Merge branch 'main' into rsang-master

Author: jaysa68

flake.lock

@@ -9,6 +9,13 @@
       ref = "nixos-25.11";
     };
 
+    nixpkgs-unstable = {
+      type = "github";
+      owner = "nixos";
+      repo = "nixpkgs";
+      ref = "nixos-unstable";
+    };
+
     systems = {
       type = "github";
       owner = "nix-systems";
@@ -120,6 +127,7 @@
     {
       self,
       nixpkgs,
+      nixpkgs-unstable,
       systems,
       colmena,
       agenix,
@@ -160,6 +168,7 @@
         disko.nixosModules.disko
         niks3.nixosModules.default
         niks3.nixosModules.niks3-auto-upload
+        wayout.nixosModules.default
       ];
 
       defaultSystem = "x86_64-linux";
@@ -199,6 +208,12 @@
           };
         };
 
+      pkgsUnstableFor =
+        system:
+        import nixpkgs-unstable {
+          inherit system;
+        };
+
       forAllSystems = fn: nixpkgs.lib.genAttrs (import systems) (system: fn (pkgsFor system));
 
       readGroup =
@@ -239,7 +254,16 @@
           meta = {
             nixpkgs = pkgsFor defaultSystem;
             nodeNixpkgs = nixpkgs.lib.mapAttrs (name: pkgsFor) overrideSystem;
-            specialArgs = { inherit self inputs; };
+            specialArgs = {
+              inherit self inputs;
+              # pkgs-unstable exposes the packages from the nixpkgs-unstable input
+              # this should only be used as a *temporary* measure when the version of
+              # a package in nixpkgs stable is not sufficiently updated
+              pkgs-unstable = pkgsUnstableFor defaultSystem;
+            };
+            nodeSpecialArgs = nixpkgs.lib.mapAttrs (name: value: {
+              pkgs-unstable = pkgsUnstableFor value;
+            }) overrideSystem;
           };
         }
       );
@@ -276,14 +300,54 @@
         };
 
       overlays.default = final: prev: {
+        # Patch nginx for multiple CVEs disclosed 2026-05-13, until nixos-25.11
+        # channel advances past the fix (nixpkgs#520076).
+        # Remove this overlay once flake.lock points to a nixpkgs with nginx >= 1.30.1.
+        nginx = prev.nginx.overrideAttrs (old: {
+          patches = (old.patches or [ ]) ++ [
+            (final.fetchpatch {
+              name = "CVE-2026-40460.patch";
+              url = "https://github.com/nginx/nginx/commit/f37ec3e5d4f527e52ed5b25951ad8aa7d1ff6266.patch";
+              hash = "sha256-++hYEzMUkl3mbBMaffR2LQTYMxOR/YziNkYCVyhw2Qg=";
+            })
+            (final.fetchpatch {
+              name = "CVE-2026-40701.patch";
+              url = "https://github.com/nginx/nginx/commit/71841dcedfdf46048ef5e25413fdf97a66957913.patch";
+              hash = "sha256-FzNZpEwIj76r5dpqEP6TgpSc1ywcW7ZOEQpFpwI/YZw=";
+            })
+            (final.fetchpatch {
+              name = "CVE-2026-42934.patch";
+              url = "https://github.com/nginx/nginx/commit/696a7f1b9198d576e6a59c1655b746fbf06561cf.patch";
+              hash = "sha256-/vjyEGysPv5VK4TZmk/gtIg9Zc5ogUXMwpBfBwe55Bc=";
+            })
+            (final.fetchpatch {
+              name = "CVE-2026-42945.patch";
+              url = "https://github.com/nginx/nginx/commit/2046b45aa0c6e712c216b9075886f3f26e9b4ca9.patch";
+              hash = "sha256-VK9CXgrCIqORsaRivTZBmkoLyQhbZ07ss6nAbLNvfJM=";
+            })
+            (final.fetchpatch {
+              name = "CVE-2026-42946.patch";
+              url = "https://github.com/nginx/nginx/commit/baef7fdac28e4e1fe26509b50b8d15603393e28e.patch";
+              hash = "sha256-Z1naMxxiVuDbUcvX3PiIK4CMuSSpUyzPqjix9GTwHmk=";
+            })
+            (final.fetchpatch {
+              name = "CVE-2026-42946-part-2.patch";
+              url = "https://github.com/nginx/nginx/commit/39d7d0ba0799fcff6baee52b6525f45739593cfd.patch";
+              hash = "sha256-6PwV0iz4kQGGBwVk9129aH+TFzbSx3QSVpp22AoKQY4=";
+            })
+          ];
+        });
+
         ocf-utils = ocf-utils.packages.${final.stdenv.hostPlatform.system}.default;
-        ocf-wayout = wayout.packages.${final.stdenv.hostPlatform.system}.default;
         ocf-jukebox = ocf-jukebox.packages.${final.stdenv.hostPlatform.system}.default;
         plasma-applet-commandoutput = final.callPackage ./pkgs/plasma-applet-commandoutput.nix { };
         catppuccin-sddm = final.qt6Packages.callPackage ./pkgs/catppuccin-sddm.nix { };
         ocf-cosmic-applets = ocf-cosmic-applets.packages.${final.stdenv.hostPlatform.system}.default;
         ocf-cosmic-greeter = final.callPackage ./pkgs/ocf-cosmic-greeter.nix { };
         ocf-hplip = final.callPackage ./pkgs/ocf-hplip.nix { };
+        ocf-niks3-push = final.callPackage ./pkgs/ocf-niks3-push {
+          niks3 = niks3.packages.${final.stdenv.hostPlatform.system}.default;
+        };
       };
 
       agenix-rekey = agenix-rekey.configure {
@@ -318,11 +382,17 @@
 
       nixosConfigurations = builtins.mapAttrs (
         host: colmenaConfig:
-        nixpkgs.lib.nixosSystem rec {
+        let
           system = overrideSystem.${host} or defaultSystem;
+        in
+        nixpkgs.lib.nixosSystem {
+          inherit system;
           pkgs = pkgsFor system;
           modules = colmenaConfig.imports;
-          specialArgs = { inherit inputs; };
+          specialArgs = {
+            inherit inputs;
+            pkgs-unstable = pkgsUnstableFor system;
+          };
         }
       ) colmenaHosts;
     };

flake.nix

@@ -99,10 +99,17 @@ in
       pkgs.cosmic-initial-setup
     ];
 
-    environment.etc = {
-      skel.source = ./skel;
-      ocf-assets.source = ./assets;
-    };
+    environment.etc =
+      let
+        kittyThemes = "${pkgs.kitty-themes}share/kitty-themes/themes";
+      in
+      {
+        skel.source = ./skel;
+        ocf-assets.source = ./assets;
+        "xdg/kitty/dark-theme.auto.conf".source = "${kittyThemes}/rose-pine.conf";
+        "xdg/kitty/light-theme.auto.conf ".source = "${kittyThemes}/rose-pine-dawn.conf";
+        "xdg/kitty/no-preference-theme.auto.conf".source = "${kittyThemes}/rose-pine.conf";
+      };
 
     # Conflict override since multiple DEs set this option
     programs.ssh.askPassword = pkgs.lib.mkForce (lib.getExe pkgs.ksshaskpass.out);
@@ -191,17 +198,8 @@ in
       };
     };
 
-    systemd.user.services.wayout = {
-      description = "Automatic idle logout manager";
-      after = [ "graphical-session.target" ];
-      partOf = [ "graphical-session.target" ];
-      wantedBy = [ "graphical-session.target" ];
-      serviceConfig = {
-        ExecStart = "${pkgs.ocf-wayout}/bin/wayout";
-        Type = "simple";
-        Restart = "on-failure";
-      };
-    };
+    services.wayout.enable = true;
+    services.wayout.openFirewall = true;
 
     systemd.user.services.desktoprc = {
       description = "Source custom rc shared across desktops";