update

firmware/README.md

@@ -1,15 +1,18 @@
 # Asahi peripheral firmware (vendored)
 
 `hardware.asahi.peripheralFirmwareDirectory` points here. A **pure** flake
-cannot read `/boot/asahi`, so the Wi-Fi/Bluetooth firmware must live inside the
+cannot read `/boot/vendorfw`, so the Wi-Fi/Bluetooth firmware must live inside
-repo tree and be git-tracked.
+the repo tree and be git-tracked.
+
+Since nixos-apple-silicon 66d8dd2 the module expects the pre-extracted
+`firmware.cpio` (placed on the ESP by the Asahi installer) instead of
+`all_firmware.tar.gz` + `kernelcache.*`.
 
 ## During install, on the Mac:
 
 ```sh
-cp /boot/asahi/all_firmware.tar.gz  ~/.dotfiles/firmware/
+cp /boot/vendorfw/firmware.cpio ~/.dotfiles/firmware/
-cp /boot/asahi/kernelcache*         ~/.dotfiles/firmware/
+git -C ~/.dotfiles add -f firmware/firmware.cpio
-git -C ~/.dotfiles add -f firmware/all_firmware.tar.gz firmware/kernelcache*
 ```
 
 (They're `.gitignore`-exempt via `-f` if needed — but the flake only sees

flake.lock

@@ -8,11 +8,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782749693,
+        "lastModified": 1785426242,
-        "narHash": "sha256-Dj2m93PXWyOoXyp9tQlyjtBPbpVobKUrgnVDNNsNT1o=",
+        "narHash": "sha256-QHAP8KsJQmI+dpNS/wfWAtEBQ0Zby+B0Ty+qZIO/U2w=",
         "owner": "nix-community",
         "repo": "nixos-apple-silicon",
-        "rev": "b6ed8c114eee6739e3a2c06d99e2e19ac608dedf",
+        "rev": "66d8dd2c27f99bd5420c99938b60695aac1785c4",
         "type": "github"
       },
       "original": {
@@ -29,11 +29,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1782878575,
+        "lastModified": 1786334532,
-        "narHash": "sha256-sw0B1D//VBGXLQZJXXFLjunnMfO7hCZ5S1kv06BBO5A=",
+        "narHash": "sha256-C/efnaEGK18irNAyDM7JtNG6QhMNewTTp/JZNdyStWs=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "e5d8f0375b4613d200e8efd64df2183a75290c4e",
+        "rev": "89326e8b272f25875f3dbebe3ec2b510016f57e0",
         "type": "gitlab"
       },
       "original": {
@@ -65,11 +65,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782881387,
+        "lastModified": 1786356609,
-        "narHash": "sha256-HvlS1KDGXDjd1bNzzPvH1mkDJATlDAfVYfTh//wJBEA=",
+        "narHash": "sha256-ou8fYz5w9yhXC8YbvvExybFIa19MyW5G/8dEPqa90hM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d32537981c036473cf6990ae03176a5d84c43b29",
+        "rev": "c30c7955cec30d664a9baced6bc0112e263d4647",
         "type": "github"
       },
       "original": {
@@ -80,11 +80,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1782723713,
+        "lastModified": 1786106723,
-        "narHash": "sha256-oPXCU/SSUokcGaJREHibG1CBX3+s/W7orDWQOZDsEeQ=",
+        "narHash": "sha256-zDSUbpoeo/9ZmD2+wXnzxoo1+uhL8vxc0b8yuYMKYq0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b5aa0fbd538984f6e3d201be0005b4463d8b09f8",
+        "rev": "f13ff45afd1bb73e640eaa08a7066dbed07e3238",
         "type": "github"
       },
       "original": {
@@ -113,11 +113,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782812215,
+        "lastModified": 1786347712,
-        "narHash": "sha256-OPVK9WW9QsO2aj1R+Ln3p7fniFj5h441vb3LyrzpeE4=",
+        "narHash": "sha256-yH+jWXH2TVd5h3J5KoZiE8/4O4HqoggfB0zl9uVj39w=",
         "owner": "0xc000022070",
         "repo": "zen-browser-flake",
-        "rev": "a7c2a9a5e492e0e62072547f7e4c2abf138425c5",
+        "rev": "945efbc704b7f8c1731a922aabbc5d95edc9eb74",
         "type": "github"
       },
       "original": {

flake.nix

@@ -96,6 +96,7 @@
         };
 
         home.pointerCursor = {
+          enable = true;
           package = pkgs.bibata-cursors;
           name = "Bibata-Modern-Ice";
           size = 24;
@@ -179,6 +180,8 @@
         };
         programs.starship.enable = true;
 
+      
+
         # SSH auth via the 1Password agent — private keys stay in the vault,
         # never on disk or in the Nix store.
         programs.ssh = {
@@ -211,9 +214,42 @@
       # ───────────────────── shared system (both hosts) ─────────────────────
       common = { pkgs, ... }: {
         nix.settings.experimental-features = [ "nix-command" "flakes" ];
+        # Trusted so client-side nix config takes effect — the deepvis repo's
+        # flake nixConfig advertises the team dev cache (attic on the builder,
+        # over the tailnet), and the daemon ignores it for untrusted users.
+        nix.settings.trusted-users = [ "mads" ];
+        # x86_64 derivations build on the build host instead of under local
+        # qemu emulation — anything the dev cache doesn't already have ships
+        # there as a remote build (tailnet; the builder's `builder` user
+        # exists for exactly this).
+        #
+        # The host key is pinned system-wide because the ssh'ing party is the
+        # root daemon, which has no known_hosts and never gets a tty to
+        # answer a trust prompt.
+        programs.ssh.knownHosts."builder" = {
+          extraHostNames = [ "5.9.71.104" "builder.tailf5eaab.ts.net" ];
+          publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHnKIrxYtlovvYGgkpEZXY8wG/CuSLMGOM/84eIlyeVW";
+        };
+        nix.distributedBuilds = true;
+        nix.buildMachines = [{
+          hostName = "builder";
+          sshUser = "builder";
+          # The daemon (root) does the ssh'ing, so it needs an explicit
+          # on-disk key — it has no access to a user's agent.
+          sshKey = "/home/mads/.ssh/id_ed25519";
+          protocol = "ssh-ng";
+          system = "x86_64-linux";
+          maxJobs = 16;
+          supportedFeatures = [ "big-parallel" "kvm" "nixos-test" ];
+        }];
 
         networking.networkmanager.enable = true;
-        networking.networkmanager.wifi.backend = "wpa_supplicant";
+        networking.networkmanager.wifi.backend = "iwd";
+
+        # Secret Service (org.freedesktop.secrets) provider, D-Bus-activated on
+        # demand. Without it 1Password can't persist the 2FA device token
+        # ("unable to save your two-factor token") and re-prompts every unlock.
+        services.gnome.gnome-keyring.enable = true;
 
         programs._1password.enable = true;
         programs._1password-gui = {
@@ -304,17 +340,33 @@
 
               # Wi-Fi/BT firmware, vendored (a pure flake can't read /boot/asahi).
               hardware.asahi.peripheralFirmwareDirectory = ./firmware;
+              hardware.asahi.enable = true;
 
               boot.loader.systemd-boot.enable = true;
               boot.loader.systemd-boot.configurationLimit = 3; # 500M ESP is small
               boot.extraModprobeConfig = "options hid_apple fnmode=1";
               boot.blacklistedKernelModules = [ "pcspkr" ];
 
-              # Asahi kernel + Mesa cache (else compile from source).
+              # Build x86_64 derivations (packing-station iso/deploys) via qemu.
+              boot.binfmt.emulatedSystems = [ "x86_64-linux" ];
+
+              # Resolve .local names, so the packing stations can be reached and
+              # deployed to by hostname instead of by address.
+              services.avahi = {
+                enable = true;
+                nssmdns4 = true;
+              };
+
+              # Asahi kernel + Mesa cache, and the Raspberry Pi vendor
+              # kernel/firmware cache (else both compile from source).
               nix.settings = {
-                extra-substituters = [ "https://nixos-apple-silicon.cachix.org" ];
+                extra-substituters = [
+                  "https://nixos-apple-silicon.cachix.org"
+                  "https://nixos-raspberrypi.cachix.org"
+                ];
                 extra-trusted-public-keys = [
                   "nixos-apple-silicon.cachix.org-1:8psDu5SA5dAD7qA0zMy5UT292TxeEPzIz8VVEr2Js20="
+                  "nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI="
                 ];
               };
             })