wow

modules/home/discord/linux.nix

@@ -1,18 +1,21 @@
 {
   pkgs,
   inputs,
-  lib,
-  options,
   ...
 }:
 {
   imports = [ inputs.nixcord.homeModules.nixcord ];
-  # imports = [ inputs.nixcord.nixosModules.nixcord ];
   programs.nixcord = {
     enable = true;
 
     discord = {
-      branch = "stable";
+      branches = [ "stable" ];
+      # Electron's Vulkan backend crashes on the NVIDIA render node under
+      # native Wayland. Keep Wayland and hardware acceleration, but use GL.
+      commandLineArgs = [
+        "--use-gl=angle"
+        "--use-angle=gl"
+      ];
       vencord.enable = false;
       equicord.enable = true;
       krisp.enable = true;
@@ -25,10 +28,4 @@
   home.packages = with pkgs; [
     discord-gamesdk
   ];
-
-  # home.activation.krispPatch = lib.mkIf (!pkgs.stdenv.isDarwin) (
-  #   lib.hm.dag.entryAfter [ "writeBoundary" ] ''
-  #     ${krisp-patcher}/bin/krisp-patcher $(${pkgs.findutils}/bin/find $HOME/.config/discord/ -name "discord_krisp.node" -path "*/modules/discord_krisp/*") || true
-  #   ''
-  # );
 }

modules/home/firefox-devedition.nix

@@ -2,6 +2,8 @@
 {
   programs.firefox = {
     enable = true;
+    # Keep the pre-26.05 Home Manager location until the profile is migrated.
+    configPath = ".mozilla/firefox";
     package = pkgs.firefox-devedition;
 
     policies = {

modules/home/kdenlive.nix

@@ -0,0 +1,80 @@
+{ lib, pkgs, ... }:
+let
+  pythonPackages = pkgs.python3Packages;
+
+  # Vosk is not present in the current nixpkgs revision, although it is one
+  # of the backends shipped with Kdenlive. Package its upstream manylinux
+  # wheel until it is available from nixpkgs.
+  vosk = pythonPackages.buildPythonPackage rec {
+    pname = "vosk";
+    version = "0.3.45";
+    format = "wheel";
+
+    src = pkgs.fetchPypi {
+      inherit pname version format;
+      python = "py3";
+      dist = "py3";
+      platform = "manylinux_2_12_x86_64.manylinux2010_x86_64";
+      hash = "sha256-JeAlCTxDmdcnj1Q1aO2MxUYKw6S/SMI2c6zh4l0mYZ8=";
+    };
+
+    # The upstream wheel bundles libvosk.so without an RPATH. Patch it to
+    # the Nix C++ runtime so importing vosk works outside a FHS environment.
+    nativeBuildInputs = [ pkgs.autoPatchelfHook ];
+    buildInputs = [ pkgs.stdenv.cc.cc.lib ];
+
+    propagatedBuildInputs = with pythonPackages; [
+      cffi
+      srt
+      requests
+      tqdm
+      websockets
+    ];
+
+    meta = with pkgs.lib; {
+      description = "Offline open source speech recognition toolkit";
+      homepage = "https://alphacephei.com/vosk/";
+      license = licenses.asl20;
+    };
+  };
+
+  # Kdenlive's speech-to-text scripts are launched through
+  # /usr/bin/env python3. Keep this environment private to Kdenlive so the
+  # other Python environments installed on the system remain independent.
+  kdenlivePython = pkgs.python3.withPackages (
+    pythonPackages: with pythonPackages; [
+      pip
+      numba
+      openai-whisper
+      srt
+      torch
+      vosk
+    ]
+  );
+
+  kdenlive = pkgs.kdePackages.kdenlive.overrideAttrs (old: {
+    nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.makeWrapper ];
+    postFixup = (old.postFixup or "") + ''
+      wrapProgram $out/bin/kdenlive \
+        --prefix PATH : ${kdenlivePython}/bin \
+        --set PYTHONNOUSERSITE 1
+    '';
+  });
+in
+{
+  home.packages = [ kdenlive ];
+
+  # Kdenlive otherwise prefers its mutable ~/.local/share/kdenlive/venv.
+  # That venv was created by pip and its native Torch libraries do not have
+  # the Nix runtime paths. Point Kdenlive at the immutable environment above.
+  home.activation.kdenliveSpeechPython = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    run ${pkgs.kdePackages.kconfig}/bin/kwriteconfig6 \
+      --file "$HOME/.config/kdenliverc" \
+      --group speech \
+      --key speech_system_python true
+    run ${pkgs.kdePackages.kconfig}/bin/kwriteconfig6 \
+      --file "$HOME/.config/kdenliverc" \
+      --group speech \
+      --key speech_system_python_path ${kdenlivePython}/bin/python3
+  '';
+}

modules/mizukios/features/packages/docker2libc.nix

@@ -14,7 +14,7 @@ pkgs.writeShellApplication {
     #!/usr/bin/env bash
     set -euo pipefail
 
-    image="${1:-tmp-elf-extract}"
+    image="''${1:-tmp-elf-extract}"
 
     docker build -t "$image" .
 
@@ -30,8 +30,8 @@ pkgs.writeShellApplication {
     [ -n "$libc_path" ] || { echo "libc.so.6 not found" >&2; exit 1; }
     [ -n "$ld_path" ] || { echo "ld-linux not found" >&2; exit 1; }
 
-    docker cp -L "${cid}:${libc_path}" ./libc.so.6
-    docker cp -L "${cid}:${ld_path}" ./ld-linux-x86-64.so.2
+    docker cp -L "''${cid}:''${libc_path}" ./libc.so.6
+    docker cp -L "''${cid}:''${ld_path}" ./ld-linux-x86-64.so.2
 
     file libc.so.6 ld-linux-x86-64.so.2
     ls -lh libc.so.6 ld-linux-x86-64.so.2

modules/mizukios/features/system/boot.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 {
   # boot.plymouth.enable = true;
   boot.loader = {
@@ -10,6 +10,36 @@
       device = "nodev";
       enableCryptodisk = true;
 
+      # GRUB is signed directly with the sbctl db key.  Do not use the shim
+      # verifier here; it would reject the NixOS kernel/initrd chain before
+      # GRUB can load it.
+      extraGrubInstallArgs = [
+        "--modules=tpm"
+        "--disable-shim-lock"
+      ];
+
+      # Sign the freshly installed GRUB and NixOS kernels before rebooting.
+      # Key creation/enrollment is intentionally a one-time manual step and
+      # is skipped until /var/lib/sbctl/keys/db/db.key exists.
+      extraInstallCommands = ''
+        if [ -r /var/lib/sbctl/keys/db/db.key ]; then
+          for file in \
+            "${config.boot.loader.efi.efiSysMountPoint}/EFI/NixOS-boot/grubx64.efi" \
+            "${config.boot.loader.efi.efiSysMountPoint}/EFI/BOOT/BOOTX64.EFI"; do
+            if [ -f "$file" ]; then
+              ${pkgs.sbctl}/bin/sbctl sign -s "$file" || true
+            fi
+          done
+
+          if [ -d "${config.boot.loader.efi.efiSysMountPoint}/kernels" ]; then
+            ${pkgs.findutils}/bin/find \
+              "${config.boot.loader.efi.efiSysMountPoint}/kernels" \
+              -type f -name '*-bzImage' \
+              -exec ${pkgs.sbctl}/bin/sbctl sign -s {} \; || true
+          fi
+        fi
+      '';
+
       # extraInstallCommands = ''
       #   mkdir -p /boot/EFI/BOOT
 

modules/mizukios/features/system/sbctl.nix

@@ -1,37 +1,21 @@
-{ pkgs, config, ... }:
+{ config, pkgs, ... }:
 {
   environment.systemPackages = with pkgs; [
     sbctl
   ];
- 
-  # The 99 here ensures that this runs AFTER the grub activation scripts.
-  system.activationScripts."99-sign-all" = {
+
+  # Keep the signing database up to date if a kernel is generated without a
+  # GRUB reinstall.  GRUB itself is signed by boot.nix after installation.
+  system.activationScripts."99-sign-secure-boot-kernels" = {
     text = ''
-      if [ "$NIXOS_ACTION" = "switch" ] || [ "$NIXOS_ACTION" = "boot" ]; then
-        # `sbctl verify --json` returns "null" if there is an error,
-        # empty string if there are no files in the database.
-        if [ "$(${pkgs.sbctl}/bin/sbctl verify --json)" != "null" ]; then
- 
-          echo "Signing all EFI binaries with sbctl..."
- 
-          ESP="${config.boot.loader.efi.efiSysMountPoint}"
-          readarray -t files < <(find "$ESP" -type f -iname "*.efi" -o -iname "*bzImage")
- 
-          # Removing all the files first.
-          for file in "${"$"}{files[@]}"; do
-            echo "Removing from sbctl: $file"
-            # The `|| true` part is because otherwise some files might not exist and
-            # the script would return an error.
-            ${pkgs.sbctl}/bin/sbctl remove-file "$file" >/dev/null 2>&1 || true
-          done
- 
-          for file in "${"$"}{files[@]}"; do
-            echo "Signing with sbctl: $file"
-            ${pkgs.sbctl}/bin/sbctl sign -s "$file" >/dev/null 2>&1
-          done
- 
+      if [ -r /var/lib/sbctl/keys/db/db.key ]; then
+        if [ -d "${config.boot.loader.efi.efiSysMountPoint}/kernels" ]; then
+          ${pkgs.findutils}/bin/find \
+            "${config.boot.loader.efi.efiSysMountPoint}/kernels" \
+            -type f -name '*-bzImage' \
+            -exec ${pkgs.sbctl}/bin/sbctl sign -s {} \; || true
         fi
       fi
     '';
   };
-}
+}