Merge pull request 'chore: update nixpkgs for cacert 3.131.1, drop emSign stopgap' (#112 ) from chore/remove-emudhra-stopgap into main

Reviewed-on: #112
fix(certificates): drop temporary emSign ECC Root CA - G3 distrust
2026-10-25 15:06:52 +01:00 · 2026-10-25 10:49:12 +01:00 · 2026-10-25 10:49:12 +01:00 · 2026-10-21 14:02:23 +02:00 · 2026-10-21 13:39:53 +02:00 · 2026-10-20 12:50:24 +02:00
7 changed files with 13 additions and 9 deletions
@@ -258,11 +258,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1791594108,
-        "narHash": "sha256-XK4KceonkwD8LuMAt/vNrz982mXJM5jeHAxMwsUXXAQ=",
+        "lastModified": 1792773339,
+        "narHash": "sha256-rZLrzrC6i+jnTAlvPZHogKDulY7WWDEv9hJeHieO7Zw=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "6510408d147d8c5e6d76043e899e9251756f6a75",
+        "rev": "3ec636362e1816bc2f0888fa0fa2c69f1bc9e504",
        "type": "github"
      },
      "original": {
@@ -10,12 +10,13 @@
    ../../modules/nixos/bootloader.nix
    ../../modules/nixos/certificates.nix
    ../../modules/nixos/data-drives.nix
+    ../../modules/nixos/docker.nix
    ../../modules/nixos/gnupg.nix
-    ../../modules/nixos/noctalia-greeter.nix
    ../../modules/nixos/lanzaboote.nix
    ../../modules/nixos/locales.nix
    ../../modules/nixos/networking.nix
    ../../modules/nixos/niri.nix
+    ../../modules/nixos/noctalia-greeter.nix
    ../../modules/nixos/noctalia.nix
    ../../modules/nixos/openssh.nix
    ../../modules/nixos/packages.nix
@@ -24,6 +24,7 @@ in

  programs.git = {
    enable = true;
+    lfs.enable = true;
    settings = {
      push.autoSetupRemote = true;
      user = {
@@ -8,6 +8,7 @@
    fastfetch
    keepassxc
    signal-desktop
+    tea
    teamspeak6-client
    typst
    zathura
@@ -1,5 +1,5 @@
 # One Nord palette for everything stylix has a target for: gtk, qt,
-# noctalia, ghostty. Niri has no target and reads the colors in niri.nix. 
+# noctalia, ghostty. Niri has no target and reads the colors in niri.nix.
 # Only the home-manager module is used, so boot, console and sddm are left alone.

 { pkgs, ... }:
@@ -9,9 +9,6 @@
    efi.canTouchEfiVariables = true;
  };

-  # enable systemd initrd
-  boot.initrd.systemd.enable = true;
-
  # plymouth
  boot.plymouth = {
    enable = true;
@@ -4,6 +4,10 @@
    tuned.enable = true;
    upower.enable = true;
    fwupd.enable = true;
-    tailscale.enable = true;
+    tailscale = {
+      enable = true;
+      # inbound 41641/udp so peers can connect directly instead of via DERP
+      openFirewall = true;
+    };
  };
 }
Author	SHA1	Message	Date
aaron	101f2fee53	Merge pull request 'chore: update nixpkgs for cacert 3.131.1, drop emSign stopgap' (#112 ) from chore/remove-emudhra-stopgap into main Reviewed-on: #112	2026-10-25 15:06:52 +01:00
aaronandClaude Opus 5.5	66e738c792	fix(certificates): drop temporary emSign ECC Root CA - G3 distrust cacert 3.131.1 no longer ships this root at all, so the blacklist entry added in #111 is redundant. Closes #110 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-25 10:49:12 +01:00
aaronandClaude Opus 5.5	bfaa1c7d9f	chore(flake): update nixpkgs to pick up cacert 3.131.1 Bumps nixos-unstable from 6510408 (2026-10-10) to 3ec6363 (2026-10-23), which includes nixpkgs f903b88 (cacert 3.126 -> 3.131.1). NSS 3.131.1 drops emSign ECC Root CA - G3 after the eMudhra intermediate key compromise. nixpkgs removed the scripted initrd in this range, so boot.initrd.systemd.enable is now a failing assertion. systemd initrd was already enabled, so dropping the line does not change boot. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-25 10:49:12 +01:00
aaron	f54798a8be	Merge pull request 'fix(certificates): temporarily distrust emSign ECC Root CA - G3' (#111 ) from fix/distrust-emudhra-ecc-root into main Reviewed-on: #111	2026-10-21 14:02:23 +02:00
aaronandClaude Opus 5.5	5b38fc4155	fix(certificates): temporarily distrust emSign ECC Root CA - G3 Eight eMudhra intermediates chaining to this root were generated with trivially recoverable private keys (Mozilla bug 2083449), so anyone can mint certificates that non-browser clients using the system bundle will accept. Browsers already block them; the system bundle does not until cacert 3.131.1 (nixpkgs f903b88), which has not reached nixos-unstable yet. Drop this once the flake lock includes that commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 13:39:53 +02:00
aaron	6c1c4403c2	Merge pull request 'fix(tailscale): open Tailscale's WireGuard port in the firewall' (#109 ) from fix/tailscale-open-firewall into main Reviewed-on: #109	2026-10-20 12:50:24 +02:00
aaronandClaude Opus 5.5	fb3e2864d6	fix(tailscale): open Tailscale's WireGuard port in the firewall services.tailscale.openFirewall defaults to false while the NixOS firewall is enabled, so argon, krypton and neon dropped unsolicited inbound 41641/udp. Direct connections then only succeed if the other peer accepts inbound; between two of these hosts (or a host and a phone) traffic can fall back to a DERP relay. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-20 12:48:41 +02:00
aaron	8701507742	Merge pull request 'feature(git): enable git lfs for my user' (#108 ) from feature/add_tea into main Reviewed-on: #108	2026-10-18 14:43:17 +02:00
aaron	c748f22033	feature(git): enable git lfs for my user	2026-10-18 14:42:07 +02:00
aaron	a9e17a8c35	Merge pull request 'feature(programs): add the tea binary to my user to communicate with my gitea server' (#107 ) from feature/add_tea into main Reviewed-on: #107	2026-10-18 14:16:55 +02:00
aaron	69adfc9890	feature(programs): add the tea binary to my user to communicate with my gitea server	2026-10-18 14:15:52 +02:00
aaron	c9c15addcc	Merge pull request 'feature(argon): add rootless docker to argon' (#106 ) from feature/docker_on_argon into main Reviewed-on: #106	2026-10-16 20:14:45 +02:00
aaron	abe6fd5c18	feature(argon): add rootless docker to argon	2026-10-16 20:06:09 +02:00