update nixos

flake.lock

@@ -44,38 +44,6 @@
         "type": "github"
       }
     },
-    "cachyos-kernel": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1784569577,
-        "narHash": "sha256-pmwdKRPSavZ98QJv/Xlbj2U60AZ/+P4aevLBZ71jDaA=",
-        "owner": "CachyOS",
-        "repo": "linux-cachyos",
-        "rev": "5ca2493c51b1cadec102c9c549345b43f669960b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "CachyOS",
-        "repo": "linux-cachyos",
-        "type": "github"
-      }
-    },
-    "cachyos-kernel-patches": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1783974915,
-        "narHash": "sha256-kReDG2emoGxaG0Lr8tt9jUuu1kQu07yAJZhVWfbwxYc=",
-        "owner": "CachyOS",
-        "repo": "kernel-patches",
-        "rev": "ea739d734ec179864b21446856315bc49f7c52fa",
-        "type": "github"
-      },
-      "original": {
-        "owner": "CachyOS",
-        "repo": "kernel-patches",
-        "type": "github"
-      }
-    },
     "cf": {
       "locked": {
         "lastModified": 1756852014,
@@ -93,17 +61,17 @@
     },
     "claude-code": {
       "inputs": {
-        "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
-        ]
+        ],
+        "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1784948311,
+        "lastModified": 1789074092,
-        "narHash": "sha256-zXmyx6HuIjH0RQPV4VjVAXQttLyLDk55x9c3NmDke8c=",
+        "narHash": "sha256-QCXTUbd4FuwOHO7LgJws78YTRcco4xgR8RoYgKLvd9w=",
         "owner": "sadjow",
         "repo": "claude-code-nix",
-        "rev": "0d3cd1d6260b6f0ed232224c274c565407446fa1",
+        "rev": "1f88b393ac054378c393f914dc83d08a6ef5daeb",
         "type": "github"
       },
       "original": {
@@ -217,11 +185,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1788450739,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
         "type": "github"
       },
       "original": {
@@ -231,24 +199,6 @@
       }
     },
     "flake-utils": {
-      "inputs": {
-        "systems": "systems_2"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
       "locked": {
         "lastModified": 1634851050,
         "narHash": "sha256-N83GlSGPJJdcqhUxSCS/WwW5pksYf3VP1M13cDRTSVA=",
@@ -292,11 +242,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784913159,
+        "lastModified": 1789071706,
-        "narHash": "sha256-JWq0BfjO4ktpH5USfQNQzdvHpIDT8fSKD5K7LvdMRFs=",
+        "narHash": "sha256-S+oyh2YSP9V5bSjWbbK0N7GxdxxMwgBfUOtUdVcAWc4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "079a3b5d1aa6a719920a51316253b7d6dd22738d",
+        "rev": "150f9ce4ddd41544ea42eb9d6043a75bd615fa24",
         "type": "github"
       },
       "original": {
@@ -306,6 +256,26 @@
         "type": "github"
       }
     },
+    "homebrew": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785271058,
+        "narHash": "sha256-xVisL04Gt6LsGa1cGCLHhTED7iEykgl7krPyzAm2ZQg=",
+        "owner": "koalalorenzo",
+        "repo": "home-manager-brew",
+        "rev": "795f9aed8ddce24b3cae3b75598e6861e7d72d10",
+        "type": "github"
+      },
+      "original": {
+        "owner": "koalalorenzo",
+        "repo": "home-manager-brew",
+        "type": "github"
+      }
+    },
     "lanzaboote": {
       "inputs": {
         "crane": "crane",
@@ -330,36 +300,18 @@
         "type": "github"
       }
     },
-    "linux-ntfs": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1784514524,
-        "narHash": "sha256-opG3HF0XoDBmZCYbG4MD0+Jt7rFL/VCEdBH74RouKPs=",
-        "owner": "namjaejeon",
-        "repo": "linux-ntfs",
-        "rev": "ca149db6b901a0d44cdd88e54047e0cd422ca70d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "namjaejeon",
-        "repo": "linux-ntfs",
-        "type": "github"
-      }
-    },
     "nix-cachyos-kernel": {
       "inputs": {
-        "cachyos-kernel": "cachyos-kernel",
-        "cachyos-kernel-patches": "cachyos-kernel-patches",
         "flake-compat": "flake-compat_2",
         "flake-parts": "flake-parts_2",
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1784919871,
+        "lastModified": 1789070668,
-        "narHash": "sha256-pCtk2K7SXa43Ujj2mav4L40OHqqymXt+y9YKGvm7AzY=",
+        "narHash": "sha256-Zel41jsQnKlZQHBFndBoRCJ3WfJCXknV2jL0GJbLy9k=",
         "owner": "xddxdd",
         "repo": "nix-cachyos-kernel",
-        "rev": "29893f428702736575d4eb5806c26c3148d6da8c",
+        "rev": "b8538a38adfd2a443aa0f8f3d506c29161f71f5f",
         "type": "github"
       },
       "original": {
@@ -368,6 +320,27 @@
         "type": "github"
       }
     },
+    "nix-darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1786845137,
+        "narHash": "sha256-oQFip+v0luP8NIxJzmiW4Wu8bILsbFWom5l0zonl8hQ=",
+        "owner": "nix-darwin",
+        "repo": "nix-darwin",
+        "rev": "4cff07de74b50e64bdd68cd4e722ab5b6b35ee48",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-darwin",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
     "nix-flatpak": {
       "locked": {
         "lastModified": 1767983141,
@@ -391,11 +364,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784989404,
+        "lastModified": 1789063032,
-        "narHash": "sha256-2USwOGm7rf9oX2lIVIIbci5hvAdP1tOHK+WpHK5nifw=",
+        "narHash": "sha256-QHJcFCNEf7gqOzwClCIyAnU24Q2OUQS9WJTduZgnkxs=",
         "owner": "sudosubin",
         "repo": "nix-skills",
-        "rev": "939e5b8184c974e8cd5d4bf3d05465589b341663",
+        "rev": "f3305681ea01e147fc65fa16d55df81fab28c6f7",
         "type": "github"
       },
       "original": {
@@ -434,11 +407,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784723954,
+        "lastModified": 1788942796,
-        "narHash": "sha256-1CfD8ZUjCkTgjsneLZ/lxCHhgDfqxxE7/GX0MmsgiqA=",
+        "narHash": "sha256-CLoJCCRi9sogsyGXYn8rOCWBLKAntfKUB9Rli/YXgEY=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "a017f5b72210026af5b3ac5949f08d94380a6fbd",
+        "rev": "83bbc895120516d6e86885a188c04beced6535d9",
         "type": "github"
       },
       "original": {
@@ -450,11 +423,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1784900848,
+        "lastModified": 1789034407,
-        "narHash": "sha256-qHfivN3D0K3wKjKCJVhzFBz6eKIt56DHJUvIzbRc5Gc=",
+        "narHash": "sha256-7X4GZ0KK5qHF9lppR9IlfXShYGcxxw1Kcjj8m5+19H0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6136e0cb87c2b1dea66de7caf58fd70db4d78267",
+        "rev": "3824e02a19d7dccf95c30aa1cab8c857323d2201",
         "type": "github"
       },
       "original": {
@@ -464,29 +437,13 @@
         "type": "github"
       }
     },
-    "nixpkgs-2605": {
-      "locked": {
-        "lastModified": 1784856561,
-        "narHash": "sha256-J+Bx1Z6Oeoj2FgnBhRMKyUhhtDoOpTgXYaVLZpDjW4A=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "597283ad8aa0b331c788e97c4c262d58877074ef",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-26.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1782614948,
+        "lastModified": 1788057806,
-        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
+        "narHash": "sha256-DTQSMxzDWmT0zhguthvegnVkn7CFqGCv4IHCzk5ZUpM=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
+        "rev": "596e2e3940e09b2abbeb03f75fa1828c57fcd72c",
         "type": "github"
       },
       "original": {
@@ -513,11 +470,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1784796856,
+        "lastModified": 1789006805,
-        "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
+        "narHash": "sha256-xB8mKMOx1IA9vTDNLmJZ6n4wCMq/cuWBBOzGCRnqxrU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
+        "rev": "8ce4ef6cb6f871616146b9fe26d2a5ae594e94fe",
         "type": "github"
       },
       "original": {
@@ -542,31 +499,10 @@
         "type": "indirect"
       }
     },
-    "ntfsplus": {
-      "inputs": {
-        "linux-ntfs": "linux-ntfs",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1774317576,
-        "narHash": "sha256-HSDFaDLvfS/NqJlXbHh9135DEpqH6JrNuWqbu3YPcTg=",
-        "owner": "cmspam",
-        "repo": "ntfsplus-flake",
-        "rev": "e22d1bcbac31b4e6484d32c503396e8184650215",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cmspam",
-        "repo": "ntfsplus-flake",
-        "type": "github"
-      }
-    },
     "peerix": {
       "inputs": {
         "flake-compat": "flake-compat_3",
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
@@ -593,11 +529,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783574839,
+        "lastModified": 1785762349,
-        "narHash": "sha256-ICof1tV4/9XheBLBGf7dhMhfMq4dOs1zwTHrr7zGFlA=",
+        "narHash": "sha256-jZhZkzAwc7f3exzcTDJWP2WCAchCv0iNC3UF/QsahdQ=",
         "owner": "nix-community",
         "repo": "plasma-manager",
-        "rev": "c551f0687658e4bb699cfff6015436ad7ee57a0d",
+        "rev": "a19a2a029fa180911bd89c554dca1616e10f4c1d",
         "type": "github"
       },
       "original": {
@@ -635,16 +571,16 @@
         "bun2nix": "bun2nix",
         "claude-code": "claude-code",
         "home-manager": "home-manager",
+        "homebrew": "homebrew",
         "lanzaboote": "lanzaboote",
         "nix-cachyos-kernel": "nix-cachyos-kernel",
+        "nix-darwin": "nix-darwin",
         "nix-flatpak": "nix-flatpak",
         "nix-skills": "nix-skills",
         "nix-sweep": "nix-sweep",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_2",
-        "nixpkgs-2605": "nixpkgs-2605",
         "nixpkgs-linuxeol": "nixpkgs-linuxeol",
-        "ntfsplus": "ntfsplus",
         "peerix": "peerix",
         "plasma-manager": "plasma-manager"
       }

flake.nix

@@ -14,7 +14,6 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgs-2605.url = "github:NixOS/nixpkgs/nixos-26.05";
     nixpkgs-linuxeol.url = "github:NixOS/nixpkgs/162f04bf3dd222187388bc990a8678170d594419";
     nixos-hardware = {
       url = "github:NixOS/nixos-hardware/master";
@@ -49,10 +48,6 @@
       url = "github:Lumpiasty/acer-wmi-ext/main";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    ntfsplus = {
-      url = "github:cmspam/ntfsplus-flake";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     nix-skills = {
       url = "github:sudosubin/nix-skills";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -62,9 +57,17 @@
       url = "github:nix-community/bun2nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    nix-darwin = {
+      url = "github:nix-darwin/nix-darwin/master";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    homebrew = {
+      url = "github:koalalorenzo/home-manager-brew";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
   
-  outputs = { self, nixos-hardware, ... }@inputs:
+  outputs = { self, nixos-hardware, nix-darwin, ... }@inputs:
     {
       nixosConfigurations = 
         let
@@ -75,5 +78,28 @@
             acer = mkNixosSystem {} hosts/acer.nix;
             gaming-pc = mkNixosSystem {} hosts/gaming-pc.nix;
           };
+      darwinConfigurations."MacBook-Pro-Macbook" = nix-darwin.lib.darwinSystem {
+        modules = [
+          ((import ./hosts/macbook.nix) self)
+          inputs.home-manager.darwinModules.home-manager
+          {
+              home-manager.useGlobalPkgs = true;
+              home-manager.useUserPackages = true;
+              home-manager.verbose = true;
+              home-manager.users.macbookpro = { ... }: {
+                imports = [
+                  ./home-modules
+                  ./users/user/home.nix
+                  inputs.homebrew.homeManagerModules.default
+                ];
+                lumpiastyHome.macos = true;
+              };
+              nixpkgs.overlays = [
+                inputs.claude-code.overlays.default
+                inputs.nix-skills.overlays.default
+              ] ++ (import ./overlays/pkgs.nix { bun2nix = inputs.bun2nix; });
+          }
+        ];
+      };
     };
 }

home-modules/default.nix

@@ -1,12 +1,20 @@
-{ flake, pkgs, lib, ... }:
+{ flake, pkgs, lib, osConfig ? null, ... }:
 
 {
+  options.lumpiastyHome.macos = lib.mkEnableOption "Macos specific things";
+
   imports = [
     ./gpg.nix
     ./pc.nix
     ./dev.nix
     ./gaming.nix
-    ./plasma.nix
     ./fhsBash.nix
+    ./linux.nix
+  ] ++ lib.optionals (osConfig ? system.defaults) [
+    # Can't use config.lumpiastyHome.macos here — imports are evaluated before config,
+    # causing infinite recursion. osConfig ? system.defaults detects nix-darwin.
+    ./macos.nix
+  ] ++ lib.optionals (osConfig.lumpiasty.enablePlasma) [
+    ./plasma.nix
   ];
-}
+}

home-modules/dev.nix

@@ -73,17 +73,14 @@
       docker
       docker-buildx
       proton-vpn
-      wl-clipboard
       devenv
       dig
       whois
       mtr
-      traceroute
       nodejs_24
       codex
       claude-code
       winbox4
-      amdgpu_top
       dua
     ];
 
@@ -120,7 +117,7 @@
         User = "root";
         ControlMaster = "auto";
         ControlPersist = "3600";
-        ControlPath = "/run/user/%i/ssh-socket-%r@%h:%p";
+        ControlPath = lib.mkIf config.lumpiastyHome.linux "/run/user/%i/ssh-socket-%r@%h:%p";
         ServerAliveInterval = 20;
       };
 

home-modules/gpg.nix

@@ -7,7 +7,7 @@
     services.gpg-agent = {
       enable = true;
       enableSshSupport = true;
-      pinentry.package = pkgs.pinentry-qt;
+      pinentry.package = lib.mkIf config.lumpiastyHome.linux pkgs.pinentry-qt;
       extraConfig = ''
         listen-backlog 256
         '';
@@ -15,11 +15,12 @@
 
     programs.gpg.enable = true;
 
-    programs.git.signing = {
+    programs.git.signing = 
-      format = "openpgp";
+      lib.mkIf config.lumpiastyHome.linux { # TODO: on macos too
-      key = "EA287B39E5F69945";
+        format = "openpgp";
-      signByDefault = true;
+        key = "EA287B39E5F69945";
-    };
+        signByDefault = true;
+      };
 
     programs.bash.enable = lib.mkDefault true;
   };

home-modules/linux.nix

@@ -0,0 +1,29 @@
+{ config, lib, pkgs, osConfig, ... }:
+
+{
+  options.lumpiastyHome.linux = lib.mkEnableOption "Linux specific things";
+  config = lib.mkIf config.lumpiastyHome.linux {
+    services.easyeffects.enable = true;
+    systemd.user.services.easyeffects.Service = lib.mkIf osConfig.lumpiasty.audioRt.cpuPartitioning {
+      # Move easyeffects into audio.slice (defined in modules/desktop/audio-rt.nix)
+      # which has AllowedCPUs=<audioCpus> — pins all DSP work to the reserved cores.
+      Slice = "audio.slice";
+    };
+
+    programs.chromium.enable = true;
+    programs.chromium.package = pkgs.ungoogled-chromium;
+
+    home.packages = with pkgs; (lib.optionals config.lumpiastyHome.dev [
+      wl-clipboard
+      traceroute
+      amdgpu_top
+    ] ++ lib.optionals config.lumpiastyHome.linux [
+      pass-wayland
+      libreoffice-qt-stable
+      vlc
+      gimp
+      ventoy-full-qt
+      teamspeak6-client
+    ]);
+  };
+}

home-modules/macos.nix

@@ -0,0 +1,33 @@
+{ config, lib, pkgs, osConfig, ... }:
+
+let
+  brewPath = config.homebrew.brewPath;
+in {
+  config = lib.mkIf config.lumpiastyHome.macos {
+    targets.darwin.copyApps.enable = true;
+    targets.darwin.linkApps.enable = false;
+
+    homebrew = {
+      enable = true;
+      brewInstall = true;
+      update = true;
+      upgrade = true;
+      cleanup = true;
+      casks = [
+        "steam"
+      ];
+    };
+
+    home.activation.homebrewInstall = lib.mkForce (
+      lib.hm.dag.entryAfter ["installPackages" "linkGeneration" "createGpgHomedir"] (
+        if config.homebrew.brewInstall then ''
+          if [ ! -f "${brewPath}" ]; then
+            echo "Homebrew not found (${brewPath}), installing..."
+            export PATH="${pkgs.curl}/bin:${pkgs.bash}/bin:${pkgs.coreutils}/bin:${pkgs.gnugrep}/bin:${pkgs.gnused}/bin:$PATH"
+            ${pkgs.bash}/bin/bash -c "$(${pkgs.curl}/bin/curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+          fi
+        '' else ""
+      )
+    );
+  };
+}

home-modules/pc.nix

@@ -8,11 +8,6 @@
       vesktop
       # Manual update, not yet in nixpkgs as for now
       spotify
-      pass-wayland
-      teamspeak6-client
-      easyeffects
-      libreoffice-qt6-fresh
-      vlc
       inkscape
       qtpass
       signal-desktop
@@ -20,26 +15,15 @@
       thunderbird
       pwgen
       siyuan
-      gimp
-      ventoy-full-qt
     ];
     programs.librewolf.enable = true;
-    services.easyeffects.enable = true;
-    systemd.user.services.easyeffects.Service = lib.mkIf osConfig.lumpiasty.audioRt.cpuPartitioning {
-      # Move easyeffects into audio.slice (defined in modules/desktop/audio-rt.nix)
-      # which has AllowedCPUs=<audioCpus> — pins all DSP work to the reserved cores.
-      Slice = "audio.slice";
-    };
 
-    programs.chromium.enable = true;
+    # services.flatpak.remotes = [{
-    programs.chromium.package = pkgs.ungoogled-chromium;
+    #   name = "flathub"; location = "https://dl.flathub.org/repo/flathub.flatpakrepo";
-
+    # }];
-    services.flatpak.remotes = [{
+    # services.flatpak.packages = [
-      name = "flathub"; location = "https://dl.flathub.org/repo/flathub.flatpakrepo";
+    #   # "org.onlyoffice.desktopeditors"
-    }];
+    # ];
-    services.flatpak.packages = [
-      # "org.onlyoffice.desktopeditors"
-    ];
 
     # Vesktop settings
     # Nope, TODO

hosts/gaming-pc.nix

@@ -102,8 +102,6 @@
         };
     };
 
-  # Use ntfs-plus instead driver
-  services.ntfsplus.enable = true;
   # Force disable ntfs-3g driver
   boot.supportedFilesystems.ntfs = lib.mkForce false;
 

hosts/macbook.nix

@@ -0,0 +1,36 @@
+self: { pkgs, ... }: {
+    imports = [ ../modules/options.nix ];
+
+    # List packages installed in system profile. To search by name, run:
+    # $ nix-env -qaP | grep wget
+    environment.systemPackages = with pkgs; [
+      vim
+      curl
+      git
+    ];
+
+    # Necessary for using flakes on this system.
+    nix.settings.experimental-features = "nix-command flakes";
+
+    # Enable alternative shell support in nix-darwin.
+    # programs.fish.enable = true;
+
+    # Set Git commit hash for darwin-version.
+    system.configurationRevision = self.rev or self.dirtyRev or null;
+
+    # Used for backwards compatibility, please read the changelog before changing.
+    # $ darwin-rebuild changelog
+    system.stateVersion = 6;
+
+    # The platform the configuration will be used on.
+    nixpkgs.hostPlatform = "aarch64-darwin";
+
+    users.users.macbookpro = {
+        home = "/Users/macbookpro";
+    };
+
+    lumpiasty.pc = true;
+
+    # Allow unfree packages
+    nixpkgs.config.allowUnfree = true;
+}

lib/mkHome.nix

@@ -9,5 +9,6 @@ lib.mkIf condition (
       ../home-modules
       home
     ];
+    lumpiastyHome.linux = true;
   }
 )

lib/mkNixosSystem.nix

@@ -1,7 +1,6 @@
 {
   self,
   nixpkgs,
-  nixpkgs-2605,
   home-manager,
   nix-flatpak,
   plasma-manager,
@@ -10,7 +9,6 @@
   nix-sweep,
   peerix,
   acer-wmi-ext,
-  ntfsplus,
   nix-skills,
   nixpkgs-linuxeol,
   bun2nix,
@@ -26,14 +24,10 @@ nixpkgs.lib.nixosSystem {
     inherit plasma-manager;
     inherit acer-wmi-ext;
     inherit nixpkgs-linuxeol;
-    inherit ntfsplus;
   };
   modules = [
     {
       nixpkgs.overlays = [
-        (final: prev: {
-          librewolf = nixpkgs-2605.legacyPackages.${prev.system}.librewolf;
-        })
         claude-code.overlays.default
         acer-wmi-ext.overlays.default
         nix-skills.overlays.default

modules/default.nix

@@ -2,13 +2,13 @@
 
 {
   imports = [
+    ./options.nix
+
     hardware/intel-cpu.nix
     hardware/amd-cpu.nix
     hardware/no-mitigations.nix
     hardware/acer-undervolt.nix
 
-    system/ntfsplus.nix
-    system/roles.nix
     system/nixpkgs.nix
     system/location.nix
     system/shell.nix
@@ -18,6 +18,7 @@
     system/ipv6-mostly.nix
     system/nix.nix
     system/zfs.nix
+    system/ntfsplus.nix
 
     desktop/plasma.nix
     desktop/touchpad.nix

modules/desktop/audio-rt.nix

@@ -38,72 +38,7 @@ let
 
 in
 
-{
+{ config = lib.mkMerge [
-  options.lumpiasty.audioRt = {
-    enable = lib.mkEnableOption "Audio RT scheduling and CPU isolation";
-
-    audioCpus = lib.mkOption {
-      type = lib.types.str;
-      default = "12-15";
-      description = "CPU list reserved for audio services (systemd cpuset syntax).";
-    };
-
-    nonAudioCpus = lib.mkOption {
-      type = lib.types.str;
-      default = "0-11";
-      description = "CPU list for everything else.";
-    };
-
-    # ------ Individual optimization toggles ------
-
-    cpuPartitioning = lib.mkOption {
-      type = lib.types.bool;
-      default = cfg.enable;
-      description = ''
-        Cgroup-based CPU partitioning via dedicated audio.slice and
-        restricted app/session/background slices.
-      '';
-    };
-
-    rtLimits = lib.mkOption {
-      type = lib.types.bool;
-      default = cfg.enable;
-      description = ''
-        Raise rlimits (RTPRIO=95, MEMLOCK=infinity) for the audio group
-        so PipeWire's module-rt can set SCHED_FIFO 88 directly instead
-        of going through RTKit's priority-10 ceiling.
-      '';
-    };
-
-    performanceGovernor = lib.mkOption {
-      type = lib.types.bool;
-      default = cfg.enable;
-      description = ''
-        Keep cpufreq governor `performance` on the audio cores so they
-        stay boosted regardless of measured utilization.
-      '';
-    };
-
-    ananicy = lib.mkOption {
-      type = lib.types.bool;
-      default = cfg.enable;
-      description = ''
-        Run ananicy-cpp with a rule that pins easyeffects to nice -12 so
-        its non-RT DSP threads get scheduler preference under load.
-      '';
-    };
-
-    optimisedBinaries = lib.mkOption {
-      type = lib.types.bool;
-      default = cfg.enable;
-      description = ''
-        Rebuild easyeffects and its DSP dependencies with -march=znver4 -O3
-        (and LTO for cmake builds, target-cpu for rust builds).
-      '';
-    };
-  };
-
-  config = lib.mkMerge [
 
     # --- Optimised binary builds ---------------------------------------------
     (lib.mkIf (cfg.enable && cfg.optimisedBinaries) {
@@ -223,6 +158,7 @@ in
       services.ananicy = {
         enable = true;
         package = pkgs.ananicy-cpp;
+        rulesProvider = pkgs.ananicy-cpp;
         extraRules = [
           { name = "easyeffects"; type = "Audio"; nice = -12; }
         ];

modules/desktop/gnome.nix

@@ -1,8 +1,6 @@
 { config, lib, pkgs, modulesPath, ... }:
 
 {
-  options.lumpiasty.enableGnome = lib.mkEnableOption "Enable Gnome desktop";
-
   config = lib.mkIf config.lumpiasty.enableGnome {
     # Enable the X11 windowing system.
     services.xserver.enable = true;

modules/desktop/plasma.nix

@@ -1,8 +1,6 @@
 { config, lib, pkgs, modulesPath, ... }:
 
 {
-  options.lumpiasty.enablePlasma = lib.mkEnableOption "Enable Plasma6 desktop";
-
   config = lib.mkIf config.lumpiasty.enablePlasma {
     # Enable the X11 windowing system.
     services.xserver.enable = true;

modules/desktop/pulseaudio.nix

@@ -2,8 +2,6 @@
 
 {
 
-  options.lumpiasty.enablePulseaudio = lib.mkEnableOption "Enable Plasma6 desktop";
-
   config = lib.mkIf config.lumpiasty.enablePulseaudio {
     # Enable sound with pipewire. Dont forget after 24.05
     services.pulseaudio.enable = false;

modules/desktop/tailscale.nix

@@ -1,8 +1,6 @@
 { config, lib, pkgs, modulesPath, ... }:
 
 {
-  options.lumpiasty.enableTailscale = lib.mkEnableOption "Enable Tailscale VPN";
-
   config = lib.mkIf config.lumpiasty.enableTailscale {
     services.tailscale = {
       enable = true;

modules/desktop/touchpad.nix

@@ -1,177 +1,6 @@
-{ config, lib, pkgs, modulesPath, ... }:
+{ ... }:
 
-# Touch pad configuration interface
+# Touch pad configuration interface.
-
+# Options are declared in ./options.nix; config is applied by home-modules/plasma.nix.
-let
-  scrollMethods = {
-    twoFingers = "twoFingers";
-    touchPadEdges = "touchPadEdges";
-  };
-  rightClickMethods = {
-    bottomRight = "bottomRight";
-    twoFingers = "twoFingers";
-  };
-  accelerationProfiles = {
-    none = "none";
-    default = "default";
-  };
-in
 {
-  # Copy of https://github.com/nix-community/plasma-manager/blob/trunk/modules/input.nix#L69
-  options.lumpiasty.touchPad = {
-    enable = lib.mkOption {
-      type = with lib.types; nullOr bool;
-      default = null;
-      example = true;
-      description = ''
-        Whether to enable the touchpad.
-      '';
-    };
-    name = lib.mkOption {
-      type = with lib.types; nullOr str;
-      default = null;
-      example = "PNP0C50:00 0911:5288 Touchpad";
-      description = ''
-        The name of the touchpad.
-
-        This can be found by looking at the `Name` attribute in the section in
-        the `/proc/bus/input/devices` path belonging to the touchpad.
-      '';
-    };
-    vendorId = lib.mkOption {
-      type = with lib.types; nullOr str;
-      default = null;
-      example = "0911";
-      description = ''
-        The vendor ID of the touchpad.
-
-        This can be found by looking at the `Vendor` attribute in the section in
-        the `/proc/bus/input/devices` path belonging to the touchpad.
-      '';
-    };
-    productId = lib.mkOption {
-      type = with lib.types; nullOr str;
-      default = null;
-      example = "5288";
-      description = ''
-        The product ID of the touchpad.
-
-        This can be found by looking at the `Product` attribute in the section in
-        the `/proc/bus/input/devices` path belonging to the touchpad.
-      '';
-    };
-    disableWhileTyping = lib.mkOption {
-      type = with lib.types; nullOr bool;
-      default = null;
-      example = true;
-      description = ''
-        Whether to disable the touchpad while typing.
-      '';
-    };
-    leftHanded = lib.mkOption {
-      type = with lib.types; nullOr bool;
-      default = null;
-      example = false;
-      description = ''
-        Whether to swap the left and right buttons.
-      '';
-    };
-    middleButtonEmulation = lib.mkOption {
-      type = with lib.types; nullOr bool;
-      default = null;
-      example = false;
-      description = ''
-        Whether to enable middle mouse click emulation by pressing the left and right buttons at the same time.
-        Activating this increases the click latency by 50ms.
-      '';
-    };
-    pointerSpeed = lib.mkOption {
-      type = with lib.types; nullOr (numbers.between (-1) 1);
-      default = null;
-      example = "0";
-      description = ''
-        How fast the pointer moves.
-      '';
-    };
-    accelerationProfile = lib.mkOption {
-      type = with lib.types; nullOr (enum (builtins.attrNames accelerationProfiles));
-      default = null;
-      example = "none";
-      description = "Set the touchpad acceleration profile.";
-      apply = profile: if (profile == null) then null else accelerationProfiles."${profile}";
-    };
-    naturalScroll = lib.mkOption {
-      type = with lib.types; nullOr bool;
-      default = null;
-      example = true;
-      description = ''
-        Whether to enable natural scrolling for the touchpad.
-      '';
-    };
-    tapToClick = lib.mkOption {
-      type = with lib.types; nullOr bool;
-      default = null;
-      example = true;
-      description = ''
-        Whether to enable tap-to-click for the touchpad.
-      '';
-    };
-    tapAndDrag = lib.mkOption {
-      type = with lib.types; nullOr bool;
-      default = null;
-      example = true;
-      description = ''
-        Whether to enable tap-and-drag for the touchpad.
-      '';
-    };
-    tapDragLock = lib.mkOption {
-      type = with lib.types; nullOr bool;
-      default = null;
-      example = true;
-      description = ''
-        Whether to enable the tap-and-drag lock for the touchpad.
-      '';
-    };
-    scrollMethod = lib.mkOption {
-      type = with lib.types; nullOr (enum (builtins.attrNames scrollMethods));
-      default = null;
-      example = "touchPadEdges";
-      description = ''
-        Configure how scrolling is performed on the touchpad.
-      '';
-      apply = method: if (method == null) then null else scrollMethods."${method}";
-    };
-    scrollSpeed = lib.mkOption {
-      type = with lib.types; nullOr (numbers.between 0.1 20);
-      default = null;
-      example = 0.1;
-      description = ''
-        Configure the scrolling speed of the touchpad. Lower is slower.
-        If unset, KDE Plasma will default to 0.3.
-      '';
-    };
-    rightClickMethod = lib.mkOption {
-      type = with lib.types; nullOr (enum (builtins.attrNames rightClickMethods));
-      default = null;
-      example = "twoFingers";
-      description = ''
-        Configure how right-clicking is performed on the touchpad.
-      '';
-      apply = method: if (method == null) then null else rightClickMethods."${method}";
-    };
-    twoFingerTap = lib.mkOption {
-      type =
-        with lib.types;
-        nullOr (enum [
-          "rightClick"
-          "middleClick"
-        ]);
-      default = null;
-      example = "twoFingers";
-      description = ''
-        Configure what a two-finger tap maps to on the touchpad.
-      '';
-      apply = v: if (v == null) then null else (v == "middleClick");
-    };
-  };
 }

modules/hardware/acer-undervolt.nix

@@ -18,8 +18,6 @@
 # persist values across boot / resume.
 
 {
-  options.lumpiasty.acerUndervolt = lib.mkEnableOption "ryzenadj + ryzen_smu tooling for Acer 8845HS";
-
   config = lib.mkIf config.lumpiasty.acerUndervolt {
     boot.kernelModules = [ "ryzen_smu" ];
     boot.extraModulePackages = [ config.boot.kernelPackages.ryzen-smu ];

modules/hardware/amd-cpu.nix

@@ -1,8 +1,6 @@
 { config, lib, pkgs, modulesPath, ... }:
 
 {
-  options.lumpiasty.amdCpu = lib.mkEnableOption "Enable amd CPU";
-
   config = lib.mkIf config.lumpiasty.amdCpu {
     nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
     hardware.cpu.amd.updateMicrocode = true;

modules/hardware/intel-cpu.nix

@@ -1,8 +1,6 @@
 { config, lib, pkgs, modulesPath, ... }:
 
 {
-  options.lumpiasty.intelCpu = lib.mkEnableOption "Enable intel CPU";
-
   config = lib.mkIf config.lumpiasty.intelCpu {
     nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
     # hardware.cpu.intel.updateMicrocode = true;

modules/hardware/no-mitigations.nix

@@ -1,8 +1,6 @@
 { config, lib, pkgs, modulesPath, ... }:
 
 {
-  options.lumpiasty.noMitigations = lib.mkEnableOption "Disable mitigations";
-
   config = lib.mkIf config.lumpiasty.noMitigations {
     boot.kernelParams = [
       "mitigations=off"

modules/options.nix

@@ -0,0 +1,258 @@
+{ config, lib, ... }:
+
+let
+  scrollMethods = {
+    twoFingers = "twoFingers";
+    touchPadEdges = "touchPadEdges";
+  };
+  rightClickMethods = {
+    bottomRight = "bottomRight";
+    twoFingers = "twoFingers";
+  };
+  accelerationProfiles = {
+    none = "none";
+    default = "default";
+  };
+in
+{
+  options.lumpiasty = {
+    pc = lib.mkEnableOption "Enable options specific to personal computers";
+    laptop = lib.mkEnableOption "Enable options specific to laptops";
+    intelCpu = lib.mkEnableOption "Enable intel CPU";
+    amdCpu = lib.mkEnableOption "Enable amd CPU";
+    noMitigations = lib.mkEnableOption "Disable mitigations";
+    acerUndervolt = lib.mkEnableOption "ryzenadj + ryzen_smu tooling for Acer 8845HS";
+    enablePlasma = lib.mkEnableOption "Enable Plasma6 desktop";
+    enableGnome = lib.mkEnableOption "Enable Gnome desktop";
+    enablePulseaudio = lib.mkEnableOption "Enable Pulseaudio/Pipewire";
+    enableTailscale = lib.mkEnableOption "Enable Tailscale VPN";
+    sshd = lib.mkEnableOption "Enable OpenSSH server";
+    gaming = lib.mkEnableOption "Enable options specific to gaming computers";
+    scx = lib.mkEnableOption "Enable sched-ext";
+    ipv6Mostly = lib.mkEnableOption "Enable IPv6-mostly (RFC 8925 + CLAT/464XLAT) support in NetworkManager";
+
+    users = {
+      user = lib.mkEnableOption "Create user \"user\"";
+      drugi = lib.mkEnableOption "Create user \"drugi\"";
+    };
+
+    touchPad = {
+      enable = lib.mkOption {
+        type = with lib.types; nullOr bool;
+        default = null;
+        example = true;
+        description = ''
+          Whether to enable the touchpad.
+        '';
+      };
+      name = lib.mkOption {
+        type = with lib.types; nullOr str;
+        default = null;
+        example = "PNP0C50:00 0911:5288 Touchpad";
+        description = ''
+          The name of the touchpad.
+
+          This can be found by looking at the `Name` attribute in the section in
+          the `/proc/bus/input/devices` path belonging to the touchpad.
+        '';
+      };
+      vendorId = lib.mkOption {
+        type = with lib.types; nullOr str;
+        default = null;
+        example = "0911";
+        description = ''
+          The vendor ID of the touchpad.
+
+          This can be found by looking at the `Vendor` attribute in the section in
+          the `/proc/bus/input/devices` path belonging to the touchpad.
+        '';
+      };
+      productId = lib.mkOption {
+        type = with lib.types; nullOr str;
+        default = null;
+        example = "5288";
+        description = ''
+          The product ID of the touchpad.
+
+          This can be found by looking at the `Product` attribute in the section in
+          the `/proc/bus/input/devices` path belonging to the touchpad.
+        '';
+      };
+      disableWhileTyping = lib.mkOption {
+        type = with lib.types; nullOr bool;
+        default = null;
+        example = true;
+        description = ''
+          Whether to disable the touchpad while typing.
+        '';
+      };
+      leftHanded = lib.mkOption {
+        type = with lib.types; nullOr bool;
+        default = null;
+        example = false;
+        description = ''
+          Whether to swap the left and right buttons.
+        '';
+      };
+      middleButtonEmulation = lib.mkOption {
+        type = with lib.types; nullOr bool;
+        default = null;
+        example = false;
+        description = ''
+          Whether to enable middle mouse click emulation by pressing the left and right buttons at the same time.
+          Activating this increases the click latency by 50ms.
+        '';
+      };
+      pointerSpeed = lib.mkOption {
+        type = with lib.types; nullOr (numbers.between (-1) 1);
+        default = null;
+        example = "0";
+        description = ''
+          How fast the pointer moves.
+        '';
+      };
+      accelerationProfile = lib.mkOption {
+        type = with lib.types; nullOr (enum (builtins.attrNames accelerationProfiles));
+        default = null;
+        example = "none";
+        description = "Set the touchpad acceleration profile.";
+        apply = profile: if (profile == null) then null else accelerationProfiles."${profile}";
+      };
+      naturalScroll = lib.mkOption {
+        type = with lib.types; nullOr bool;
+        default = null;
+        example = true;
+        description = ''
+          Whether to enable natural scrolling for the touchpad.
+        '';
+      };
+      tapToClick = lib.mkOption {
+        type = with lib.types; nullOr bool;
+        default = null;
+        example = true;
+        description = ''
+          Whether to enable tap-to-click for the touchpad.
+        '';
+      };
+      tapAndDrag = lib.mkOption {
+        type = with lib.types; nullOr bool;
+        default = null;
+        example = true;
+        description = ''
+          Whether to enable tap-and-drag for the touchpad.
+        '';
+      };
+      tapDragLock = lib.mkOption {
+        type = with lib.types; nullOr bool;
+        default = null;
+        example = true;
+        description = ''
+          Whether to enable the tap-and-drag lock for the touchpad.
+        '';
+      };
+      scrollMethod = lib.mkOption {
+        type = with lib.types; nullOr (enum (builtins.attrNames scrollMethods));
+        default = null;
+        example = "touchPadEdges";
+        description = ''
+          Configure how scrolling is performed on the touchpad.
+        '';
+        apply = method: if (method == null) then null else scrollMethods."${method}";
+      };
+      scrollSpeed = lib.mkOption {
+        type = with lib.types; nullOr (numbers.between 0.1 20);
+        default = null;
+        example = 0.1;
+        description = ''
+          Configure the scrolling speed of the touchpad. Lower is slower.
+          If unset, KDE Plasma will default to 0.3.
+        '';
+      };
+      rightClickMethod = lib.mkOption {
+        type = with lib.types; nullOr (enum (builtins.attrNames rightClickMethods));
+        default = null;
+        example = "twoFingers";
+        description = ''
+          Configure how right-clicking is performed on the touchpad.
+        '';
+        apply = method: if (method == null) then null else rightClickMethods."${method}";
+      };
+      twoFingerTap = lib.mkOption {
+        type =
+          with lib.types;
+          nullOr (enum [
+            "rightClick"
+            "middleClick"
+          ]);
+        default = null;
+        example = "twoFingers";
+        description = ''
+          Configure what a two-finger tap maps to on the touchpad.
+        '';
+        apply = v: if (v == null) then null else (v == "middleClick");
+      };
+    };
+
+    audioRt = {
+      enable = lib.mkEnableOption "Audio RT scheduling and CPU isolation";
+
+      audioCpus = lib.mkOption {
+        type = lib.types.str;
+        default = "12-15";
+        description = "CPU list reserved for audio services (systemd cpuset syntax).";
+      };
+
+      nonAudioCpus = lib.mkOption {
+        type = lib.types.str;
+        default = "0-11";
+        description = "CPU list for everything else.";
+      };
+
+      cpuPartitioning = lib.mkOption {
+        type = lib.types.bool;
+        default = config.lumpiasty.audioRt.enable;
+        description = ''
+          Cgroup-based CPU partitioning via dedicated audio.slice and
+          restricted app/session/background slices.
+        '';
+      };
+
+      rtLimits = lib.mkOption {
+        type = lib.types.bool;
+        default = config.lumpiasty.audioRt.enable;
+        description = ''
+          Raise rlimits (RTPRIO=95, MEMLOCK=infinity) for the audio group
+          so PipeWire's module-rt can set SCHED_FIFO 88 directly instead
+          of going through RTKit's priority-10 ceiling.
+        '';
+      };
+
+      performanceGovernor = lib.mkOption {
+        type = lib.types.bool;
+        default = config.lumpiasty.audioRt.enable;
+        description = ''
+          Keep cpufreq governor `performance` on the audio cores so they
+          stay boosted regardless of measured utilization.
+        '';
+      };
+
+      ananicy = lib.mkOption {
+        type = lib.types.bool;
+        default = config.lumpiasty.audioRt.enable;
+        description = ''
+          Run ananicy-cpp with a rule that pins easyeffects to nice -12 so
+          its non-RT DSP threads get scheduler preference under load.
+        '';
+      };
+
+      optimisedBinaries = lib.mkOption {
+        type = lib.types.bool;
+        default = config.lumpiasty.audioRt.enable;
+        description = ''
+          Rebuild easyeffects and its DSP dependencies with -march=znver4 -O3
+          (and LTO for cmake builds, target-cpu for rust builds).
+        '';
+      };
+    };
+  };
+}

modules/system/gaming.nix

@@ -1,8 +1,5 @@
 { config, lib, pkgs, modulesPath, ... }:
 {
-  options.lumpiasty.gaming = lib.mkEnableOption "Enable options specific to gaming computers";
-  options.lumpiasty.scx = lib.mkEnableOption "Enable sched-ext";
-
   config = lib.mkIf config.lumpiasty.gaming {
     # https://github.com/NixOS/nixpkgs/blob/10e687235226880ed5e9f33f1ffa71fe60f2638a/nixos/modules/programs/steam.nix
     hardware.graphics = {

modules/system/ipv6-mostly.nix

@@ -6,8 +6,6 @@
 # defaults, mirroring the Fedora 45 change:
 # https://fedoraproject.org/wiki/Changes/IPv6-Mostly_Support_In_NetworkManager
 {
-  options.lumpiasty.ipv6Mostly = lib.mkEnableOption "Enable IPv6-mostly (RFC 8925 + CLAT/464XLAT) support in NetworkManager";
-
   config = lib.mkIf config.lumpiasty.ipv6Mostly {
     # Use the patched NM build with CLAT support, without replacing pkgs.networkmanager
     # globally (which would cascade rebuilds across the entire system closure).

modules/system/nixpkgs.nix

@@ -6,6 +6,6 @@
 
   nixpkgs.config.permittedInsecurePackages = [
     # Ventoy has some blobs making it insecure
-    "ventoy-qt5-1.1.12"
+    "ventoy-qt5-${pkgs.ventoy.version}"
   ];
 }

modules/system/ntfsplus-patches/0001-fix-windows_names-option.patch

@@ -1,16 +1,6 @@
-From 8b5c5d23c1218a996a1d6780ca56853454813418 Mon Sep 17 00:00:00 2001
+diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
-From: Lumpiasty <arek.dzski@gmail.com>
+--- a/fs/ntfs/super.c
-Date: Thu, 7 May 2026 01:50:05 +0200
++++ b/fs/ntfs/super.c
-Subject: [PATCH 1/2] fix windows_names option
-
----
- super.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/super.c b/super.c
-index 875fb5a..49ad898 100644
---- a/super.c
-+++ b/super.c
 @@ -91,7 +91,7 @@ static const struct fs_parameter_spec ntfs_parameters[] = {
  	fsparam_flag("sys_immutable",		Opt_sys_immutable),
  	fsparam_flag("nohidden",		Opt_nohidden),
@@ -20,6 +10,4 @@ index 875fb5a..49ad898 100644
  	fsparam_flag("acl",			Opt_acl),
  	fsparam_flag("discard",			Opt_discard),
  	fsparam_flag("sparse",			Opt_sparse),
--- 
-2.53.0
 

modules/system/ntfsplus-patches/0002-gate-bad-character-check-by-windows_names.patch

@@ -1,16 +1,6 @@
-From 7fbf82056e26d99bfa4d5aab87ce287cd8c8cbef Mon Sep 17 00:00:00 2001
+diff --git a/fs/ntfs/namei.c b/fs/ntfs/namei.c
-From: Lumpiasty <arek.dzski@gmail.com>
+--- a/fs/ntfs/namei.c
-Date: Thu, 7 May 2026 01:56:33 +0200
++++ b/fs/ntfs/namei.c
-Subject: [PATCH 2/2] gate bad character check by windows_names
-
----
- namei.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/namei.c b/namei.c
-index 9e937d1..7369943 100644
---- a/namei.c
-+++ b/namei.c
 @@ -61,12 +61,12 @@ static int ntfs_check_bad_windows_name(struct ntfs_volume *vol,
  				       const __le16 *wc,
  				       unsigned int wc_len)
@@ -27,6 +17,4 @@ index 9e937d1..7369943 100644
  	/* Check for trailing space or dot. */
  	if (wc_len > 0 &&
  	    (wc[wc_len - 1] == cpu_to_le16(' ') ||
--- 
-2.53.0
 

modules/system/ntfsplus.nix

@@ -1,78 +1,13 @@
-{ config, pkgs, lib, ntfsplus, ... }:
+{ config, lib, pkgs, ... }:
 
-# Builds and loads the ntfsplus kernel driver (github:namjaejeon/linux-ntfs),
-# a maintained out-of-tree NTFS driver for Linux 6.1+.
-#
-# The upstream driver is used as-is, with two local patches applied on top
-# (see ntfsplus-patches/). This avoids maintaining a fork that would need
-# rebasing on every upstream update — patches are plain files that apply
-# cleanly regardless of upstream churn.
-#
-# The ntfsplus flake's nixosModule is NOT used directly. It builds the kernel
-# module as a `let` binding inside the module closure — not exposed as a
-# package in its flake outputs — so there is nothing in pkgs to override.
-# Replicating the module here is the only way to substitute a patched source.
-#
-# The ntfsplus flake (github:cmspam/ntfsplus-flake) is reused only for:
-#   - its linux-ntfs source input  (ntfsplus.inputs.linux-ntfs)
-#   - its bundled Makefile         (${ntfsplus}/Makefile)
-#     The flake ships its own Makefile because the upstream repo's Makefile
-#     has an ifneq KERNELRELEASE guard that breaks the out-of-tree nix build.
-#
-# The derivation is built inside this module (not via an overlay) so that
-# config.boot.kernelPackages.kernel resolves to whatever kernel the host
-# declares, with no extra indirection or per-host maintenance.
-#
-# ntfsplus is passed in via specialArgs in lib/mkNixosSystem.nix.
 
-let
-  cfg = config.services.ntfsplus;
-
-  patchedSrc = pkgs.applyPatches {
-    name = "linux-ntfs-patched";
-    src = ntfsplus.inputs.linux-ntfs;
-    patches = [
-      # fsparam_flag → fsparam_bool so windows_names=0/1 is accepted as a
-      # mount option rather than being treated as a bare flag.
-      ./ntfsplus-patches/0001-fix-windows_names-option.patch
-      # Gate the bad-character check behind NVolCheckWindowsNames so that
-      # the check only runs when windows_names is actually enabled.
-      ./ntfsplus-patches/0002-gate-bad-character-check-by-windows_names.patch
-    ];
-  };
-
-  ntfsplus-mod = pkgs.stdenv.mkDerivation {
-    pname = "ntfsplus-module";
-    version = ntfsplus.inputs.linux-ntfs.shortRev or ntfsplus.inputs.linux-ntfs.rev;
-    src = patchedSrc;
-    nativeBuildInputs = config.boot.kernelPackages.kernel.moduleBuildDependencies;
-    preBuild = "cp ${ntfsplus}/Makefile Makefile";
-    makeFlags = [
-      "KDIR=${config.boot.kernelPackages.kernel.dev}/lib/modules/${config.boot.kernelPackages.kernel.modDirVersion}/build"
-      "KVERSION=${config.boot.kernelPackages.kernel.modDirVersion}"
-      "CONFIG_NTFS_FS_POSIX_ACL=y"
-    ];
-    installPhase = ''
-      mkdir -p $out/lib/modules/${config.boot.kernelPackages.kernel.modDirVersion}/extra
-      cp ntfs.ko $out/lib/modules/${config.boot.kernelPackages.kernel.modDirVersion}/extra/
-    '';
-  };
-in
 {
-  options.services.ntfsplus = {
+  boot.extraModulePackages = [
-    enable = lib.mkEnableOption "ntfsplus kernel driver and utilities";
+    ((pkgs.callPackage ../../pkgs/ntfs/package.nix { kernel = config.boot.kernelPackages.kernel; }).overrideAttrs {
-  };
+      patches = [
-
+        ./ntfsplus-patches/0001-fix-windows_names-option.patch
-  config = lib.mkIf cfg.enable {
+        ./ntfsplus-patches/0002-gate-bad-character-check-by-windows_names.patch
-    boot.extraModulePackages = [ ntfsplus-mod ];
+        ];
-    boot.kernelModules = [ "ntfs" ];
+    })
-    boot.extraModprobeConfig = ''
+  ];
-      alias fs-ntfs ntfs
-      alias ntfsplus ntfs
-    '';
-    services.udev.extraRules = ''
-      SUBSYSTEM=="block", ENV{ID_FS_TYPE}=="ntfs", ENV{ID_FS_TYPE}="ntfs"
-    '';
-    environment.systemPackages = [ pkgs.ntfsprogs-plus ];
-  };
 }

modules/system/roles.nix

@@ -1,6 +0,0 @@
-{config, lib, pkgs, modulesPath, ... }:
-
-{
-  options.lumpiasty.pc = lib.mkEnableOption "Enable options specific to personal computers";
-  options.lumpiasty.laptop = lib.mkEnableOption "Enable options specific to laptops";
-}

modules/system/ssh.nix

@@ -1,8 +1,6 @@
 { config, lib, pkgs, modulesPath, ... }:
 
 {
-  options.lumpiasty.sshd = lib.mkEnableOption "Enable intel CPU";
-
   config = lib.mkIf config.lumpiasty.sshd {
     services.openssh = {
       enable = true;

modules/system/users.nix

@@ -10,12 +10,6 @@ let
   mkUser = import ../../lib/mkUser.nix { inherit lib; };
 in
 {
-  options.lumpiasty.users = {
-    user = lib.mkEnableOption "Create user \"user\"";
-    drugi = lib.mkEnableOption "Create user \"drugi\"";
-  };
-
-
   config = {
     # Install system-wide docker because rootless causes issues with binfmt
     virtualisation.docker.enable = config.lumpiasty.pc;
@@ -69,7 +63,7 @@ in
     users.users.user = lib.mkMerge [
       (mkUser cfg.user ../../users/user/config.nix)
       {
-        extraGroups = lib.mkIf config.lumpiasty.pc [ "docker" "libvirtd" ];
+        extraGroups = lib.mkIf config.lumpiasty.pc [ "docker" "libvirtd" "cdrom" ];
       }
     ];
     home-manager.users.user = mkHome cfg.user ../../users/user/home.nix;

overlays/pkgs.nix

@@ -9,8 +9,8 @@
     # Used via networking.networkmanager.package — does not replace pkgs.networkmanager globally.
     # Remove once nixpkgs ships networkmanager >= 1.58 stable.
     networkmanager-clat = assert final.lib.assertMsg
-      (final.lib.versionOlder prev.networkmanager.version "1.58")
+      (final.lib.versionOlder prev.networkmanager.version "1.59")
-      "nixpkgs now ships NetworkManager ${prev.networkmanager.version} >= 1.58 — remove the override in overlays/pkgs.nix and pkgs/networkmanager-dev/";
+      "nixpkgs now ships NetworkManager ${prev.networkmanager.version} >= 1.59 — remove the override in overlays/pkgs.nix and pkgs/networkmanager-dev/ if the patches are no longer needed";
       prev.callPackage ../pkgs/networkmanager-dev/package.nix { };
   })
 ]

pkgs/networkmanager-dev/fix-install-paths.patch

@@ -1,16 +0,0 @@
-diff --git a/meson.build b/meson.build
-index 61c025b9d7..d2ae60da34 100644
---- a/meson.build
-+++ b/meson.build
-@@ -1025,9 +1025,9 @@ meson.add_install_script(
-   join_paths('tools', 'meson-post-install.sh'),
-   nm_datadir,
-   nm_bindir,
--  nm_pkgconfdir,
-+  nm_prefix + nm_pkgconfdir,
-   nm_pkglibdir,
--  nm_pkgstatedir,
-+  nm_prefix + nm_pkgstatedir,
-   nm_mandir,
-   nm_sysconfdir,
-   enable_docs ? '1' : '0',

pkgs/networkmanager-dev/fix-paths.patch

@@ -1,48 +0,0 @@
-diff --git a/data/84-nm-drivers.rules b/data/84-nm-drivers.rules
-index 148acade5c..6395fbfbe5 100644
---- a/data/84-nm-drivers.rules
-+++ b/data/84-nm-drivers.rules
-@@ -7,6 +7,6 @@ ACTION!="add|change|move", GOTO="nm_drivers_end"
- # Determine ID_NET_DRIVER if there's no ID_NET_DRIVER or DRIVERS (old udev?)
- ENV{ID_NET_DRIVER}=="?*", GOTO="nm_drivers_end"
- DRIVERS=="?*", GOTO="nm_drivers_end"
--PROGRAM="/bin/sh -c '/usr/sbin/ethtool -i $$1 |/usr/bin/sed -n s/^driver:\ //p' -- $env{INTERFACE}", ENV{ID_NET_DRIVER}="%c"
-+PROGRAM="@runtimeShell@ -c '@ethtool@/bin/ethtool -i $$1 |@gnused@/bin/sed -n s/^driver:\ //p' -- $env{INTERFACE}", ENV{ID_NET_DRIVER}="%c"
- 
- LABEL="nm_drivers_end"
-diff --git a/src/libnmc-base/nm-vpn-helpers.c b/src/libnmc-base/nm-vpn-helpers.c
-index cbe76f5f1c..6ec684f9fe 100644
---- a/src/libnmc-base/nm-vpn-helpers.c
-+++ b/src/libnmc-base/nm-vpn-helpers.c
-@@ -284,15 +284,6 @@ nm_vpn_openconnect_authenticate_helper(NMSettingVpn *s_vpn, GPtrArray *secrets,
-     const char *const   *iter;
-     const char          *path;
-     const char          *opt;
--    const char *const    DEFAULT_PATHS[] = {
--        "/sbin/",
--        "/usr/sbin/",
--        "/usr/local/sbin/",
--        "/bin/",
--        "/usr/bin/",
--        "/usr/local/bin/",
--        NULL,
--    };
-     const char *oc_argv[(12 + 2 * G_N_ELEMENTS(oc_property_args))];
-     const char *gw;
-     int         port;
-@@ -311,13 +302,8 @@ nm_vpn_openconnect_authenticate_helper(NMSettingVpn *s_vpn, GPtrArray *secrets,
- 
-     port = extract_url_port(gw);
- 
--    path = nm_utils_file_search_in_paths("openconnect",
--                                         "/usr/sbin/openconnect",
--                                         DEFAULT_PATHS,
--                                         G_FILE_TEST_IS_EXECUTABLE,
--                                         NULL,
--                                         NULL,
--                                         error);
-+    path = g_find_program_in_path("openconnect");
-+
-     if (!path)
-         return FALSE;
- 

pkgs/networkmanager-dev/package.nix

@@ -2,242 +2,14 @@
 # Required for IPv6-mostly / RFC 8925 + RFC 6877 on NixOS until 1.58 stable lands in nixpkgs.
 # Remove this override once nixpkgs ships networkmanager >= 1.58.
 {
-  lib,
+  networkmanager
-  stdenv,
-  fetchurl,
-  replaceVars,
-  gettext,
-  pkg-config,
-  dbus,
-  gitUpdater,
-  libuuid,
-  polkit,
-  gnutls,
-  ppp,
-  dhcpcd,
-  iptables,
-  nftables,
-  python3,
-  vala,
-  libgcrypt,
-  dnsmasq,
-  bluez5,
-  readline,
-  libselinux,
-  audit,
-  gobject-introspection,
-  perl,
-  modemmanager,
-  openresolv,
-  libndp,
-  newt,
-  ethtool,
-  gnused,
-  iputils,
-  kmod,
-  jansson,
-  elfutils,
-  gtk-doc,
-  libxslt,
-  docbook_xsl,
-  docbook_xml_dtd_412,
-  docbook_xml_dtd_42,
-  docbook_xml_dtd_43,
-  curl,
-  meson,
-  mesonEmulatorHook,
-  ninja,
-  bpftools,
-  llvmPackages,
-  libbpf,
-  libnvme,
-  libpsl,
-  mobile-broadband-provider-info,
-  runtimeShell,
-  buildPackages,
-  nixosTests,
-  systemd,
-  slang,
-  udev,
-  udevCheckHook,
-  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
-  withNbft ? false,
 }:
 
-let
+networkmanager.overrideAttrs (old: {
-  pythonForDocs = python3.pythonOnBuildForHost.withPackages (pkgs: with pkgs; [ pygobject3 ]);
+  patches = old.patches ++ [
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "networkmanager";
-  version = "1.58.0";
-
-  src = fetchurl {
-    # Use the stable release tarball (not the git archive) — GitLab git archives are not content-stable.
-    url = "https://gitlab.freedesktop.org/api/v4/projects/411/packages/generic/NetworkManager/${finalAttrs.version}/NetworkManager-${finalAttrs.version}.tar.xz";
-    hash = "sha256-DG8nA6LJsBfNaPv+HS6KGl1/8FE3x1HsQhy6NulFRro=";
-  };
-
-  outputs = [
-    "out"
-    "dev"
-    "devdoc"
-    "man"
-    "doc"
-  ];
-
-  mesonFlags = [
-    "--sysconfdir=/etc"
-    "--localstatedir=/var"
-    (lib.mesonOption "systemdsystemunitdir" (
-      if withSystemd then "${placeholder "out"}/etc/systemd/system" else "no"
-    ))
-    "-Dudev_dir=${placeholder "out"}/lib/udev"
-    "-Ddbus_conf_dir=${placeholder "out"}/share/dbus-1/system.d"
-    "-Dkernel_firmware_dir=/run/current-system/firmware"
-
-    "-Dmodprobe=${kmod}/bin/modprobe"
-    (lib.mesonOption "session_tracking" (if withSystemd then "systemd" else "no"))
-    (lib.mesonBool "systemd_journal" withSystemd)
-    "-Dlibaudit=yes-disabled-by-default"
-    "-Dpolkit_agent_helper_1=/run/wrappers/bin/polkit-agent-helper-1"
-
-    "-Diwd=true"
-    "-Dpppd=${ppp}/bin/pppd"
-    "-Diptables=${iptables}/bin/iptables"
-    "-Dnft=${nftables}/bin/nft"
-    "-Dmodem_manager=true"
-    "-Dnmtui=true"
-    "-Ddnsmasq=${dnsmasq}/bin/dnsmasq"
-    "-Dqt=false"
-    (lib.mesonBool "nbft" withNbft)
-
-    "-Dresolvconf=${openresolv}/bin/resolvconf"
-    "-Ddhcpcd=${dhcpcd}/bin/dhcpcd"
-
-    "-Ddocs=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}"
-    "-Dman=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}"
-    "-Dtests=no"
-    "-Dcrypto=gnutls"
-    "-Dmobile_broadband_provider_info_database=${mobile-broadband-provider-info}/share/mobile-broadband-provider-info/serviceproviders.xml"
-  ];
-
-  patches = [
-    (replaceVars ./fix-paths.patch {
-      inherit
-        ethtool
-        gnused
-        ;
-      inherit runtimeShell;
-    })
-    ./fix-install-paths.patch
     # CLAT prefix selection ignores RFC 6724 rule 3 (avoid deprecated addresses):
     # a deprecated prefix (preferred lifetime 0) can win the selection and break
     # CLAT with an unroutable source address. Report upstream, then drop this.
     ./clat-skip-deprecated-prefixes.patch
   ];
-
-  buildInputs = [
-    (if withSystemd then systemd else udev)
-    libselinux
-    audit
-    libpsl
-    libuuid
-    polkit
-    ppp
-    libndp
-    curl
-    mobile-broadband-provider-info
-    bluez5
-    dnsmasq
-    modemmanager
-    readline
-    newt
-    jansson
-    dbus
-    libbpf
-    slang
-  ]
-  ++ lib.optionals withNbft [
-    libnvme
-  ];
-
-  propagatedBuildInputs = [
-    gnutls
-    libgcrypt
-  ];
-
-  # Disable hardening flags that break clang -target bpf (CLAT BPF compilation).
-  # Same workaround as nixpkgs systemd package.
-  hardeningDisable = [ "zerocallusedregs" "shadowstack" "pacret" ];
-
-  nativeBuildInputs = [
-    meson
-    ninja
-    gettext
-    pkg-config
-    # BPF compiler for CLAT/464XLAT — must use buildPackages to avoid splicing issues
-    bpftools
-    buildPackages.llvmPackages.clang
-    buildPackages.llvmPackages.libllvm
-    vala
-    gobject-introspection
-    perl
-    elfutils
-    gtk-doc
-    libxslt
-    docbook_xsl
-    docbook_xml_dtd_412
-    docbook_xml_dtd_42
-    docbook_xml_dtd_43
-    pythonForDocs
-    udevCheckHook
-  ]
-  ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
-    mesonEmulatorHook
-  ];
-
-  doCheck = false;
-
-  postPatch = ''
-    patchShebangs ./tools
-    patchShebangs libnm/generate-setting-docs.py
-
-    # TODO: submit upstream
-    substituteInPlace meson.build \
-      --replace "'vala', req" "'vala', native: false, req"
-  ''
-  + lib.optionalString withSystemd ''
-    substituteInPlace data/NetworkManager.service.in \
-      --replace-fail /usr/bin/busctl ${systemd}/bin/busctl
-  '';
-
-  preBuild = ''
-    mkdir -p ${placeholder "out"}/lib
-    ln -s $PWD/src/libnm-client-impl/libnm.so.0 ${placeholder "out"}/lib/libnm.so.0
-  '';
-
-  postFixup = lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
-    cp -r ${buildPackages.networkmanager.devdoc} $devdoc
-    cp -r ${buildPackages.networkmanager.man} $man
-  '';
-
-  doInstallCheck = true;
-
-  passthru = {
-    tests = {
-      inherit (nixosTests.networking) networkmanager;
-    };
-  };
-
-  meta = {
-    homepage = "https://networkmanager.dev";
-    description = "Network configuration and management tool (1.58.0 with CLAT/ipv6-mostly support)";
-    license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ obadz ];
-    teams = [ lib.teams.freedesktop ];
-    platforms = lib.platforms.linux;
-    badPlatforms = [
-      lib.systems.inspect.platformPatterns.isStatic
-    ];
-  };
 })

pkgs/ntfs/package.nix

@@ -0,0 +1,38 @@
+{ pkgs
+, lib
+, kernel ? pkgs.linuxPackages_latest.kernel
+}:
+
+pkgs.stdenv.mkDerivation {
+  pname = "ntfs-kernel-module";
+  inherit (kernel) src version postPatch nativeBuildInputs;
+
+  kernel_dev = kernel.dev;
+  kernelVersion = kernel.modDirVersion;
+
+  modulePath = "fs/ntfs";
+
+  buildPhase = ''
+    BUILT_KERNEL=$kernel_dev/lib/modules/$kernelVersion/build
+
+    cp $BUILT_KERNEL/Module.symvers .
+    cp $BUILT_KERNEL/.config        .
+    cp $kernel_dev/vmlinux          .
+
+    make "-j$NIX_BUILD_CORES" modules_prepare
+    make "-j$NIX_BUILD_CORES" M=$modulePath modules
+  '';
+
+  installPhase = ''
+    make \
+      INSTALL_MOD_PATH="$out" \
+      XZ="xz -T$NIX_BUILD_CORES" \
+      M="$modulePath" \
+      modules_install
+  '';
+
+  meta = {
+    description = "NTFS kernel module";
+    license = lib.licenses.gpl3;
+  };
+}

users/user/home.nix

@@ -1,14 +1,14 @@
 { config, pkgs, osConfig, ... }:
 
 {
-  home.username = "user";
+  # home.username = "user";
 
   lumpiastyHome = {
     gpg = osConfig.lumpiasty.pc;
     enablePcApps = osConfig.lumpiasty.pc;
     dev = osConfig.lumpiasty.pc;
     gaming = osConfig.lumpiasty.gaming;
-    fhs = osConfig.lumpiasty.pc;
+    fhs = osConfig.lumpiasty.pc && config.lumpiastyHome.linux;
   };
 
   home.stateVersion = "24.05";