From 2bfcb22a2229b2e53a839ceb35057ff3b9fd92a2 Mon Sep 17 00:00:00 2001
From: Fabian Montero <fabian@posixlycorrect.com>
Date: Fri, 7 Feb 2025 13:10:02 -0600
Subject: [PATCH 01/31] add firefox module

---
 hm/default.nix                  | 11 ++++++-
 hm/programs/default.nix         | 10 ++++++
 hm/programs/firefox/default.nix | 57 +++++++++++++++++++++++++++++++++
 3 files changed, 77 insertions(+), 1 deletion(-)
 create mode 100644 hm/programs/default.nix
 create mode 100644 hm/programs/firefox/default.nix

diff --git a/hm/default.nix b/hm/default.nix
index 0967ef4..dd56cf2 100644
--- a/hm/default.nix
+++ b/hm/default.nix
@@ -1 +1,10 @@
-{}
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  imports = [
+    ./programs
+  ];
+}
diff --git a/hm/programs/default.nix b/hm/programs/default.nix
new file mode 100644
index 0000000..e95efb7
--- /dev/null
+++ b/hm/programs/default.nix
@@ -0,0 +1,10 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  imports = [
+    ./firefox
+  ];
+}
diff --git a/hm/programs/firefox/default.nix b/hm/programs/firefox/default.nix
new file mode 100644
index 0000000..c6907a7
--- /dev/null
+++ b/hm/programs/firefox/default.nix
@@ -0,0 +1,57 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.options.trivium.programs.firefox;
+in {
+  options.options.trivium.programs.firefox = {
+    enable = mkEnableOption "firefox settings";
+
+    workspace = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        i3 Workspace in which Firefox should open. If not set, Firefox will not open at startup
+      '';
+    };
+
+    makeDefaultBrowser = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Take a guess
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable (mkMerge [
+    {
+      programs.firefox.enable = true;
+
+      xsession.windowManager.i3.config.startup = optional (cfg.workspace != null) {
+        command = "${lib.getExe pkgs.i3-gaps} 'workspace ${cfg.workspace}; exec ${lib.getExe pkgs.firefox}'";
+      };
+    }
+
+    (mkIf cfg.makeDefaultBrowser {
+      xdg = {
+        mimeApps = {
+          enable = true;
+          defaultApplications = {
+            "text/html" = ["firefox"];
+            "text/uri-list" = ["firefox"];
+            "x-scheme-handler/http" = ["firefox"];
+            "x-scheme-handler/https" = ["firefox"];
+            "x-scheme-handler/about" = ["firefox"];
+            "x-scheme-handler/unknown" = ["firefox"];
+          };
+        };
+      };
+
+      home.sessionVariables.DEFAULT_BROWSER = "${lib.getExe pkgs.firefox}";
+    })
+  ]);
+}

From 12cd6972097b3d321875351292fb05d5c72f5444 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Thu, 5 Jun 2025 19:46:06 -0600
Subject: [PATCH 02/31] pkgs: add spliit

---
 pkgs/default.nix        |  2 ++
 pkgs/spliit/default.nix | 64 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 66 insertions(+)
 create mode 100644 pkgs/spliit/default.nix

diff --git a/pkgs/default.nix b/pkgs/default.nix
index 2ee6bfd..454b81d 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -5,4 +5,6 @@ in {
   lib = callPackage ./lib {};
 
   override = {};
+
+  spliit = callPackage ./spliit {};
 }
diff --git a/pkgs/spliit/default.nix b/pkgs/spliit/default.nix
new file mode 100644
index 0000000..5ac56b1
--- /dev/null
+++ b/pkgs/spliit/default.nix
@@ -0,0 +1,64 @@
+{
+  buildNpmPackage,
+  fetchFromGitHub,
+  nodePackages,
+  lib,
+  writeShellScriptBin,
+}:
+buildNpmPackage {
+  pname = "spliit2";
+  version = "master-20250420";
+
+  src = fetchFromGitHub {
+    repo = "spliit";
+    owner = "spliit-app";
+
+    rev = "a11efc79c13298c0d282e47496d132538752405f";
+    hash = "sha256-v4gaPzLzBbbqw/LDYxe1fiyficcrqcGOop23YPiTrdc=";
+  };
+
+  npmDepsHash = "sha256-sd0/7ruNUFxUKTeTwx/v8Vc/G3llkXP6RSDE78h3qVU=";
+  npmRebuildFlags = ["--ignore-scripts"];
+
+  doCheck = false;
+
+  postPatch = ''
+    cp -v .env.example .env
+  '';
+
+  # nixpkgs/pkgs/applications/office/documenso/default.nix          (git)-[master]  05:36:05
+  preBuild = ''
+    # somehow for linux, npm is not finding the prisma package with the
+    # packages installed with the lockfile.
+    # This generates a prisma version incompatibility warning and is a kludge
+    # until the upstream package-lock is modified.
+    ${lib.getExe nodePackages.prisma} generate
+  '';
+
+  postInstall = ''
+    install -Dvm755 -t $out/bin ${lib.getExe (writeShellScriptBin "spliit2" ''
+      set -euxo pipefail
+
+      cd @out@/lib/node_modules/spliit2
+
+      export PATH="$PWD/node_modules/.bin:$PATH"
+      export NEXT_TELEMETRY_DISABLED=1
+
+      prisma migrate deploy
+      exec next start
+    '')}
+
+    #kk?
+    #${lib.getExe nodePackages.prisma} migrate deploy
+
+    substituteInPlace $out/bin/spliit2 \
+      --replace @out@ $out
+  '';
+
+  meta = {
+    description = "Free and Open Source Alternative to Splitwise. Share expenses with your friends and family.";
+    homepage = "https://spliit.app";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [];
+  };
+}

From 517c240c195525593c33aa8a57ffb42d50a6a330 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Thu, 5 Jun 2025 21:30:04 -0600
Subject: [PATCH 03/31] flake: add attribute 'packages'

---
 flake.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/flake.nix b/flake.nix
index d8e51c6..29664c3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -16,6 +16,12 @@
   in
     flake-utils.lib.eachDefaultSystem (system: {
       formatter = (import nixpkgs {inherit system;}).alejandra;
+
+      packages =
+        (import nixpkgs {
+          inherit system;
+          overlays = [(mapOverlayOverride "local" (import ./pkgs))];
+        }).local;
     })
     // {
       templates = let

From a78a4f764ec8d5c4d005f554b37d25069efcff7b Mon Sep 17 00:00:00 2001
From: Alejandro Diaz <alejandrodp@protonmail.com>
Date: Sun, 22 Jun 2025 01:17:27 -0600
Subject: [PATCH 04/31] spliit: added functional package

---
 pkgs/spliit/default.nix | 41 +++++++++++++++++++++++++++--------------
 1 file changed, 27 insertions(+), 14 deletions(-)

diff --git a/pkgs/spliit/default.nix b/pkgs/spliit/default.nix
index 5ac56b1..60e12dd 100644
--- a/pkgs/spliit/default.nix
+++ b/pkgs/spliit/default.nix
@@ -4,7 +4,14 @@
   nodePackages,
   lib,
   writeShellScriptBin,
+  pkgs
 }:
+let 
+  schemaEngine = "${pkgs.prisma-engines}/bin/schema-engine";
+  queryEngineBin = "${pkgs.prisma-engines}/bin/query-engine";
+  queryEngineLib = "${pkgs.prisma-engines}/lib/libquery_engine.node";
+  buildFlags = [ "--ignore-scripts" ];
+in
 buildNpmPackage {
   pname = "spliit2";
   version = "master-20250420";
@@ -18,24 +25,26 @@ buildNpmPackage {
   };
 
   npmDepsHash = "sha256-sd0/7ruNUFxUKTeTwx/v8Vc/G3llkXP6RSDE78h3qVU=";
-  npmRebuildFlags = ["--ignore-scripts"];
 
-  doCheck = false;
+  nativeBuildInputs = [ pkgs.openssl ];
 
-  postPatch = ''
-    cp -v .env.example .env
-  '';
+  npmRebuildFlags = buildFlags;
+
+  PRISMA_SCHEMA_ENGINE_BINARY = schemaEngine;
+  PRISMA_QUERY_ENGINE_BINARY  = queryEngineBin;
+  PRISMA_QUERY_ENGINE_LIBRARY = queryEngineLib;
 
-  # nixpkgs/pkgs/applications/office/documenso/default.nix          (git)-[master]  05:36:05
   preBuild = ''
-    # somehow for linux, npm is not finding the prisma package with the
-    # packages installed with the lockfile.
-    # This generates a prisma version incompatibility warning and is a kludge
-    # until the upstream package-lock is modified.
-    ${lib.getExe nodePackages.prisma} generate
+    cp -v scripts/build.env .env
+
+    npx prisma generate
   '';
 
+  npmBuildFlags = buildFlags;
+
   postInstall = ''
+    cp -r .next public package.json next.config.mjs $out/lib/node_modules/spliit2
+
     install -Dvm755 -t $out/bin ${lib.getExe (writeShellScriptBin "spliit2" ''
       set -euxo pipefail
 
@@ -44,15 +53,19 @@ buildNpmPackage {
       export PATH="$PWD/node_modules/.bin:$PATH"
       export NEXT_TELEMETRY_DISABLED=1
 
+      export PRISMA_SCHEMA_ENGINE_BINARY="${schemaEngine}"
+      export PRISMA_QUERY_ENGINE_BINARY="${queryEngineBin}"
+      export PRISMA_QUERY_ENGINE_LIBRARY="${queryEngineLib}"
+
       prisma migrate deploy
       exec next start
     '')}
 
-    #kk?
-    #${lib.getExe nodePackages.prisma} migrate deploy
-
     substituteInPlace $out/bin/spliit2 \
       --replace @out@ $out
+
+    wrapProgram $out/bin/spliit2 \
+      --prefix PATH : ${lib.makeBinPath [ pkgs.openssl ]}
   '';
 
   meta = {

From 12b7c09c0b25a7bb95f1d9e80fddd9210ddfbfa9 Mon Sep 17 00:00:00 2001
From: Alejandro Diaz <alejandrodp@protonmail.com>
Date: Sun, 22 Jun 2025 13:06:40 -0600
Subject: [PATCH 05/31] spliit: removes exec at start

---
 pkgs/spliit/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/spliit/default.nix b/pkgs/spliit/default.nix
index 60e12dd..5a917ce 100644
--- a/pkgs/spliit/default.nix
+++ b/pkgs/spliit/default.nix
@@ -58,7 +58,7 @@ buildNpmPackage {
       export PRISMA_QUERY_ENGINE_LIBRARY="${queryEngineLib}"
 
       prisma migrate deploy
-      exec next start
+      next start
     '')}
 
     substituteInPlace $out/bin/spliit2 \

From cfdf227b9cf1f02512d2e9fe6f28e27e48e0804c Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Tue, 5 Aug 2025 21:29:34 -0600
Subject: [PATCH 06/31] flake: export nixosModules and homeManagerModules

---
 flake.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/flake.nix b/flake.nix
index 29664c3..a18f2c7 100644
--- a/flake.nix
+++ b/flake.nix
@@ -42,6 +42,9 @@
         trivium = overlay;
       };
 
+      homeManagerModules.default = ./hm;
+      nixosModules.default = ./nixos;
+
       lib = {
         mkSystemFlake = {
           flakes,
@@ -151,7 +154,7 @@
                 hostConfig = platform:
                   nixosSystem {
                     modules = [
-                      ./nixos
+                      self.nixosModules.default
                       nixosSourcePath
                       platform
                     ];
@@ -177,7 +180,7 @@
                     };
 
                     modules = [
-                      ./hm
+                      self.homeManagerModules.default
                       hmSourcePath
                       platform
                       registry

From 263b27cbb2532ed6457cdcad6477a39bdf367c7d Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Tue, 5 Aug 2025 21:35:18 -0600
Subject: [PATCH 07/31] flake: add nixpkgs input url

---
 .gitignore |  1 -
 flake.lock | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 flake.nix  |  5 ++++-
 3 files changed, 65 insertions(+), 2 deletions(-)
 create mode 100644 flake.lock

diff --git a/.gitignore b/.gitignore
index 21f979d..f094862 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,2 @@
 !**/.keep
 result
-flake.lock
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..8730827
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1754292888,
+        "narHash": "sha256-1ziydHSiDuSnaiPzCQh1mRFBsM2d2yRX9I+5OPGEmIE=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "ce01daebf8489ba97bd1609d185ea276efdeb121",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
index a18f2c7..173766d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,5 +1,8 @@
 {
-  inputs.flake-utils.url = "github:numtide/flake-utils";
+  inputs = {
+    flake-utils.url = "github:numtide/flake-utils";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
+  };
 
   outputs = {
     self,

From adc44af3a0a83889491417c1ed77340f04befdcd Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Tue, 5 Aug 2025 21:43:37 -0600
Subject: [PATCH 08/31] nixos/services: remove forgejo

---
 nixos/services/default.nix         |  4 +-
 nixos/services/forgejo/default.nix | 66 ------------------------------
 2 files changed, 1 insertion(+), 69 deletions(-)
 delete mode 100644 nixos/services/forgejo/default.nix

diff --git a/nixos/services/default.nix b/nixos/services/default.nix
index 36b456a..5ce655e 100644
--- a/nixos/services/default.nix
+++ b/nixos/services/default.nix
@@ -4,7 +4,5 @@
   pkgs,
   ...
 }: {
-  imports = [
-    ./forgejo
-  ];
+  imports = [];
 }
diff --git a/nixos/services/forgejo/default.nix b/nixos/services/forgejo/default.nix
deleted file mode 100644
index b15d2d9..0000000
--- a/nixos/services/forgejo/default.nix
+++ /dev/null
@@ -1,66 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.options.trivium.services.forgejo;
-in {
-  options.trivium.services.forgejo = {
-    enable = mkEnableOption "forgejo settings";
-
-    virtualHost = mkOption {
-      type = types.string;
-      description = "Virtualhost to use for nginx's reverse proxy. Usually something like git.<your server>.com";
-    };
-
-    appName = mkOption {
-      type = types.string;
-      description = "You guess what this does";
-    };
-
-    disableRegistration = mkOption {
-      type = types.bool;
-      default = true;
-      description = "Turn this off just to create the first admin account";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    services = {
-      nginx = {
-        virtualHosts."${cfg.virtualHost}" = {
-          enableACME = true;
-          forceSSL = true;
-          locations."/".proxyPass = "http://localhost:9170";
-        };
-      };
-
-      forgejo = {
-        enable = true;
-        lfs.enable = true;
-        useWizard = false;
-        settings = {
-          general.APP_NAME = "${cfg.appName}";
-          ui.DEFAULT_THEME = "forgejo-dark";
-          server = {
-            DOMAIN = "${cfg.virtualHost}";
-            ROOT_URL = "https://${cfg.virtualHost}";
-            HTTP_PORT = 9170;
-            LANDING_PAGE = "explore";
-          };
-
-          service.DISABLE_REGISTRATION = ${cfg.disableRegistration};
-
-          actions = {
-            ENABLED = true;
-          };
-          mailer = {
-            ENABLED = false;
-          };
-        };
-      };
-    };
-  };
-}

From 1c7810a49eb270019eb3cd4f928a3d4aa4569ac6 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Tue, 5 Aug 2025 21:45:03 -0600
Subject: [PATCH 09/31] nixos: remove services, trash

---
 nixos/default.nix             |  5 +---
 nixos/services/default.nix    |  8 -----
 nixos/trash/default.nix       | 10 -------
 nixos/trash/steam/default.nix | 55 -----------------------------------
 4 files changed, 1 insertion(+), 77 deletions(-)
 delete mode 100644 nixos/services/default.nix
 delete mode 100644 nixos/trash/default.nix
 delete mode 100644 nixos/trash/steam/default.nix

diff --git a/nixos/default.nix b/nixos/default.nix
index e2637ac..5ce655e 100644
--- a/nixos/default.nix
+++ b/nixos/default.nix
@@ -4,8 +4,5 @@
   pkgs,
   ...
 }: {
-  imports = [
-    ./trash
-    ./services
-  ];
+  imports = [];
 }
diff --git a/nixos/services/default.nix b/nixos/services/default.nix
deleted file mode 100644
index 5ce655e..0000000
--- a/nixos/services/default.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: {
-  imports = [];
-}
diff --git a/nixos/trash/default.nix b/nixos/trash/default.nix
deleted file mode 100644
index a8c8785..0000000
--- a/nixos/trash/default.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: {
-  imports = [
-    ./steam
-  ];
-}
diff --git a/nixos/trash/steam/default.nix b/nixos/trash/steam/default.nix
deleted file mode 100644
index 80a45e8..0000000
--- a/nixos/trash/steam/default.nix
+++ /dev/null
@@ -1,55 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.options.trivium.trash.steam;
-in {
-  options.trivium.trash.steam = {
-    enable = mkEnableOption "steam settings";
-
-    compatibilityPackages = mkOption {
-      type = types.bool;
-      default = true;
-      description = "Enable additional compatibility packages (protontricks, protonup, etc.)";
-    };
-
-    remotePlayOpenFirewall = mkOption {
-      type = types.bool;
-      default = false;
-      description = "Open firewall for Steam Remote Play";
-    };
-
-    dedicatedServerOpenFirewall = mkOption {
-      type = types.bool;
-      default = false;
-      description = "Open firewall for Steam Dedicated Server";
-    };
-
-    localNetworkGameTransfersOpenFirewall = mkOption {
-      type = types.bool;
-      default = false;
-      description = "Open firewall for Steam Local Network Game Transfers";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    programs.steam = {
-      enable = true;
-      remotePlay.openFirewall = cfg.remotePlayOpenFirewall;
-      dedicatedServer.openFirewall = cfg.dedicatedServerOpenFirewall;
-      localNetworkGameTransfers.openFirewall = cfg.localNetworkGameTransfersOpenFirewall;
-    };
-
-    environment = mkIf cfg.compatibilityPackages {
-      systemPackages = with pkgs; [
-        protontricks
-        protonup
-        protonup-ng
-        winetricks
-      ];
-    };
-  };
-}

From 26619394f44e5763e2094002e4d78e6b2a27b3a5 Mon Sep 17 00:00:00 2001
From: Fabian Montero <fabian@posixlycorrect.com>
Date: Tue, 5 Aug 2025 23:22:16 -0600
Subject: [PATCH 10/31] add doctrine

---
 doctrine/default.nix                 | 12 ++++
 doctrine/lib/default.nix             | 10 +++
 {pkgs => doctrine}/lib/importAll.nix |  0
 doctrine/lib/mk-module.nix           | 38 +++++++++++
 flake.nix                            |  4 +-
 hm/default.nix                       |  1 -
 modules/default.nix                  |  3 +
 nixos/default.nix                    |  8 ---
 pkgs/lib/default.nix                 |  3 -
 pkgs/spliit/default.nix              | 97 ++++++++++++++--------------
 10 files changed, 113 insertions(+), 63 deletions(-)
 create mode 100644 doctrine/default.nix
 create mode 100644 doctrine/lib/default.nix
 rename {pkgs => doctrine}/lib/importAll.nix (100%)
 create mode 100644 doctrine/lib/mk-module.nix
 delete mode 100644 hm/default.nix
 create mode 100644 modules/default.nix
 delete mode 100644 nixos/default.nix
 delete mode 100644 pkgs/lib/default.nix

diff --git a/doctrine/default.nix b/doctrine/default.nix
new file mode 100644
index 0000000..b4c72b8
--- /dev/null
+++ b/doctrine/default.nix
@@ -0,0 +1,12 @@
+{
+  pkgs,
+  namespace,
+}: let
+  doctrine = {
+    lib = import ./lib {inherit lib pkgs doctrine;};
+    prefix = "trivium";
+    inherit namespace;
+  };
+  inherit (pkgs) lib;
+in
+  doctrine
diff --git a/doctrine/lib/default.nix b/doctrine/lib/default.nix
new file mode 100644
index 0000000..1b03fe1
--- /dev/null
+++ b/doctrine/lib/default.nix
@@ -0,0 +1,10 @@
+{
+  lib,
+  doctrine,
+  pkgs,
+}: let
+  close = f: args: f (args // {inherit lib pkgs doctrine;});
+in {
+  importAll = pkgs.callPackage ./importAll.nix {};
+  mkModule = close (import ./mk-module.nix);
+}
diff --git a/pkgs/lib/importAll.nix b/doctrine/lib/importAll.nix
similarity index 100%
rename from pkgs/lib/importAll.nix
rename to doctrine/lib/importAll.nix
diff --git a/doctrine/lib/mk-module.nix b/doctrine/lib/mk-module.nix
new file mode 100644
index 0000000..79c24c5
--- /dev/null
+++ b/doctrine/lib/mk-module.nix
@@ -0,0 +1,38 @@
+{
+  name,
+  hm ? null,
+  sys ? null,
+  options ? null,
+  lib,
+  config,
+  pkgs,
+  doctrine,
+}: let
+  optionsSet = import options {
+    inherit config lib pkgs cfg name doctrine;
+  };
+
+  configSet = import configFiles.${doctrine.namespace} {
+    inherit config lib pkgs doctrine cfg;
+  };
+
+  configFiles = lib.filterAttrs (k: v: v != null) {
+    inherit sys hm;
+  };
+
+  cfg = config.${doctrine.prefix}.${name};
+in {
+  config =
+    lib.optionalAttrs (configFiles ? ${doctrine.namespace})
+    (lib.mkIf cfg.enable configSet);
+
+  options = lib.optionalAttrs (options
+    != null
+    && optionsSet ? ${doctrine.namespace}) {
+    ${doctrine.prefix}.${name} =
+      optionsSet.${doctrine.namespace}
+      // {
+        enable = lib.mkEnableOption name;
+      };
+  };
+}
diff --git a/flake.nix b/flake.nix
index 173766d..1a20e9e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -45,8 +45,8 @@
         trivium = overlay;
       };
 
-      homeManagerModules.default = ./hm;
-      nixosModules.default = ./nixos;
+      homeManagerModules.default = ./modules;
+      nixosModules.default = ./modules;
 
       lib = {
         mkSystemFlake = {
diff --git a/hm/default.nix b/hm/default.nix
deleted file mode 100644
index 0967ef4..0000000
--- a/hm/default.nix
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/modules/default.nix b/modules/default.nix
new file mode 100644
index 0000000..70dec76
--- /dev/null
+++ b/modules/default.nix
@@ -0,0 +1,3 @@
+{
+  imports = [];
+}
diff --git a/nixos/default.nix b/nixos/default.nix
deleted file mode 100644
index 5ce655e..0000000
--- a/nixos/default.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: {
-  imports = [];
-}
diff --git a/pkgs/lib/default.nix b/pkgs/lib/default.nix
deleted file mode 100644
index e3ab56e..0000000
--- a/pkgs/lib/default.nix
+++ /dev/null
@@ -1,3 +0,0 @@
-{callPackage}: {
-  importAll = callPackage ./importAll.nix {};
-}
diff --git a/pkgs/spliit/default.nix b/pkgs/spliit/default.nix
index 5a917ce..280e820 100644
--- a/pkgs/spliit/default.nix
+++ b/pkgs/spliit/default.nix
@@ -4,74 +4,73 @@
   nodePackages,
   lib,
   writeShellScriptBin,
-  pkgs
-}:
-let 
+  pkgs,
+}: let
   schemaEngine = "${pkgs.prisma-engines}/bin/schema-engine";
   queryEngineBin = "${pkgs.prisma-engines}/bin/query-engine";
   queryEngineLib = "${pkgs.prisma-engines}/lib/libquery_engine.node";
-  buildFlags = [ "--ignore-scripts" ];
+  buildFlags = ["--ignore-scripts"];
 in
-buildNpmPackage {
-  pname = "spliit2";
-  version = "master-20250420";
+  buildNpmPackage {
+    pname = "spliit2";
+    version = "master-20250420";
 
-  src = fetchFromGitHub {
-    repo = "spliit";
-    owner = "spliit-app";
+    src = fetchFromGitHub {
+      repo = "spliit";
+      owner = "spliit-app";
 
-    rev = "a11efc79c13298c0d282e47496d132538752405f";
-    hash = "sha256-v4gaPzLzBbbqw/LDYxe1fiyficcrqcGOop23YPiTrdc=";
-  };
+      rev = "a11efc79c13298c0d282e47496d132538752405f";
+      hash = "sha256-v4gaPzLzBbbqw/LDYxe1fiyficcrqcGOop23YPiTrdc=";
+    };
 
-  npmDepsHash = "sha256-sd0/7ruNUFxUKTeTwx/v8Vc/G3llkXP6RSDE78h3qVU=";
+    npmDepsHash = "sha256-sd0/7ruNUFxUKTeTwx/v8Vc/G3llkXP6RSDE78h3qVU=";
 
-  nativeBuildInputs = [ pkgs.openssl ];
+    nativeBuildInputs = [pkgs.openssl];
 
-  npmRebuildFlags = buildFlags;
+    npmRebuildFlags = buildFlags;
 
-  PRISMA_SCHEMA_ENGINE_BINARY = schemaEngine;
-  PRISMA_QUERY_ENGINE_BINARY  = queryEngineBin;
-  PRISMA_QUERY_ENGINE_LIBRARY = queryEngineLib;
+    PRISMA_SCHEMA_ENGINE_BINARY = schemaEngine;
+    PRISMA_QUERY_ENGINE_BINARY = queryEngineBin;
+    PRISMA_QUERY_ENGINE_LIBRARY = queryEngineLib;
 
-  preBuild = ''
-    cp -v scripts/build.env .env
+    preBuild = ''
+      cp -v scripts/build.env .env
 
-    npx prisma generate
-  '';
+      npx prisma generate
+    '';
 
-  npmBuildFlags = buildFlags;
+    npmBuildFlags = buildFlags;
 
-  postInstall = ''
-    cp -r .next public package.json next.config.mjs $out/lib/node_modules/spliit2
+    postInstall = ''
+      cp -r .next public package.json next.config.mjs $out/lib/node_modules/spliit2
 
-    install -Dvm755 -t $out/bin ${lib.getExe (writeShellScriptBin "spliit2" ''
-      set -euxo pipefail
+      install -Dvm755 -t $out/bin ${lib.getExe (writeShellScriptBin "spliit2" ''
+        set -euxo pipefail
 
-      cd @out@/lib/node_modules/spliit2
+        cd @out@/lib/node_modules/spliit2
 
-      export PATH="$PWD/node_modules/.bin:$PATH"
-      export NEXT_TELEMETRY_DISABLED=1
+        export PATH="$PWD/node_modules/.bin:$PATH"
+        export NEXT_TELEMETRY_DISABLED=1
 
-      export PRISMA_SCHEMA_ENGINE_BINARY="${schemaEngine}"
-      export PRISMA_QUERY_ENGINE_BINARY="${queryEngineBin}"
-      export PRISMA_QUERY_ENGINE_LIBRARY="${queryEngineLib}"
+        export PRISMA_SCHEMA_ENGINE_BINARY="${schemaEngine}"
+        export PRISMA_QUERY_ENGINE_BINARY="${queryEngineBin}"
+        export PRISMA_QUERY_ENGINE_LIBRARY="${queryEngineLib}"
 
-      prisma migrate deploy
-      next start
-    '')}
+        prisma migrate deploy
+        next start
+      '')}
 
-    substituteInPlace $out/bin/spliit2 \
-      --replace @out@ $out
+      substituteInPlace $out/bin/spliit2 \
+        --replace @out@ $out
 
-    wrapProgram $out/bin/spliit2 \
-      --prefix PATH : ${lib.makeBinPath [ pkgs.openssl ]}
-  '';
+      wrapProgram $out/bin/spliit2 \
+        --prefix PATH : ${lib.makeBinPath [pkgs.openssl]}
+    '';
 
-  meta = {
-    description = "Free and Open Source Alternative to Splitwise. Share expenses with your friends and family.";
-    homepage = "https://spliit.app";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [];
-  };
-}
+    meta = {
+      description = "Free and Open Source Alternative to Splitwise. Share expenses with your friends and family.";
+      homepage = "https://spliit.app";
+      license = lib.licenses.mit;
+      maintainers = with lib.maintainers; [];
+    };
+  }

From 8741b320219185af2bc7b5cf89e59d297e0bb074 Mon Sep 17 00:00:00 2001
From: Fabian Montero <fabian@posixlycorrect.com>
Date: Tue, 5 Aug 2025 23:22:16 -0600
Subject: [PATCH 11/31] add sway module

---
 modules/default.nix      |  4 +++-
 modules/sway/default.nix | 13 ++++++++++++
 modules/sway/options.nix |  3 +++
 modules/sway/sys.nix     | 45 ++++++++++++++++++++++++++++++++++++++++
 4 files changed, 64 insertions(+), 1 deletion(-)
 create mode 100644 modules/sway/default.nix
 create mode 100644 modules/sway/options.nix
 create mode 100644 modules/sway/sys.nix

diff --git a/modules/default.nix b/modules/default.nix
index 70dec76..bd5d292 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -1,3 +1,5 @@
 {
-  imports = [];
+  imports = [
+    ./sway
+  ];
 }
diff --git a/modules/sway/default.nix b/modules/sway/default.nix
new file mode 100644
index 0000000..9f49e7c
--- /dev/null
+++ b/modules/sway/default.nix
@@ -0,0 +1,13 @@
+{
+  config,
+  lib,
+  pkgs,
+  doctrine,
+  ...
+}:
+doctrine.lib.mkModule {
+  inherit config;
+  name = "sway";
+  sys = ./sys.nix;
+  options = ./options.nix;
+}
diff --git a/modules/sway/options.nix b/modules/sway/options.nix
new file mode 100644
index 0000000..e433039
--- /dev/null
+++ b/modules/sway/options.nix
@@ -0,0 +1,3 @@
+{...}: {
+  sys = {};
+}
diff --git a/modules/sway/sys.nix b/modules/sway/sys.nix
new file mode 100644
index 0000000..9c8b664
--- /dev/null
+++ b/modules/sway/sys.nix
@@ -0,0 +1,45 @@
+{
+  pkgs,
+  lib,
+  ...
+}: {
+  services.libinput.enable = true;
+  hardware.graphics.enable = true;
+
+  xdg.portal = {
+    enable = true;
+    wlr.enable = true;
+    extraPortals = with pkgs; [xdg-desktop-portal-gtk];
+    xdgOpenUsePortal = true;
+
+    # warning: xdg-desktop-portal 1.17 reworked how portal implementations are loaded, you
+    # should either set `xdg.portal.config` or `xdg.portal.configPackages`
+    # to specify which portal backend to use for the requested interface.
+    #
+    # https://github.com/flatpak/xdg-desktop-portal/blob/1.18.1/doc/portals.conf.rst.in
+    #
+    # If you simply want to keep the behaviour in < 1.17, which uses the first
+    # portal implementation found in lexicographical order, use the following:
+    #
+    # xdg.portal.config.common.default = "*";
+    config.common.default = "*";
+  };
+
+  environment = {
+    sessionVariables.NIXOS_OZONE_WL = "1";
+
+    systemPackages = with pkgs; [
+      qt5.qtwayland
+      qt6.qtwayland
+    ];
+  };
+
+  programs = {
+    gtklock = {
+      enable = lib.mkDefault true;
+
+      config = {};
+      modules = [];
+    };
+  };
+}

From 5d375d1d930631b960393b8de12eae16abbe01e0 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Wed, 6 Aug 2025 13:56:34 -0600
Subject: [PATCH 12/31] modules: automatically import all modules

---
 doctrine/lib/importAll.nix | 4 ++--
 modules/default.nix        | 6 ++----
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/doctrine/lib/importAll.nix b/doctrine/lib/importAll.nix
index 6acabe9..03c5330 100644
--- a/doctrine/lib/importAll.nix
+++ b/doctrine/lib/importAll.nix
@@ -1,6 +1,6 @@
 {lib}: {
   root,
-  exclude ? [],
+  exclude ? ["default"],
 }:
 with builtins;
 with lib;
@@ -10,7 +10,7 @@ with lib;
 
     isMatch = name: type:
       (hasSuffix ".nix" name || type == "directory")
-      && ! elem name (map basename exclude);
+      && ! elem (basename name) exclude;
 
     entry = name: _: {
       name = basename name;
diff --git a/modules/default.nix b/modules/default.nix
index bd5d292..0c0fd4c 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -1,5 +1,3 @@
-{
-  imports = [
-    ./sway
-  ];
+{doctrine, ...}: {
+  imports = builtins.attrValues (doctrine.lib.importAll {root = ./.;});
 }

From a8ef8e43b913adea7131ee678a4467e62b70d9b1 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Wed, 6 Aug 2025 13:57:25 -0600
Subject: [PATCH 13/31] modules/yubico: initialcommit

---
 modules/yubico/default.nix | 13 +++++++++++++
 modules/yubico/hm.nix      |  9 +++++++++
 modules/yubico/sys.nix     | 14 ++++++++++++++
 3 files changed, 36 insertions(+)
 create mode 100644 modules/yubico/default.nix
 create mode 100644 modules/yubico/hm.nix
 create mode 100644 modules/yubico/sys.nix

diff --git a/modules/yubico/default.nix b/modules/yubico/default.nix
new file mode 100644
index 0000000..71bed70
--- /dev/null
+++ b/modules/yubico/default.nix
@@ -0,0 +1,13 @@
+{
+  config,
+  lib,
+  pkgs,
+  doctrine,
+  ...
+}:
+doctrine.lib.mkModule {
+  inherit config;
+  name = "yubico";
+  hm = ./hm.nix;
+  sys = ./sys.nix;
+}
diff --git a/modules/yubico/hm.nix b/modules/yubico/hm.nix
new file mode 100644
index 0000000..8d06368
--- /dev/null
+++ b/modules/yubico/hm.nix
@@ -0,0 +1,9 @@
+{
+  pkgs,
+  lib,
+  ...
+}: {
+  home.packages = [
+    pkgs.yubikey-manager
+  ];
+}
diff --git a/modules/yubico/sys.nix b/modules/yubico/sys.nix
new file mode 100644
index 0000000..3cd009f
--- /dev/null
+++ b/modules/yubico/sys.nix
@@ -0,0 +1,14 @@
+{
+  pkgs,
+  lib,
+  ...
+}: {
+  environment.etc."pkcs11/modules/ykcs11".text = ''
+    module: ${pkgs.yubico-piv-tool}/lib/libykcs11.so
+  '';
+
+  services = {
+    pcscd.enable = true;
+    udev.packages = [pkgs.yubikey-personalization];
+  };
+}

From 2fe1f36eb96e6b6623d3dd4804cf1b0e3874708a Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Wed, 6 Aug 2025 13:58:07 -0600
Subject: [PATCH 14/31] doctrine/lib: refactor 'close' helper

---
 doctrine/lib/default.nix   | 16 +++++++++++++---
 doctrine/lib/importAll.nix |  3 ++-
 doctrine/lib/mk-module.nix | 14 +++++---------
 3 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/doctrine/lib/default.nix b/doctrine/lib/default.nix
index 1b03fe1..5e2eb44 100644
--- a/doctrine/lib/default.nix
+++ b/doctrine/lib/default.nix
@@ -3,8 +3,18 @@
   doctrine,
   pkgs,
 }: let
-  close = f: args: f (args // {inherit lib pkgs doctrine;});
+  close = vars: f: args:
+    (
+      if builtins.isPath f
+      then import f
+      else f
+    )
+    (args // vars);
+
+  closeLib = close {inherit lib;};
+  closeFull = close {inherit lib pkgs doctrine;};
 in {
-  importAll = pkgs.callPackage ./importAll.nix {};
-  mkModule = close (import ./mk-module.nix);
+  inherit close;
+  importAll = closeLib ./importAll.nix;
+  mkModule = closeFull ./mk-module.nix;
 }
diff --git a/doctrine/lib/importAll.nix b/doctrine/lib/importAll.nix
index 03c5330..423dd9c 100644
--- a/doctrine/lib/importAll.nix
+++ b/doctrine/lib/importAll.nix
@@ -1,4 +1,5 @@
-{lib}: {
+{
+  lib,
   root,
   exclude ? ["default"],
 }:
diff --git a/doctrine/lib/mk-module.nix b/doctrine/lib/mk-module.nix
index 79c24c5..c8b810d 100644
--- a/doctrine/lib/mk-module.nix
+++ b/doctrine/lib/mk-module.nix
@@ -26,13 +26,9 @@ in {
     lib.optionalAttrs (configFiles ? ${doctrine.namespace})
     (lib.mkIf cfg.enable configSet);
 
-  options = lib.optionalAttrs (options
-    != null
-    && optionsSet ? ${doctrine.namespace}) {
-    ${doctrine.prefix}.${name} =
-      optionsSet.${doctrine.namespace}
-      // {
-        enable = lib.mkEnableOption name;
-      };
-  };
+  options.${doctrine.prefix}.${name} =
+    lib.optionalAttrs (options != null && optionsSet ? ${doctrine.namespace}) optionsSet.${doctrine.namespace}
+    // {
+      enable = lib.mkEnableOption name;
+    };
 }

From 8cc6c13cf5ca0a8943e42a952eb852926669574c Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Wed, 6 Aug 2025 14:05:49 -0600
Subject: [PATCH 15/31] doctrine/lib: rename importAll.nix -> import-all.nix

---
 doctrine/lib/default.nix                       | 2 +-
 doctrine/lib/{importAll.nix => import-all.nix} | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename doctrine/lib/{importAll.nix => import-all.nix} (100%)

diff --git a/doctrine/lib/default.nix b/doctrine/lib/default.nix
index 5e2eb44..f189e21 100644
--- a/doctrine/lib/default.nix
+++ b/doctrine/lib/default.nix
@@ -15,6 +15,6 @@
   closeFull = close {inherit lib pkgs doctrine;};
 in {
   inherit close;
-  importAll = closeLib ./importAll.nix;
+  importAll = closeLib ./import-all.nix;
   mkModule = closeFull ./mk-module.nix;
 }
diff --git a/doctrine/lib/importAll.nix b/doctrine/lib/import-all.nix
similarity index 100%
rename from doctrine/lib/importAll.nix
rename to doctrine/lib/import-all.nix

From 3152a0f626e18e3306f72c3af752a317dbd01867 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Wed, 6 Aug 2025 14:15:41 -0600
Subject: [PATCH 16/31] modules/laptop: initial commit

---
 modules/laptop/default.nix | 10 ++++++++++
 modules/laptop/sys.nix     | 11 +++++++++++
 2 files changed, 21 insertions(+)
 create mode 100644 modules/laptop/default.nix
 create mode 100644 modules/laptop/sys.nix

diff --git a/modules/laptop/default.nix b/modules/laptop/default.nix
new file mode 100644
index 0000000..b908d47
--- /dev/null
+++ b/modules/laptop/default.nix
@@ -0,0 +1,10 @@
+{
+  config,
+  doctrine,
+  ...
+}:
+doctrine.lib.mkModule {
+  inherit config;
+  name = "laptop";
+  sys = ./sys.nix;
+}
diff --git a/modules/laptop/sys.nix b/modules/laptop/sys.nix
new file mode 100644
index 0000000..252f49c
--- /dev/null
+++ b/modules/laptop/sys.nix
@@ -0,0 +1,11 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  services = {
+    tlp.enable = lib.mkDefault true;
+    upower.enable = lib.mkDefault true;
+  };
+}

From 312101337646c68c837fc9222ac273386cd4108c Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Wed, 6 Aug 2025 14:23:00 -0600
Subject: [PATCH 17/31] doctrine/lib: support module dependencies

---
 doctrine/lib/mk-module.nix | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/doctrine/lib/mk-module.nix b/doctrine/lib/mk-module.nix
index c8b810d..fa1cd37 100644
--- a/doctrine/lib/mk-module.nix
+++ b/doctrine/lib/mk-module.nix
@@ -1,12 +1,14 @@
 {
+  # The first few arguments are implicitly passed by the 'close' helper
+  lib,
+  pkgs,
+  doctrine,
   name,
+  config,
   hm ? null,
   sys ? null,
   options ? null,
-  lib,
-  config,
-  pkgs,
-  doctrine,
+  requires ? [],
 }: let
   optionsSet = import options {
     inherit config lib pkgs cfg name doctrine;
@@ -24,7 +26,17 @@
 in {
   config =
     lib.optionalAttrs (configFiles ? ${doctrine.namespace})
-    (lib.mkIf cfg.enable configSet);
+    (lib.mkIf cfg.enable (lib.mkMerge [
+      configSet
+      {
+        assertions =
+          map (dependency: {
+            assertion = cfg.enable -> config.${doctrine.prefix}.${dependency}.enable;
+            message = "${doctrine.prefix}.${name}.enable requires ${doctrine.prefix}.${dependency}.enable";
+          })
+          requires;
+      }
+    ]));
 
   options.${doctrine.prefix}.${name} =
     lib.optionalAttrs (options != null && optionsSet ? ${doctrine.namespace}) optionsSet.${doctrine.namespace}

From 4a7e6f545c569c59a92ba1f5f2c7afd29caf00b2 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Wed, 6 Aug 2025 14:25:27 -0600
Subject: [PATCH 18/31] doctrine/lib: add optional prefix/namespace args to
 mkModule

---
 doctrine/lib/mk-module.nix | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/doctrine/lib/mk-module.nix b/doctrine/lib/mk-module.nix
index fa1cd37..f76ccfe 100644
--- a/doctrine/lib/mk-module.nix
+++ b/doctrine/lib/mk-module.nix
@@ -9,12 +9,14 @@
   sys ? null,
   options ? null,
   requires ? [],
+  prefix ? doctrine.prefix,
+  namespace ? doctrine.namespace,
 }: let
   optionsSet = import options {
     inherit config lib pkgs cfg name doctrine;
   };
 
-  configSet = import configFiles.${doctrine.namespace} {
+  configSet = import configFiles.${namespace} {
     inherit config lib pkgs doctrine cfg;
   };
 
@@ -22,24 +24,24 @@
     inherit sys hm;
   };
 
-  cfg = config.${doctrine.prefix}.${name};
+  cfg = config.${prefix}.${name};
 in {
   config =
-    lib.optionalAttrs (configFiles ? ${doctrine.namespace})
+    lib.optionalAttrs (configFiles ? ${namespace})
     (lib.mkIf cfg.enable (lib.mkMerge [
       configSet
       {
         assertions =
           map (dependency: {
-            assertion = cfg.enable -> config.${doctrine.prefix}.${dependency}.enable;
-            message = "${doctrine.prefix}.${name}.enable requires ${doctrine.prefix}.${dependency}.enable";
+            assertion = cfg.enable -> config.${prefix}.${dependency}.enable;
+            message = "${prefix}.${name}.enable requires ${prefix}.${dependency}.enable";
           })
           requires;
       }
     ]));
 
-  options.${doctrine.prefix}.${name} =
-    lib.optionalAttrs (options != null && optionsSet ? ${doctrine.namespace}) optionsSet.${doctrine.namespace}
+  options.${prefix}.${name} =
+    lib.optionalAttrs (options != null && optionsSet ? ${namespace}) optionsSet.${namespace}
     // {
       enable = lib.mkEnableOption name;
     };

From a69723cf87c4678d5e89aa6ce7090b9ad0605690 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Wed, 6 Aug 2025 14:25:43 -0600
Subject: [PATCH 19/31] modules/thinkpad: initial commit

---
 modules/thinkpad/default.nix | 11 +++++++++++
 modules/thinkpad/sys.nix     | 30 ++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+)
 create mode 100644 modules/thinkpad/default.nix
 create mode 100644 modules/thinkpad/sys.nix

diff --git a/modules/thinkpad/default.nix b/modules/thinkpad/default.nix
new file mode 100644
index 0000000..e210947
--- /dev/null
+++ b/modules/thinkpad/default.nix
@@ -0,0 +1,11 @@
+{
+  config,
+  doctrine,
+  ...
+}:
+doctrine.lib.mkModule {
+  inherit config;
+  name = "thinkpad";
+  sys = ./sys.nix;
+  requires = ["laptop"];
+}
diff --git a/modules/thinkpad/sys.nix b/modules/thinkpad/sys.nix
new file mode 100644
index 0000000..bc96146
--- /dev/null
+++ b/modules/thinkpad/sys.nix
@@ -0,0 +1,30 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  # For suspending to RAM to work, set Config -> Power -> Sleep State to "Linux" in EFI.
+  # See https://wiki.archlinux.org/index.php/Lenovo_ThinkPad_X1_Carbon_(Gen_6)#Suspend_issues
+  # Fingerprint sensor requires a firmware-update to work.
+
+  boot = {
+    extraModulePackages = with config.boot.kernelPackages; [acpi_call];
+    extraModprobeConfig = "options iwlwifi 11n_disable=1 wd_disable=1";
+
+    # acpi_call makes tlp work for newer thinkpads
+    kernelModules = ["acpi_call"];
+
+    # Force use of the thinkpad_acpi driver for backlight control.
+    # This allows the backlight save/load systemd service to work.
+    kernelParams = ["acpi_backlight=native"];
+  };
+
+  hardware.firmware = [pkgs.sof-firmware];
+
+  services = {
+    fprintd.enable = lib.mkDefault true;
+    thinkfan.enable = lib.mkDefault true;
+    tp-auto-kbbl.enable = lib.mkDefault true;
+  };
+}

From e72efe6b594d86b8b16a111e5fbe5e5aae3f3013 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Wed, 6 Aug 2025 14:46:59 -0600
Subject: [PATCH 20/31] pkgs/athena-bccr: initial commit

---
 ...-CheckUpdatePlugin-from-default-list.patch |  25 ++
 pkgs/athena-bccr/LaunchGaudi.java             |  12 +
 pkgs/athena-bccr/default.nix                  |  30 +++
 pkgs/athena-bccr/firmador.nix                 |  57 +++++
 pkgs/athena-bccr/gaudi-env.nix                |  62 +++++
 pkgs/athena-bccr/releases.nix                 |  12 +
 pkgs/athena-bccr/unwrapped.nix                | 226 ++++++++++++++++++
 pkgs/default.nix                              |   3 +-
 8 files changed, 425 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/athena-bccr/0001-Remove-CheckUpdatePlugin-from-default-list.patch
 create mode 100644 pkgs/athena-bccr/LaunchGaudi.java
 create mode 100644 pkgs/athena-bccr/default.nix
 create mode 100644 pkgs/athena-bccr/firmador.nix
 create mode 100644 pkgs/athena-bccr/gaudi-env.nix
 create mode 100644 pkgs/athena-bccr/releases.nix
 create mode 100644 pkgs/athena-bccr/unwrapped.nix

diff --git a/pkgs/athena-bccr/0001-Remove-CheckUpdatePlugin-from-default-list.patch b/pkgs/athena-bccr/0001-Remove-CheckUpdatePlugin-from-default-list.patch
new file mode 100644
index 0000000..e7fc5d5
--- /dev/null
+++ b/pkgs/athena-bccr/0001-Remove-CheckUpdatePlugin-from-default-list.patch
@@ -0,0 +1,25 @@
+From 5e7eb46f46af6a29a2aea19db722ebc28baede25 Mon Sep 17 00:00:00 2001
+From: Alejandro Soto <alejandro@34project.org>
+Date: Sat, 21 Jun 2025 22:37:19 -0600
+Subject: [PATCH] Remove CheckUpdatePlugin from default list
+
+---
+ src/main/java/cr/libre/firmador/Settings.java | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/main/java/cr/libre/firmador/Settings.java b/src/main/java/cr/libre/firmador/Settings.java
+index e5ddf01..a028d6e 100644
+--- a/src/main/java/cr/libre/firmador/Settings.java
++++ b/src/main/java/cr/libre/firmador/Settings.java
+@@ -81,7 +81,7 @@ public class Settings {
+ 
+     public Settings() {
+         activePlugins.add("cr.libre.firmador.plugins.DummyPlugin");
+-        activePlugins.add("cr.libre.firmador.plugins.CheckUpdatePlugin");
++        // activePlugins.add("cr.libre.firmador.plugins.CheckUpdatePlugin");
+         availablePlugins.add("cr.libre.firmador.plugins.DummyPlugin");
+         availablePlugins.add("cr.libre.firmador.plugins.CheckUpdatePlugin");
+     }
+-- 
+2.49.0
+
diff --git a/pkgs/athena-bccr/LaunchGaudi.java b/pkgs/athena-bccr/LaunchGaudi.java
new file mode 100644
index 0000000..e4bcdbf
--- /dev/null
+++ b/pkgs/athena-bccr/LaunchGaudi.java
@@ -0,0 +1,12 @@
+// Los del BCCR no se molestaron en ponerle un main al Agente Gaudi porque el
+// actualizador (que a su vez sí tiene main) carga el jar en memoria y crea una
+// instancia de Inicializador usando reflexión. El actualizador no es relevante
+// en Nix. En todo caso, dicho actualizador es sumamente frágil y me daría
+// demasiada pereza arreglarlo, así que en su lugar usamos este stub para
+// launchear Gaudi.
+
+public class LaunchGaudi {
+	public static void main(String[] args) {
+		new InicializadorCliente.Inicializador("");
+	}
+}
diff --git a/pkgs/athena-bccr/default.nix b/pkgs/athena-bccr/default.nix
new file mode 100644
index 0000000..a5f79ca
--- /dev/null
+++ b/pkgs/athena-bccr/default.nix
@@ -0,0 +1,30 @@
+{
+  callPackage,
+  lib,
+}: let
+  latest = "deb64-rev26";
+
+  releases = lib.mapAttrs (name: release: release // {name = name;}) (import ./releases.nix);
+
+  overrideUnwrapped = default: new: let
+    args = default // new;
+    unwrappedPkgs = lib.filterAttrs (name: _: ! lib.elem name ["override" "overrideDerivation"]) (callPackage ./unwrapped.nix args);
+  in
+    lib.fix (unwrapped: lib.mapAttrs (_: pkg: callPackage pkg unwrapped) unwrappedPkgs)
+    // {
+      override = overrideUnwrapped args;
+    };
+
+  pkgsForRelease = release: let
+    ase-pkcs11 = unwrapped.ase-idprotect.lib;
+    libasep11 = "${ase-pkcs11}/lib/x64-athena/libASEP11.so";
+    unwrapped = overrideUnwrapped {inherit release;} {};
+  in {
+    inherit ase-pkcs11 libasep11;
+    inherit (unwrapped) ase-idprotect bccr-cacerts;
+
+    gaudi = callPackage ./gaudi-env.nix {inherit unwrapped;};
+    firmador = callPackage ./firmador.nix {inherit libasep11;};
+  };
+in
+  lib.mapAttrs (_: pkgsForRelease) (releases // {latest = releases.${latest};})
diff --git a/pkgs/athena-bccr/firmador.nix b/pkgs/athena-bccr/firmador.nix
new file mode 100644
index 0000000..d280b56
--- /dev/null
+++ b/pkgs/athena-bccr/firmador.nix
@@ -0,0 +1,57 @@
+{
+  fetchgit,
+  lib,
+  makeWrapper,
+  maven,
+  openjdk,
+  wrapGAppsHook,
+  libasep11 ? null,
+}: let
+  jdk = openjdk.override {
+    enableJavaFX = true;
+  };
+
+  version = "1.9.8";
+in
+  maven.buildMavenPackage {
+    pname = "firmador";
+    inherit version;
+
+    src = fetchgit {
+      url = "https://codeberg.org/firmador/firmador";
+      rev = version;
+      hash = "sha256-xdiVPjihRADPK4nG+WQHWsDzVYLCeN6ouQ6SDtjf1qQ=";
+    };
+
+    patches = [
+      ./0001-Remove-CheckUpdatePlugin-from-default-list.patch
+    ];
+
+    mvnHash = "sha256-h1zoStTgaE7toWWKq0Y0ahOORyltChwjmaMYjLgs1VE=";
+
+    nativeBuildInputs = [
+      makeWrapper
+      wrapGAppsHook
+    ];
+
+    postPatch = lib.optionalString (libasep11 != null) ''
+      sed -i 's@/usr/lib/x64-athena/libASEP11.so@${libasep11}@g' src/main/java/cr/libre/firmador/CRSigner.java
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/bin $out/share/java
+      install -Dm644 target/firmador.jar $out/share/java
+
+      makeWrapper ${jdk}/bin/java $out/bin/firmador \
+        --add-flags "-jar $out/share/java/firmador.jar"
+
+      runHook postInstall
+    '';
+
+    meta = {
+      homepage = "https://firmador.libre.cr";
+      license = lib.licenses.gpl3Plus;
+    };
+  }
diff --git a/pkgs/athena-bccr/gaudi-env.nix b/pkgs/athena-bccr/gaudi-env.nix
new file mode 100644
index 0000000..0ca1b82
--- /dev/null
+++ b/pkgs/athena-bccr/gaudi-env.nix
@@ -0,0 +1,62 @@
+{
+  buildFHSEnv,
+  curl,
+  lib,
+  writeShellScriptBin,
+  gaudiHash ? null,
+  unwrapped,
+}: let
+  unwrappedWithGaudi = unwrapped.override {inherit gaudiHash;};
+in
+  buildFHSEnv {
+    name = "gaudi";
+
+    targetPkgs = pkgs: [
+      unwrappedWithGaudi.ase-idprotect.lib
+      unwrappedWithGaudi.gaudi
+
+      (writeShellScriptBin "launch-gaudi" ''
+        set -o errexit
+        set -o pipefail
+        set -o nounset
+
+        PATH="${lib.makeBinPath [curl]}:$PATH"
+
+        echo "$0: testing for incompatible releases..." >&2
+
+        jar_name=bccr-firma-fva-clienteMultiplataforma.jar
+        url="https://www.firmadigital.go.cr/Bccr.Firma.Fva.Actualizador.ClienteFirmadorJava//recursosLiberica17/actualizador/$jar_name"
+        ca_file="${unwrappedWithGaudi.bccr-cacerts}/root-ca.pem"
+        url_hash=$(curl -sS --cacert "$ca_file" "$url" | sha256sum | cut -d' ' -f1)
+        jar_path="${unwrappedWithGaudi.gaudi}/share/java/$jar_name"
+        jar_hash=$(sha256sum "$jar_path" | cut -d' ' -f1)
+
+        if [ "$url_hash" != "$jar_hash" ]; then
+          last_modified=$(curl -sS --head --cacert "$ca_file" "$url" | grep -i '^last-modified:' | head -1)
+
+          echo "$0: sha256 mismatch for $jar_path due to server-side update" >&2
+          echo "$0:   expected:      $url_hash" >&2
+          echo "$0:   actual:        $jar_hash" >&2
+          echo "$0:   $last_modified" >&2
+          echo "$0: run the following to download the new client JAR, then update your derivation:" >&2
+          echo "$0: \$ ${unwrappedWithGaudi.update-gaudi}" >&2
+
+          exit 1
+        fi
+
+        cache_path_1="''${XDG_CACHE_HOME:-$HOME/.cache}/Agente-GAUDI"
+        cache_path_2="''${XDG_CACHE_HOME:-$HOME/.cache}/Firmador-BCCR"
+
+        for cache_path in "$cache_path_1" "$cache_path_2"; do
+          mkdir -p "$cache_path"
+          ln -sf -- ${unwrappedWithGaudi.gaudi}/share/java/bccr-firma-fva-clienteMultiplataforma.jar "$cache_path"
+        done
+
+        cp -f --no-preserve=mode -t "$cache_path_1" -- "${unwrappedWithGaudi.gaudi}/share/java/config.properties"
+
+        exec gaudi
+      '')
+    ];
+
+    runScript = "launch-gaudi";
+  }
diff --git a/pkgs/athena-bccr/releases.nix b/pkgs/athena-bccr/releases.nix
new file mode 100644
index 0000000..e965172
--- /dev/null
+++ b/pkgs/athena-bccr/releases.nix
@@ -0,0 +1,12 @@
+{
+  "deb64-rev26" = {
+    # nix hash convert --hash-algo sha256 --from base16 --to sri $(sha256sum sfd_ClientesLinux_DEB64_Rev26.zip | cut -d' ' -f1)
+    hash = "sha256-ZPWP9TqJQ5coJAPzUSiaXKVItBWlqFM4smCjOf+gqQM=";
+    basename = "sfd_ClientesLinux_DEB64_Rev26";
+
+    srcPaths = {
+      gaudi = "Firma Digital/Agente GAUDI/agente-gaudi_20.0_amd64.deb";
+      idprotect = "Firma Digital/PinTool/IDProtect PINTool 7.24.02/DEB/idprotectclient_7.24.02-0_amd64.deb";
+    };
+  };
+}
diff --git a/pkgs/athena-bccr/unwrapped.nix b/pkgs/athena-bccr/unwrapped.nix
new file mode 100644
index 0000000..d6f3f38
--- /dev/null
+++ b/pkgs/athena-bccr/unwrapped.nix
@@ -0,0 +1,226 @@
+{
+  lib,
+  requireFile,
+  release,
+  gaudiHash ? null,
+  ...
+}: let
+  inherit (release) srcPaths;
+
+  src = requireFile {
+    url = "https://soportefirmadigital.com";
+    name = "${release.basename}.zip";
+
+    inherit (release) hash;
+  };
+
+  gaudiUpdateSrc = {update-gaudi}:
+    requireFile {
+      url = "${update-gaudi}";
+      name = "gaudi-update-${release.name}.zip";
+
+      hash = gaudiHash;
+    };
+
+  moduleFromDeb = name: args @ {
+    stdenv,
+    dpkg,
+    unzip,
+    srcPath,
+    ...
+  }:
+    stdenv.mkDerivation ({
+        pname = "${name}-unwrapped";
+        version = release.name;
+
+        inherit src;
+
+        nativeBuildInputs = [dpkg unzip] ++ (args.nativeBuildInputs or []);
+
+        postUnpack = ''
+          dpkg -x ${lib.escapeShellArg "${release.basename}/${srcPath}"} ${lib.escapeShellArg release.basename}
+        '';
+      }
+      // lib.removeAttrs args ["stdenv" "dpkg" "unzip" "srcPath" "nativeBuildInputs"]);
+in {
+  ase-idprotect = {
+    autoPatchelfHook,
+    dpkg,
+    fontconfig,
+    freetype,
+    pcsclite,
+    stdenv,
+    unzip,
+    xorg,
+    zlib,
+    ...
+  }:
+    moduleFromDeb "ase-idprotect" {
+      inherit dpkg stdenv unzip;
+      srcPath = srcPaths.idprotect;
+
+      buildInputs = [
+        fontconfig
+        freetype
+        pcsclite
+        stdenv.cc.cc.lib
+        xorg.libX11
+        xorg.libXext
+        zlib
+      ];
+
+      nativeBuildInputs = [
+        autoPatchelfHook
+      ];
+
+      outputs = ["out" "lib"];
+
+      installPhase = ''
+        runHook preInstall
+
+        install -m755 -d $out/bin $lib/{etc,lib/x64-athena}
+        install -m755 usr/bin/IDProtect{_Manager,PINTool} $out/bin/
+        install -m755 usr/lib/x64-athena/* $lib/lib/x64-athena
+        cp -r etc/Athena $lib/etc/Athena
+
+        runHook postInstall
+      '';
+
+      preFixup = ''
+        patchelf --set-rpath $lib/lib/x64-athena $out/bin/*
+      '';
+    };
+
+  gaudi = {
+    autoPatchelfHook,
+    dpkg,
+    makeWrapper,
+    openjdk,
+    pkgs,
+    stdenv,
+    unzip,
+    writeShellScriptBin,
+    update-gaudi,
+    ...
+  }: let
+    jdk = openjdk.override {
+      enableJavaFX = true;
+      openjfx_jdk = pkgs."openjfx${lib.head (lib.splitString "." openjdk.version)}".override {withWebKit = true;};
+    };
+
+    fakeSudo = writeShellScriptBin "sudo" "";
+    gaudiUpdate = gaudiUpdateSrc {inherit update-gaudi;};
+  in
+    moduleFromDeb "gaudi" {
+      inherit dpkg stdenv unzip;
+      srcPath = srcPaths.gaudi;
+
+      nativeBuildInputs = [
+        autoPatchelfHook
+        jdk
+        makeWrapper
+      ];
+
+      preBuild = lib.optionalString (gaudiHash != null) ''
+        unzip -o ${gaudiUpdate} -d opt/Agente-GAUDI/lib/app
+      '';
+
+      buildPhase = ''
+        runHook preBuild
+
+        install -m755 -d $out/{bin,opt/Firmador-BCCR/lib}
+        cp -r opt/Agente-GAUDI/lib/app $out/opt/Firmador-BCCR/lib/app
+
+        # Preserves the original filename and avoids <hash>-LaunchGaudi.java
+        ln -s ${./LaunchGaudi.java} LaunchGaudi.java
+
+        javac \
+          -cp opt/Agente-GAUDI/lib/app/bccr-firma-fva-clienteMultiplataforma.jar \
+          -d $out/opt/Firmador-BCCR/lib/app \
+          LaunchGaudi.java
+
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        install -m755 -d $out/{share,opt/Firmador-BCCR/lib/runtime/lib}
+        install -m755 -D opt/Agente-GAUDI/bin/Agente-GAUDI $out/opt/Firmador-BCCR/bin/Agente-GAUDI
+        install -m755 -D opt/Agente-GAUDI/lib/libapplauncher.so $out/opt/Firmador-BCCR/lib/libapplauncher.so
+
+        ln -s ../opt/Firmador-BCCR/lib/app $out/share/java
+        ln -s Firmador-BCCR $out/opt/Agente-GAUDI
+        ln -s ${jdk}/lib/openjdk/lib/libjli.so $out/opt/Firmador-BCCR/lib/runtime/lib/libjli.so
+
+        makeWrapper ${jdk}/bin/java $out/bin/gaudi \
+          --prefix PATH : ${fakeSudo}/bin \
+          --add-flags "-cp $out/share/java:$out/share/java/bccr-firma-fva-clienteMultiplataforma.jar" \
+          --add-flags "-Djavax.net.ssl.trustStore=$out/opt/Firmador-BCCR/lib/app/bccr.cacerts" \
+          --add-flags "LaunchGaudi"
+
+        runHook postInstall
+      '';
+    };
+
+  bccr-cacerts = {
+    openssl,
+    stdenv,
+    unzip,
+    ...
+  }:
+    stdenv.mkDerivation {
+      pname = "bccr-cacerts";
+      version = release.name;
+
+      inherit src;
+
+      nativeBuildInputs = [
+        openssl
+        unzip
+      ];
+
+      installPhase = ''
+        cp -r Firma\ Digital/Certificados $out
+        openssl x509 -in $out/CA\ RAIZ\ NACIONAL\ -\ COSTA\ RICA\ v2.crt -out $out/root-ca.pem -text
+      '';
+    };
+
+  update-gaudi = {
+    wget,
+    writeShellScript,
+    zip,
+    bccr-cacerts,
+    ...
+  }:
+    writeShellScript "update-gaudi" ''
+      set -o errexit
+      set -o pipefail
+      set -o nounset
+
+      temp_dir="$(mktemp -d)"
+      trap 'cd / && rm -rf -- "$temp_dir"' EXIT
+      cd "$temp_dir"
+
+      PATH="${lib.makeBinPath [wget zip]}:$PATH"
+      ca_cert="${bccr-cacerts}/root-ca.pem"
+      base_url="https://www.firmadigital.go.cr/Bccr.Firma.Fva.Actualizador.ClienteFirmadorJava//recursosLiberica17/actualizador"
+
+      wget --ca-certificate="$ca_cert" "$base_url/bccr.cacerts"
+      wget --ca-certificate="$ca_cert" "$base_url/config.properties"
+      wget --ca-certificate="$ca_cert" "$base_url/bccr-firma-fva-clienteMultiplataforma.jar"
+      wget --ca-certificate="$ca_cert" "$base_url/ServicioActualizadorClienteBCCR.jar"
+
+      # https://gist.github.com/stokito/c588b8d6a6a0aee211393d68eea678f2
+      TZ=UTC find . -exec touch --no-dereference -a -m -t 198002010000.00 {} +
+      zip_path="$PWD/gaudi-update-${release.name}.zip"
+      TZ=UTC zip -q --move --recurse-paths --symlinks -X "$zip_path" .
+      TZ=UTC touch -a -m -t 198002010000.00 "$zip_path"
+
+      set -x
+      nix-store --add-fixed sha256 "$zip_path"
+      set +x
+
+      echo -e "\ngaudiHash: $(nix-hash --to-sri --type sha256 $(sha256sum "$zip_path" | cut -d' ' -f1))"
+    '';
+}
diff --git a/pkgs/default.nix b/pkgs/default.nix
index 454b81d..484ca77 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -2,9 +2,8 @@ final: prev:
 with prev.lib; let
   inherit (final) callPackage;
 in {
-  lib = callPackage ./lib {};
-
   override = {};
 
+  athena-bccr = callPackage ./athena-bccr {};
   spliit = callPackage ./spliit {};
 }

From c651b8c4706cfc750303db12ae19e58164a6bebb Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Wed, 6 Aug 2025 14:59:33 -0600
Subject: [PATCH 21/31] modules/athena-bccr: initial commit

---
 modules/athena-bccr/default.nix | 14 +++++++++++++
 modules/athena-bccr/hm.nix      | 14 +++++++++++++
 modules/athena-bccr/options.nix | 30 ++++++++++++++++++++++++++++
 modules/athena-bccr/sys.nix     | 35 +++++++++++++++++++++++++++++++++
 4 files changed, 93 insertions(+)
 create mode 100644 modules/athena-bccr/default.nix
 create mode 100644 modules/athena-bccr/hm.nix
 create mode 100644 modules/athena-bccr/options.nix
 create mode 100644 modules/athena-bccr/sys.nix

diff --git a/modules/athena-bccr/default.nix b/modules/athena-bccr/default.nix
new file mode 100644
index 0000000..93c5660
--- /dev/null
+++ b/modules/athena-bccr/default.nix
@@ -0,0 +1,14 @@
+{
+  config,
+  lib,
+  pkgs,
+  doctrine,
+  ...
+}:
+doctrine.lib.mkModule {
+  inherit config;
+  name = "athena-bccr";
+  hm = ./hm.nix;
+  sys = ./sys.nix;
+  options = ./options.nix;
+}
diff --git a/modules/athena-bccr/hm.nix b/modules/athena-bccr/hm.nix
new file mode 100644
index 0000000..0678e3c
--- /dev/null
+++ b/modules/athena-bccr/hm.nix
@@ -0,0 +1,14 @@
+{
+  pkgs,
+  lib,
+  cfg,
+  doctrine,
+  ...
+}: let
+  athena = pkgs.${doctrine.prefix}.athena-bccr.${cfg.release};
+in {
+  home.packages = [
+    athena.firmador
+    (athena.gaudi.override {inherit (cfg) gaudiHash;})
+  ];
+}
diff --git a/modules/athena-bccr/options.nix b/modules/athena-bccr/options.nix
new file mode 100644
index 0000000..eb61cf5
--- /dev/null
+++ b/modules/athena-bccr/options.nix
@@ -0,0 +1,30 @@
+{lib, ...}:
+with lib.types; {
+  hm = {
+    gaudiHash = lib.mkOption {
+      type = nullOr str;
+      default = null;
+      description = "hash of the Gaudi client";
+    };
+
+    release = lib.mkOption {
+      type = str;
+      default = "latest";
+      description = "pinned athena-bccr release tag";
+    };
+  };
+
+  sys = {
+    group = lib.mkOption {
+      type = str;
+      default = "users";
+      description = "user group with full access to the smartcard reader";
+    };
+
+    release = lib.mkOption {
+      type = str;
+      default = "latest";
+      description = "pinned athena-bccr release tag";
+    };
+  };
+}
diff --git a/modules/athena-bccr/sys.nix b/modules/athena-bccr/sys.nix
new file mode 100644
index 0000000..631185d
--- /dev/null
+++ b/modules/athena-bccr/sys.nix
@@ -0,0 +1,35 @@
+{
+  pkgs,
+  lib,
+  cfg,
+  doctrine,
+  ...
+}: let
+  athena = pkgs.${doctrine.prefix}.athena-bccr.${cfg.release};
+in {
+  environment = {
+    etc = {
+      "Athena".source = "${athena.ase-pkcs11}/etc/Athena";
+
+      "pkcs11/modules/asep11".text = ''
+        module: ${athena.libasep11}
+      '';
+    };
+
+    systemPackages = [athena.ase-pkcs11];
+  };
+
+  #FIXME: Extremadamente peligroso si BCCR o MICITT caen, investigar política nacional de root CA
+  security.pki.certificateFiles = ["${athena.bccr-cacerts}/root-ca.pem"];
+
+  services = {
+    pcscd.enable = true;
+
+    udev.extraRules = ''
+      # Athena Smartcard Solutions, Inc. ASEDrive V3CR
+      ATTRS{idVendor}=="0dc3", ATTRS{idProduct}=="1004", MODE="660", GROUP="${cfg.group}", TAG+="uaccess"
+    '';
+  };
+
+  users.groups.${cfg.group} = {};
+}

From 7daa3d91b377bbe38265ddb941ef0a1321193714 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Sun, 24 Aug 2025 18:49:13 -0600
Subject: [PATCH 22/31] trivionomicon/doctrine: add support for overriding the
 prefix

---
 doctrine/default.nix       | 18 +++++++++++-------
 doctrine/lib/default.nix   | 13 ++++++++-----
 doctrine/lib/mk-module.nix | 15 +++++++++------
 3 files changed, 28 insertions(+), 18 deletions(-)

diff --git a/doctrine/default.nix b/doctrine/default.nix
index b4c72b8..0d50d49 100644
--- a/doctrine/default.nix
+++ b/doctrine/default.nix
@@ -1,12 +1,16 @@
 {
+  lib ? pkgs.lib,
   pkgs,
-  namespace,
+  prefix ? "trivium",
+  namespace ? null,
 }: let
-  doctrine = {
-    lib = import ./lib {inherit lib pkgs doctrine;};
-    prefix = "trivium";
-    inherit namespace;
-  };
-  inherit (pkgs) lib;
+  doctrine =
+    {
+      lib = import ./lib {inherit lib pkgs doctrine;};
+      inherit namespace prefix;
+    }
+    // lib.optionalAttrs (pkgs != null) {
+      inherit pkgs;
+    };
 in
   doctrine
diff --git a/doctrine/lib/default.nix b/doctrine/lib/default.nix
index f189e21..e2d84b8 100644
--- a/doctrine/lib/default.nix
+++ b/doctrine/lib/default.nix
@@ -13,8 +13,11 @@
 
   closeLib = close {inherit lib;};
   closeFull = close {inherit lib pkgs doctrine;};
-in {
-  inherit close;
-  importAll = closeLib ./import-all.nix;
-  mkModule = closeFull ./mk-module.nix;
-}
+in
+  {
+    inherit close;
+    importAll = closeLib ./import-all.nix;
+  }
+  // lib.optionalAttrs (doctrine.namespace != null) {
+    mkModule = closeFull ./mk-module.nix;
+  }
diff --git a/doctrine/lib/mk-module.nix b/doctrine/lib/mk-module.nix
index f76ccfe..ffbe6bc 100644
--- a/doctrine/lib/mk-module.nix
+++ b/doctrine/lib/mk-module.nix
@@ -11,14 +11,17 @@
   requires ? [],
   prefix ? doctrine.prefix,
   namespace ? doctrine.namespace,
+  passthru ? {},
 }: let
-  optionsSet = import options {
-    inherit config lib pkgs cfg name doctrine;
-  };
+  optionsSet = import options (passthru
+    // {
+      inherit config lib pkgs cfg name doctrine;
+    });
 
-  configSet = import configFiles.${namespace} {
-    inherit config lib pkgs doctrine cfg;
-  };
+  configSet = import configFiles.${namespace} (passthru
+    // {
+      inherit config lib pkgs doctrine cfg;
+    });
 
   configFiles = lib.filterAttrs (k: v: v != null) {
     inherit sys hm;

From 111d3dabf21e6b413e4cf91136a8fec720a58f28 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Sun, 24 Aug 2025 18:49:47 -0600
Subject: [PATCH 23/31] trivionomicon/modules/nix-registry: initial commit

---
 modules/nix-registry/default.nix | 16 ++++++++++++++++
 modules/nix-registry/hm.nix      | 23 +++++++++++++++++++++++
 modules/nix-registry/options.nix | 19 +++++++++++++++++++
 3 files changed, 58 insertions(+)
 create mode 100644 modules/nix-registry/default.nix
 create mode 100644 modules/nix-registry/hm.nix
 create mode 100644 modules/nix-registry/options.nix

diff --git a/modules/nix-registry/default.nix b/modules/nix-registry/default.nix
new file mode 100644
index 0000000..8406d88
--- /dev/null
+++ b/modules/nix-registry/default.nix
@@ -0,0 +1,16 @@
+{
+  config,
+  lib,
+  pkgs,
+  doctrine,
+  flakes,
+  ...
+}:
+doctrine.lib.mkModule {
+  inherit config;
+  name = "nix-registry";
+  hm = ./hm.nix;
+  options = ./options.nix;
+
+  passthru = {inherit flakes;};
+}
diff --git a/modules/nix-registry/hm.nix b/modules/nix-registry/hm.nix
new file mode 100644
index 0000000..1c57e95
--- /dev/null
+++ b/modules/nix-registry/hm.nix
@@ -0,0 +1,23 @@
+{
+  pkgs,
+  lib,
+  cfg,
+  flakes,
+  ...
+}: let
+  registryName = name:
+    if name == "self"
+    then cfg.renameSelf
+    else name;
+
+  registryFilter = {
+    nixpkgs = true;
+    unstable = true;
+    self = cfg.renameSelf != null;
+  };
+in {
+  nix.registry =
+    lib.mapAttrs'
+    (name: value: lib.nameValuePair (registryName name) {flake = value;})
+    (lib.filterAttrs (name: _: registryFilter.${name} or cfg.allInputs) flakes);
+}
diff --git a/modules/nix-registry/options.nix b/modules/nix-registry/options.nix
new file mode 100644
index 0000000..e8898ec
--- /dev/null
+++ b/modules/nix-registry/options.nix
@@ -0,0 +1,19 @@
+{lib, ...}:
+with lib.types; {
+  hm = {
+    allInputs = mkOption {
+      type = bool;
+      default = default;
+      description = ''
+        Include all flake inputs. If false, only 'nixpkgs' and 'unstable'
+        (if available) will be added to the flake registry by default.
+      '';
+    };
+
+    renameSelf = mkOption {
+      type = nullOr str;
+      default = "self";
+      description = "Registry name to use for the 'self' input";
+    };
+  };
+}

From bf39923f9ce5cd14c7fcbc40474d01f2f87fb10f Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Sun, 24 Aug 2025 18:51:05 -0600
Subject: [PATCH 24/31] trivionomicon/flake: rewrite broken implementation of
 mkSystemFlake

---
 flake.nix | 205 ++++++++++++++++++++++++++++++------------------------
 1 file changed, 113 insertions(+), 92 deletions(-)

diff --git a/flake.nix b/flake.nix
index 1a20e9e..7ab10c5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -16,15 +16,24 @@
         "${namespace}" = builtins.removeAttrs overlayPkgs ["override"];
       }
       // (overlayPkgs.override or {});
+
+    doctrineNoPkgs = self.lib.mkDoctrine {
+      lib = nixpkgs.lib;
+      pkgs = null;
+    };
   in
-    flake-utils.lib.eachDefaultSystem (system: {
-      formatter = (import nixpkgs {inherit system;}).alejandra;
+    flake-utils.lib.eachDefaultSystem (system: let
+      pkgs = import nixpkgs {inherit system;};
+    in {
+      formatter = pkgs.alejandra;
 
       packages =
         (import nixpkgs {
           inherit system;
-          overlays = [(mapOverlayOverride "local" (import ./pkgs))];
-        }).local;
+          overlays = [(mapOverlayOverride doctrineNoPkgs.prefix (import ./pkgs))];
+        }).${
+          doctrineNoPkgs.prefix
+        };
     })
     // {
       templates = let
@@ -39,33 +48,37 @@
       };
 
       overlays = let
-        overlay = mapOverlayOverride "trivium" (import ./pkgs);
+        overlay = mapOverlayOverride doctrineNoPkgs.prefix (import ./pkgs);
       in {
         default = overlay;
-        trivium = overlay;
+        ${doctrineNoPkgs.prefix} = overlay;
       };
 
       homeManagerModules.default = ./modules;
       nixosModules.default = ./modules;
 
       lib = {
+        mkDoctrine = import ./doctrine;
+
         mkSystemFlake = {
           flakes,
           system,
+          doctrinePrefix ? null,
           formatter ? "alejandra",
-          localOverlayPath ? /. + "${flakes.self}" + /pkgs,
-          nixpkgsConfigPath ? localOverlayPath + /config,
-          nixosSourcePath ? /. + "${flakes.self}" + /sys,
-          nixosPlatformsPath ?
-            if nixosSourcePath != null
-            then nixosSourcePath + /platform
-            else null,
-          hmSourcePath ? /. + "${flakes.self}" + /home,
-          hmPlatformsPath ?
-            if hmSourcePath != null
-            then hmSourcePath + /platform
-            else null,
+          paths ? {},
         }: let
+          mkDoctrine = args:
+            self.lib.mkDoctrine
+            (args
+              // optionalAttrs (doctrinePrefix != null) {
+                prefix = doctrinePrefix;
+              });
+
+          doctrineNoPkgs = mkDoctrine {
+            lib = nixpkgs.lib;
+            pkgs = null;
+          };
+
           optionalFlake = name:
             if flakes ? "${name}"
             then flakes.${name}
@@ -74,7 +87,7 @@
           requireFlake = name:
             if flakes ? "${name}"
             then flakes.${name}
-            else throw "Required flake input '${name}' is required but was not provided";
+            else throw "Required flake input '${name}' is missing";
 
           nur = optionalFlake "nur";
           nixpkgs = requireFlake "nixpkgs";
@@ -85,13 +98,21 @@
             then requireFlake "home-manager"
             else null;
 
+          pathFromSelf = path: builtins.toPath "${flakes.self}" + "/${path}";
+
+          localOverlayPath = pathFromSelf paths.localOverlay;
+          nixpkgsConfigPath = pathFromSelf paths.nixpkgsConfig;
+          nixosSourcePath = pathFromSelf paths.nixosSource;
+          nixosPlatformsPath = pathFromSelf paths.nixosPlatforms;
+          hmSourcePath = pathFromSelf paths.hmSource;
+          hmPlatformsPath = pathFromSelf paths.hmPlatforms;
+
           pkgs = importPkgs nixpkgs;
 
           importPkgs = flake:
             import flake ({
                 inherit system;
 
-                config = import ./pkgs/config nixpkgs.lib;
                 overlays = let
                   conditions = [
                     {
@@ -100,7 +121,7 @@
                     }
                     # NB: Preserve the relative order
                     {
-                      overlay = self.overlays.trivium;
+                      overlay = self.overlays.default;
                       condition = true;
                     }
                     {
@@ -111,87 +132,87 @@
                 in
                   builtins.map (cond: cond.overlay) (builtins.filter (cond: cond.condition) conditions);
               }
-              // (
-                if nixpkgsConfigPath != null
-                then {
-                  config = import nixpkgsConfigPath {inherit (nixpkgs) lib;};
-                }
-                else {}
-              ));
+              // optionalAttrs (paths ? nixpkgsConfig) {
+                config = import nixpkgsConfigPath {inherit (nixpkgs) lib;};
+              });
 
-          inherit (pkgs.trivium.lib) importAll;
+          inherit (pkgs) lib;
+          inherit (nixpkgs.lib) optionalAttrs; # Prevents infinite recursion
+          inherit (doctrineNoPkgs) prefix;
+          inherit (doctrineNoPkgs.lib) importAll;
         in
-          with pkgs.lib;
-            {
-              formatter.${system} =
-                if formatter == "alejandra"
-                then pkgs.alejandra
-                else if formatter == "nixpkgs-fmt"
-                then pkgs.nixpkgs-fmt
-                else throw "Unknown formatter: '${formatter}'";
+          {
+            formatter.${system} =
+              if formatter == "alejandra"
+              then pkgs.alejandra
+              else if formatter == "nixpkgs-fmt"
+              then pkgs.nixpkgs-fmt
+              else throw "Unknown formatter: '${formatter}'";
 
-              packages.${system} = pkgs.local;
+            packages.${system} = pkgs.${prefix};
 
-              overlays.default = final: prev: let
-                overlay =
-                  if localOverlayPath != null
-                  then import localOverlayPath
-                  else (final: prev: {});
-              in
-                mapOverlayOverride "local" overlay final prev
-                // optionalAttrs (unstable != null) {
-                  unstable = importPkgs unstable;
+            overlays.default = final: prev: let
+              overlay =
+                if paths ? localOverlay
+                then import localOverlayPath
+                else (final: prev: {});
+            in
+              mapOverlayOverride prefix overlay final prev
+              // optionalAttrs (unstable != null) {
+                unstable = importPkgs unstable;
+              };
+          }
+          // optionalAttrs (paths ? nixosSource) {
+            nixosConfigurations = let
+              nixosSystem = {modules}:
+                lib.makeOverridable nixpkgs.lib.nixosSystem {
+                  inherit modules pkgs system;
+
+                  specialArgs = {
+                    inherit flakes;
+
+                    doctrine = mkDoctrine {
+                      inherit pkgs;
+                      namespace = "sys";
+                    };
+                  };
                 };
-            }
-            // optionalAttrs (nixosSourcePath != null) {
-              nixosConfigurations = let
-                nixosSystem = {modules}:
-                  makeOverridable nixpkgs.lib.nixosSystem {
-                    inherit modules pkgs system;
 
-                    specialArgs = {
-                      inherit flakes;
+              hostConfig = platform:
+                nixosSystem {
+                  modules = [
+                    self.nixosModules.default
+                    nixosSourcePath
+                    platform
+                  ];
+                };
+            in
+              lib.mapAttrs (_: hostConfig) (importAll {root = nixosPlatformsPath;});
+          }
+          // optionalAttrs (paths ? hmSource) {
+            homeConfigurations = let
+              home = name: platform:
+                home-manager.lib.homeManagerConfiguration {
+                  inherit pkgs;
+
+                  extraSpecialArgs = {
+                    inherit flakes;
+
+                    doctrine = mkDoctrine {
+                      inherit pkgs;
+                      namespace = "hm";
                     };
                   };
 
-                hostConfig = platform:
-                  nixosSystem {
-                    modules = [
-                      self.nixosModules.default
-                      nixosSourcePath
-                      platform
-                    ];
-                  };
-              in
-                mapAttrs (_: hostConfig) (importAll {root = nixosPlatformsPath;});
-            }
-            // optionalAttrs (hmSourcePath != null) {
-              homeConfigurations = let
-                registry = {...}: {
-                  config.nix.registry =
-                    mapAttrs
-                    (_: value: {flake = value;})
-                    flakes;
+                  modules = [
+                    self.homeManagerModules.default
+                    hmSourcePath
+                    platform
+                  ];
                 };
-
-                home = name: platform:
-                  home-manager.lib.homeManagerConfiguration {
-                    inherit pkgs;
-
-                    extraSpecialArgs = {
-                      inherit flakes;
-                    };
-
-                    modules = [
-                      self.homeManagerModules.default
-                      hmSourcePath
-                      platform
-                      registry
-                    ];
-                  };
-              in
-                mapAttrs home (importAll {root = hmPlatformsPath;});
-            };
+            in
+              lib.mapAttrs home (importAll {root = hmPlatformsPath;});
+          };
       };
     };
 }

From b36942fafbdd9e7191ea9fc0d28a5d0d07ac3532 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Mon, 25 Aug 2025 16:04:19 -0600
Subject: [PATCH 25/31] trivionomicon/flake: fix 'localOverlay' function
 interface to accept flakes

---
 flake.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.nix b/flake.nix
index 7ab10c5..f2ee049 100644
--- a/flake.nix
+++ b/flake.nix
@@ -152,10 +152,10 @@
             packages.${system} = pkgs.${prefix};
 
             overlays.default = final: prev: let
-              overlay =
+              overlay = final: prev:
                 if paths ? localOverlay
-                then import localOverlayPath
-                else (final: prev: {});
+                then import localOverlayPath {inherit final prev flakes;}
+                else {};
             in
               mapOverlayOverride prefix overlay final prev
               // optionalAttrs (unstable != null) {

From 0ae8676d5028467db1cf8139210d22c2fbb5041d Mon Sep 17 00:00:00 2001
From: fabian <fabian@posixlycorrect.com>
Date: Tue, 26 Aug 2025 00:11:07 +0200
Subject: [PATCH 26/31] add README.md

---
 README.md | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 README.md

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..aced5a2
--- /dev/null
+++ b/README.md
@@ -0,0 +1,8 @@
+### Push:
+
+    git subtree push --prefix=trivionomicon forgejo@git.posixlycorrect.com:deepState/trivionomicon.git master
+
+
+### Pull:
+
+    git subtree pull --prefix=trivionomicon forgejo@git.posixlycorrect.com:deepState/trivionomicon.git master

From e4eb342725b1dbdd241010ce7c01e4f0eac66d11 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Mon, 25 Aug 2025 23:25:25 -0600
Subject: [PATCH 27/31] trivionomicon/flake: make 'mkSystem' available to
 library users

---
 flake.nix | 43 +++++++++++++++++++++++++++----------------
 1 file changed, 27 insertions(+), 16 deletions(-)

diff --git a/flake.nix b/flake.nix
index f2ee049..5fa2d1d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -164,24 +164,12 @@
           }
           // optionalAttrs (paths ? nixosSource) {
             nixosConfigurations = let
-              nixosSystem = {modules}:
-                lib.makeOverridable nixpkgs.lib.nixosSystem {
-                  inherit modules pkgs system;
-
-                  specialArgs = {
-                    inherit flakes;
-
-                    doctrine = mkDoctrine {
-                      inherit pkgs;
-                      namespace = "sys";
-                    };
-                  };
-                };
-
               hostConfig = platform:
-                nixosSystem {
+                self.lib.mkSystem {
+                  inherit flakes pkgs;
+                  doctrine = doctrineNoPkgs;
+
                   modules = [
-                    self.nixosModules.default
                     nixosSourcePath
                     platform
                   ];
@@ -213,6 +201,29 @@
             in
               lib.mapAttrs home (importAll {root = hmPlatformsPath;});
           };
+
+        mkSystem = {
+          pkgs,
+          flakes,
+          doctrine,
+          modules,
+        }:
+          flakes.nixpkgs.lib.makeOverridable flakes.nixpkgs.lib.nixosSystem {
+            inherit pkgs;
+            inherit (pkgs) system;
+
+            modules = [self.nixosModules.default] ++ modules;
+
+            specialArgs = {
+              inherit flakes;
+
+              doctrine = self.lib.mkDoctrine {
+                inherit pkgs;
+                inherit (doctrine) prefix;
+                namespace = "sys";
+              };
+            };
+          };
       };
     };
 }

From eb85e815983ae526365460a960d78f0754cd1f0d Mon Sep 17 00:00:00 2001
From: Fabian Montero <fabian@posixlycorrect.com>
Date: Tue, 26 Aug 2025 15:02:26 -0600
Subject: [PATCH 28/31] trivionomicon: add motd module

---
 modules/trivionomiconMotd/default.nix | 10 ++++++++++
 modules/trivionomiconMotd/sys.nix     | 22 ++++++++++++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 modules/trivionomiconMotd/default.nix
 create mode 100644 modules/trivionomiconMotd/sys.nix

diff --git a/modules/trivionomiconMotd/default.nix b/modules/trivionomiconMotd/default.nix
new file mode 100644
index 0000000..0844b5a
--- /dev/null
+++ b/modules/trivionomiconMotd/default.nix
@@ -0,0 +1,10 @@
+{
+  config,
+  doctrine,
+  ...
+}:
+doctrine.lib.mkModule {
+  inherit config;
+  name = "trivionomiconMotd";
+  sys = ./sys.nix;
+}
diff --git a/modules/trivionomiconMotd/sys.nix b/modules/trivionomiconMotd/sys.nix
new file mode 100644
index 0000000..5b38e3d
--- /dev/null
+++ b/modules/trivionomiconMotd/sys.nix
@@ -0,0 +1,22 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  users.motd = ''
+                                          _   _             _   _
+                                         | | | |           | | | |
+     _ __   _____      _____ _ __ ___  __| | | |__  _   _  | |_| |__   ___
+    | '_ \ / _ \ \ /\ / / _ \ '__/ _ \/ _` | | '_ \| | | | | __| '_ \ / _ \
+    | |_) | (_) \ V  V /  __/ | |  __/ (_| | | |_) | |_| | | |_| | | |  __/
+    | .__/ \___/ \_/\_/ \___|_|  \___|\__,_| |_.__/ \__, |  \__|_| |_|\___|
+    | |                                              __/ |
+    |_|_____ _____  _______      _______ ____  _   _|___/_  __  __ _____ _____ ____  _   _
+    |__   __|  __ \|_   _\ \    / /_   _/ __ \| \ | |/ __ \|  \/  |_   _/ ____/ __ \| \ | |
+       | |  | |__) | | |  \ \  / /  | || |  | |  \| | |  | | \  / | | || |   | |  | |  \| |
+       | |  |  _  /  | |   \ \/ /   | || |  | | . ` | |  | | |\/| | | || |   | |  | | . ` |
+       | |  | | \ \ _| |_   \  /   _| || |__| | |\  | |__| | |  | |_| || |___| |__| | |\  |
+       |_|  |_|  \_\_____|   \/   |_____\____/|_| \_|\____/|_|  |_|_____\_____\____/|_| \_|
+  '';
+}

From 49dae97575b7204c03fc05e7c4ffb20644546a6f Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Sun, 31 Aug 2025 10:38:53 -0600
Subject: [PATCH 29/31] trivionomicon/flake: fix overlay stacking

---
 flake.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/flake.nix b/flake.nix
index 5fa2d1d..2b53ebd 100644
--- a/flake.nix
+++ b/flake.nix
@@ -9,11 +9,11 @@
     nixpkgs,
     flake-utils,
   }: let
-    mapOverlayOverride = namespace: overlay: final: prev: let
+    mapOverlayOverride = prefix: overlay: final: prev: let
       overlayPkgs = overlay final prev;
     in
       {
-        "${namespace}" = builtins.removeAttrs overlayPkgs ["override"];
+        "${prefix}" = (prev.${prefix} or {}) // builtins.removeAttrs overlayPkgs ["override"];
       }
       // (overlayPkgs.override or {});
 
@@ -30,7 +30,7 @@
       packages =
         (import nixpkgs {
           inherit system;
-          overlays = [(mapOverlayOverride doctrineNoPkgs.prefix (import ./pkgs))];
+          overlays = [self.overlays.default];
         }).${
           doctrineNoPkgs.prefix
         };
@@ -121,7 +121,7 @@
                     }
                     # NB: Preserve the relative order
                     {
-                      overlay = self.overlays.default;
+                      overlay = mapOverlayOverride prefix (import ./pkgs);
                       condition = true;
                     }
                     {

From 427a928f6c6482a12c3b24a9dee9bc6d036e88c9 Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Sun, 31 Aug 2025 19:20:13 -0600
Subject: [PATCH 30/31] trivionomicon/pkgs: add snapborg

---
 pkgs/default.nix                              |  1 +
 ...Remove-env-arg-from-subprocess-calls.patch | 29 ++++++++++++++++
 pkgs/snapborg/default.nix                     | 34 +++++++++++++++++++
 3 files changed, 64 insertions(+)
 create mode 100644 pkgs/snapborg/0001-Remove-env-arg-from-subprocess-calls.patch
 create mode 100644 pkgs/snapborg/default.nix

diff --git a/pkgs/default.nix b/pkgs/default.nix
index 484ca77..4a275a3 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -5,5 +5,6 @@ in {
   override = {};
 
   athena-bccr = callPackage ./athena-bccr {};
+  snapborg = final.python3Packages.callPackage ./snapborg {};
   spliit = callPackage ./spliit {};
 }
diff --git a/pkgs/snapborg/0001-Remove-env-arg-from-subprocess-calls.patch b/pkgs/snapborg/0001-Remove-env-arg-from-subprocess-calls.patch
new file mode 100644
index 0000000..33f7a0c
--- /dev/null
+++ b/pkgs/snapborg/0001-Remove-env-arg-from-subprocess-calls.patch
@@ -0,0 +1,29 @@
+From c363931656938f9cc3354b8e2797fe9abac1b0e3 Mon Sep 17 00:00:00 2001
+From: Alejandro Soto <alejandro@34project.org>
+Date: Sun, 31 Aug 2025 13:30:45 -0600
+Subject: [PATCH] Remove "env" arg from subprocess calls
+
+---
+ snapborg/borg.py | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/snapborg/borg.py b/snapborg/borg.py
+index 89a3d84..b74ddf7 100644
+--- a/snapborg/borg.py
++++ b/snapborg/borg.py
+@@ -173,11 +173,10 @@ def launch_borg(args, password=None, print_output=False, dryrun=False, cwd=None)
+         # TODO: parse output from JSON log lines
+         try:
+             if print_output:
+-                subprocess.run(cmd, env=env, check=True, cwd=cwd)
++                subprocess.run(cmd, check=True, cwd=cwd)
+             else:
+                 subprocess.check_output(cmd,
+                                         stderr=subprocess.STDOUT,
+-                                        env=env,
+                                         cwd=cwd)
+         except CalledProcessError as e:
+             if e.returncode == 1:
+-- 
+2.49.0
+
diff --git a/pkgs/snapborg/default.nix b/pkgs/snapborg/default.nix
new file mode 100644
index 0000000..271be5c
--- /dev/null
+++ b/pkgs/snapborg/default.nix
@@ -0,0 +1,34 @@
+{
+  borgbackup,
+  buildPythonApplication,
+  fetchFromGitHub,
+  lib,
+  packaging,
+  pyyaml,
+}:
+buildPythonApplication {
+  pname = "snapborg";
+  version = "0.1.0-unstable-20250331";
+
+  src = fetchFromGitHub {
+    repo = "snapborg";
+    owner = "enzingerm";
+
+    rev = "7e860395319f995161a6e0c7954ce47635e3cd59";
+    hash = "sha256-RzYL4IHulk1Q/ALWFs6YCTeCO8ohwqXH2NMHRctRVSA=";
+  };
+
+  patches = [
+    ./0001-Remove-env-arg-from-subprocess-calls.patch # Fixes broken $PATH when calling borg
+  ];
+
+  propagatedBuildInputs = [
+    borgbackup
+    packaging
+    pyyaml
+  ];
+
+  preFixup = ''
+    makeWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [borgbackup]})
+  '';
+}

From b424cc1c1cf6094aa589646d51500cf542c66c6b Mon Sep 17 00:00:00 2001
From: Fabian Montero <fabian@posixlycorrect.com>
Date: Sat, 13 Sep 2025 11:52:18 -0600
Subject: [PATCH 31/31] trivionomicon: soju: add soju to the trivionomicon

---
 modules/soju/default.nix | 13 +++++++++++
 modules/soju/options.nix | 16 ++++++++++++++
 modules/soju/sys.nix     | 47 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 76 insertions(+)
 create mode 100644 modules/soju/default.nix
 create mode 100644 modules/soju/options.nix
 create mode 100644 modules/soju/sys.nix

diff --git a/modules/soju/default.nix b/modules/soju/default.nix
new file mode 100644
index 0000000..2b302f0
--- /dev/null
+++ b/modules/soju/default.nix
@@ -0,0 +1,13 @@
+{
+  config,
+  lib,
+  pkgs,
+  doctrine,
+  ...
+}:
+doctrine.lib.mkModule {
+  inherit config;
+  name = "soju";
+  sys = ./sys.nix;
+  options = ./options.nix;
+}
diff --git a/modules/soju/options.nix b/modules/soju/options.nix
new file mode 100644
index 0000000..06c3381
--- /dev/null
+++ b/modules/soju/options.nix
@@ -0,0 +1,16 @@
+{lib, ...}:
+with lib.types; {
+  sys = {
+    fullyQualifiedDomain = lib.mkOption {
+      type = str;
+      example = "soju.trivionomicon.com";
+      description = "fully qualified domain name to be used by soju";
+    };
+
+    port = lib.mkOption {
+      type = port;
+      default = 6697;
+      description = "port to be used by soju";
+    };
+  };
+}
diff --git a/modules/soju/sys.nix b/modules/soju/sys.nix
new file mode 100644
index 0000000..83c3560
--- /dev/null
+++ b/modules/soju/sys.nix
@@ -0,0 +1,47 @@
+{
+  config,
+  pkgs,
+  lib,
+  cfg,
+  doctrine,
+  ...
+}:
+with lib; {
+  security.acme.certs."${cfg.fullyQualifiedDomain}" = {
+    reloadServices = ["soju.service"];
+    group = "soju";
+  };
+
+  networking.firewall.allowedTCPPorts = [cfg.port];
+
+  services.soju = let
+    sojuCertDir = config.security.acme.certs."${cfg.fullyQualifiedDomain}".directory;
+  in {
+    enable = true;
+    hostName = "${cfg.fullyQualifiedDomain}";
+    listen = ["ircs://[::]:${toString cfg.port}"];
+    tlsCertificate = "${sojuCertDir}/fullchain.pem";
+    tlsCertificateKey = "${sojuCertDir}/key.pem";
+  };
+
+  systemd.services.soju = {
+    after = ["acme-${cfg.fullyQualifiedDomain}.service"];
+    serviceConfig = {
+      DynamicUser = mkForce false; # fuck dynamic users
+      User = "soju";
+      Group = "soju";
+      ProtectSystem = "strict";
+      ProtectHome = "read-only";
+      PrivateTmp = true;
+      RemoveIPC = true;
+    };
+  };
+
+  users = {
+    users.soju = {
+      isSystemUser = true;
+      group = "soju";
+    };
+    groups.soju = {};
+  };
+}