Run the upstream NixOS wpa_supplicant module under system-manager through a
compat shim. system-manager already reuses nixpkgs' systemdUtils,
environment.etc and userborn, so the unit, the generated config and the
wpa_supplicant user come out unchanged; only four NixOS-only options needed
stubbing, two of which are re-expressed on top of environment.etc.
Extract the wireless config to hosts/wireless.nix so both trees share one
source: they sit at the same depth, so every path resolves identically.
electra's generated wpa_supplicant.conf is now byte-identical to atlas'
except for the country line.
Take over networkd from netplan on electra with the same generic match rules
NixOS uses, which also covers ethernet and USB tethering, neither of which
was configured before. netplan is neutered by masking its generator rather
than uninstalling it, since purging netplan.io would take cloud-init,
ubuntu-minimal and ubuntu-server-minimal with it.
Assisted-by: pi (claude-opus-5)
The setuid /run/wrappers/bin/unix_chkpwd wrapper is generic plumbing that
nixpkgs' pam_unix requires (system-manager, unlike NixOS, doesn't provide
it), not host policy. Move it to modules/system-manager/unix-chkpwd.nix,
applied unconditionally like NixOS does; hosts/.../pam.nix keeps only the
pam.d stacks.
Assisted-by: pi (claude-opus-4-8)
Port nixpkgs' nix.registry option (config/nix-flakes.nix) into
modules/system-manager/nix-registry.nix, giving system-manager the same
interface NixOS has. common/global/nix.nix now just sets
'nix.registry = mapAttrs (_: flake: {inherit flake;}) flakeInputs' like
the NixOS side, instead of hand-writing /etc/nix/registry.json.
Assisted-by: pi (claude-opus-4-8)
Port modules/nixos/hydra-auto-upgrade.nix to the system-manager side as
modules/system-manager/hydra-auto-upgrade.nix, exposed via a new
outputs.systemManagerModules and imported by the common/global base.
The script (cached-system-manager) mirrors cached-nixos-rebuild, adapted
to system-manager's model: there is no /run/current-system active pointer
and no boot-time reactivation, so the registered profile
(/nix/var/nix/profiles/system-manager-profiles/system-manager) is the
single source of truth. Only 'diff' and 'switch' actions; switch does
register-profile + activate (the CLI's switch = both, atomically).
Not enabled anywhere yet.
Assisted-by: pi (claude-opus-4-8)
Import the collection through pkgs/default.nix while preserving the combined Hydra derivation and per-wallpaper attributes.
Assisted-by: pi (openai-codex/gpt-5.6-sol)
Prep for renaming the GitHub repo to Foundry: update the Hydra jobset flakes
(.hydra.json), the auto-upgrade project name (must match the Hydra project),
the README status badge, the hydra-auto-upgrade example, the website CV link,
and the flake description. Hydra project/jobset becomes 'foundry'.
Assisted-by: pi (opus-4.8)
With the matugen IFD replaced by lib/material-you.nix, projects/themes only existed
to cache that IFD, so remove it:
- Move wallpapers/ to the repo root. Each wallpaper now carries its material-you
source color (extracted once, committed in list.json) in passthru, so schemes
generate with no image decoding at eval.
- Expose pkgs.wallpapers via the additions overlay, and a 'wallpapers'
linkFarm package so Hydra builds+caches every image (imgur is upstream).
- Fold colorscheme generation into modules/home-manager/colors.nix: it now
calls outputs.lib.material-you.generateColorscheme on the source color (the
wallpaper's sourceColor or a hex) instead of the matugen derivation. No IFD,
no generatedDrv.
- wallpaper option is now types.package (preserves the sourceColor passthru).
- Drop the themes flake input and its Hydra job; wallpapers ride the pkgs job.
Verified: atlas evaluates to a full toplevel; its colors match matugen 2.4.1
for the aenami-dawn seed (roles exact, one custom channel +-1 LSB).
Assisted-by: pi (opus-4.8)
Remove LibreChat, its nginx vhost, local MongoDB persistence, and the Codex OpenAI proxy package/module it depended on. Also drop the now-unused taygeta sops entries.
Assisted-by: pi (gpt-5.5)
Bridges LibreChat's native Responses API custom endpoint to the ChatGPT Codex
backend at chatgpt.com/backend-api/codex/responses. It exchanges a refresh token
(CODEX_REFRESH_TOKEN) for access tokens on demand, derives the chatgpt-account-id
from the id_token claims, injects the headers the backend gates on (originator,
OpenAI-Beta, session), and reshapes the body (store:false, streaming, inline
reasoning). Nothing is persisted to disk.
Serves GET /v1/models, POST /v1/responses (streaming passthrough, or reassembled
into a single response object for non-streaming callers), and GET /health.
Ships a services.codex-openai-proxy NixOS module (host, port, environmentFile).
The ChatGPT account only accepts a subset of model ids (gpt-5.5, gpt-5.4,
gpt-5.4-mini); others such as gpt-5, the -codex variants, and gpt-5.5-mini 400.
Probe with /v1/responses if OpenAI rotates the allowed set.
Assisted-by: pi (claude-opus-4-8)
It now works with home configs inside nixos configs (no need to export standalone), and it's factored out to config.colorscheme.hosts to reuse everywhere.
Previously, it would always use the latest eval. While this works, it's more correct to check the eval belonging to the latest successfull build for that specific host.
Gabriel Fontes