Merge remote-tracking branch 'origin/master' into staging-next

2025-08-12 17:09:22 +03:00
parent 191c82ac46 64c46cbdd6
commit 3f8d9e8f9c
157 changed files with 3872 additions and 3452 deletions
@@ -288,3 +288,7 @@ b4532efe93882ae2e3fc579929a42a5a56544146

 # systemd: nixfmt
 b1c5cd3e794cdf89daa5e4f0086274a416a1cded
+
+#nixos/nextcloud: remove with lib usage
+b6088b0d8e13e8d18464d78935f0130052784658
+f7611cad5154a9096faa26d156a4079577bfae17
@@ -34,6 +34,7 @@ jobs:
          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write
+          permission-workflows: write

      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
@@ -11,6 +11,10 @@ on:
      systems:
        required: true
        type: string
+      testVersions:
+        required: false
+        default: false
+        type: boolean
    secrets:
      OWNER_APP_PRIVATE_KEY:
        required: false
@@ -22,13 +26,49 @@ defaults:
    shell: bash

 jobs:
+  versions:
+    if: inputs.testVersions
+    runs-on: ubuntu-24.04-arm
+    outputs:
+      versions: ${{ steps.versions.outputs.versions }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          path: trusted
+          sparse-checkout: |
+            ci/supportedVersions.nix
+
+      - name: Check out the PR at the test merge commit
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: ${{ inputs.mergedSha }}
+          path: untrusted
+          sparse-checkout: |
+            ci/pinned.json
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
+
+      - name: Load supported versions
+        id: versions
+        run: |
+          echo "versions=$(trusted/ci/supportedVersions.nix --arg pinnedJson untrusted/ci/pinned.json)" >> "$GITHUB_OUTPUT"
+
  eval:
    runs-on: ubuntu-24.04-arm
+    needs: versions
+    if: ${{ !cancelled() && !failure() }}
    strategy:
      fail-fast: false
      matrix:
        system: ${{ fromJSON(inputs.systems) }}
-    name: ${{ matrix.system }}
+        version:
+          - "" # Default Eval triggering rebuild labels and such.
+          - ${{ fromJSON(needs.versions.outputs.versions || '[]') }} # Only for ci/pinned.json updates.
+    # Failures for versioned Evals will be collected in a separate job below
+    # to not interrupt main Eval's compare step.
+    continue-on-error: ${{ matrix.version != '' }}
+    name: ${{ matrix.system }}${{ matrix.version && format(' @ {0}', matrix.version) || '' }}
    outputs:
      targetRunId: ${{ steps.targetRunId.outputs.targetRunId }}
    timeout-minutes: 15
@@ -60,17 +100,19 @@ jobs:
      - name: Evaluate the ${{ matrix.system }} output paths for all derivation attributes
        env:
          MATRIX_SYSTEM: ${{ matrix.system }}
+          MATRIX_VERSION: ${{ matrix.version || 'nixVersions.latest' }}
        run: |
          nix-build untrusted/ci --arg nixpkgs ./pinned  -A eval.singleSystem \
            --argstr evalSystem "$MATRIX_SYSTEM" \
            --arg chunkSize 8000 \
+            --argstr nixPath "$MATRIX_VERSION" \
            --out-link merged
          # If it uses too much memory, slightly decrease chunkSize

      - name: Upload the output paths and eval stats
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
-          name: merged-${{ matrix.system }}
+          name: ${{ matrix.version && format('{0}-', matrix.version) || '' }}merged-${{ matrix.system }}
          path: merged/*

      - name: Log current API rate limits
@@ -125,7 +167,7 @@ jobs:
          GH_TOKEN: ${{ github.token }}
        run: gh api /rate_limit | jq

-      - uses: actions/download-artifact@v5
+      - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        if: steps.targetRunId.outputs.targetRunId
        with:
          run-id: ${{ steps.targetRunId.outputs.targetRunId }}
@@ -149,13 +191,13 @@ jobs:
        if: steps.targetRunId.outputs.targetRunId
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
-          name: diff-${{ matrix.system }}
+          name: ${{ matrix.version && format('{0}-', matrix.version) || '' }}diff-${{ matrix.system }}
          path: diff/*

  compare:
    runs-on: ubuntu-24.04-arm
    needs: [eval]
-    if: needs.eval.outputs.targetRunId
+    if: needs.eval.outputs.targetRunId && !cancelled() && !failure()
    permissions:
      statuses: write
    timeout-minutes: 5
@@ -171,7 +213,7 @@ jobs:
          pinnedFrom: trusted

      - name: Download output paths and eval stats for all systems
-        uses: actions/download-artifact@de96f4613b77ec03b5cf633e7c350c32bd3c5660 # v4.1.8
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          pattern: diff-*
          path: diff
@@ -240,6 +282,91 @@ jobs:
              target_url
            })

+  # Creates a matrix of Eval performance for various versions and systems.
+  report:
+    runs-on: ubuntu-24.04-arm
+    needs: [versions, eval]
+    steps:
+      - name: Download output paths and eval stats for all versions
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          pattern: "*-diff-*"
+          path: versions
+
+      - name: Add version comparison table to job summary
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        env:
+          SYSTEMS: ${{ inputs.systems }}
+          VERSIONS: ${{ needs.versions.outputs.versions }}
+        with:
+          script: |
+            const { readFileSync } = require('node:fs')
+            const path = require('node:path')
+
+            const systems = JSON.parse(process.env.SYSTEMS)
+            const versions = JSON.parse(process.env.VERSIONS)
+
+            core.summary.addHeading('Lix/Nix version comparison')
+            core.summary.addTable(
+              [].concat(
+                [
+                  [{ data: 'Version', header: true }].concat(
+                    systems.map((system) => ({ data: system, header: true })),
+                  ),
+                ],
+                versions.map((version) =>
+                  [{ data: version }].concat(
+                    systems.map((system) => {
+                      try {
+                        const artifact = path.join('versions', `${version}-diff-${system}`)
+                        const time = Math.round(
+                          parseFloat(
+                            readFileSync(
+                              path.join(artifact, 'after', system, 'total-time'),
+                              'utf-8',
+                            ),
+                          ),
+                        )
+                        const diff = JSON.parse(
+                          readFileSync(path.join(artifact, system, 'diff.json'), 'utf-8'),
+                        )
+                        const attrs = [].concat(
+                          diff.added,
+                          diff.removed,
+                          diff.changed,
+                          diff.rebuilds
+                        ).filter(attr =>
+                          // Exceptions related to dev shells, which changed at some time between 2.18 and 2.24.
+                          !attr.startsWith('tests.devShellTools.nixos.') &&
+                          !attr.startsWith('tests.devShellTools.unstructuredDerivationInputEnv.')
+                        )
+                        if (attrs.length > 0) {
+                          core.setFailed(
+                            `${version} on ${system} has changed outpaths!\nNote: Please make sure to update ci/pinned.json separately from changes to other packages.`,
+                          )
+                          return { data: ':x:' }
+                        }
+                        return { data: time }
+                      } catch {
+                        core.warning(`${version} on ${system} did not produce artifact.`)
+                        return { data: ':warning:' }
+                      }
+                    }),
+                  ),
+                ),
+              ),
+            )
+            core.summary.addRaw(
+              '\n*Evaluation time in seconds without downloading dependencies.*',
+              true,
+            )
+            core.summary.addRaw('\n*:warning: Job did not report a result.*', true)
+            core.summary.addRaw(
+              '\n*:x: Job produced different outpaths than the target branch.*',
+              true,
+            )
+            core.summary.write()
+
  misc:
    if: ${{ github.event_name != 'push' }}
    runs-on: ubuntu-24.04-arm
@@ -28,6 +28,7 @@ jobs:
      mergedSha: ${{ steps.get-merge-commit.outputs.mergedSha }}
      targetSha: ${{ steps.get-merge-commit.outputs.targetSha }}
      systems: ${{ steps.systems.outputs.systems }}
+      touched: ${{ steps.files.outputs.touched }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
@@ -64,6 +65,20 @@ jobs:
            core.setOutput('head', headClassification)
            core.info('head classification:', headClassification)

+      - name: Determine changed files
+        id: files
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const files = (await github.paginate(github.rest.pulls.listFiles, {
+              ...context.repo,
+              pull_number: context.payload.pull_request.number,
+              per_page: 100,
+            })).map(file => file.filename)
+
+            if (files.includes('ci/pinned.json')) core.setOutput('touched', ['pinned'])
+            else core.setOutput('touched', [])
+
  check:
    name: Check
    needs: [prepare]
@@ -96,6 +111,7 @@ jobs:
      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
      targetSha: ${{ needs.prepare.outputs.targetSha }}
      systems: ${{ needs.prepare.outputs.systems }}
+      testVersions: ${{ contains(fromJSON(needs.prepare.outputs.touched), 'pinned') && !contains(fromJSON(needs.prepare.outputs.headBranch).type, 'development') }}

  labels:
    name: Labels
@@ -144,7 +160,7 @@ jobs:
    # Do NOT change the name of this job, otherwise the rule will not catch it anymore.
    # This would prevent all PRs from merging.
    name: no PR failures
-    if: ${{ failure() }}
+    if: ${{ cancelled() || failure() }}
    runs-on: ubuntu-24.04-arm
    steps:
      - run: exit 1
@@ -96,7 +96,7 @@ jobs:
        run: gh api /rate_limit | jq

      - name: Download the comparison results
-        uses: actions/download-artifact@de96f4613b77ec03b5cf633e7c350c32bd3c5660 # v4.1.8
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          run-id: ${{ steps.eval.outputs.run-id }}
          github-token: ${{ github.token }}
@@ -5,6 +5,7 @@ in
  system ? builtins.currentSystem,

  nixpkgs ? null,
+  nixPath ? "nixVersions.latest",
 }:
 let
  nixpkgs' =
@@ -16,13 +17,7 @@ let
    else
      nixpkgs;

-  pkgs = import nixpkgs' {
-    inherit system;
-    config = {
-      permittedInsecurePackages = [ "nix-2.3.18" ];
-    };
-    overlays = [ ];
-  };
+  pkgs = import nixpkgs' { inherit system; };

  fmt =
    let
@@ -115,7 +110,7 @@ rec {
  # (nixVersions.stable and Lix) here somehow at some point to ensure we don't
  # have eval divergence.
  eval = pkgs.callPackage ./eval {
-    nix = pkgs.nixVersions.latest;
+    nix = pkgs.lib.getAttrFromPath (pkgs.lib.splitString "." nixPath) pkgs;
  };

  # CI jobs
@@ -127,8 +122,7 @@ rec {
  parse = pkgs.lib.recurseIntoAttrs {
    latest = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.latest; };
    lix = pkgs.callPackage ./parse.nix { nix = pkgs.lix; };
-    # TODO: Raise nixVersions.minimum to 2.24 and flip back to it.
-    minimum = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.nix_2_24; };
+    nix_2_24 = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.nix_2_24; };
  };
  shell = import ../shell.nix { inherit nixpkgs system; };
  tarball = import ../pkgs/top-level/make-tarball.nix {
@@ -146,6 +146,12 @@ runCommand "compare"

    cp ${changed-paths} $out/changed-paths.json

+    {
+      echo
+      echo "# Packages"
+      echo
+      jq -r -f ${./generate-step-summary.jq} < ${changed-paths}
+    } >> $out/step-summary.md

    if jq -e '(.attrdiff.added | length == 0) and (.attrdiff.removed | length == 0)' "${changed-paths}" > /dev/null; then
      # Chunks have changed between revisions
@@ -175,12 +181,5 @@ runCommand "compare"
      } >> $out/step-summary.md
    fi

-    {
-      echo
-      echo "# Packages"
-      echo
-      jq -r -f ${./generate-step-summary.jq} < ${changed-paths}
-    } >> $out/step-summary.md
-
    cp "$maintainersPath" "$out/maintainers.json"
  ''
@@ -9,9 +9,9 @@
      },
      "branch": "nixpkgs-unstable",
      "submodules": false,
-      "revision": "6a489c9482ca676ce23c0bcd7f2e1795383325fa",
-      "url": "https://github.com/NixOS/nixpkgs/archive/6a489c9482ca676ce23c0bcd7f2e1795383325fa.tar.gz",
-      "hash": "0vsvkhy3gb8yzq62vazhmpqixssmd4xinnll7w73l4vrqd611wlf"
+      "revision": "641d909c4a7538f1539da9240dedb1755c907e40",
+      "url": "https://github.com/NixOS/nixpkgs/archive/641d909c4a7538f1539da9240dedb1755c907e40.tar.gz",
+      "hash": "10hpb1aw884k3zzcy1mhf47dqvfagiyx7kr6hg0p5xcwg04mkx8x"
    },
    "treefmt-nix": {
      "type": "Git",
@@ -22,9 +22,9 @@
      },
      "branch": "main",
      "submodules": false,
-      "revision": "58bd4da459f0a39e506847109a2a5cfceb837796",
-      "url": "https://github.com/numtide/treefmt-nix/archive/58bd4da459f0a39e506847109a2a5cfceb837796.tar.gz",
-      "hash": "01bg9b4xzlv6s5q1q78vib6l2csw02b3rk5bm5yj4gx2sk2hvmrq"
+      "revision": "7d81f6fb2e19bf84f1c65135d1060d829fae2408",
+      "url": "https://github.com/numtide/treefmt-nix/archive/7d81f6fb2e19bf84f1c65135d1060d829fae2408.tar.gz",
+      "hash": "1cg20q8ja8k2nb7mzy95hgmd8whxapc3fbyndh1ip5dr6d1grxfs"
    }
  },
  "version": 5
@@ -0,0 +1,32 @@
+#!/usr/bin/env -S nix-instantiate --eval --strict --json --arg unused true
+# Unused argument to trigger nix-instantiate calling this function with the default arguments.
+{
+  pinnedJson ? ./pinned.json,
+}:
+let
+  pinned = (builtins.fromJSON (builtins.readFile pinnedJson)).pins;
+  nixpkgs = fetchTarball {
+    inherit (pinned.nixpkgs) url;
+    sha256 = pinned.nixpkgs.hash;
+  };
+  pkgs = import nixpkgs {
+    config.allowAliases = false;
+  };
+
+  inherit (pkgs) lib;
+
+  lix = lib.pipe pkgs.lixPackageSets [
+    (lib.filterAttrs (_: set: lib.isDerivation set.lix or null && set.lix.meta.available))
+    lib.attrNames
+    (lib.filter (name: lib.match "lix_[0-9_]+|git" name != null))
+    (map (name: "lixPackageSets.${name}.lix"))
+  ];
+
+  nix = lib.pipe pkgs.nixVersions [
+    (lib.filterAttrs (_: drv: lib.isDerivation drv && drv.meta.available))
+    lib.attrNames
+    (lib.filter (name: lib.match "nix_[0-9_]+|git" name != null))
+    (map (name: "nixVersions.${name}"))
+  ];
+in
+lix ++ nix
@@ -14,6 +14,10 @@

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

+- `nixVersions.nix_2_3` has been dropped because it was insecure and unmaintained.
+
+- The minimum version of Nix required to evaluate Nixpkgs has been raised from 2.3 to 2.18.
+
 - The `offrss` package was removed due to lack of upstream maintenance since 2012. It's recommended for users to migrate to another RSS reader

 - `base16-builder` node package has been removed due to lack of upstream maintenance.
@@ -1,2 +1,2 @@
 # Expose the minimum required version for evaluating Nixpkgs
-"2.3.17"
+"2.18"
@@ -2,21 +2,14 @@
  # The pkgs used for dependencies for the testing itself
  # Don't test properties of pkgs.lib, but rather the lib in the parent directory
  system ? builtins.currentSystem,
-  pkgs ?
-    import ../.. {
-      inherit system;
-      config = {
-        permittedInsecurePackages = [ "nix-2.3.18" ];
-      };
-    }
-    // {
-      lib = throw "pkgs.lib accessed, but the lib tests should use nixpkgs' lib path directly!";
-    },
+  pkgs ? import ../.. { inherit system; } // {
+    lib = throw "pkgs.lib accessed, but the lib tests should use nixpkgs' lib path directly!";
+  },
  # For testing someone may edit impure.nix to return cross pkgs, use `pkgsBuildBuild` directly so everything here works.
  pkgsBB ? pkgs.pkgsBuildBuild,
  nix ? pkgs-nixVersions.stable,
  nixVersions ? [
-    pkgs-nixVersions.minimum
+    pkgs-nixVersions.nix_2_24
    nix
    pkgs-nixVersions.latest
  ],
@@ -28147,6 +28147,12 @@
    githubId = 908716;
    name = "Zach Coyle";
  };
+  ZachDavies = {
+    name = "Zach Davies";
+    email = "zdmalta@proton.me";
+    github = "ZachDavies";
+    githubId = 131615861;
+  };
  Zaczero = {
    name = "Kamil Monicz";
    email = "kamil@monicz.dev";
@@ -11,7 +11,7 @@
    # Add Firefox and other tools useful for installation to the launcher
    favoriteAppsOverride = ''
      [org.gnome.shell]
-      favorite-apps=[ 'firefox.desktop', 'nixos-manual.desktop', 'org.gnome.Console.desktop', 'org.gnome.Nautilus.desktop', 'gparted.desktop', 'io.calamares.calamares.desktop' ]
+      favorite-apps=[ 'firefox.desktop', 'nixos-manual.desktop', 'org.gnome.Console.desktop', 'org.gnome.Nautilus.desktop', 'gparted.desktop', 'calamares.desktop' ]
    '';

    # Override GNOME defaults to disable GNOME tour and disable suspend
@@ -45,8 +45,8 @@
      ln -sfT ${pkgs.plasma5Packages.konsole}/share/applications/org.kde.konsole.desktop ${
        desktopDir + "org.kde.konsole.desktop"
      }
-      ln -sfT ${pkgs.calamares-nixos}/share/applications/io.calamares.calamares.desktop ${
-        desktopDir + "io.calamares.calamares.desktop"
+      ln -sfT ${pkgs.calamares-nixos}/share/applications/calamares.desktop ${
+        desktopDir + "calamares.desktop"
      }
    '';

@@ -50,8 +50,8 @@

      ln -sfT ${manualDesktopFile} ${desktopDir + "nixos-manual.desktop"}
      ln -sfT ${pkgs.gparted}/share/applications/gparted.desktop ${desktopDir + "gparted.desktop"}
-      ln -sfT ${pkgs.calamares-nixos}/share/applications/io.calamares.calamares.desktop ${
-        desktopDir + "io.calamares.calamares.desktop"
+      ln -sfT ${pkgs.calamares-nixos}/share/applications/calamares.desktop ${
+        desktopDir + "calamares.desktop"
      }
    '';

@@ -4,16 +4,18 @@
 { pkgs, ... }:
 let
  calamares-nixos-autostart = pkgs.makeAutostartItem {
-    name = "io.calamares.calamares";
+    name = "calamares";
    package = pkgs.calamares-nixos;
  };
 in
 {
  imports = [ ./installation-cd-graphical-base.nix ];

+  # required for kpmcore to work correctly
+  programs.partition-manager.enable = true;
+
  environment.systemPackages = with pkgs; [
    # Calamares for graphical installation
-    libsForQt5.kpmcore
    calamares-nixos
    calamares-nixos-autostart
    calamares-nixos-extensions
@@ -15,7 +15,7 @@ in
    programs.partition-manager = {
      enable = lib.mkEnableOption "KDE Partition Manager";

-      package = lib.mkPackageOption pkgs [ "libsForQt5" "partitionmanager" ] { };
+      package = lib.mkPackageOption pkgs [ "kdePackages" "partitionmanager" ] { };
    };
  };

@@ -494,7 +494,7 @@ let
          filterAttrs (_: v: v == false) container.capabilities
        )
        ++ map (d: "--device=${escapeShellArg d}") container.devices
-        ++ map (n: "--network=${escapeShellArg n}") container.networks
+        ++ map (n: "--network=${escapeShellArg n}") (lib.lists.unique container.networks)
        ++ [ "--pull ${escapeShellArg container.pull}" ]
        ++ map escapeShellArg container.extraOptions
        ++ [ container.image ]
@@ -13,6 +13,10 @@
      ...
    }:
    let
+      # Use derivations instead of attr names to avoid listing missing packages
+      maskedTerminfos = with pkgs; [
+        alacritty-graphics # would clobber alacritty terminfo
+      ];
      infoFilter =
        name: drv:
        let
@@ -23,7 +27,8 @@
        && o.value ? outputs
        && builtins.elem "terminfo" o.value.outputs
        && !o.value.meta.broken
-        && lib.meta.availableOn pkgs.stdenv.hostPlatform o.value;
+        && lib.meta.availableOn pkgs.stdenv.hostPlatform o.value
+        && !(builtins.elem o.value maskedTerminfos);
      terminfos = lib.filterAttrs infoFilter pkgs;
      excludedTerminfos = lib.filterAttrs (
        _: drv: !(builtins.elem drv.terminfo config.environment.systemPackages)
@@ -1123,6 +1123,7 @@ in
  osquery = handleTestOn [ "x86_64-linux" ] ./osquery.nix { };
  osrm-backend = runTest ./osrm-backend.nix;
  overlayfs = runTest ./overlayfs.nix;
+  oxidized = handleTest ./oxidized.nix { };
  pacemaker = runTest ./pacemaker.nix;
  packagekit = runTest ./packagekit.nix;
  paisa = runTest ./paisa.nix;
@@ -0,0 +1,104 @@
+{
+  system ? builtins.currentSystem,
+  pkgs ? import ../.. {
+    inherit system;
+    config = { };
+  },
+}:
+
+let
+  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
+in
+makeTest {
+  name = "oxidized";
+
+  nodes.server =
+    { config, pkgs, ... }:
+    {
+      security.pam.services.sshd.allowNullPassword = true; # the default `UsePam yes` makes this necessary
+      services = {
+        sshd.enable = true;
+        openssh = {
+          settings.PermitRootLogin = "yes";
+          settings.PermitEmptyPasswords = "yes";
+        };
+        oxidized = {
+          enable = true;
+          package = pkgs.oxidized;
+          routerDB = pkgs.writeText "oxidized-router.db" ''
+            localhost:linuxgeneric:root
+          '';
+          configFile = pkgs.writeText "oxidized-config.yml" ''
+            # vi: ft=yaml
+            ---
+            extensions:
+              oxidized-web:
+                load: true
+                listen: 127.0.0.1
+                port: 8888
+                vhosts:
+                  - localhost
+                  - 127.0.0.1
+                  - oxidized
+                  - oxidized.example.com
+            interval: 3600
+            retries: 3
+            model: linuxgeneric
+            username: root
+            source:
+              default: csv
+              csv:
+                file: "/var/lib/oxidized/.config/oxidized/router.db"
+                delimiter: !ruby/regexp /:/
+                map:
+                  name: 0
+                  model: 1
+                  username: 2
+                  password: 3
+                vars_map:
+                  enable: 4
+            input:
+              default: ssh
+              utf8_encoded: true
+            output:
+              default: git
+              git:
+                single_repo:  true
+                user: oxidized
+                email: oxidized@example.com
+                repo: /var/lib/oxidized/git
+          '';
+        };
+      };
+      systemd.services.oxidized = {
+        stopIfChanged = false;
+        environment.HOME = "/var/lib/oxidized";
+        environment.APP_ENV = "production";
+        serviceConfig = {
+          StateDirectory = "oxidized";
+          MemoryDenyWriteExecute = false;
+
+          PrivateNetwork = false;
+          SystemCallFilter = "@system-service";
+        };
+
+        path = [ config.programs.ssh.package ];
+      };
+
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+
+      server.wait_for_unit("oxidized.service")
+
+      with subtest("Check if oxidized reports the correct version"):
+        server.wait_until_succeeds(("curl --silent --fail --location http://127.0.0.1:8888/ | grep '${nodes.server.services.oxidized.package.version}' >&2"))
+      with subtest("Check if oxidized can be accessed with a vhost and reports the correct version"):
+        server.wait_until_succeeds(("curl --silent --fail --resolve oxidized:8888:127.0.0.1 --location http://oxidized:8888/ | grep '${nodes.server.services.oxidized.package.version}' >&2"))
+      with subtest("Check if oxidized can connect to linuxgeneric model"):
+        server.wait_until_succeeds("journalctl -b --grep 'Oxidized::Worker -- Configuration updated for /localhost' -t oxidized")
+    '';
+}
@@ -24,8 +24,8 @@ let
    sha256Hash = "sha256-qA7iu4nK+29aHKsUmyQWuwV0SFnv5cYQvFq5CAMKyKw=";
  };
  latestVersion = {
-    version = "2025.1.3.3"; # "Android Studio Narwhal Feature Drop | 2025.1.3 Canary 3"
-    sha256Hash = "sha256-0BdbAJMQi9qgss1IJTMxjQpOjynLFuiY0Vlw5VYCY+c=";
+    version = "2025.1.3.4"; # "Android Studio Narwhal 3 Feature Drop | 2025.1.3 Canary 4"
+    sha256Hash = "sha256-SAdmuuentJZGtjcFAgAedPa9MLAS9vNtWoOI1pPvDhA=";
  };
 in
 {
@@ -13,13 +13,13 @@
 }:
 mkLibretroCore {
  core = "ppsspp";
-  version = "0-unstable-2025-07-16";
+  version = "0-unstable-2025-08-11";

  src = fetchFromGitHub {
    owner = "hrydgard";
    repo = "ppsspp";
-    rev = "e68cec63d0d5d89442ddfab5b425c73e2bb5eb35";
-    hash = "sha256-xNh+McD/oGBKTcnhQgM3zCZhX4Q7IOf9CcdIJJvqM4g=";
+    rev = "9912aa5c8d3b95165c56e29ffaa50069aeae0860";
+    hash = "sha256-5snyC0hk1VqYH4aqz4E7ukPyOLrDVZwDsw3LPdHDSzM=";
    fetchSubmodules = true;
  };

@@ -52,6 +52,10 @@ python3.pkgs.buildPythonApplication rec {
    "--prefix PYTHONPATH : ${makePythonPath [ maestral ]}"
  ];

+  postInstall = ''
+    install -Dm444 -t $out/share/icons/hicolor/512x512/apps src/maestral_qt/resources/maestral.png
+  '';
+
  # no tests
  doCheck = false;

@@ -46,11 +46,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://ce-programming.github.io/CEmu";
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ ];
-    platforms = [
-      "x86_64-linux"
-      "x86_64-darwin"
-      "aarch64-linux"
-    ];
-    broken = stdenv.hostPlatform.isDarwin || (stdenv.system == "x86_64-linux");
+    platforms = lib.platforms.unix;
  };
 })
@@ -0,0 +1,46 @@
+{
+  lib,
+  llvmPackages,
+  python3,
+}:
+let
+  inherit (llvmPackages) clang-unwrapped;
+in
+python3.pkgs.buildPythonApplication rec {
+  pname = "analyze-build";
+  inherit (clang-unwrapped) version;
+
+  format = "other";
+
+  src = clang-unwrapped + "/bin";
+
+  dontUnpack = true;
+
+  dependencies = with python3.pkgs; [
+    libscanbuild
+  ];
+
+  installPhase = ''
+    mkdir -p "$out/bin"
+    install "$src/analyze-build" "$out/bin/"
+  '';
+
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [ clang-unwrapped ])
+  ];
+
+  meta = {
+    description = "run Clang static analyzer against a project with compilation database";
+    homepage = "https://github.com/llvm/llvm-project/tree/llvmorg-${version}/clang/tools/scan-build-py/";
+    mainProgram = "scan-build";
+    license = with lib.licenses; [
+      asl20
+      llvm-exception
+    ];
+    maintainers = with lib.maintainers; [ RossSmyth ];
+    platforms = lib.intersectLists python3.meta.platforms clang-unwrapped.meta.platforms;
+  };
+}
@@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "asn";
-  version = "0.78.3";
+  version = "0.78.6";

  src = fetchFromGitHub {
    owner = "nitefood";
    repo = "asn";
    tag = "v${version}";
-    hash = "sha256-ydCpCmW6NK3LM05YLw6KtJWo7UtMcsxQt2RH/Xl+bFw=";
+    hash = "sha256-IcAXcsmzxzDUPJp2ieouxfkpdwpOZP6IBTPdm3C5/k4=";
  };

  nativeBuildInputs = [
@@ -11,13 +11,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ast-grep";
-  version = "0.39.2";
+  version = "0.39.3";

  src = fetchFromGitHub {
    owner = "ast-grep";
    repo = "ast-grep";
    tag = finalAttrs.version;
-    hash = "sha256-RfsBgxxb9Kd28hzDXNBNFEwpRchxt+VmSMwc2wRDuig=";
+    hash = "sha256-oUVsfR5azu4i6irCQL1CXCWA8ygIHK+dpWC/grbkSyk=";
  };

  # error: linker `aarch64-linux-gnu-gcc` not found
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    rm .cargo/config.toml
  '';

-  cargoHash = "sha256-5SDGkOeByG8SUQJH/89TLuEJeKcu9lu/ZKbudwCAM0o=";
+  cargoHash = "sha256-BX5OAwIZzl9dm7ebw/zyJ2ICVpzCcHUVRTyUDMY4fH0=";

  nativeBuildInputs = [ installShellFiles ];

@@ -7,13 +7,13 @@

 buildNpmPackage (finalAttrs: {
  pname = "autobase";
-  version = "7.17.0";
+  version = "7.17.3";

  src = fetchFromGitHub {
    owner = "holepunchto";
    repo = "autobase";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KSx9zOnoJouH2sAByG0947uxgqPu9cx3fTbA2MDiMt4=";
+    hash = "sha256-RTbK1U63gNuUN81ceJVjFzqNtg0kfvfq8DiLEpDXJq0=";
  };

  npmDepsHash = "sha256-H9Xy1VD7WQvi0+86v6CMcmc0L3mB6KuSCtgQSF4AlkY=";
@@ -5,16 +5,15 @@
  nix-update-script,
  buildNpmPackage,
 }:
-
 buildGoModule rec {
  pname = "beszel";
-  version = "0.11.1";
+  version = "0.12.3";

  src = fetchFromGitHub {
    owner = "henrygd";
    repo = "beszel";
    tag = "v${version}";
-    hash = "sha256-tAi48PAHDGIZn/HMsnCq0mLpvFSqUOMocq47hooiFT8=";
+    hash = "sha256-rthaufUL0JX3sE2hdrcJ8J73DLK4/2wMR+uOs8GoX2A=";
  };

  webui = buildNpmPackage {
@@ -48,12 +47,12 @@ buildGoModule rec {

    sourceRoot = "${src.name}/beszel/site";

-    npmDepsHash = "sha256-27NUV23dNHFSwOHiB/wGSAWkp6eZMnw/6Pd3Fwn98+s=";
+    npmDepsHash = "sha256-6J1LwRzwbQyXVBHNgG7k8CQ67JZIDqYreDbgfm6B4w4=";
  };

  sourceRoot = "${src.name}/beszel";

-  vendorHash = "sha256-B6mOqOgcrRn0jV9wnDgRmBvfw7I/Qy5MNYvTiaCgjBE=";
+  vendorHash = "sha256-Nd2jDlq+tdGrgxU6ZNgj9awAb+G/yDqY1J15dpMcjtw=";

  preBuild = ''
    mkdir -p site/dist
@@ -1,26 +1,25 @@
 {
  stdenv,
-  fetchFromGitHub,
  lib,
+  glibcLocales,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "calamares-nixos-extensions";
  version = "0.3.23";

-  src = fetchFromGitHub {
-    owner = "NixOS";
-    repo = "calamares-nixos-extensions";
-    rev = finalAttrs.version;
-    hash = "sha256-KNRztajU7sTLNDwCwP4WOdR2IRMqfbeapdko58LcrjM=";
-  };
+  src = ./src;

  installPhase = ''
    runHook preInstall
-    mkdir -p $out/{lib,share}/calamares
+    mkdir -p $out/{etc,lib,share}/calamares
    cp -r modules $out/lib/calamares/
-    cp -r config/* $out/share/calamares/
+    cp -r config/* $out/etc/calamares/
    cp -r branding $out/share/calamares/
+
+    substituteInPlace $out/etc/calamares/settings.conf --replace-fail @out@ $out
+    substituteInPlace $out/etc/calamares/modules/locale.conf --replace-fail @glibcLocales@ ${glibcLocales}
+
    runHook postInstall
  '';

@@ -28,11 +27,10 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Calamares modules for NixOS";
    homepage = "https://github.com/NixOS/calamares-nixos-extensions";
    license = with licenses; [
-      gpl3Plus
-      bsd2
+      mit
+      # assets
      cc-by-40
      cc-by-sa-40
-      cc0
    ];
    maintainers = with maintainers; [ vlinkz ];
    platforms = platforms.linux;
@@ -0,0 +1,233 @@
+# SPDX-FileCopyrightText: no
+# SPDX-License-Identifier: CC0-1.0
+#
+---
+componentName:  nixos
+
+
+### WELCOME / OVERALL WORDING
+#
+# These settings affect some overall phrasing and looks,
+# which are most visible in the welcome page.
+
+# This selects between different welcome texts. When false, uses
+# the traditional "Welcome to the %1 installer.", and when true,
+# uses "Welcome to the Calamares installer for %1." This allows
+# to distinguish this installer from other installers for the
+# same distribution.
+welcomeStyleCalamares:   false
+
+# Should the welcome image (productWelcome, below) be scaled
+# up beyond its natural size? If false, the image does not grow
+# with the window but remains the same size throughout (this
+# may have surprising effects on HiDPI monitors).
+welcomeExpandingLogo:   true
+
+### WINDOW CONFIGURATION
+#
+# The settings here affect the placement of the Calamares
+# window through hints to the window manager and initial
+# sizing of the Calamares window.
+
+# Size and expansion policy for Calamares.
+#  - "normal" or unset, expand as needed, use *windowSize*
+#  - "fullscreen", start as large as possible, ignore *windowSize*
+#  - "noexpand", don't expand automatically, use *windowSize*
+windowExpanding:    normal
+
+# Size of Calamares window, expressed as w,h. Both w and h
+# may be either pixels (suffix px) or font-units (suffix em).
+#   e.g.    "800px,600px"
+#           "60em,480px"
+# This setting is ignored if "fullscreen" is selected for
+# *windowExpanding*, above. If not set, use constants defined
+# in CalamaresUtilsGui, 800x520.
+windowSize: 800px,520px
+
+# Placement of Calamares window. Either "center" or "free".
+# Whether "center" actually works does depend on the window
+# manager in use (and only makes sense if you're not using
+# *windowExpanding* set to "fullscreen").
+windowPlacement: center
+
+### PANELS CONFIGURATION
+#
+# Calamares has a main content area, and two panels (navigation
+# and progress / sidebar). The panels can be controlled individually,
+# or switched off. If both panels are switched off, the layout of
+# the main content area loses its margins, on the assumption that
+# you're doing something special.
+
+# Kind of sidebar (panel on the left, showing progress).
+#  - "widget" or unset, use traditional sidebar (logo, items)
+#  - "none", hide it entirely
+#  - "qml", use calamares-sidebar.qml from branding folder
+# In addition, you **may** specify a side, separated by a comma,
+# from the kind. Valid sides are:
+#  - "left" (if not specified, uses this)
+#  - "right"
+#  - "top"
+#  - "bottom"
+# For instance, "widget,right" is valid; so is "qml", which defaults
+# to putting the sidebar on the left. Also valid is "qml,top".
+# While "widget,top" is valid, the widgets code is **not** flexible
+# and results will be terrible.
+sidebar: widget
+
+# Kind of navigation (button panel on the bottom).
+#  - "widget" or unset, use traditional navigation
+#  - "none", hide it entirely
+#  - "qml", use calamares-navigation.qml from branding folder
+# In addition, you **may** specify a side, separated by a comma,
+# from the kind. The same sides are valid as for *sidebar*,
+# except the default is *bottom*.
+navigation: widget
+
+
+### STRINGS, IMAGES AND COLORS
+#
+# This section contains the "branding proper" of names
+# and images, rather than global-look settings.
+
+# These are strings shown to the user in the user interface.
+# There is no provision for translating them -- since they
+# are names, the string is included as-is.
+#
+# The four Url strings are the Urls used by the buttons in
+# the welcome screen, and are not shown to the user. Clicking
+# on the "Support" button, for instance, opens the link supportUrl.
+# If a Url is empty, the corresponding button is not shown.
+#
+# bootloaderEntryName is how this installation / distro is named
+# in the boot loader (e.g. in the GRUB menu).
+#
+# These strings support substitution from /etc/os-release
+# if KDE Frameworks 5.58 are available at build-time. When
+# enabled, ${varname} is replaced by the equivalent value
+# from os-release. All the supported var-names are in all-caps,
+# and are listed on the FreeDesktop.org site,
+#       https://www.freedesktop.org/software/systemd/man/os-release.html
+# Note that ANSI_COLOR and CPE_NAME don't make sense here, and
+# are not supported (the rest are). Remember to quote the string
+# if it contains substitutions, or you'll get YAML exceptions.
+#
+# The *Url* entries are used on the welcome page, and they
+# are visible as buttons there if the corresponding *show* keys
+# are set to "true" (they can also be overridden).
+strings:
+    productName:         "${NAME}"
+    shortProductName:    NixOS
+    version:
+    shortVersion:
+    versionedName:       NixOS
+    shortVersionedName:  NixOS
+    bootloaderEntryName: NixOS
+    productUrl:          https://nixos.org/
+    supportUrl:          https://nixos.org/manual/nixos
+    knownIssuesUrl:      https://github.com/NixOS/nixpkgs/issues
+    releaseNotesUrl:     https://nixos.org/manual/nixos/stable/release-notes.html
+    donateUrl:           https://nixos.org/donate.html
+
+# These images are loaded from the branding module directory.
+#
+# productBanner is an optional image, which if present, will be shown
+#       on the welcome page of the application, above the welcome text.
+#       It is intended to have a width much greater than height.
+#       It is displayed at 64px height (also on HiDPI).
+#       Recommended size is 64px tall, and up to 460px wide.
+# productIcon is used as the window icon, and will (usually) be used
+#       by the window manager to represent the application. This image
+#       should be square, and may be displayed by the window manager
+#       as small as 16x16 (but possibly larger).
+# productLogo is used as the logo at the top of the left-hand column
+#       which shows the steps to be taken. The image should be square,
+#       and is displayed at 80x80 pixels (also on HiDPI).
+# productWallpaper is an optional image, which if present, will replace
+#       the normal solid background on every page of the application.
+#       It can be any size and proportion,
+#       and will be tiled to fit the entire window.
+#       For a non-tiled wallpaper, the size should be the same as
+#       the overall window, see *windowSize* above (800x520).
+# productWelcome is shown on the welcome page of the application in
+#       the middle of the window, below the welcome text. It can be
+#       any size and proportion, and will be scaled to fit inside
+#       the window. Use `welcomeExpandingLogo` to make it non-scaled.
+#       Recommended size is 320x150.
+#
+# These filenames can also use substitutions from os-release (see above).
+images:
+    # productBanner:       "banner.png"
+    productIcon:         "nix-snowflake.svg"
+    productLogo:         "white.png"
+    # productWallpaper:    "wallpaper.png"
+    productWelcome:      "nix-snowflake.svg"
+
+# Colors for text and background components.
+#
+#  - SidebarBackground is the background of the sidebar
+#  - SidebarText is the (foreground) text color
+#  - SidebarBackgroundCurrent sets the background of the current step.
+#    Optional, and defaults to the application palette.
+#  - SidebarTextCurrent is the text color of the current step.
+#
+# These colors can **also** be set through the stylesheet, if the
+# branding component also ships a stylesheet.qss. Then they are
+# the corresponding CSS attributes of #sidebarApp.
+style:
+   SidebarBackground:        "#5277C3"
+   SidebarText:              "#FFFFFF"
+   SidebarTextCurrent:       "#292F34"
+   SidebarBackgroundCurrent: "#7EBAE4"
+
+### SLIDESHOW
+#
+# The slideshow is displayed during execution steps (e.g. when the
+# installer is actually writing to disk and doing other slow things).
+
+# The slideshow can be a QML file (recommended) which can display
+# arbitrary things -- text, images, animations, or even play a game --
+# during the execution step. The QML **is** abruptly stopped when the
+# execution step is done, though, so maybe a game isn't a great idea.
+#
+# The slideshow can also be a sequence of images (not recommended unless
+# you don't want QML at all in your Calamares). The images are displayed
+# at a rate of 1 every 2 seconds during the execution step.
+#
+# To configure a QML file, list a single filename:
+#   slideshow:               "show.qml"
+# To configure images, like the filenames (here, as an inline list):
+#   slideshow: [ "/etc/calamares/slideshow/0.png", "/etc/logo.png" ]
+slideshow:               "show.qml"
+
+# There are two available APIs for a QML slideshow:
+#  - 1 (the default) loads the entire slideshow when the installation-
+#      slideshow page is shown and starts the QML then. The QML
+#      is never stopped (after installation is done, times etc.
+#      continue to fire).
+#  - 2 loads the slideshow on startup and calls onActivate() and
+#      onLeave() in the root object. After the installation is done,
+#      the show is stopped (first by calling onLeave(), then destroying
+#      the QML components).
+#
+# An image slideshow does not need to have the API defined.
+slideshowAPI: 2
+
+
+# These options are to customize online uploading of logs to pastebins:
+#  - type      : Defines the kind of pastebin service to be used. Currently
+#                it accepts two values:
+#                - none    :    disables the pastebin functionality
+#                - fiche   :    use fiche pastebin server
+#  - url       : Defines the address of pastebin service to be used.
+#                Takes string as input. Important bits are the host and port,
+#                the scheme is not used.
+#  - sizeLimit : Defines maximum size limit (in KiB) of log file to be pasted.
+#                The option must be set, to have the log option work.
+#                Takes integer as input. If < 0, no limit will be forced,
+#                else only last (approximately) 'n' KiB of log file will be pasted.
+#                Please note that upload size may be slightly over the limit (due
+#                to last minute logging), so provide a suitable value.
+uploadServer :
+    type :    "fiche"
+    url :     "http://termbin.com:9999"
+    sizeLimit : -1
@@ -0,0 +1,513 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:xlink="http://www.w3.org/1999/xlink"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="141.5919mm"
+   height="122.80626mm"
+   viewBox="0 0 501.70361 435.14028"
+   id="svg2"
+   version="1.1"
+   inkscape:version="0.92.0 r15299"
+   sodipodi:docname="nix-snowflake.svg">
+  <defs
+     id="defs4">
+    <linearGradient
+       inkscape:collect="always"
+       id="linearGradient5562">
+      <stop
+         style="stop-color:#699ad7;stop-opacity:1"
+         offset="0"
+         id="stop5564" />
+      <stop
+         id="stop5566"
+         offset="0.24345198"
+         style="stop-color:#7eb1dd;stop-opacity:1" />
+      <stop
+         style="stop-color:#7ebae4;stop-opacity:1"
+         offset="1"
+         id="stop5568" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       id="linearGradient5053">
+      <stop
+         style="stop-color:#415e9a;stop-opacity:1"
+         offset="0"
+         id="stop5055" />
+      <stop
+         id="stop5057"
+         offset="0.23168644"
+         style="stop-color:#4a6baf;stop-opacity:1" />
+      <stop
+         style="stop-color:#5277c3;stop-opacity:1"
+         offset="1"
+         id="stop5059" />
+    </linearGradient>
+    <linearGradient
+       id="linearGradient5960"
+       inkscape:collect="always">
+      <stop
+         id="stop5962"
+         offset="0"
+         style="stop-color:#637ddf;stop-opacity:1" />
+      <stop
+         style="stop-color:#649afa;stop-opacity:1"
+         offset="0.23168644"
+         id="stop5964" />
+      <stop
+         id="stop5966"
+         offset="1"
+         style="stop-color:#719efa;stop-opacity:1" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       id="linearGradient5867">
+      <stop
+         style="stop-color:#7363df;stop-opacity:1"
+         offset="0"
+         id="stop5869" />
+      <stop
+         id="stop5871"
+         offset="0.23168644"
+         style="stop-color:#6478fa;stop-opacity:1" />
+      <stop
+         style="stop-color:#719efa;stop-opacity:1"
+         offset="1"
+         id="stop5873" />
+    </linearGradient>
+    <linearGradient
+       y2="515.97058"
+       x2="282.26105"
+       y1="338.62445"
+       x1="213.95642"
+       gradientTransform="translate(983.36076,601.38885)"
+       gradientUnits="userSpaceOnUse"
+       id="linearGradient5855"
+       xlink:href="#linearGradient5960"
+       inkscape:collect="always" />
+    <linearGradient
+       y2="515.97058"
+       x2="282.26105"
+       y1="338.62445"
+       x1="213.95642"
+       gradientTransform="translate(-197.75174,-337.1451)"
+       gradientUnits="userSpaceOnUse"
+       id="linearGradient5855-8"
+       xlink:href="#linearGradient5867"
+       inkscape:collect="always" />
+    <linearGradient
+       y2="247.58188"
+       x2="-702.75317"
+       y1="102.74675"
+       x1="-775.20807"
+       gradientTransform="translate(983.36076,601.38885)"
+       gradientUnits="userSpaceOnUse"
+       id="linearGradient4544"
+       xlink:href="#linearGradient5960"
+       inkscape:collect="always" />
+    <clipPath
+       id="clipPath4501"
+       clipPathUnits="userSpaceOnUse">
+      <circle
+         r="241.06563"
+         cy="686.09473"
+         cx="335.13995"
+         id="circle4503"
+         style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#adadad;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate" />
+    </clipPath>
+    <clipPath
+       id="clipPath5410"
+       clipPathUnits="userSpaceOnUse">
+      <circle
+         r="241.13741"
+         cy="340.98975"
+         cx="335.98114"
+         id="circle5412"
+         style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#ffffff;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate" />
+    </clipPath>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient5053"
+       id="linearGradient5137"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(864.55062,-2197.497)"
+       x1="-584.19934"
+       y1="782.33563"
+       x2="-496.29703"
+       y2="937.71399" />
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient5053"
+       id="linearGradient5147"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(864.55062,-2197.497)"
+       x1="-584.19934"
+       y1="782.33563"
+       x2="-496.29703"
+       y2="937.71399" />
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient5562"
+       id="linearGradient5162"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(70.505061,-1761.3076)"
+       x1="200.59668"
+       y1="351.41116"
+       x2="290.08701"
+       y2="506.18814" />
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient5562"
+       id="linearGradient5172"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(70.505061,-1761.3076)"
+       x1="200.59668"
+       y1="351.41116"
+       x2="290.08701"
+       y2="506.18814" />
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient5562"
+       id="linearGradient5182"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(70.505061,-1761.3076)"
+       x1="200.59668"
+       y1="351.41116"
+       x2="290.08701"
+       y2="506.18814" />
+    <linearGradient
+       y2="506.18814"
+       x2="290.08701"
+       y1="351.41116"
+       x1="200.59668"
+       gradientTransform="translate(70.505061,-1761.3076)"
+       gradientUnits="userSpaceOnUse"
+       id="linearGradient5201"
+       xlink:href="#linearGradient5562"
+       inkscape:collect="always" />
+    <linearGradient
+       y2="937.71399"
+       x2="-496.29703"
+       y1="782.33563"
+       x1="-584.19934"
+       gradientTransform="translate(864.55062,-2197.497)"
+       gradientUnits="userSpaceOnUse"
+       id="linearGradient5205"
+       xlink:href="#linearGradient5053"
+       inkscape:collect="always" />
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient5562"
+       id="linearGradient4328"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(70.650339,-1055.1511)"
+       x1="200.59668"
+       y1="351.41116"
+       x2="290.08701"
+       y2="506.18814" />
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient5053"
+       id="linearGradient4330"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(864.69589,-1491.3405)"
+       x1="-584.19934"
+       y1="782.33563"
+       x2="-496.29703"
+       y2="937.71399" />
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="0.98318225"
+     inkscape:cx="113.58176"
+     inkscape:cy="-45.193301"
+     inkscape:document-units="px"
+     inkscape:current-layer="layer3"
+     showgrid="false"
+     inkscape:window-width="2560"
+     inkscape:window-height="1577"
+     inkscape:window-x="0"
+     inkscape:window-y="0"
+     inkscape:window-maximized="1"
+     inkscape:snap-global="true"
+     fit-margin-top="0"
+     fit-margin-left="0"
+     fit-margin-right="0"
+     fit-margin-bottom="0" />
+  <metadata
+     id="metadata7">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title />
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     inkscape:groupmode="layer"
+     id="layer7"
+     inkscape:label="bg"
+     style="display:none"
+     transform="translate(-23.75651,-24.84972)">
+    <rect
+       transform="translate(-132.5822,958.04022)"
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#ffffff;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       id="rect5389"
+       width="1543.4283"
+       height="483.7439"
+       x="132.5822"
+       y="-957.77832" />
+  </g>
+  <g
+     inkscape:groupmode="layer"
+     id="layer6"
+     inkscape:label="logo-guide"
+     style="display:none"
+     transform="translate(-156.33871,933.1905)">
+    <rect
+       y="-958.02759"
+       x="132.65129"
+       height="484.30399"
+       width="550.41602"
+       id="rect5379"
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#5c201e;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       inkscape:export-filename="/home/tim/dev/nix/homepage/logo/nix-wiki.png"
+       inkscape:export-xdpi="22.07"
+       inkscape:export-ydpi="22.07" />
+    <rect
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#c24a46;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       id="rect5372"
+       width="501.94415"
+       height="434.30405"
+       x="156.12303"
+       y="-933.02759"
+       inkscape:export-filename="/home/tim/dev/nix/homepage/logo/nixos-logo-only-hires-print.png"
+       inkscape:export-xdpi="212.2"
+       inkscape:export-ydpi="212.2" />
+    <rect
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#d98d8a;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       id="rect5381"
+       width="24.939611"
+       height="24.939611"
+       x="658.02826"
+       y="-958.04022" />
+  </g>
+  <g
+     inkscape:label="print-logo"
+     inkscape:groupmode="layer"
+     id="layer1"
+     style="display:inline"
+     transform="translate(-156.33871,933.1905)"
+     sodipodi:insensitive="true">
+    <path
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#5277c3;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       d="m 309.40365,-710.2521 122.19683,211.6751 -56.15706,0.5268 -32.6236,-56.8692 -32.85645,56.5653 -27.90237,-0.011 -14.29086,-24.6896 46.81047,-80.4902 -33.22946,-57.8256 z"
+       id="path4861"
+       inkscape:connector-curvature="0"
+       sodipodi:nodetypes="cccccccccc" />
+    <path
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#7ebae4;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       d="m 353.50926,-797.4433 -122.21756,211.6631 -28.53477,-48.37 32.93839,-56.6875 -65.41521,-0.1719 -13.9414,-24.1698 14.23637,-24.721 93.11177,0.2939 33.46371,-57.6903 z"
+       id="use4863"
+       inkscape:connector-curvature="0"
+       sodipodi:nodetypes="cccccccccc" />
+    <path
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#7ebae4;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       d="m 362.88537,-628.243 244.41439,0.012 -27.62229,48.8968 -65.56199,-0.1817 32.55876,56.7371 -13.96098,24.1585 -28.52722,0.032 -46.3013,-80.7841 -66.69317,-0.1353 z"
+       id="use4865"
+       inkscape:connector-curvature="0"
+       sodipodi:nodetypes="cccccccccc" />
+    <path
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#7ebae4;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       d="m 505.14318,-720.9886 -122.19683,-211.6751 56.15706,-0.5268 32.6236,56.8692 32.85645,-56.5653 27.90237,0.011 14.29086,24.6896 -46.81047,80.4902 33.22946,57.8256 z"
+       id="use4867"
+       inkscape:connector-curvature="0"
+       sodipodi:nodetypes="cccccccccc" />
+    <path
+       sodipodi:nodetypes="cccccccccc"
+       inkscape:connector-curvature="0"
+       id="path4873"
+       d="m 309.40365,-710.2521 122.19683,211.6751 -56.15706,0.5268 -32.6236,-56.8692 -32.85645,56.5653 -27.90237,-0.011 -14.29086,-24.6896 46.81047,-80.4902 -33.22946,-57.8256 z"
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#5277c3;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate" />
+    <path
+       sodipodi:nodetypes="cccccccccc"
+       inkscape:connector-curvature="0"
+       id="use4875"
+       d="m 451.3364,-803.53264 -244.4144,-0.012 27.62229,-48.89685 65.56199,0.18175 -32.55875,-56.73717 13.96097,-24.15851 28.52722,-0.0315 46.3013,80.78414 66.69317,0.13524 z"
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#5277c3;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate" />
+    <path
+       sodipodi:nodetypes="cccccccccc"
+       inkscape:connector-curvature="0"
+       id="use4877"
+       d="m 460.87178,-633.8425 122.21757,-211.66304 28.53477,48.37003 -32.93839,56.68751 65.4152,0.1718 13.9414,24.1698 -14.23636,24.7211 -93.11177,-0.294 -33.46371,57.6904 z"
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#5277c3;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate" />
+    <g
+       id="layer2"
+       inkscape:label="guides"
+       style="display:none"
+       transform="translate(72.039038,-1799.4476)">
+      <path
+         d="M 460.60629,594.72881 209.74183,594.7288 84.309616,377.4738 209.74185,160.21882 l 250.86446,1e-5 125.43222,217.255 z"
+         inkscape:randomized="0"
+         inkscape:rounded="0"
+         inkscape:flatsided="true"
+         sodipodi:arg2="1.5707963"
+         sodipodi:arg1="1.0471976"
+         sodipodi:r2="217.25499"
+         sodipodi:r1="250.86446"
+         sodipodi:cy="377.47382"
+         sodipodi:cx="335.17407"
+         sodipodi:sides="6"
+         id="path6032"
+         style="color:#000000;display:inline;overflow:visible;visibility:visible;opacity:0.23600003;fill:#4e4d52;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;enable-background:accumulate"
+         sodipodi:type="star" />
+      <path
+         transform="translate(0,-308.26772)"
+         sodipodi:type="star"
+         style="color:#000000;display:inline;overflow:visible;visibility:visible;opacity:1;fill:#4e4d52;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;enable-background:accumulate"
+         id="path5875"
+         sodipodi:sides="6"
+         sodipodi:cx="335.17407"
+         sodipodi:cy="685.74158"
+         sodipodi:r1="100.83495"
+         sodipodi:r2="87.32563"
+         sodipodi:arg1="1.0471976"
+         sodipodi:arg2="1.5707963"
+         inkscape:flatsided="true"
+         inkscape:rounded="0"
+         inkscape:randomized="0"
+         d="m 385.59154,773.06721 -100.83495,0 -50.41747,-87.32564 50.41748,-87.32563 100.83495,10e-6 50.41748,87.32563 z" />
+      <path
+         transform="translate(0,-308.26772)"
+         sodipodi:nodetypes="ccccccccc"
+         inkscape:connector-curvature="0"
+         id="path5851"
+         d="m 1216.5591,938.53395 123.0545,228.14035 -42.6807,-1.2616 -43.4823,-79.7725 -39.6506,80.3267 -32.6875,-19.7984 53.4737,-100.2848 -37.1157,-73.88955 z"
+         style="fill:url(#linearGradient5855);fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <rect
+         style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:0.41499999;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#c53a3a;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+         id="rect5884"
+         width="48.834862"
+         height="226.22897"
+         x="-34.74221"
+         y="446.17056"
+         transform="rotate(-30)" />
+      <path
+         transform="translate(0,-308.26772)"
+         sodipodi:type="star"
+         style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:0.50899999;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#000000;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+         id="path3428"
+         sodipodi:sides="6"
+         sodipodi:cx="223.93674"
+         sodipodi:cy="878.63831"
+         sodipodi:r1="28.048939"
+         sodipodi:r2="24.291094"
+         sodipodi:arg1="0"
+         sodipodi:arg2="0.52359878"
+         inkscape:flatsided="true"
+         inkscape:rounded="0"
+         inkscape:randomized="0"
+         d="m 251.98568,878.63831 -14.02447,24.29109 h -28.04894 l -14.02447,-24.29109 14.02447,-24.2911 h 28.04894 z" />
+      <use
+         x="0"
+         y="0"
+         xlink:href="#rect5884"
+         id="use4252"
+         transform="rotate(60,268.29786,489.4515)"
+         width="100%"
+         height="100%" />
+      <rect
+         style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#000000;fill-opacity:0.6507937;fill-rule:evenodd;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+         id="rect4254"
+         width="5.3947482"
+         height="115.12564"
+         x="545.71014"
+         y="467.07007"
+         transform="rotate(30,575.23539,-154.13386)" />
+    </g>
+  </g>
+  <g
+     inkscape:groupmode="layer"
+     id="layer3"
+     inkscape:label="gradient-logo"
+     style="display:inline;opacity:1"
+     sodipodi:insensitive="true"
+     transform="translate(-156.33871,933.1905)">
+    <path
+       sodipodi:nodetypes="cccccccccc"
+       inkscape:connector-curvature="0"
+       id="path3336-6"
+       d="m 309.54892,-710.38827 122.19683,211.67512 -56.15706,0.5268 -32.6236,-56.8692 -32.85645,56.5653 -27.90237,-0.011 -14.29086,-24.6896 46.81047,-80.4901 -33.22946,-57.8257 z"
+       style="opacity:1;fill:url(#linearGradient4328);fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+    <use
+       height="100%"
+       width="100%"
+       transform="rotate(60,407.11155,-715.78724)"
+       id="use3439-6"
+       inkscape:transform-center-y="151.59082"
+       inkscape:transform-center-x="124.43045"
+       xlink:href="#path3336-6"
+       y="0"
+       x="0" />
+    <use
+       height="100%"
+       width="100%"
+       transform="rotate(-60,407.31177,-715.70016)"
+       id="use3445-0"
+       inkscape:transform-center-y="75.573958"
+       inkscape:transform-center-x="-168.20651"
+       xlink:href="#path3336-6"
+       y="0"
+       x="0" />
+    <use
+       height="100%"
+       width="100%"
+       transform="rotate(180,407.41868,-715.7565)"
+       id="use3449-5"
+       inkscape:transform-center-y="-139.94592"
+       inkscape:transform-center-x="59.669705"
+       xlink:href="#path3336-6"
+       y="0"
+       x="0" />
+    <path
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:url(#linearGradient4330);fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       d="m 309.54892,-710.38827 122.19683,211.67512 -56.15706,0.5268 -32.6236,-56.8692 -32.85645,56.5653 -27.90237,-0.011 -14.29086,-24.6896 46.81047,-80.4901 -33.22946,-57.8256 z"
+       id="path4260-0"
+       inkscape:connector-curvature="0"
+       sodipodi:nodetypes="cccccccccc" />
+    <use
+       height="100%"
+       width="100%"
+       transform="rotate(120,407.33916,-716.08356)"
+       id="use4354-5"
+       xlink:href="#path4260-0"
+       y="0"
+       x="0"
+       style="display:inline" />
+    <use
+       height="100%"
+       width="100%"
+       transform="rotate(-120,407.28823,-715.86995)"
+       id="use4362-2"
+       xlink:href="#path4260-0"
+       y="0"
+       x="0"
+       style="display:inline" />
+  </g>
+</svg>
@@ -0,0 +1,34 @@
+import io.calamares.core
+
+import QtQuick
+import QtQuick.Controls
+import QtQuick.Layouts
+import org.kde.kirigami as Kirigami
+
+Page {
+    width: parent.width
+    height: parent.height
+
+    ColumnLayout {
+        width: parent.width
+        spacing: Kirigami.Units.smallSpacing
+
+        Column {
+            Layout.fillWidth: true
+
+            Text {
+                text: qsTr("NixOS is fully open source, but it also provides optional software packages that do not respect users' freedom to run, copy, distribute, study, change and improve the software, and are commonly not open source. By default such \"unfree\" packages are not allowed, but you can enable it here. If you check this box, you agree that unfree software may be installed which might have additional End User License Agreements (EULAs) that you need to agree to. If not enabled, some hardware (notably Nvidia GPUs and some WiFi chips) might not work or not work optimally.<br/>")
+                width: parent.width
+                wrapMode: Text.WordWrap
+            }
+
+            CheckBox {
+                text: qsTr("Allow unfree software")
+
+                onCheckedChanged: {
+                    Global.insert("nixos_allow_unfree", checked)
+                }
+            }
+        }
+    }
+}
@@ -0,0 +1,122 @@
+import QtQuick 2.0;
+import calamares.slideshow 1.0;
+
+Presentation
+{
+    id: presentation
+
+    function nextSlide() {
+        presentation.goToNextSlide();
+    }
+
+    Timer {
+        id: advanceTimer
+        interval: 20000
+        running: presentation.activatedInCalamares
+        repeat: true
+        onTriggered: nextSlide()
+    }
+
+    Slide {
+        Text {
+            id: text1
+            anchors.centerIn: parent
+            text: "Reproducible"
+            font.pixelSize: 30
+            wrapMode: Text.WordWrap
+            width: presentation.width
+            horizontalAlignment: Text.Center
+            color: "#6586C8"
+        }
+        Image {
+            id: background1
+            source: "gfx-landing-reproducible.png"
+            width: 200; height: 200
+            fillMode: Image.PreserveAspectFit
+            anchors.bottom: text1.top
+            anchors.horizontalCenter: parent.horizontalCenter
+        }
+        Text {
+            anchors.horizontalCenter: background1.horizontalCenter
+            anchors.top: text1.bottom
+            text: "Nix builds packages in isolation from each other.<br/>"+
+                  "This ensures that they are reproducible and don't<br/>"+
+                  "have undeclared dependencies, so <b>if a package<br/>"+
+                  "works on one machine, it will also work on another.</b>"
+            wrapMode: Text.WordWrap
+            width: presentation.width
+            horizontalAlignment: Text.Center
+        }
+    }
+
+    Slide {
+        Text {
+            id: text2
+            anchors.centerIn: parent
+            text: "Declarative"
+            font.pixelSize: 30
+            wrapMode: Text.WordWrap
+            width: presentation.width
+            horizontalAlignment: Text.Center
+            color: "#6586C8"
+        }
+        Image {
+            id: background2
+            source: "gfx-landing-declarative.png"
+            width: 200; height: 200
+            fillMode: Image.PreserveAspectFit
+            anchors.bottom: text2.top
+            anchors.horizontalCenter: parent.horizontalCenter
+        }
+        Text {
+            anchors.horizontalCenter: background2.horizontalCenter
+            anchors.top: text2.bottom
+            text: "Nix makes it <b>trivial to share development and build<br/>"+
+                  "environments</b> for your projects, regardless of what<br/>"+
+                  "programming languages and tools you’re using."
+            wrapMode: Text.WordWrap
+            width: presentation.width
+            horizontalAlignment: Text.Center
+        }
+    }
+
+    Slide {
+        Text {
+            id: text3
+            anchors.centerIn: parent
+            text: "Reliable"
+            font.pixelSize: 30
+            wrapMode: Text.WordWrap
+            width: presentation.width
+            horizontalAlignment: Text.Center
+            color: "#6586C8"
+        }
+        Image {
+            id: background3
+            source: "gfx-landing-reliable.png"
+            width: 200; height: 200
+            fillMode: Image.PreserveAspectFit
+            anchors.bottom: text3.top
+            anchors.horizontalCenter: parent.horizontalCenter
+        }
+        Text {
+            anchors.horizontalCenter: background3.horizontalCenter
+            anchors.top: text3.bottom
+            text: "Nix ensures that installing or upgrading one package<br/>"+
+                  "<b>cannot break other packages.</b> It allows you to <b>roll<br/>"+
+                  "back to previous versions,</b> and ensures that no<br/>"+
+                  "package is in an inconsistent state during an<br/>"+
+                  "upgrade."
+            wrapMode: Text.WordWrap
+            width: presentation.width
+            horizontalAlignment: Text.Center
+        }
+    }
+
+    function onActivate() {
+        presentation.currentSlide = 0;
+    }
+
+    function onLeave() {
+    }
+}
@@ -0,0 +1,4 @@
+# https://codeberg.org/Calamares/calamares/src/branch/calamares/src/modules/finished/finished.conf
+restartNowMode: user-unchecked
+restartNowCommand: "systemctl -i reboot"
+notifyOnFinished: true
@@ -0,0 +1,7 @@
+# https://codeberg.org/Calamares/calamares/src/branch/calamares/src/modules/keyboard/keyboard.conf
+xOrgConfFileName: "/etc/X11/xorg.conf.d/00-keyboard.conf"
+writeEtcDefaultKeyboard: false
+
+# Use special code path to configure GNOME keyboard settings
+configure:
+    gnome: true
@@ -0,0 +1,11 @@
+# https://codeberg.org/Calamares/calamares/src/branch/calamares/src/modules/locale/locale.conf
+useSystemTimezone: true
+
+# Isn't supported on NixOS
+adjustLiveTimezone: false
+
+localeGenPath: @glibcLocales@/share/i18n/SUPPORTED
+
+geoip:
+    style: "json"
+    url: "https://geoip.kde.org/v1/calamares"
@@ -0,0 +1,27 @@
+# https://codeberg.org/Calamares/calamares/src/branch/calamares/src/modules/mount/mount.conf
+extraMounts:
+    - device: proc
+      fs: proc
+      mountPoint: /proc
+    - device: sys
+      fs: sysfs
+      mountPoint: /sys
+    - device: /dev
+      mountPoint: /dev
+      options: [ bind ]
+    - device: tmpfs
+      fs: tmpfs
+      mountPoint: /run
+    - device: /run/udev
+      mountPoint: /run/udev
+      options: [ bind ]
+    - device: efivarfs
+      fs: efivarfs
+      mountPoint: /sys/firmware/efi/efivars
+      efi: true
+
+# Ensure the right fmask/dmask is set on the ESP, as it will be
+# picked up by nixos-generate-config later
+mountOptions:
+    - filesystem: efi
+      options: [ fmask=0077, dmask=0077 ]
@@ -0,0 +1,105 @@
+# https://codeberg.org/Calamares/calamares/src/branch/calamares/src/modules/packagechooser/packagechooser.conf
+mode: required
+
+# FIXME: what's the correct way of doing this now?
+method: legacy
+
+labels:
+    step: "Desktop"
+
+default: gnome
+
+items:
+    - id: gnome
+      packages: [ gnome ]
+      name: GNOME
+      description: "<html>Every part of GNOME has been designed to make it simple and easy to use. It provides a focused working environment that helps you get things done. GNOME is a popular choice and well tested on NixOS.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://www.gnome.org/\">gnome.org</a></html>"
+      screenshot: "images/gnome.png"
+
+    - id: plasma6
+      packages: [ plasma6 ]
+      name: Plasma
+      description: "<html>Plasma is made to stay out of the way as it helps you get things done. But under its light and intuitive surface, it's a highly customizable. So you're free to choose ways of usage right as you need them and when you need them. Plasma is a popular choice and well tested on NixOS.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://kde.org/plasma-desktop/\">kde.org/plasma-desktop</a></html>"
+      screenshot: "images/plasma6.png"
+
+    - id: xfce
+      packages: [ xfce ]
+      name: Xfce
+      description: "<html>Xfce is a lightweight desktop environment. It aims to be fast and low on system resources, while still being visually appealing and user friendly.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://www.xfce.org/\">xfce.org</a></html>"
+      screenshot: "images/xfce.png"
+
+    - id: pantheon
+      packages: [ pantheon ]
+      name: Pantheon
+      description: "<html>Pantheon is the default desktop of Elementary OS. It provides a productive and intuitive user experience while also being visually appealing.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://elementary.io/docs/learning-the-basics\">elementary.io/docs/learning-the-basics</a></html>"
+      screenshot: "images/pantheon.png"
+
+    - id: cinnamon
+      packages: [ cinnamon ]
+      name: Cinnamon
+      description: "<html>Cinnamon is a desktop which provides advanced innovative features and a traditional user experience. The emphasis is put on making users feel at home and providing them with an easy to use and comfortable desktop experience.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://projects.linuxmint.com/cinnamon/\">projects.linuxmint.com/cinnamon</a></html>"
+      screenshot: "images/cinnamon.png"
+
+    - id: mate
+      packages: [ mate ]
+      name: MATE
+      description: "<html>The MATE Desktop Environment is the continuation of GNOME 2. It provides an intuitive and attractive desktop environment.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://mate-desktop.org/\">mate-desktop.org</a></html>"
+      screenshot: "images/mate.png"
+
+    - id: enlightenment
+      packages: [ enlightenment ]
+      name: Enlightenment
+      description: "<html>Enlightenment is a Window Manager, Compositor and Minimal Desktop. Enlightenment is classed as a desktop shell as it provides everything you need to operate your desktop or laptop, but it is not a full application suite.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://www.enlightenment.org/\">enlightenment.org</a></html>"
+      screenshot: "images/enlightenment.png"
+
+    - id: lxqt
+      packages: [ lxqt ]
+      name: LXQt
+      description: "<html>LXQt is a lightweight Qt desktop environment. It will not get in your way. It will not hang or slow down your system. It is focused on being a classic desktop with a modern look and feel.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://lxqt-project.org/\">lxqt-project.org</a></html>"
+      screenshot: "images/lxqt.png"
+
+    # Lumina is not yet stable enough, once it is, simply uncommenting the lines below is all that's needed to enable it as an option
+    #- id: lumina
+    #  packages: [ lumina ]
+    #  name: Lumina
+    #  description: "<html>Lumina is designed to have a small footprint, giving your system the best performance possible. It is built to flow seamlessly between computer tasks and offers several integrated utilities in one convenient package.<br/>
+    #                - Learn more at <a href=\"https://lumina-desktop.org/\">lumina-desktop.org</a></html>"
+    #  screenshot: "images/lumina.png"
+
+    - id: budgie
+      packages: [ budgie ]
+      name: Budgie
+      description: "<html>The Budgie Desktop is a feature-rich, modern desktop designed to keep out the way of the user.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://docs.buddiesofbudgie.org/\">buddiesofbudgie.org</a></html>"
+      screenshot: "images/budgie.png"
+
+    - id: deepin
+      packages: [ deepin ]
+      name: Deepin
+      description: "<html>The Deepin Desktop Environment is an elegant, easy to use and reliable desktop environment.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://www.deepin.org/\">deepin.org</a></html>"
+      screenshot: "images/deepin.png"
+
+    - id: ""
+      packages: []
+      name: "No desktop"
+      screenshot: "images/nodesktop.png"
+      description: "A minimal system without a graphical user interface will be installed. This is great for servers or custom setups with window managers. The configuration can be changed after installation."
@@ -0,0 +1,22 @@
+# https://codeberg.org/Calamares/calamares/src/branch/calamares/src/modules/partition/partition.conf
+efi:
+    mountPoint: "/boot"
+    recommendedSize: 1GiB
+    minimumSize: 32MiB
+    label: "EFI"
+
+userSwapChoices:
+    - none
+    - small
+    - suspend
+
+luksGeneration: luks2
+
+showNotEncryptedBootMessage: false
+
+partitionLayout:
+    - name: "root"
+      filesystem: "ext4"
+      noEncrypt: false
+      mountPoint: "/"
+      size: 100%
@@ -0,0 +1,5 @@
+---
+qmlSearch: branding
+
+qmlLabel:
+    notes: "Unfree software"
@@ -0,0 +1,32 @@
+# https://codeberg.org/Calamares/calamares/src/branch/calamares/src/modules/users/users.conf
+defaultGroups:
+    - users
+    - networkmanager
+    - wheel
+
+setRootPassword: true
+doReusePassword: false
+doAutologin: false
+
+# Recommended libpwquality settings from upstream
+passwordRequirements:
+    minLength: 8
+    maxLength: 64
+    libpwquality:
+        - minlen=8
+        - maxrepeat=3
+        - maxsequence=3
+        - usersubstr=4
+        - badwords=linux
+
+allowWeakPasswords: true
+allowWeakPasswordsDefault: false
+
+user:
+  shell: /run/current-system/sw/bin/bash
+  forbidden_names: [ root ]
+
+hostname:
+  location: None
+  writeHostsFile: false
+  forbidden_names: [ localhost ]
@@ -0,0 +1,20 @@
+# https://codeberg.org/Calamares/calamares/src/branch/calamares/src/modules/welcome/welcome.conf
+showReleaseNotesUrl: true
+
+requirements:
+    requiredStorage: 10
+    requiredRam: 3.0
+
+    internetCheckUrl: [ https://geoip.kde.org/v1/calamares, https://cache.nixos.org/ ]
+
+    check:
+        - storage
+        - ram
+        - power
+        - internet
+        - screen
+
+    required:
+        - storage
+        - ram
+        - internet
@@ -0,0 +1,208 @@
+# Configuration file for Calamares
+#
+# This is the top-level configuration file for Calamares.
+# It specifies what modules will be used, as well as some
+# overall characteristics -- is this a setup program, or
+# an installer. More specific configuration is devolved
+# to the branding file (for the UI) and the individual
+# module configuration files (for functionality).
+---
+# Modules can be job modules (with different interfaces) and QtWidgets view
+# modules. They could all be placed in a number of different paths.
+# "modules-search" is a list of strings, each of these can either be a full
+# path to a directory or the keyword "local".
+#
+# "local" means:
+#   - modules in $LIBDIR/calamares/modules, with
+#   - settings in SHARE/calamares/modules or /etc/calamares/modules.
+# In debug-mode (e.g. calamares -d) "local" also adds some paths
+# that make sense from inside the build-directory, so that you
+# can build-and-run with the latest modules immediately.
+#
+# Strings other than "local" are taken as paths and interpreted
+# relative to wherever Calamares is started. It is therefore **strongly**
+# recommended to use only absolute paths here. This is mostly useful
+# if your distro has forks of standard Calamares modules, but also
+# uses some form of upstream packaging which might overwrite those
+# forked modules -- then you can keep modules somewhere outside of
+# the "regular" module tree.
+#
+#
+# YAML: list of strings.
+modules-search: [ local, @out@/lib/calamares/modules ]
+
+# Instances section. This section is optional, and it defines custom instances
+# for modules of any kind. An instance entry has these keys:
+# - *module* name, which matches the module name from the module descriptor
+#   (usually the name of the directory under `src/modules/`, but third-
+#   party modules may diverge.
+# - *id* (optional) an identifier to distinguish this instance from
+#   all the others. If none is given, the name of the module is used.
+#   Together, the module and id form an instance key (see below).
+# - *config* (optional) a filename for the configuration. If none is
+#   given, *module*`.conf` is used (e.g. `welcome.conf` for the welcome
+#   module)
+# - *weight* (optional) In the *exec* phase of the sequence, progress
+#   is reported as jobs are completed. The jobs from a single module
+#   together contribute the full weight of that module. The overall
+#   progress (0 .. 100%) is divided up according to the weight of each
+#   module. Give modules that take a lot of time to complete, a larger
+#   weight to keep the overall progress moving along steadily. This
+#   weight overrides a weight given in the module descriptor. If no weight
+#   is given, uses the value from the module descriptor, or 1 if there
+#   isn't one there either.
+#
+# The primary goal of this mechanism is to allow loading multiple instances
+# of the same module, with different configuration. If you don't need this,
+# the instances section can safely be left empty.
+#
+# Module name plus instance name makes an instance key, e.g.
+# "webview@owncloud", where "webview" is the module name (for the webview
+# viewmodule) and "owncloud" is the instance name. In the *sequence*
+# section below, use instance-keys to name instances (instead of just
+# a module name, for modules which have only a single instance).
+#
+# Every module implicitly has an instance with the instance name equal
+# to its module name, e.g. "welcome@welcome". In the *sequence* section,
+# mentioning a module without a full instance key (e.g. "welcome")
+# means that implicit module.
+#
+# An instance may specify its configuration file (e.g. `webview-home.conf`).
+# The implicit instances all have configuration files named `<module>.conf`.
+# This (implict) way matches the source examples, where the welcome
+# module contains an example `welcome.conf`. Specify a *config* for
+# any module (also implicit instances) to change which file is used.
+#
+# For more information on running module instances, run Calamares in debug
+# mode and check the Modules page in the Debug information interface.
+#
+# A module that is often used with instances is shellprocess, which will
+# run shell commands specified in the configuration file. By configuring
+# more than one instance of the module, multiple shell sessions can be run
+# during install.
+#
+# YAML: list of maps of string:string key-value pairs.
+instances:
+- id:       unfree
+  module:   notesqml
+  config:   unfree.conf
+
+# Sequence section. This section describes the sequence of modules, both
+# viewmodules and jobmodules, as they should appear and/or run.
+#
+# A jobmodule instance key (or name) can only appear in an exec phase, whereas
+# a viewmodule instance key (or name) can appear in both exec and show phases.
+# There is no limit to the number of show or exec phases. However, the same
+# module instance key should not appear more than once per phase, and
+# deployers should take notice that the global storage structure is persistent
+# throughout the application lifetime, possibly influencing behavior across
+# phases. A show phase defines a sequence of viewmodules (and therefore
+# pages). These viewmodules can offer up jobs for the execution queue.
+#
+# An exec phase displays a progress page (with brandable slideshow). This
+# progress page iterates over the modules listed in the *immediately
+# preceding* show phase, and enqueues their jobs, as well as any other jobs
+# from jobmodules, in the order defined in the current exec phase.
+#
+# It then executes the job queue and clears it. If a viewmodule offers up a
+# job for execution, but the module name (or instance key) isn't listed in the
+# immediately following exec phase, this job will not be executed.
+#
+# YAML: list of lists of strings.
+sequence:
+- show:
+  - welcome
+  - locale
+  - keyboard
+  - users
+  - packagechooser
+  - notesqml@unfree
+  - partition
+  - summary
+- exec:
+  - partition
+  - mount
+  - nixos
+  - users
+  - umount
+- show:
+  - finished
+
+# A branding component is a directory, either in SHARE/calamares/branding or
+# in /etc/calamares/branding (the latter takes precedence). The directory must
+# contain a YAML file branding.desc which may reference additional resources
+# (such as images) as paths relative to the current directory.
+#
+# A branding component can also ship a QML slideshow for execution pages,
+# along with translation files.
+#
+# Only the name of the branding component (directory) should be specified
+# here, Calamares then takes care of finding it and loading the contents.
+#
+# YAML: string.
+branding: nixos
+
+# If this is set to true, Calamares will show an "Are you sure?" prompt right
+# before each execution phase, i.e. at points of no return. If this is set to
+# false, no prompt is shown. Default is false, but Calamares will complain if
+# this is not explicitly set.
+#
+# YAML: boolean.
+prompt-install: false
+
+# If this is set to true, Calamares will execute all target environment
+# commands in the current environment, without chroot. This setting should
+# only be used when setting up Calamares as a post-install configuration tool,
+# as opposed to a full operating system installer.
+#
+# Some official Calamares modules are not expected to function with this
+# setting. (e.g. partitioning seems like a bad idea, since that is expected to
+# have been done already)
+#
+# Default is false (for a normal installer), but Calamares will complain if
+# this is not explicitly set.
+#
+# YAML: boolean.
+dont-chroot: false
+
+# If this is set to true, Calamares refers to itself as a "setup program"
+# rather than an "installer". Defaults to the value of dont-chroot, but
+# Calamares will complain if this is not explicitly set.
+oem-setup: false
+
+# If this is set to true, the "Cancel" button will be disabled entirely.
+# The button is also hidden from view.
+#
+# This can be useful if when e.g. Calamares is used as a post-install
+# configuration tool and you require the user to go through all the
+# configuration steps.
+#
+# Default is false, but Calamares will complain if this is not explicitly set.
+#
+# YAML: boolean.
+disable-cancel: false
+
+# If this is set to true, the "Cancel" button will be disabled once
+# you start the 'Installation', meaning there won't be a way to cancel
+# the Installation until it has finished or installation has failed.
+#
+# Default is false, but Calamares will complain if this is not explicitly set.
+#
+# YAML: boolean.
+disable-cancel-during-exec: false
+
+# If this is set to true, the "Next" and "Back" button will be hidden once
+# you start the 'Installation'.
+#
+# Default is false, but Calamares will complain if this is not explicitly set.
+#
+# YAML: boolean.
+hide-back-and-next-during-exec: false
+
+# If this is set to true, then once the end of the sequence has
+# been reached, the quit (done) button is clicked automatically
+# and Calamares will close. Default is false: the user will see
+# that the end of installation has been reached, and that things are ok.
+#
+#
+quit-at-end: false
@@ -0,0 +1,835 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+import configparser
+import libcalamares
+import os
+import subprocess
+import re
+
+import gettext
+
+_ = gettext.translation(
+    "calamares-python",
+    localedir=libcalamares.utils.gettext_path(),
+    languages=libcalamares.utils.gettext_languages(),
+    fallback=True,
+).gettext
+
+
+# The following strings contain pieces of a nix-configuration file.
+# They are adapted from the default config generated from the nixos-generate-config command.
+
+cfghead = """# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+"""
+cfgbootefi = """  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+"""
+
+cfgbootbios = """  # Bootloader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "@@bootdev@@";
+  boot.loader.grub.useOSProber = true;
+
+"""
+
+cfgbootnone = """  # Disable bootloader.
+  boot.loader.grub.enable = false;
+
+"""
+
+cfgbootgrubcrypt = """  # Setup keyfile
+  boot.initrd.secrets = {
+    "/boot/crypto_keyfile.bin" = null;
+  };
+
+  boot.loader.grub.enableCryptodisk = true;
+
+"""
+
+cfgnetwork = """  networking.hostName = "@@hostname@@"; # Define your hostname.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+"""
+
+cfgnetworkmanager = """  # Enable networking
+  networking.networkmanager.enable = true;
+
+"""
+
+cfgconnman = """  # Enable networking
+  services.connman.enable = true;
+
+"""
+
+cfgnmapplet = """  # Enable network manager applet
+  programs.nm-applet.enable = true;
+
+"""
+
+cfgtime = """  # Set your time zone.
+  time.timeZone = "@@timezone@@";
+
+"""
+
+cfglocale = """  # Select internationalisation properties.
+  i18n.defaultLocale = "@@LANG@@";
+
+"""
+
+cfglocaleextra = """  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "@@LC_ADDRESS@@";
+    LC_IDENTIFICATION = "@@LC_IDENTIFICATION@@";
+    LC_MEASUREMENT = "@@LC_MEASUREMENT@@";
+    LC_MONETARY = "@@LC_MONETARY@@";
+    LC_NAME = "@@LC_NAME@@";
+    LC_NUMERIC = "@@LC_NUMERIC@@";
+    LC_PAPER = "@@LC_PAPER@@";
+    LC_TELEPHONE = "@@LC_TELEPHONE@@";
+    LC_TIME = "@@LC_TIME@@";
+  };
+
+"""
+
+cfggnome = """  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Enable the GNOME Desktop Environment.
+  services.xserver.displayManager.gdm.enable = true;
+  services.xserver.desktopManager.gnome.enable = true;
+
+"""
+
+cfgplasma6 = """  # Enable the X11 windowing system.
+  # You can disable this if you're only using the Wayland session.
+  services.xserver.enable = true;
+
+  # Enable the KDE Plasma Desktop Environment.
+  services.displayManager.sddm.enable = true;
+  services.desktopManager.plasma6.enable = true;
+
+"""
+
+cfgxfce = """  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Enable the XFCE Desktop Environment.
+  services.xserver.displayManager.lightdm.enable = true;
+  services.xserver.desktopManager.xfce.enable = true;
+
+"""
+
+cfgpantheon = """  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Enable the Pantheon Desktop Environment.
+  services.xserver.displayManager.lightdm.enable = true;
+  services.xserver.desktopManager.pantheon.enable = true;
+
+"""
+
+cfgcinnamon = """  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Enable the Cinnamon Desktop Environment.
+  services.xserver.displayManager.lightdm.enable = true;
+  services.xserver.desktopManager.cinnamon.enable = true;
+
+"""
+
+cfgmate = """  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Enable the MATE Desktop Environment.
+  services.xserver.displayManager.lightdm.enable = true;
+  services.xserver.desktopManager.mate.enable = true;
+
+"""
+
+cfgenlightenment = """  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Enable the Enlightenment Desktop Environment.
+  services.xserver.displayManager.lightdm.enable = true;
+  services.xserver.desktopManager.enlightenment.enable = true;
+
+  # Enable acpid
+  services.acpid.enable = true;
+
+"""
+
+cfglxqt = """  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Enable the LXQT Desktop Environment.
+  services.xserver.displayManager.lightdm.enable = true;
+  services.xserver.desktopManager.lxqt.enable = true;
+
+"""
+
+cfglumina = """  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Enable the Lumina Desktop Environment.
+  services.xserver.displayManager.lightdm.enable = true;
+  services.xserver.desktopManager.lumina.enable = true;
+
+"""
+
+cfgbudgie = """  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Enable the Budgie Desktop environment.
+  services.xserver.displayManager.lightdm.enable = true;
+  services.xserver.desktopManager.budgie.enable = true;
+
+"""
+
+cfgdeepin = """  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Enable the Deepin Desktop Environment.
+  services.xserver.displayManager.lightdm.enable = true;
+  services.xserver.desktopManager.deepin.enable = true;
+
+"""
+
+cfgkeymap = """  # Configure keymap in X11
+  services.xserver.xkb = {
+    layout = "@@kblayout@@";
+    variant = "@@kbvariant@@";
+  };
+
+"""
+cfgconsole = """  # Configure console keymap
+  console.keyMap = "@@vconsole@@";
+
+"""
+
+cfgmisc = """  # Enable CUPS to print documents.
+  services.printing.enable = true;
+
+  # Enable sound with pipewire.
+  services.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    # If you want to use JACK applications, uncomment this
+    #jack.enable = true;
+
+    # use the example session manager (no others are packaged yet so this is enabled by default,
+    # no need to redefine it in your config for now)
+    #media-session.enable = true;
+  };
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+
+"""
+cfgusers = """  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.@@username@@ = {
+    isNormalUser = true;
+    description = "@@fullname@@";
+    extraGroups = [ @@groups@@ ];
+    packages = with pkgs; [@@pkgs@@];
+  };
+
+"""
+
+cfgfirefox = """  # Install firefox.
+  programs.firefox.enable = true;
+
+"""
+
+cfgautologin = """  # Enable automatic login for the user.
+  services.displayManager.autoLogin.enable = true;
+  services.displayManager.autoLogin.user = "@@username@@";
+
+"""
+
+cfgautologingdm = """  # Workaround for GNOME autologin: https://github.com/NixOS/nixpkgs/issues/103746#issuecomment-945091229
+  systemd.services."getty@tty1".enable = false;
+  systemd.services."autovt@tty1".enable = false;
+
+"""
+
+cfgautologintty = """  # Enable automatic login for the user.
+  services.getty.autologinUser = "@@username@@";
+
+"""
+
+cfgunfree = """  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+"""
+
+cfgpkgs = """  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+  #  vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+  #  wget
+  ];
+
+"""
+
+cfgtail = """  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "@@nixosversion@@"; # Did you read the comment?
+
+}
+"""
+
+cfglatestkernel = """  # Use latest kernel.
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+"""
+def env_is_set(name):
+    envValue = os.environ.get(name)
+    return not (envValue is None or envValue == "")
+
+def generateProxyStrings():
+    proxyEnv = []
+    if env_is_set('http_proxy'):
+        proxyEnv.append('http_proxy={}'.format(os.environ.get('http_proxy')))
+    if env_is_set('https_proxy'):
+        proxyEnv.append('https_proxy={}'.format(os.environ.get('https_proxy')))
+    if env_is_set('HTTP_PROXY'):
+        proxyEnv.append('HTTP_PROXY={}'.format(os.environ.get('HTTP_PROXY')))
+    if env_is_set('HTTPS_PROXY'):
+        proxyEnv.append('HTTPS_PROXY={}'.format(os.environ.get('HTTPS_PROXY')))
+
+    if len(proxyEnv) > 0:
+        proxyEnv.insert(0, "env")
+
+    return proxyEnv
+
+def pretty_name():
+    return _("Installing NixOS.")
+
+
+status = pretty_name()
+
+
+def pretty_status_message():
+    return status
+
+
+def catenate(d, key, *values):
+    """
+    Sets @p d[key] to the string-concatenation of @p values
+    if none of the values are None.
+    This can be used to set keys conditionally based on
+    the values being found.
+    """
+    if [v for v in values if v is None]:
+        return
+
+    d[key] = "".join(values)
+
+
+def run():
+    """NixOS Configuration."""
+
+    global status
+    status = _("Configuring NixOS")
+    libcalamares.job.setprogress(0.1)
+
+    ngc_cfg = configparser.ConfigParser()
+    ngc_cfg["Defaults"] = { "Kernel": "lts" }
+    ngc_cfg.read("/etc/nixos-generate-config.conf")
+
+    # Create initial config file
+    cfg = cfghead
+    gs = libcalamares.globalstorage
+    variables = dict()
+
+    # Setup variables
+    root_mount_point = gs.value("rootMountPoint")
+    config = os.path.join(root_mount_point, "etc/nixos/configuration.nix")
+    fw_type = gs.value("firmwareType")
+    bootdev = (
+        "nodev"
+        if gs.value("bootLoader") is None
+        else gs.value("bootLoader")["installPath"]
+    )
+
+    # Pick config parts and prepare substitution
+
+    # Check bootloader
+    if fw_type == "efi":
+        cfg += cfgbootefi
+    elif bootdev != "nodev":
+        cfg += cfgbootbios
+        catenate(variables, "bootdev", bootdev)
+    else:
+        cfg += cfgbootnone
+
+    if ngc_cfg["Defaults"]["Kernel"] == "latest":
+        cfg += cfglatestkernel
+
+    # Setup encrypted swap devices. nixos-generate-config doesn't seem to notice them.
+    for part in gs.value("partitions"):
+        if (
+            part["claimed"] is True
+            and (part["fsName"] == "luks" or part["fsName"] == "luks2")
+            and part["device"] is not None
+            and part["fs"] == "linuxswap"
+        ):
+            cfg += """  boot.initrd.luks.devices."{}".device = "/dev/disk/by-uuid/{}";\n""".format(
+                part["luksMapperName"], part["uuid"]
+            )
+
+    # Check partitions
+    root_is_encrypted = False
+    boot_is_encrypted = False
+    boot_is_partition = False
+
+    for part in gs.value("partitions"):
+        if part["mountPoint"] == "/":
+            root_is_encrypted = part["fsName"] in ["luks", "luks2"]
+        elif part["mountPoint"] == "/boot":
+            boot_is_partition = True
+            boot_is_encrypted = part["fsName"] in ["luks", "luks2"]
+
+    # Setup keys in /boot/crypto_keyfile if using BIOS and Grub cryptodisk
+    if fw_type != "efi" and (
+        (boot_is_partition and boot_is_encrypted)
+        or (root_is_encrypted and not boot_is_partition)
+    ):
+        cfg += cfgbootgrubcrypt
+        status = _("Setting up LUKS")
+        libcalamares.job.setprogress(0.15)
+        try:
+            libcalamares.utils.host_env_process_output(
+                ["mkdir", "-p", root_mount_point + "/boot"], None
+            )
+            libcalamares.utils.host_env_process_output(
+                ["chmod", "0700", root_mount_point + "/boot"], None
+            )
+            # Create /boot/crypto_keyfile.bin
+            libcalamares.utils.host_env_process_output(
+                [
+                    "dd",
+                    "bs=512",
+                    "count=4",
+                    "if=/dev/random",
+                    "of=" + root_mount_point + "/boot/crypto_keyfile.bin",
+                    "iflag=fullblock",
+                ],
+                None,
+            )
+            libcalamares.utils.host_env_process_output(
+                ["chmod", "600", root_mount_point + "/boot/crypto_keyfile.bin"], None
+            )
+        except subprocess.CalledProcessError:
+            libcalamares.utils.error("Failed to create /boot/crypto_keyfile.bin")
+            return (
+                _("Failed to create /boot/crypto_keyfile.bin"),
+                _("Check if you have enough free space on your partition."),
+            )
+
+        for part in gs.value("partitions"):
+            if (
+                part["claimed"] is True
+                and (part["fsName"] == "luks" or part["fsName"] == "luks2")
+                and part["device"] is not None
+            ):
+                cfg += """  boot.initrd.luks.devices."{}".keyFile = "/boot/crypto_keyfile.bin";\n""".format(
+                    part["luksMapperName"]
+                )
+                try:
+                    # Grub currently only supports pbkdf2 for luks2
+                    libcalamares.utils.host_env_process_output(
+                        [
+                            "cryptsetup",
+                            "luksConvertKey",
+                            "--hash",
+                            "sha256",
+                            "--pbkdf",
+                            "pbkdf2",
+                            part["device"],
+                        ],
+                        None,
+                        part["luksPassphrase"],
+                    )
+                    # Add luks drives to /boot/crypto_keyfile.bin
+                    libcalamares.utils.host_env_process_output(
+                        [
+                            "cryptsetup",
+                            "luksAddKey",
+                            "--hash",
+                            "sha256",
+                            "--pbkdf",
+                            "pbkdf2",
+                            part["device"],
+                            root_mount_point + "/boot/crypto_keyfile.bin",
+                        ],
+                        None,
+                        part["luksPassphrase"],
+                    )
+                except subprocess.CalledProcessError:
+                    libcalamares.utils.error(
+                        "Failed to add {} to /boot/crypto_keyfile.bin".format(
+                            part["luksMapperName"]
+                        )
+                    )
+                    return (
+                        _("cryptsetup failed"),
+                        _(
+                            "Failed to add {} to /boot/crypto_keyfile.bin".format(
+                                part["luksMapperName"]
+                            )
+                        ),
+                    )
+
+    status = _("Configuring NixOS")
+    libcalamares.job.setprogress(0.18)
+
+    cfg += cfgnetwork
+    if gs.value("packagechooser_packagechooser") == "enlightenment":
+        cfg += cfgconnman
+    else:
+        cfg += cfgnetworkmanager
+
+    if (
+        (gs.value("packagechooser_packagechooser") == "mate")
+        | (gs.value("packagechooser_packagechooser") == "lxqt")
+        | (gs.value("packagechooser_packagechooser") == "lumina")
+    ):
+        cfg += cfgnmapplet
+
+    if gs.value("hostname") is None:
+        catenate(variables, "hostname", "nixos")
+    else:
+        catenate(variables, "hostname", gs.value("hostname"))
+
+    if gs.value("locationRegion") is not None and gs.value("locationZone") is not None:
+        cfg += cfgtime
+        catenate(
+            variables,
+            "timezone",
+            gs.value("locationRegion"),
+            "/",
+            gs.value("locationZone"),
+        )
+
+    if gs.value("localeConf") is not None:
+        localeconf = gs.value("localeConf")
+        locale = localeconf.pop("LANG").split("/")[0]
+        cfg += cfglocale
+        catenate(variables, "LANG", locale)
+        if (
+            len(set(localeconf.values())) != 1
+            or list(set(localeconf.values()))[0] != locale
+        ):
+            cfg += cfglocaleextra
+            for conf in localeconf:
+                catenate(variables, conf, localeconf.get(conf).split("/")[0])
+
+    # Choose desktop environment
+    if gs.value("packagechooser_packagechooser") == "gnome":
+        cfg += cfggnome
+    elif gs.value("packagechooser_packagechooser") == "plasma6":
+        cfg += cfgplasma6
+    elif gs.value("packagechooser_packagechooser") == "xfce":
+        cfg += cfgxfce
+    elif gs.value("packagechooser_packagechooser") == "pantheon":
+        cfg += cfgpantheon
+    elif gs.value("packagechooser_packagechooser") == "cinnamon":
+        cfg += cfgcinnamon
+    elif gs.value("packagechooser_packagechooser") == "mate":
+        cfg += cfgmate
+    elif gs.value("packagechooser_packagechooser") == "enlightenment":
+        cfg += cfgenlightenment
+    elif gs.value("packagechooser_packagechooser") == "lxqt":
+        cfg += cfglxqt
+    elif gs.value("packagechooser_packagechooser") == "lumina":
+        cfg += cfglumina
+    elif gs.value("packagechooser_packagechooser") == "budgie":
+        cfg += cfgbudgie
+    elif gs.value("packagechooser_packagechooser") == "deepin":
+        cfg += cfgdeepin
+
+    if (
+        gs.value("keyboardLayout") is not None
+        and gs.value("keyboardVariant") is not None
+    ):
+        cfg += cfgkeymap
+        catenate(variables, "kblayout", gs.value("keyboardLayout"))
+        catenate(variables, "kbvariant", gs.value("keyboardVariant"))
+
+        if gs.value("keyboardVConsoleKeymap") is not None:
+            try:
+                subprocess.check_output(
+                    ["pkexec", "loadkeys", gs.value("keyboardVConsoleKeymap").strip()],
+                    stderr=subprocess.STDOUT,
+                )
+                cfg += cfgconsole
+                catenate(
+                    variables, "vconsole", gs.value("keyboardVConsoleKeymap").strip()
+                )
+            except subprocess.CalledProcessError as e:
+                libcalamares.utils.error("loadkeys: {}".format(e.output))
+                libcalamares.utils.error(
+                    "Setting vconsole keymap to {} will fail, using default".format(
+                        gs.value("keyboardVConsoleKeymap").strip()
+                    )
+                )
+        else:
+            kbdmodelmap = open(
+                "/run/current-system/sw/share/systemd/kbd-model-map", "r"
+            )
+            kbd = kbdmodelmap.readlines()
+            out = []
+            for line in kbd:
+                if line.startswith("#"):
+                    continue
+                out.append(line.split())
+            # Find rows with same layout
+            find = []
+            for row in out:
+                if gs.value("keyboardLayout") == row[1]:
+                    find.append(row)
+            if find != []:
+                vconsole = find[0][0]
+            else:
+                vconsole = ""
+            if gs.value("keyboardVariant") is not None:
+                variant = gs.value("keyboardVariant")
+            else:
+                variant = "-"
+            # Find rows with same variant
+            for row in find:
+                if variant in row[3]:
+                    vconsole = row[0]
+                    break
+                # If none found set to "us"
+            if vconsole != "" and vconsole != "us" and vconsole is not None:
+                try:
+                    subprocess.check_output(
+                        ["pkexec", "loadkeys", vconsole], stderr=subprocess.STDOUT
+                    )
+                    cfg += cfgconsole
+                    catenate(variables, "vconsole", vconsole)
+                except subprocess.CalledProcessError as e:
+                    libcalamares.utils.error("loadkeys: {}".format(e.output))
+                    libcalamares.utils.error("vconsole value: {}".format(vconsole))
+                    libcalamares.utils.error(
+                        "Setting vconsole keymap to {} will fail, using default".format(
+                            gs.value("keyboardVConsoleKeymap")
+                        )
+                    )
+
+    if (
+        gs.value("packagechooser_packagechooser") is not None
+        and gs.value("packagechooser_packagechooser") != ""
+    ):
+        cfg += cfgmisc
+
+    if gs.value("username") is not None:
+        fullname = gs.value("fullname")
+        groups = ["networkmanager", "wheel"]
+
+        cfg += cfgusers
+        catenate(variables, "username", gs.value("username"))
+        catenate(variables, "fullname", fullname)
+        catenate(variables, "groups", (" ").join(['"' + s + '"' for s in groups]))
+        if (
+            gs.value("autoLoginUser") is not None
+            and gs.value("packagechooser_packagechooser") is not None
+            and gs.value("packagechooser_packagechooser") != ""
+        ):
+            cfg += cfgautologin
+            if gs.value("packagechooser_packagechooser") == "gnome":
+                cfg += cfgautologingdm
+        elif gs.value("autoLoginUser") is not None:
+            cfg += cfgautologintty
+
+    if gs.value("packagechooser_packagechooser") != "":
+        cfg += cfgfirefox
+
+    # Check if unfree packages are allowed
+    free = True
+    if gs.value("nixos_allow_unfree"):
+        free = False
+        cfg += cfgunfree
+
+    cfg += cfgpkgs
+    # Use firefox as default as a graphical web browser, and add kate to plasma desktop
+    if gs.value("packagechooser_packagechooser") == "plasma6":
+        catenate(
+            variables, "pkgs", "\n      kdePackages.kate\n    #  thunderbird\n    "
+        )
+    elif gs.value("packagechooser_packagechooser") != "":
+        catenate(variables, "pkgs", "\n    #  thunderbird\n    ")
+    else:
+        catenate(variables, "pkgs", "")
+
+    cfg += cfgtail
+    version = ".".join(subprocess.getoutput(["nixos-version"]).split(".")[:2])[:5]
+    catenate(variables, "nixosversion", version)
+
+    # Check that all variables are used
+    for key in variables.keys():
+        pattern = "@@{key}@@".format(key=key)
+        if pattern not in cfg:
+            libcalamares.utils.warning("Variable '{key}' is not used.".format(key=key))
+
+    # Check that all patterns exist
+    variable_pattern = re.compile(r"@@\w+@@")
+    for match in variable_pattern.finditer(cfg):
+        variable_name = cfg[match.start() + 2 : match.end() - 2]
+        if variable_name not in variables:
+            libcalamares.utils.warning(
+                "Variable '{key}' is used but not defined.".format(key=variable_name)
+            )
+
+    # Do the substitutions
+    for key in variables.keys():
+        pattern = "@@{key}@@".format(key=key)
+        cfg = cfg.replace(pattern, str(variables[key]))
+
+    status = _("Generating NixOS configuration")
+    libcalamares.job.setprogress(0.25)
+
+    try:
+        # Generate hardware.nix with mounted swap device
+        subprocess.check_output(
+            ["pkexec", "nixos-generate-config", "--root", root_mount_point],
+            stderr=subprocess.STDOUT,
+        )
+    except subprocess.CalledProcessError as e:
+        if e.output is not None:
+            libcalamares.utils.error(e.output.decode("utf8"))
+        return (_("nixos-generate-config failed"), _(e.output.decode("utf8")))
+
+    # Check for unfree stuff in hardware-configuration.nix
+    hf = open(root_mount_point + "/etc/nixos/hardware-configuration.nix", "r")
+    htxt = hf.read()
+    search = re.search(r"boot\.extraModulePackages = \[ (.*) \];", htxt)
+
+    # Check if any extraModulePackages are defined, and remove if only free packages are allowed
+    if search is not None and free:
+        expkgs = search.group(1).split(" ")
+        for pkg in expkgs:
+            p = ".".join(pkg.split(".")[3:])
+            # Check package p is unfree
+            isunfree = subprocess.check_output(
+                [
+                    "nix-instantiate",
+                    "--eval",
+                    "--strict",
+                    "-E",
+                    "with import <nixpkgs> {{}}; pkgs.linuxKernel.packageAliases.linux_default.{}.meta.unfree".format(
+                        p
+                    ),
+                    "--json",
+                ],
+                stderr=subprocess.STDOUT,
+            )
+            if isunfree == b"true":
+                libcalamares.utils.warning(
+                    "{} is marked as unfree, removing from hardware-configuration.nix".format(
+                        p
+                    )
+                )
+                expkgs.remove(pkg)
+        hardwareout = re.sub(
+            r"boot\.extraModulePackages = \[ (.*) \];",
+            "boot.extraModulePackages = [ {}];".format(
+                "".join(map(lambda x: x + " ", expkgs))
+            ),
+            htxt,
+        )
+        # Write the hardware-configuration.nix file
+        libcalamares.utils.host_env_process_output(
+            [
+                "cp",
+                "/dev/stdin",
+                root_mount_point + "/etc/nixos/hardware-configuration.nix",
+            ],
+            None,
+            hardwareout,
+        )
+
+    # Write the configuration.nix file
+    libcalamares.utils.host_env_process_output(["cp", "/dev/stdin", config], None, cfg)
+
+    status = _("Installing NixOS")
+    libcalamares.job.setprogress(0.3)
+
+    # build nixos-install command
+    nixosInstallCmd = [ "pkexec" ]
+    nixosInstallCmd.extend(generateProxyStrings())
+    nixosInstallCmd.extend(
+        [
+            "nixos-install",
+            "--no-root-passwd",
+            "--root",
+            root_mount_point
+        ]
+    )
+
+    # Install customizations
+    try:
+        output = ""
+        proc = subprocess.Popen(
+            nixosInstallCmd,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT
+        )
+        while True:
+            line = proc.stdout.readline().decode("utf-8")
+            output += line
+            libcalamares.utils.debug("nixos-install: {}".format(line.strip()))
+            if not line:
+                break
+        exit = proc.wait()
+        if exit != 0:
+            return (_("nixos-install failed"), _(output))
+    except:
+        return (_("nixos-install failed"), _("Installation failed to complete"))
+
+    return None
@@ -0,0 +1,5 @@
+---
+type:       "job"
+name:       "nixos"
+interface:  "python"
+script:     "main.py"
@@ -0,0 +1,30 @@
+{
+  lib,
+  runCommand,
+  makeWrapper,
+  calamares,
+  calamares-nixos-extensions,
+}:
+runCommand "calamares-wrapped"
+  {
+    inherit (calamares) version meta;
+
+    nativeBuildInputs = [ makeWrapper ];
+  }
+  ''
+    mkdir -p $out/bin
+
+    cd ${calamares}
+
+    for i in *; do
+      if [ "$i" == "bin" ]; then
+        continue
+      fi
+      ln -s ${calamares}/$i $out/$i
+    done
+
+    makeWrapper ${lib.getExe calamares} $out/bin/calamares \
+      --prefix XDG_DATA_DIRS : ${calamares-nixos-extensions}/share \
+      --prefix XDG_CONFIG_DIRS : ${calamares-nixos-extensions}/etc \
+      --add-flag --xdg-config
+  ''
@@ -1,20 +1,8 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Victor Fuentes <vmfuentes64@gmail.com>
-Date: Thu, 1 Aug 2024 15:53:16 -0400
-Subject: [PATCH] Modifies the users module to only set passwords of user and
- root
-
-as the users will have already been created in the configuration.nix
-file
---
- src/modules/users/Config.cpp | 15 ---------------
- 1 file changed, 15 deletions(-)
-
 diff --git a/src/modules/users/Config.cpp b/src/modules/users/Config.cpp
-index cd56bc3e2..9b09b36cd 100644
+index be754774b..4b0513df0 100644
 --- a/src/modules/users/Config.cpp
 +++ b/src/modules/users/Config.cpp
-@@ -1028,12 +1028,6 @@ Config::createJobs() const
+@@ -1069,12 +1069,6 @@ Config::createJobs() const
 
     Calamares::Job* j;
 
@@ -27,7 +15,7 @@ index cd56bc3e2..9b09b36cd 100644
     if ( getActiveDirectoryUsed() )
     {
         j = new ActiveDirectoryJob( m_activeDirectoryAdminUsername,
-@@ -1043,20 +1037,11 @@ Config::createJobs() const
+@@ -1084,20 +1078,11 @@ Config::createJobs() const
         jobs.append( Calamares::job_ptr( j ) );
     }
 
@@ -0,0 +1,33 @@
+diff --git a/src/libcalamares/GlobalStorage.h b/src/libcalamares/GlobalStorage.h
+index 37ea332d2..b9e629350 100644
+--- a/src/libcalamares/GlobalStorage.h
+++ b/src/libcalamares/GlobalStorage.h
+@@ -56,13 +56,6 @@ public:
+      */
+     explicit GlobalStorage( QObject* parent = nullptr );
+ 
+-    /** @brief Insert a key and value into the store
+-     *
+-     * The @p value is added to the store with key @p key. If @p key
+-     * already exists in the store, its existing value is overwritten.
+-     * The changed() signal is emitted regardless.
+-     */
+-    void insert( const QString& key, const QVariant& value );
+     /** @brief Removes a key and its value
+      *
+      * The @p key is removed from the store. If the @p key does not
+@@ -123,6 +116,14 @@ public:
+     QVariantMap data() const { return m; }
+ 
+ public Q_SLOTS:
+    /** @brief Insert a key and value into the store
+     *
+     * The @p value is added to the store with key @p key. If @p key
+     * already exists in the store, its existing value is overwritten.
+     * The changed() signal is emitted regardless.
+     */
+    void insert( const QString& key, const QVariant& value );
+
+     /** @brief Does the store contain the given key?
+      *
+      * This can distinguish an explicitly-inserted QVariant() from
@@ -0,0 +1,135 @@
+{
+  lib,
+  stdenv,
+
+  writeShellScriptBin,
+  xdg-utils,
+
+  fetchFromGitea,
+
+  cmake,
+  ninja,
+  kdePackages,
+  qt6,
+
+  libpwquality,
+  libxcrypt,
+  parted,
+  yaml-cpp,
+
+  tzdata,
+  ckbcomp,
+  util-linux,
+  os-prober,
+  xkeyboard_config,
+
+  # passthru.tests
+  calamares-nixos,
+}:
+
+let
+  # drop privileges so we can launch browsers, etc;
+  # force going through the portal so we get the right environment
+  xdg-open-nixos = writeShellScriptBin "xdg-open" ''
+    sudo --user $(id -nu $PKEXEC_UID) env NIXOS_XDG_OPEN_USE_PORTAL=1 ${xdg-utils}/bin/xdg-open "$@"
+  '';
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "calamares";
+  version = "3.4.0";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "Calamares";
+    repo = "calamares";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Qk+GnonuEWK3hXjmwxf9awgxr6dGunShJgwmkT78qKM=";
+  };
+
+  patches = [
+    # Don't allow LUKS in manual partitioning
+    # FIXME: this really needs to be fixed on the module end
+    ./dont-allow-manual-luks.patch
+
+    # Don't create users - they're already created by the installer
+    # FIXME: upstream this?
+    ./dont-create-users.patch
+
+    # Allow QML to write to GlobalStorage
+    # FIXME: upstream this
+    ./let-qml-write-to-global-storage.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    kdePackages.extra-cmake-modules
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    kdePackages.kcoreaddons
+    kdePackages.kcrash
+    kdePackages.kpackage
+    kdePackages.kparts
+    kdePackages.kpmcore
+    kdePackages.kservice
+    kdePackages.libplasma
+    libpwquality
+    libxcrypt
+    parted
+    kdePackages.polkit-qt-1
+    qt6.qtbase
+    qt6.qttools
+    yaml-cpp
+  ];
+
+  postPatch = ''
+    # this is called via pkexec, which does not resolve symlinks, so the policy
+    # needs to point at the symlinked path
+    substituteInPlace io.calamares.calamares.policy \
+      --replace-fail /usr/bin/calamares /run/current-system/sw/bin/calamares
+
+    substituteInPlace src/modules/locale/SetTimezoneJob.cpp src/libcalamares/locale/TimeZone.cpp \
+      --replace-fail /usr/share/zoneinfo ${tzdata}/share/zoneinfo
+
+    substituteInPlace src/modules/keyboard/keyboardwidget/keyboardglobal.cpp \
+      --replace-fail /usr/share/X11/xkb/rules/base.lst ${xkeyboard_config}/share/X11/xkb/rules/base.lst
+
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "\''${POLKITQT-1_POLICY_FILES_INSTALL_DIR}" "$out/share/polkit-1/actions"
+  '';
+
+  separateDebugInfo = true;
+
+  qtWrapperArgs = [
+    "--prefix PATH : ${
+      lib.makeBinPath [
+        ckbcomp
+        os-prober
+        util-linux
+        xdg-open-nixos
+      ]
+    }"
+  ];
+
+  passthru.tests = {
+    inherit calamares-nixos;
+  };
+
+  meta = with lib; {
+    description = "Distribution-independent installer framework";
+    homepage = "https://calamares.io/";
+    license = with licenses; [
+      gpl3Plus
+      bsd2
+      cc0
+    ];
+    maintainers = with maintainers; [
+      manveru
+      vlinkz
+    ];
+    platforms = platforms.linux;
+    mainProgram = "calamares";
+  };
+})
@@ -6,13 +6,13 @@
  "packages": {
    "": {
      "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.72"
+        "@anthropic-ai/claude-code": "^1.0.73"
      }
    },
    "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.72",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.72.tgz",
-      "integrity": "sha512-nA/l/xKX4sgOE0Y6P3o6czNGQqlyqJPjs9CHFxantsmyKvOot9VlRW4AiEAn42hQrZReCXeSnt8LOMx9ev7Erg==",
+      "version": "1.0.73",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.73.tgz",
+      "integrity": "sha512-UVBkta/BWy49xR9fgi/Oy2tl7p/k+lOCinv21zSK/E9KB4JObAAZ1BAOWteu4fhv7gs3Ipfev5r6yo3OplmwNg==",
      "license": "SEE LICENSE IN README.md",
      "bin": {
        "claude": "cli.js"
@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "claude-code";
-  version = "1.0.72";
+  version = "1.0.73";

  nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin

  src = fetchzip {
    url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-1vIElqZ5sk62o1amdfOqhmSG4B5wzKWDLcCgvQO4a5o=";
+    hash = "sha256-DdNMgKiGA4NjBAqes3hsWLouvcgtDDFnBWdNGpRgSV4=";
  };

-  npmDepsHash = "sha256-LkQf2lW6TM1zRr10H7JgtnE+dy0CE7WCxF4GhTd4GT4=";
+  npmDepsHash = "sha256-PYACkrv/8d4StNaM6QYaIgjrD6rL0N6cc08wagcga+A=";

  postPatch = ''
    cp ${./package-lock.json} package-lock.json
@@ -9,15 +9,17 @@

 buildGoModule (finalAttrs: {
  pname = "crush";
-  version = "0.2.1";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "charmbracelet";
    repo = "crush";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-SjrkQFSjJrPNynARE92uKA53hkstIUBSvQbqcYSsnaM=";
+    hash = "sha256-u2w19Xmcm3cx/B8QRNGaP2qeg+Cif/L92RNlJav6H3w=";
  };

+  vendorHash = "sha256-H92TgZoWdYQ863AAb2116zJtmgkKXh2hRoEBRcn5zeA=";
+
  # rename TestMain to prevent it from running, as it panics in the sandbox.
  postPatch = ''
    substituteInPlace internal/llm/provider/openai_test.go \
@@ -26,8 +28,6 @@ buildGoModule (finalAttrs: {
        "func DisabledTestMain"
  '';

-  vendorHash = "sha256-aI3MSaQYUOLJxBxwCoVg13HpxK46q6ZITrw1osx5tiE=";
-
  ldflags = [
    "-s"
    "-X=github.com/charmbracelet/crush/internal/version.Version=${finalAttrs.version}"
@@ -10,13 +10,13 @@

 buildGoModule (finalAttrs: {
  pname = "cue";
-  version = "0.14.0";
+  version = "0.14.1";

  src = fetchFromGitHub {
    owner = "cue-lang";
    repo = "cue";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rQsFMBREmXnJP1vTr+mz1720nVI0oxvDYEuQtibL79g=";
+    hash = "sha256-U/Cptda+2UIDIxuStNYAwZABlNdkS723TnoixVlvS4k=";
  };

  vendorHash = "sha256-hV5LO9R854YuazzS6VkxoY64h3+JboBgEDRWAoWats8=";
@@ -23,13 +23,13 @@ let
 in
 buildDartApplication rec {
  pname = "dart-sass";
-  version = "1.89.2";
+  version = "1.90.0";

  src = fetchFromGitHub {
    owner = "sass";
    repo = "dart-sass";
    tag = version;
-    hash = "sha256-IDR00pxEKQ5DQM+q0P/iRnsH80ZUbokZhbnBoomy2oQ=";
+    hash = "sha256-ChHaFjuEhDpx2MVbsNNrFIg7LQ6tY/9BsWSF3MFofN0=";
  };

  pubspecLock = lib.importJSON ./pubspec.lock.json;
@@ -4,21 +4,21 @@
      "dependency": "transitive",
      "description": {
        "name": "_fe_analyzer_shared",
-        "sha256": "e55636ed79578b9abca5fecf9437947798f5ef7456308b5cb85720b793eac92f",
+        "sha256": "da0d9209ca76bde579f2da330aeb9df62b6319c834fa7baae052021b0462401f",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "82.0.0"
+      "version": "85.0.0"
    },
    "analyzer": {
      "dependency": "direct dev",
      "description": {
        "name": "analyzer",
-        "sha256": "904ae5bb474d32c38fb9482e2d925d5454cda04ddd0e55d2e6826bc72f6ba8c0",
+        "sha256": "974859dc0ff5f37bc4313244b3218c791810d03ab3470a579580279ba971a48d",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "7.4.5"
+      "version": "7.7.1"
    },
    "archive": {
      "dependency": "direct dev",
@@ -144,11 +144,11 @@
      "dependency": "transitive",
      "description": {
        "name": "coverage",
-        "sha256": "aa07dbe5f2294c827b7edb9a87bba44a9c15a3cc81bc8da2ca19b37322d30080",
+        "sha256": "5da775aa218eaf2151c721b16c01c7676fbfdd99cebba2bf64e8b807a28ff94d",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.14.1"
+      "version": "1.15.0"
    },
    "crypto": {
      "dependency": "direct dev",
@@ -174,11 +174,21 @@
      "dependency": "transitive",
      "description": {
        "name": "dart_mappable",
-        "sha256": "2255b2c00e328a65fef5a8df2dabfc0dc9c2e518c33a50051a4519b1c7a28c48",
+        "sha256": "15f41a35da8ee690bbfa0059fa241edeeaea73f89a2ba685b354ece07cd8ada6",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "4.5.0"
+      "version": "4.6.0"
+    },
+    "dart_style": {
+      "dependency": "transitive",
+      "description": {
+        "name": "dart_style",
+        "sha256": "8a0e5fba27e8ee025d2ffb4ee820b4e6e2cf5e4246a6b1a477eb66866947e0bb",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.1.1"
    },
    "dartdoc": {
      "dependency": "direct dev",
@@ -264,11 +274,11 @@
      "dependency": "direct main",
      "description": {
        "name": "http",
-        "sha256": "2c11f3f94c687ee9bad77c171151672986360b2b001d109814ee7140b2cf261b",
+        "sha256": "bb2ce4590bc2667c96f318d68cac1b5a7987ec819351d32b1c987239a815e007",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.4.0"
+      "version": "1.5.0"
    },
    "http_multi_server": {
      "dependency": "transitive",
@@ -474,21 +484,21 @@
      "dependency": "direct main",
      "description": {
        "name": "protobuf",
-        "sha256": "579fe5557eae58e3adca2e999e38f02441d8aa908703854a9e0a0f47fa857731",
+        "sha256": "6153efcc92a06910918f3db8231fd2cf828ac81e50ebd87adc8f8a8cb3caff0e",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "4.1.0"
+      "version": "4.1.1"
    },
    "protoc_plugin": {
      "dependency": "direct dev",
      "description": {
        "name": "protoc_plugin",
-        "sha256": "32fbf4ac1b1a7263440898c9011209c3a13c9063f326ef78da83734e6f992ff3",
+        "sha256": "5bf4289e0fa9eec4b0ee4e77111fa47fa2e6b54b2a7b9c2e83ec87a971542f01",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "22.3.0"
+      "version": "22.5.0"
    },
    "pub_api_client": {
      "dependency": "direct dev",
@@ -654,31 +664,31 @@
      "dependency": "direct dev",
      "description": {
        "name": "test",
-        "sha256": "65e29d831719be0591f7b3b1a32a3cda258ec98c58c7b25f7b84241bc31215bb",
+        "sha256": "75906bf273541b676716d1ca7627a17e4c4070a3a16272b7a3dc7da3b9f3f6b7",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.26.2"
+      "version": "1.26.3"
    },
    "test_api": {
      "dependency": "transitive",
      "description": {
        "name": "test_api",
-        "sha256": "522f00f556e73044315fa4585ec3270f1808a4b186c936e612cab0b565ff1e00",
+        "sha256": "ab2726c1a94d3176a45960b6234466ec367179b87dd74f1611adb1f3b5fb9d55",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.7.6"
+      "version": "0.7.7"
    },
    "test_core": {
      "dependency": "transitive",
      "description": {
        "name": "test_core",
-        "sha256": "80bf5a02b60af04b09e14f6fe68b921aad119493e26e490deaca5993fef1b05a",
+        "sha256": "0cc24b5ff94b38d2ae73e1eb43cc302b77964fbf67abad1e296025b78deb53d0",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.6.11"
+      "version": "0.6.12"
    },
    "test_descriptor": {
      "dependency": "direct dev",
@@ -77,6 +77,11 @@ stdenv.mkDerivation (
      runHook postConfigure
    '';

+    # Workaround for darwin sandbox build failure: "Error: listen EPERM: operation not permitted ..tsx..."
+    preBuild = lib.optionalString stdenv.hostPlatform.isDarwin ''
+      export TMPDIR="$(mktemp -d)"
+    '';
+
    buildPhase = ''
      runHook preBuild

@@ -30,19 +30,19 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fractal";
-  version = "11.2";
+  version = "12";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "fractal";
    tag = finalAttrs.version;
-    hash = "sha256-UE0TRC9DeP+fl85fzuQ8/3ioIPdeSqsJWnW1olB1gmo=";
+    hash = "sha256-galaFpHcWrN+jQ6uOS78EB6wjfR8KIBLZvKmH7Rb1Xs=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) src;
-    hash = "sha256-I+1pGZWxn9Q/CL8D6VxsaO3H4EdBek4wyykvNgCNRZI=";
+    hash = "sha256-DuEuCvhwulDHVCmUPXcM6PZ34nueRmKYHYffSsFCbLE=";
  };

  patches = [
@@ -7,13 +7,13 @@

 buildNpmPackage (finalAttrs: {
  pname = "hypercore";
-  version = "11.11.2";
+  version = "11.12.1";

  src = fetchFromGitHub {
    owner = "holepunchto";
    repo = "hypercore";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-vDI1j5seR6OBp64wq9oy4eVrtlJF7OCiQb+2EEdOGXw=";
+    hash = "sha256-AhmOT+ehyfut8QkwbcdHITOrWKfLPsjDx9zjBv9xeB4=";
  };

  npmDepsHash = "sha256-ZJxVmQWKgHyKkuYfGIlANXFcROjI7fibg6mxIhDZowM=";
@@ -19,8 +19,8 @@
      "version": "1.137.3"
    },
    "geonames": {
-      "timestamp": "20250801182552",
-      "hash": "sha256-jfC/FgfeSz1tdtYc1EqQ/HJw5LlYQSyGntPuXv24JVY="
+      "timestamp": "20250812073904",
+      "hash": "sha256-1ZvFkaNdG5s25YwP5CsblvIFT4rlvNrCBiPNR+lAPTQ="
    }
  }
 }
@@ -0,0 +1,38 @@
+{
+  lib,
+  llvmPackages,
+  python3,
+}:
+let
+  inherit (llvmPackages) clang-unwrapped;
+in
+python3.pkgs.buildPythonApplication rec {
+  pname = "intercept-build";
+  inherit (clang-unwrapped) version;
+
+  format = "other";
+
+  src = clang-unwrapped + "/bin";
+
+  dontUnpack = true;
+
+  dependencies = with python3.pkgs; [
+    libscanbuild
+  ];
+
+  installPhase = ''
+    mkdir -p "$out/bin"
+    install "$src/intercept-build" "$out/bin"
+  '';
+
+  meta = {
+    description = "intercepts the build process to generate a compilation database";
+    homepage = "https://github.com/llvm/llvm-project/tree/llvmorg-${version}/clang/tools/scan-build-py/";
+    mainProgram = "intercept-build";
+    license = with lib.licenses; [
+      asl20
+      llvm-exception
+    ];
+    maintainers = with lib.maintainers; [ RossSmyth ];
+  };
+}
@@ -7,15 +7,15 @@

 buildGoModule rec {
  pname = "istioctl";
-  version = "1.26.3";
+  version = "1.27.0";

  src = fetchFromGitHub {
    owner = "istio";
    repo = "istio";
    rev = version;
-    hash = "sha256-GWhG3FV9CLhy+IBJSKjf6FOzvex0xI62+7dmZz/lASg=";
+    hash = "sha256-Rehzwr/6S1c3kzqyJIIvLO3jDTSSrkyb2HHcUn9Tco8=";
  };
-  vendorHash = "sha256-P6h/cIJ3mCHJZEceEB2CDutftwh5Saie9oxmF3TXbdo=";
+  vendorHash = "sha256-AAWGfNRAgR/Vr3VDMphOPah8a02czsf8fpWi2aeG1Jo=";

  nativeBuildInputs = [ installShellFiles ];

@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+  xorg,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "kirsch";
+  version = "0.6.1";
+
+  src = fetchzip {
+    url = "https://github.com/molarmanful/kirsch/releases/download/v${finalAttrs.version}/kirsch-release_v${finalAttrs.version}.zip";
+    hash = "sha256-6POi3N1JX6FFWHwqOlB3mrkHMYG+TJXz9URarbSPrZw=";
+  };
+
+  nativeBuildInputs = [ xorg.mkfontscale ];
+
+  installPhase = ''
+    runHook preInstall
+
+    misc="$out/share/fonts/misc"
+    install -D -m 644 *.{bdf,otb,pcf} -t "$misc"
+    install -D -m 644 *.ttf -t "$out/share/fonts/truetype"
+
+    # create fonts.dir so NixOS xorg module adds to fp
+    mkfontdir "$misc"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Versatile bitmap font with an organic flair";
+    homepage = "https://github.com/molarmanful/kirsch";
+    changelog = "https://github.com/molarmanful/kirsch/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [
+      ejiektpobehuk
+    ];
+  };
+})
@@ -41,13 +41,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "koboldcpp";
-  version = "1.96.2";
+  version = "1.97.4";

  src = fetchFromGitHub {
    owner = "LostRuins";
    repo = "koboldcpp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-OSAFJ2z6vSTTOovgcF/TZvug51uydmZmkjamN/xv2dc=";
+    hash = "sha256-z9F3q+1iq6HQV37yRjBOlJRChhnQ/cPP5sAZl5rFDUs=";
  };

  enableParallelBuilding = true;
@@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "kubevirt";
-  version = "1.5.2";
+  version = "1.6.0";

  src = fetchFromGitHub {
    owner = "kubevirt";
    repo = "kubevirt";
    rev = "v${version}";
-    hash = "sha256-R01kW6mS1Ce3oi3p6RFVXif/BybM9HlbL2WT9b5wJuE=";
+    hash = "sha256-vPlQ03AR44UVlRkZe34ZhdhBInZloOeEgjHXq7RC5Lw=";
  };

  vendorHash = null;
@@ -14,11 +14,11 @@

 stdenv.mkDerivation rec {
  pname = "libmediainfo";
-  version = "25.04";
+  version = "25.07.1";

  src = fetchurl {
    url = "https://mediaarea.net/download/source/libmediainfo/${version}/libmediainfo_${version}.tar.xz";
-    hash = "sha256-rUXtfJ23gHqoA4RcqIutlSaqjaiDpYEn5TkKqi2Bu7E=";
+    hash = "sha256-jm6S8gzyynzoq6U60LWJqJovp9/T55cdOFAQms1JvtU=";
  };

  nativeBuildInputs = [
@@ -4,6 +4,8 @@
  makeDesktopItem,
  lib,
  xorg,
+  wayland,
+  wayland-protocols,
 }:
 let
  pname = "LycheeSlicer";
@@ -18,7 +20,7 @@ let
    name = "Lychee Slicer";
    genericName = "Resin Slicer";
    comment = "All-in-one 3D slicer for Resin and Filament";
-    desktopName = "Lychee";
+    desktopName = "LycheeSlicer";
    noDisplay = false;
    exec = "lychee";
    terminal = false;
@@ -39,16 +41,21 @@ appimageTools.wrapType2 {
    install -Dm444 -t $out/share/applications ${desktopItem}/share/applications/*
  '';

-  extraLibraries = [
+  extraPkgs = _: [
    xorg.libxshmfence
+    wayland
+    wayland-protocols
  ];

  meta = {
    description = "All-in-one 3D slicer for resin and FDM printers";
    homepage = "https://lychee.mango3d.io/";
    license = lib.licenses.unfree;
-    maintainers = with lib.maintainers; [ tarinaky ];
+    maintainers = with lib.maintainers; [
+      tarinaky
+      ZachDavies
+    ];
    platforms = [ "x86_64-linux" ];
-    mainProgram = "lychee";
+    mainProgram = "LycheeSlicer";
  };
 }
@@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "mtxclient";
-  version = "0.10.0";
+  version = "0.10.1";

  src = fetchFromGitHub {
    owner = "Nheko-Reborn";
    repo = "mtxclient";
    rev = "v${version}";
-    hash = "sha256-luWcbYCv5OM3aidxiO7glqD+VYnCZMElZYaPKbtvMYI=";
+    hash = "sha256-Y0FMCq4crSbm0tJtYq04ZFwWw+vlfxXKXBo0XUgf7hw=";
  };

  postPatch = ''
@@ -17,19 +17,19 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "n8n";
-  version = "1.104.1";
+  version = "1.105.3";

  src = fetchFromGitHub {
    owner = "n8n-io";
    repo = "n8n";
    tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-/GrpcJU94NqeTAcXVGWG+NamS28cLxKDSr6M4sF6Els=";
+    hash = "sha256-IsAazA4DCkcOE5lNbxNMYgWAZycwjLYneSFBLAhltac=";
  };

  pnpmDeps = pnpm_10.fetchDeps {
    inherit (finalAttrs) pname version src;
    fetcherVersion = 1;
-    hash = "sha256-UhCwZPthRZSF5ZLFLc5SgG5EZeFySnCRLqGRbc+3F/U=";
+    hash = "sha256-maKD03Gr1gGUQwvTk35kv89a9TvzsIeKqI9NjjTO1TQ=";
  };

  nativeBuildInputs = [
@@ -26,13 +26,13 @@

 stdenv.mkDerivation rec {
  pname = "nheko";
-  version = "0.12.0";
+  version = "0.12.1";

  src = fetchFromGitHub {
    owner = "Nheko-Reborn";
    repo = "nheko";
    rev = "v${version}";
-    hash = "sha256-hQb+K8ogNj/s6ZO2kgS/sZZ35y4CwMeS3lVeMYNucYQ=";
+    hash = "sha256-WlWxe4utRSc9Tt2FsnhBwxzQsoDML2hvm3g5zRnDEiU=";
  };

  nativeBuildInputs = [
@@ -89,9 +89,8 @@ not possible to fix, please open an issue and we can discuss a solution.
  your password wrong, it will fail during activation (this can be improved
  though)
 - When `--build-host` and `--target-host` are used together, we will use `nix
-  copy` (or 2 `nix-copy-closure` if you're using Nix <2.18) instead of SSH'ing
-  to build host and using `nix-copy-closure --to target-host`. The reason for
-  this is documented in PR
+  copy` instead of SSH'ing to build host and using
+  `nix-copy-closure --to target-host`. The reason for this is documented in PR
  [#364698](https://github.com/NixOS/nixpkgs/pull/364698). If you do need the
  previous behavior, you can simulate it using `ssh build-host --
  nixos-rebuild-ng switch --target-host target-host`. If that is not the case,
@@ -119,7 +118,7 @@ not possible to fix, please open an issue and we can discuss a solution.
  and there was a need to bootstrap a new version of Nix before evaluating the
  configuration (otherwise the new Nixpkgs version may have code that is only
  compatible with a newer version of Nix). Nixpkgs now has a policy to be
-  compatible with Nix 2.3, and even if this is bumped as long we don't do
+  compatible with Nix 2.18, and even if this is bumped as long we don't do
  drastic minimum version changes this should not be an issue. Also, the daemon
  itself always run with the previous version since even we can replace Nix in
  `PATH` (so Nix client), but we can't replace the daemon without switching to
@@ -251,10 +251,10 @@ It must be one of the following:

 *--use-substitutes*
 	When set, nixos-rebuild will add *--use-substitutes* to each invocation
-	of _nix-copy-closure_/_nix copy_. This will only affect the behavior of
-	nixos-rebuild if *--target-host* or *--build-host* is also set. This is
-	useful when the target-host connection to cache.nixos.org is faster than
-	the connection between hosts.
+	of _nix copy_. This will only affect the behavior of nixos-rebuild if
+	*--target-host* or *--build-host* is also set. This is useful when the
+	target-host connection to cache.nixos.org is faster than the connection
+	between hosts.

 *--sudo*
 	When set, *nixos-rebuild* prefixes activation commands with sudo.
@@ -15,13 +15,6 @@
  # Very long tmp dirs lead to "too long for Unix domain socket"
  # SSH ControlPath errors. Especially macOS sets long TMPDIR paths.
  withTmpdir ? if stdenv.hostPlatform.isDarwin then "/tmp" else null,
-  # This version is kind of arbitrary, we use some features that were
-  # implemented in newer versions of Nix, but not necessary 2.18.
-  # However, Lix is a fork of Nix 2.18, so this looks like a good version
-  # to cut specific functionality.
-  # ATTN: This currently doesn't disambiguate between Nix and Lix, so using this
-  # in a conditional needs careful checking against both Nix implementations.
-  withNix218 ? lib.versionAtLeast nix.version "2.18",
  # passthru.tests
  nixosTests,
  nixVersions,
@@ -62,7 +55,6 @@ python3Packages.buildPythonApplication rec {
  postPatch = ''
    substituteInPlace nixos_rebuild/constants.py \
      --subst-var-by executable ${executable} \
-      --subst-var-by withNix218 ${lib.boolToString withNix218} \
      --subst-var-by withReexec ${lib.boolToString withReexec} \
      --subst-var-by withShellFiles ${lib.boolToString withShellFiles}

@@ -121,9 +113,9 @@ python3Packages.buildPythonApplication rec {
        with_nix_stable = nixos-rebuild-ng.override {
          nix = nixVersions.stable;
        };
-        with_nix_2_3 = nixos-rebuild-ng.override {
-          # oldest / minimum supported version in nixpkgs
-          nix = nixVersions.nix_2_3;
+        with_nix_2_24 = nixos-rebuild-ng.override {
+          # oldest supported version in nixpkgs
+          nix = nixVersions.nix_2_24;
        };
        with_lix_latest = nixos-rebuild-ng.override {
          nix = lixPackageSets.latest.lix;
@@ -6,7 +6,7 @@ from subprocess import CalledProcessError, run
 from typing import Final, assert_never

 from . import nix, services
-from .constants import EXECUTABLE, WITH_NIX_2_18, WITH_REEXEC, WITH_SHELL_FILES
+from .constants import EXECUTABLE, WITH_REEXEC, WITH_SHELL_FILES
 from .models import Action, BuildAttr, Flake, Profile
 from .process import Remote
 from .utils import LogFormatter
@@ -270,9 +270,6 @@ def parse_args(
 def execute(argv: list[str]) -> None:
    args, args_groups = parse_args(argv)

-    if not WITH_NIX_2_18:
-        logger.warning("you're using Nix <2.18, some features will not work correctly")
-
    common_flags = vars(args_groups["common_flags"])
    common_build_flags = common_flags | vars(args_groups["common_build_flags"])
    build_flags = common_build_flags | vars(args_groups["classic_build_flags"])
@@ -6,6 +6,5 @@ from typing import Final
 EXECUTABLE: Final[str] = "@executable@"
 # Use either `== "true"` if the default (e.g.: `python -m nixos_rebuild`) is
 # `False` or `!= "false"` if the default is `True`
-WITH_NIX_2_18: Final[bool] = "@withNix218@" != "false"
 WITH_REEXEC: Final[bool] = "@withReexec@" == "true"
 WITH_SHELL_FILES: Final[bool] = "@withShellFiles@" == "true"
@@ -13,7 +13,6 @@ from textwrap import dedent
 from typing import Final, Literal

 from . import tmpdir
-from .constants import WITH_NIX_2_18
 from .models import (
    Action,
    BuildAttr,
@@ -228,18 +227,7 @@ def copy_closure(
        case (Remote(_) as host, None) | (None, Remote(_) as host):
            nix_copy_closure(host, to=bool(to_host))
        case (Remote(_), Remote(_)):
-            if WITH_NIX_2_18:
-                # With newer Nix, use `nix copy` instead of `nix-copy-closure`
-                # since it supports `--to` and `--from` at the same time
-                # TODO: once we drop Nix 2.3 from nixpkgs, remove support for
-                # `nix-copy-closure`
-                nix_copy(to_host, from_host)
-            else:
-                # With older Nix, we need to copy from to local and local to
-                # host. This means it is slower and need additional disk space
-                # in local
-                nix_copy_closure(from_host, to=False)
-                nix_copy_closure(to_host, to=True)
+            nix_copy(to_host, from_host)


 def edit() -> None:
@@ -10,7 +10,6 @@ from unittest.mock import ANY, Mock, call, patch
 import pytest

 import nixos_rebuild as nr
-from nixos_rebuild.constants import WITH_NIX_2_18

 from .helpers import get_qualified_name

@@ -450,10 +449,6 @@ def test_execute_nix_switch_flake(mock_run: Mock, tmp_path: Path) -> None:
@patch("subprocess.run", autospec=True)
@patch("uuid.uuid4", autospec=True)
@patch(get_qualified_name(nr.services.cleanup_ssh), autospec=True)
-@pytest.mark.skipif(
-    not WITH_NIX_2_18,
-    reason="Tests internal logic based on the assumption that Nix >= 2.18",
-)
 def test_execute_nix_switch_build_target_host(
    mock_cleanup_ssh: Mock,
    mock_uuid4: Mock,
@@ -254,7 +254,6 @@ def test_copy_closure(monkeypatch: MonkeyPatch) -> None:
        )

    monkeypatch.setenv("NIX_SSHOPTS", "--ssh build-target-opt")
-    monkeypatch.setattr(n, "WITH_NIX_2_18", True)
    extra_env = {
        "NIX_SSHOPTS": " ".join([*p.SSH_DEFAULT_OPTS, "--ssh build-target-opt"])
    }
@@ -276,22 +275,6 @@ def test_copy_closure(monkeypatch: MonkeyPatch) -> None:
            extra_env=extra_env,
        )

-    monkeypatch.setattr(n, "WITH_NIX_2_18", False)
-    with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
-        n.copy_closure(closure, target_host, build_host)
-        mock_run.assert_has_calls(
-            [
-                call(
-                    ["nix-copy-closure", "--from", "user@build.host", closure],
-                    extra_env=extra_env,
-                ),
-                call(
-                    ["nix-copy-closure", "--to", "user@target.host", closure],
-                    extra_env=extra_env,
-                ),
-            ]
-        )
-

@patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 def test_edit(mock_run: Mock, monkeypatch: MonkeyPatch, tmpdir: Path) -> None:
@@ -9,16 +9,16 @@

 buildNpmPackage (finalAttrs: {
  pname = "node-core-utils";
-  version = "5.14.1";
+  version = "5.15.0";

  src = fetchFromGitHub {
    owner = "nodejs";
    repo = "node-core-utils";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-F+WMwyMw4cgGevcgi7vUkboXjZmBpPKsTUDvM6NHr0o=";
+    hash = "sha256-yY3EGSBdMpvUIq8UgeEcAm1RIaaNtZxCVp6TlycYjoY=";
  };

-  npmDepsHash = "sha256-fMWb17t+ARJYsA7DgEBDY3vfbLrrCQiECRy947I90uI=";
+  npmDepsHash = "sha256-VIkJHEGlJqweNVkx3WfLMiDOQRSPtwpJBfJ3vKHv4YM=";

  dontNpmBuild = true;
  dontNpmPrune = true;
@@ -14,13 +14,13 @@ assert

 buildGoModule (finalAttrs: {
  pname = "open-policy-agent";
-  version = "1.6.0";
+  version = "1.7.1";

  src = fetchFromGitHub {
    owner = "open-policy-agent";
    repo = "opa";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-p03yjLPphS4jp0dK3hlREKzAzCKRPOpvUnmGaGzrwww=";
+    hash = "sha256-FFJiw2OE5mTFyjOdMoau8Ix8Q+id5hIpCeQaUua1IKg=";
  };

  vendorHash = null;
--- a/Show More
+++ b/Show More