Merge pull request 'chore(update): update flake file' (#72) from chore/update into main

Reviewed-on: #72

flake.lock

@@ -8,11 +8,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1785627969,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
         "type": "github"
       },
       "original": {
@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784546264,
+        "lastModified": 1787176219,
-        "narHash": "sha256-jxVr5EHMYAOkFvS2k0abIvt6NqyshyWmiHHzV17sT2g=",
+        "narHash": "sha256-djoRr6jBpe35q/0JwAvXpFXg1Ktf+X54NU2RLR7wnHw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e3dea8e4792b09a6c0eb5836b0284ad05b1acba0",
+        "rev": "c53d643b3737e2fcd04e6cb3b3580ef50b2087a0",
         "type": "github"
       },
       "original": {
@@ -43,11 +43,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1784497964,
+        "lastModified": 1787135253,
-        "narHash": "sha256-vlHUuqAcbcH2RKmHbPiuQzbv1pnzzavXnI62RD0bqCU=",
+        "narHash": "sha256-RD2kNWCG+Bjo6h+JVjWVNntZs2GtRoeY2xHjts/FNkA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "241313f4e8e508cb9b13278c2b0fa25b9ca27163",
+        "rev": "ffb3c9b700e759be2ef13237c9d8f953b32a1e46",
         "type": "github"
       },
       "original": {
@@ -66,11 +66,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1784057377,
+        "lastModified": 1787151631,
-        "narHash": "sha256-yycNej5//EsRbV10moBoh+/63vXEwZD1ZFEiRm6C9rQ=",
+        "narHash": "sha256-EblMdrDFBFNNlUPm5zUQdh0j6gDx+OFQPv7LFE4B5AA=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "07180a087e4a00720dc0731cbcd8dec796974381",
+        "rev": "d0d62a2b5027da689b4e8d5ee43f1cf83f2e975d",
         "type": "github"
       },
       "original": {
@@ -86,11 +86,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784556533,
+        "lastModified": 1787234716,
-        "narHash": "sha256-tlcP2x7d+ldS3BypTcInqrsOhi6BPuSSTeubfBMmm8Y=",
+        "narHash": "sha256-O07tHqxugZ/XE/90kx/UCZ0YCbHSI88v2ct2ezuCKi4=",
         "owner": "noctalia-dev",
         "repo": "noctalia-shell",
-        "rev": "815635cf7dc810616c9e6ecf4b9b4f4c54e69905",
+        "rev": "a064c063f204518619b8c032c944138a0349966b",
         "type": "github"
       },
       "original": {
@@ -108,6 +108,7 @@
       }
     },
     "systems": {
+      "flake": false,
       "locked": {
         "lastModified": 1774449309,
         "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",

hosts/argon/configuration.nix

@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ../../modules/nixos/appimage.nix
     ../../modules/nixos/astro.nix
     ../../modules/nixos/audio.nix
     ../../modules/nixos/bootloader.nix
@@ -25,6 +26,7 @@
     ../../modules/nixos/steam.nix
     ../../modules/nixos/thunar.nix
     ../../modules/nixos/users.nix
+    ../../modules/nixos/vial.nix
   ];
 
   # set hostname

hosts/neon/configuration.nix

@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ../../modules/nixos/appimage.nix
     ../../modules/nixos/astro.nix
     ../../modules/nixos/audio.nix
     ../../modules/nixos/bootloader.nix
@@ -21,6 +22,7 @@
     ../../modules/nixos/settings.nix
     ../../modules/nixos/steam.nix
     ../../modules/nixos/users.nix
+    ../../modules/nixos/vial.nix
   ];
 
   # set hostname

modules/nixos/appimage.nix

@@ -0,0 +1,19 @@
+{ config, lib, pkgs, ... }:
+
+{
+  # AppImages ship a squashfs payload that the bundled runtime mounts through
+  # libfuse.so.2 at startup. nix-ld resolves the ELF interpreter but not that
+  # dlopen, so running one directly dies with "dlopen(): error loading
+  # libfuse.so.2". appimage-run sidesteps the mount entirely: it unpacks the
+  # image and runs the payload inside an FHS sandbox, which the bundled Qt and
+  # electron style binaries need anyway.
+  #
+  # Used for the BitBox02 wallet AppImage, downloaded fresh from
+  # https://bitbox.swiss/download/ rather than installed from nixpkgs.
+  programs.appimage = {
+    enable = true;
+    # register AppImages with binfmt_misc so ./Something.AppImage runs as-is,
+    # no appimage-run prefix to remember.
+    binfmt = true;
+  };
+}

modules/nixos/packages.nix

@@ -35,6 +35,7 @@
     tree
     unzip
     usbutils
+    vial
     vim
     wget
     which

modules/nixos/vial.nix

@@ -0,0 +1,26 @@
+{ config, lib, pkgs, ... }:
+
+{
+  # Vial-capable keyboards (lily58 pro r2g) expose a second, non-keyboard raw
+  # HID interface that vial.rocks drives over WebHID. Its /dev/hidraw* node is
+  # root-only by default, so neither chromium nor the native app can open it.
+  #
+  # This has to ship as a numbered rules file rather than via
+  # services.udev.extraRules: extraRules lands in 99-local.rules, but the
+  # builtin that turns TAG+="uaccess" into an actual ACL is invoked from
+  # systemd's 73-seat-late.rules. A tag set at 99 is set too late to be seen,
+  # so the device ends up correctly tagged and still unreadable. 60- sorts
+  # safely ahead of 73.
+  services.udev.packages = [
+    (pkgs.writeTextFile {
+      name = "vial-udev-rules";
+      destination = "/lib/udev/rules.d/60-vial.rules";
+      # Vial firmware advertises itself through a magic USB serial, so this
+      # matches any vial board rather than just the lily58. uaccess hands the
+      # device to whoever owns the active seat, no group membership needed.
+      text = ''
+        KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{serial}=="*vial:f64c2b3c*", TAG+="uaccess"
+      '';
+    })
+  ];
+}