z "$pat" ] && continue
+                  case "$candidate" in
+                    *"$pat"*)
+                      skip=1
+                      skip_reason="$pat ($candidate)"
+                      break
+                      ;;
+                  esac
+                done << 'EXCLUDE_PATTERNS'
+            ${lib.concatStringsSep "\n" cfg.push.excludedPatterns}
+            EXCLUDE_PATTERNS
+                if [ "$skip" -eq 1 ]; then
+                  break
+                fi
+              done
+
+              if [ "$skip" -eq 0 ]; then
+                push_paths="$push_paths $path"
+                pushed_roots=$((pushed_roots + 1))
+              else
+                skipped_roots=$((skipped_roots + 1))
+                echo "attic: skipping root $path (matches exclude pattern via $skip_reason)" >&2
+              fi
+            done
+
+            echo "attic: summary seen=$seen_roots selected=$pushed_roots skipped=$skipped_roots" >&2
+
+            if [ -n "$push_paths" ]; then
+              echo "attic: pushing to ci:${cfg.cacheName}" >&2
+              if ! attic push ${lib.escapeShellArg "ci:${cfg.cacheName}"} $push_paths; then
+                echo "attic: push failed (build succeeded; check token/network)" >&2
+              else
+                echo "attic: push succeeded" >&2
+              fi
+            else
+              echo "attic: nothing selected for push" >&2
+            fi
+            exit 0
+          '');
+
+          environment.systemPackages = lib.mkIf cfg.userCli.enable [ pkgs.attic-client ];
+        })
+        (lib.optionalAttrs (lib.hasAttrByPath [ "home-manager" "sharedModules" ] options) {
+          "home-manager".sharedModules = lib.mkIf (enabled && cfg.userCli.enable) [ hmAtticCliModule ];
+        })
+      ];
+    };
+}