Rebase to flake parts #9

modules/system/caching/cachix.nix

@@ -0,0 +1,120 @@
+# Pull everywhere; enable push only on the host that runs `nixos-rebuild --target-host` (needs sops `cachix/auth-token`).
+{ inputs, ... }: {
+  flake.nixosModules.systemCachingCachix =
+    { config, lib, pkgs, ... }:
+    let
+      cfg = config.chiasson.system.caching.cachix;
+    in
+    {
+      imports = [ inputs.sops-nix.nixosModules.sops ];
+
+      options.chiasson.system.caching.cachix = with lib; {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable Cachix cache integration for this host.";
+        };
+
+        cacheName = mkOption {
+          type = types.str;
+          default = "";
+          example = "chiasson-nixosnew";
+          description = "Your Cachix cache name (from app.cachix.org). Leave empty to disable.";
+        };
+        publicKey = mkOption {
+          type = types.str;
+          default = "";
+          example = "chiasson-nixosnew.cachix.org-1:xxxx=";
+          description = "Public key for the cache (shown on the cache page).";
+        };
+        enablePush = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Push every build to Cachix (enable only on the machine that runs nixos-rebuild --target-host).";
+        };
+        pushExcludePatterns = mkOption {
+          type = types.listOf types.str;
+          default = [ ];
+          example = [ "wallpaper" "hm_wallpapers" ".iso" "-source" "large-assets" ];
+          description = "Substring patterns: store paths containing any of these are not pushed to Cachix (saves cache space for heavy outputs).";
+        };
+      };
+
+      config = let
+        enabled = cfg.enable && cfg.cacheName != "" && cfg.publicKey != "";
+        cacheUrl = "https://${cfg.cacheName}.cachix.org";
+      in
+      lib.mkMerge [
+        (lib.mkIf enabled {
+          nix.settings = {
+            substituters = lib.mkAfter [ cacheUrl ];
+            trusted-public-keys = lib.mkAfter [ cfg.publicKey ];
+          };
+        })
+        (lib.mkIf (enabled && cfg.enablePush) {
+          nix.settings.post-build-hook = pkgs.writeShellScript "upload-to-cachix" ''
+            set -eu
+            set -f
+            token_path="${config.sops.secrets."cachix/auth-token".path}"
+            if [ ! -r "$token_path" ]; then
+              echo "cachix: skipping push (token not readable at $token_path)" >&2
+              exit 0
+            fi
+            export PATH="${lib.makeBinPath [ pkgs.cachix ]}:$PATH"
+            export CACHIX_AUTH_TOKEN=$(cat "$token_path")
+
+            push_paths=""
+            skipped_roots=0
+            pushed_roots=0
+            for path in $OUT_PATHS; do
+              skip=0
+              skip_reason=""
+
+              closure_paths="$(nix-store -qR "$path" 2>/dev/null || true)"
+              for candidate in "$path" $closure_paths; do
+                while IFS= read -r pat; do
+                  pat="$(printf '%s' "$pat" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+                  [ -z "$pat" ] && continue
+                  case "$candidate" in
+                    *"$pat"*)
+                      skip=1
+                      skip_reason="$pat ($candidate)"
+                      break
+                      ;;
+                  esac
+                done << 'EXCLUDE_PATTERNS'
+            ${lib.concatStringsSep "\n" cfg.pushExcludePatterns}
+            EXCLUDE_PATTERNS
+                if [ "$skip" -eq 1 ]; then
+                  break
+                fi
+              done
+
+              if [ "$skip" -eq 0 ]; then
+                push_paths="$push_paths $path"
+                pushed_roots=$((pushed_roots + 1))
+              else
+                skipped_roots=$((skipped_roots + 1))
+                echo "cachix: skipping root $path (matches exclude pattern via $skip_reason)" >&2
+              fi
+            done
+
+            echo "cachix: root paths selected for push: $pushed_roots, skipped: $skipped_roots" >&2
+
+            if [ -n "$push_paths" ]; then
+              if ! cachix push ${lib.escapeShellArg cfg.cacheName} $push_paths; then
+                echo "cachix: push failed (build succeeded; check token/network)" >&2
+              fi
+            fi
+            exit 0
+          '';
+
+          sops.secrets."cachix/auth-token" = {
+            owner = "root";
+            group = "root";
+            mode = "0400";
+          };
+        })
+      ];
+    };
+}

modules/system/caching/default.nix

@@ -0,0 +1,9 @@
+# `system.caching.*` — Attic + Cachix; exported again as `nixosModules.systemCaching`.
+{ self, ... }: {
+  flake.nixosModules.systemCaching = {
+    imports = [
+      self.nixosModules.systemCachingAttic
+      self.nixosModules.systemCachingCachix
+    ];
+  };
+}

modules/system/default.nix

@@ -13,6 +13,7 @@
       self.nixosModules.systemFlatpak
       self.nixosModules.systemAudio
       self.nixosModules.systemIdeapadMrubyOverlay
+      self.nixosModules.systemYtDlpTelequebecPatch
       self.nixosModules.systemGaming
       self.nixosModules.systemUconsoleKernelBuilder
       self.nixosModules.systemLibrepods
@@ -20,7 +21,6 @@
       self.nixosModules.systemCaching
       inputs.swiftshare.nixosModules.systemServiceSwiftshare
       self.nixosModules.systemServiceImmich
-      self.nixosModules.systemVM
     ];
   };
 }

modules/system/users/catalog-default.nix

@@ -11,11 +11,14 @@
           extraGroups = [
             "networkmanager"
             "wheel"
-            "libvirtd"
             "docker"
             "fuse"
             "uinput"
             "kvm"
+            # `video` is required for the brightnessctl/light udev rules to grant write access
+            # to /sys/class/backlight/*/brightness without sudo. Harmless on hosts without a
+            # backlight (servers, desktop towers): the group simply has no devices to own.
+            "video"
           ];
 
           # Host must set `sops.secrets."users/olivier/hashedPassword".neededForUsers = true`.

modules/system/yt-dlp-telequebec-overlay.nix

@@ -0,0 +1,35 @@
+# Tele-Québec extractor fixes until upstream yt-dlp carries them.
+#
+# Regenerate `modules/patches/yt-dlp-telequebec.patch` from yt-dlp checkout
+# (branch with fixes vs master), redirecting into this flake's modules/patches/:
+#
+#   git diff master..ie/telequebec-update -- \
+#     yt_dlp/extractor/telequebec.py yt_dlp/extractor/_extractors.py \
+#     > path/to/NixOS-V2/modules/patches/yt-dlp-telequebec.patch
+#
+{ ... }: {
+  flake.nixosModules.systemYtDlpTelequebecPatch =
+    { config, lib, ... }:
+    let
+      cfg = config.chiasson.system.ytDlpTelequebecPatch;
+      patchFile = ../patches/yt-dlp-telequebec.patch;
+    in
+    {
+      options.chiasson.system.ytDlpTelequebecPatch = {
+        enable = lib.mkEnableOption ''
+          Patch yt-dlp with Tele-Québec extractor updates (telequebec.tv, Coucou, season playlists).
+          Regenerate `modules/patches/yt-dlp-telequebec.patch` when nixpkgs bumps yt-dlp if the build fails.
+        '';
+      };
+
+      config = lib.mkIf cfg.enable {
+        nixpkgs.overlays = lib.mkOrder 1000 [
+          (final: prev: {
+            yt-dlp = prev.yt-dlp.overrideAttrs (old: {
+              patches = (old.patches or [ ]) ++ [ patchFile ];
+            });
+          })
+        ];
+      };
+    };
+}