Remove global packages from users, skrott: remove neovim properly

Reviewed-on: https://git.pvv.ntnu.no/Drift/pvv-nixos-config/pulls/121

README.md

@@ -43,6 +43,7 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
 | [kommode][kom]             | Virtual  | Gitea + Gitea pages                                       |
 | [lupine][lup]              | Physical | Gitea CI/CD runners                                       |
 |  shark                     | Virtual  | Test host for authentication, absolutely horrendous       |
+| [skrott][skr]              | Physical | Kiosk, snacks and soda                                    |
 | [wenche][wen]              | Virtual  | Nix-builders, general purpose compute                     |
 
 ## Documentation
@@ -59,4 +60,5 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
 [ild]: https://wiki.pvv.ntnu.no/wiki/Maskiner/ildkule
 [kom]: https://wiki.pvv.ntnu.no/wiki/Maskiner/kommode
 [lup]: https://wiki.pvv.ntnu.no/wiki/Maskiner/lupine
+[skr]: https://wiki.pvv.ntnu.no/wiki/Maskiner/Skrott
 [wen]: https://wiki.pvv.ntnu.no/wiki/Maskiner/wenche

base/default.nix

@@ -81,7 +81,7 @@
     AllowHibernation=no
   '';
 
-  users.mutableUsers = lib.mkDefault false;
+  # users.mutableUsers = lib.mkDefault false;
 
   users.groups."drift".name = "drift";
 

base/programs.nix

@@ -13,6 +13,9 @@
     # Debug and find files
     file
 
+    # Process json data
+    jq
+
     # Check computer specs
     lshw
 
@@ -54,6 +57,8 @@
   programs.nano.enable = true;
   # Same reasoning as nano
   programs.vim.enable = true;
+  # Same reasoning as vim
+  programs.neovim.enable = true;
 
   # Some people like this shell for some reason
   programs.zsh.enable = true;

flake.lock

@@ -8,11 +8,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768138611,
-        "narHash": "sha256-KfZX6wpuwE2IRKLjh0DrEviE4f6kqLJWwKIE5QJSqa4=",
+        "lastModified": 1769395643,
+        "narHash": "sha256-41eMQ9nbkHNYuZnGAlyGNc8K717pfnGKiADuiSOW29E=",
         "ref": "main",
-        "rev": "cb385097dcda5fb9772f903688d078b30a66ccd4",
-        "revCount": 221,
+        "rev": "a0a89c22a24f55b6b6738c95e361e1551895be29",
+        "revCount": 230,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
       },

flake.nix

@@ -69,8 +69,7 @@
   in {
     inputs = lib.mapAttrs (_: src: src.outPath) inputs;
 
-    pkgs = forAllSystems (system:
-      import nixpkgs {
+    pkgs = forAllSystems (system: import nixpkgs {
       inherit system;
       config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
         [
@@ -80,26 +79,44 @@
     });
 
     nixosConfigurations = let
-      unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
-
       nixosConfig =
         nixpkgs:
         name:
         configurationPath:
         extraArgs@{
-          system ? "x86_64-linux",
+          localSystem ? "x86_64-linux", # buildPlatform
+          crossSystem ? "x86_64-linux", # hostPlatform
           specialArgs ? { },
           modules ? [ ],
           overlays ? [ ],
           enableDefaults ? true,
           ...
         }:
+        let
+          commonPkgsConfig = {
+            inherit localSystem crossSystem;
+            config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
+              [
+                "nvidia-x11"
+                "nvidia-settings"
+              ];
+            overlays = (lib.optionals enableDefaults [
+              # Global overlays go here
+              inputs.roowho2.overlays.default
+            ]) ++ overlays;
+          };
+
+          pkgs = import nixpkgs commonPkgsConfig;
+          unstablePkgs = import nixpkgs-unstable commonPkgsConfig;
+        in
         lib.nixosSystem (lib.recursiveUpdate
         {
-          inherit system;
+          system = crossSystem;
+
+          inherit pkgs;
 
           specialArgs = {
-            inherit unstablePkgs inputs;
+            inherit inputs unstablePkgs;
             values = import ./values.nix;
             fp = path: ./${path};
           } // specialArgs;
@@ -113,22 +130,10 @@
             sops-nix.nixosModules.sops
             inputs.roowho2.nixosModules.default
           ]) ++ modules;
-
-          pkgs = import nixpkgs {
-            inherit system;
-            config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
-              [
-                "nvidia-x11"
-                "nvidia-settings"
-              ];
-            overlays = (lib.optionals enableDefaults [
-              # Global overlays go here
-              inputs.roowho2.overlays.default
-            ]) ++ overlays;
-          };
         }
         (builtins.removeAttrs extraArgs [
-          "system"
+          "localSystem"
+          "crossSystem"
           "modules"
           "overlays"
           "specialArgs"
@@ -163,7 +168,6 @@
       bekkalokk = stableNixosConfig "bekkalokk" {
         overlays = [
           (final: prev: {
-            heimdal = unstablePkgs.heimdal;
             mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions { };
             simplesamlphp = final.callPackage ./packages/simplesamlphp { };
             bluemap = final.callPackage ./packages/bluemap.nix { };
@@ -221,17 +225,36 @@
           inputs.gergle.overlays.default
         ];
       };
-      skrott = stableNixosConfig "skrott" {
-        system = "aarch64-linux";
+    }
+    //
+    (let
+      skrottConfig = {
         modules = [
           (nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
           inputs.dibbler.nixosModules.default
         ];
         overlays = [
           inputs.dibbler.overlays.default
+          (final: prev: {
+            atool = prev.emptyDirectory;
+            micro = prev.vim;
+          })
         ];
       };
-    }
+    in {
+      skrott = stableNixosConfig "skrott" (skrottConfig // {
+        localSystem = "x86_64-linux";
+        crossSystem = "aarch64-linux";
+      });
+      skrott-x86_64 = stableNixosConfig "skrott" (skrottConfig // {
+        localSystem = "x86_64-linux";
+        crossSystem = "x86_64-linux";
+      });
+      skrott-native = stableNixosConfig "skrott" (skrottConfig // {
+        localSystem = "aarch64-linux";
+        crossSystem = "aarch64-linux";
+      });
+    })
     //
     (let
       machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
@@ -295,6 +318,7 @@
       # Skrott is exception
       {
         skrott = self.nixosConfigurations.skrott.config.system.build.sdImage;
+        skrott-native = self.nixosConfigurations.skrott-native.config.system.build.sdImage;
       }
       //
       # Nix-topology

hosts/bekkalokk/services/idp-simplesamlphp/config.php

@@ -556,7 +556,6 @@ $config = [
     'module.enable' => [
         'admin' => true,
 	'authpwauth' => true,
-	'themepvv' => true,
     ],
 
 
@@ -859,7 +858,7 @@ $config = [
     /*
      * Which theme directory should be used?
      */
-    'theme.use' => 'themepvv:pvv',
+    'theme.use' => 'default',
 
     /*
      * Set this option to the text you would like to appear at the header of each page. Set to false if you don't want

hosts/bekkalokk/services/idp-simplesamlphp/default.nix

@@ -1,24 +1,8 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
+{ config, pkgs, lib, ... }:
 let
-  themePvv = pkgs.fetchFromGitea {
-    domain = "git.pvv.ntnu.no";
-    owner = "Drift";
-    repo = "ssp-theme";
-    rev = "bda4314030be5f81aeaf2fb1927aee582f1194d9";
-    hash = "sha256-naNRyPL6PAsZKW2w1Vt9wrHT9inCL/yAFnvpy4glv+c=";
-  };
-
   pwAuthScript = pkgs.writeShellApplication {
     name = "pwauth";
-    runtimeInputs = with pkgs; [
-      coreutils
-      heimdal
-    ];
+    runtimeInputs = with pkgs; [ coreutils heimdal ];
     text = ''
       read -r user1
       user2="$(echo -n "$user1" | tr -c -d '0123456789abcdefghijklmnopqrstuvwxyz')"
@@ -101,27 +85,18 @@ let
 
         substituteInPlace "$out" \
           --replace-warn '$SAML_COOKIE_SECURE' 'true' \
-          --replace-warn '$SAML_COOKIE_SALT' 'file_get_contents("${
-            config.sops.secrets."idp/cookie_salt".path
-          }")' \
+          --replace-warn '$SAML_COOKIE_SALT' 'file_get_contents("${config.sops.secrets."idp/cookie_salt".path}")' \
           --replace-warn '$SAML_ADMIN_NAME' '"Drift"' \
           --replace-warn '$SAML_ADMIN_EMAIL' '"drift@pvv.ntnu.no"' \
-          --replace-warn '$SAML_ADMIN_PASSWORD' 'file_get_contents("${
-            config.sops.secrets."idp/admin_password".path
-          }")' \
+          --replace-warn '$SAML_ADMIN_PASSWORD' 'file_get_contents("${config.sops.secrets."idp/admin_password".path}")' \
           --replace-warn '$SAML_TRUSTED_DOMAINS' 'array( "idp.pvv.ntnu.no" )' \
           --replace-warn '$SAML_DATABASE_DSN' '"pgsql:host=postgres.pvv.ntnu.no;port=5432;dbname=idp"' \
           --replace-warn '$SAML_DATABASE_USERNAME' '"idp"' \
-          --replace-warn '$SAML_DATABASE_PASSWORD' 'file_get_contents("${
-            config.sops.secrets."idp/postgres_password".path
-          }")' \
+          --replace-warn '$SAML_DATABASE_PASSWORD' 'file_get_contents("${config.sops.secrets."idp/postgres_password".path}")' \
           --replace-warn '$CACHE_DIRECTORY' '/var/cache/idp'
       '';
 
       "modules/authpwauth/src/Auth/Source/PwAuth.php" = ./authpwauth.php;
-
-      # PVV theme module (themepvv).
-      "modules/themepvv" = themePvv;
     };
   };
 in
@@ -183,12 +158,10 @@ in
     services.phpfpm.pools.idp = {
       user = "idp";
       group = "idp";
-      settings =
-        let
+      settings = let
         listenUser = config.services.nginx.user;
         listenGroup = config.services.nginx.group;
-        in
-        {
+      in {
         "pm" = "dynamic";
         "pm.max_children" = 32;
         "pm.max_requests" = 500;

hosts/gluttony/configuration.nix

@@ -11,6 +11,15 @@
   ];
 
   systemd.network.enable = lib.mkForce false;
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+
+  boot.loader = {
+    systemd-boot.enable = false; # no uefi support on this device
+    grub.device = "/dev/sda";
+    grub.enable = true;
+  };
+  boot.tmp.cleanOnBoot = true;
+
   networking =
     let
       hostConf = values.hosts.gluttony;

hosts/skrott/configuration.nix

@@ -1,10 +1,13 @@
-{ config, pkgs, lib, fp, values, ... }: {
+{ config, pkgs, lib, modulesPath, fp, values, ... }: {
   imports = [
-    # ./hardware-configuration.nix
+    (modulesPath + "/profiles/perlless.nix")
 
     (fp /base)
   ];
 
+  # Disable import of a bunch of tools we don't need from nixpkgs.
+  disabledModules = [ "profiles/base.nix" ];
+
   sops.defaultSopsFile = fp /secrets/skrott/skrott.yaml;
 
   boot = {
@@ -16,16 +19,25 @@
   };
 
   # Now turn off a bunch of stuff lol
+  # TODO: can we reduce further?
+  # See also https://nixcademy.com/posts/minimizing-nixos-images/
   system.autoUpgrade.enable = lib.mkForce false;
   services.irqbalance.enable = lib.mkForce false;
   services.logrotate.enable = lib.mkForce false;
   services.nginx.enable = lib.mkForce false;
   services.postfix.enable = lib.mkForce false;
+  services.smartd.enable = lib.mkForce false;
+  services.udisks2.enable = lib.mkForce false;
+  services.thermald.enable = lib.mkForce false;
+  services.promtail.enable = lib.mkForce false;
 
-  # TODO: can we reduce further?
+  documentation.enable = lib.mkForce false;
+
+  programs.neovim.enable = lib.mkForce false;
+  programs.git.package = pkgs.gitMinimal;
 
   sops.secrets = {
-    "dibbler/postgresql/url" = {
+    "dibbler/postgresql/password" = {
       owner = "dibbler";
       group = "dibbler";
     };
@@ -35,6 +47,8 @@
 
   networking = {
     hostName = "skrot";
+    defaultGateway = values.hosts.gateway;
+    defaultGateway6 = values.hosts.gateway6;
     interfaces.eth0 = {
       useDHCP = false;
       ipv4.addresses = [{
@@ -56,7 +70,15 @@
 
     settings = {
       general.quit_allowed = false;
-      database.url = config.sops.secrets."dibbler/postgresql/url".path;
+      database = {
+        type = "postgresql";
+        postgresql = {
+          username = "pvv_vv";
+          dbname = "pvv_vv";
+          host = "postgres.pvv.ntnu.no";
+          password_file = config.sops.secrets."dibbler/postgresql/password".path;
+        };
+      };
     };
   };
 
@@ -73,5 +95,5 @@
 
   # Don't change (even during upgrades) unless you know what you are doing.
   # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "25.05";
+  system.stateVersion = "25.11";
 }

secrets/skrott/skrott.yaml

@@ -1,6 +1,6 @@
 dibbler:
     postgresql:
-        url: ENC[AES256_GCM,data:rHmeviBKp5b33gZ+nRweJ9YSobG4OSOxypMcyGb3/Za5DyVjydEgWBkcugrLuy1fUYIu1UV93JizCRLqOOsNkg7ON2AGhw==,iv:mWgLeAmnVaRNuKI4jIKRtW5ZPjnt2tGqjfDbZkuAIXk=,tag:iHSkFcMmTWEFlIH7lVmN1Q==,type:str]
+        password: ENC[AES256_GCM,data:2n85TO709GJc7/qoYp2RXO8Ttfo=,iv:5ZCZPEQQXPGYfDd1qPhDwDfm1Gds1M8PEX9IiCsHcrw=,tag:PAseyFBAe56pLj5Uv8Jd7A==,type:str]
 sops:
     age:
         - recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
@@ -48,8 +48,8 @@ sops:
             ZE5tMXJOYlFMOVNJU3FEZFB4TlZ1U00KHnunzKMy91oc92ptcaKCE1sfkhFGvf0S
             vRX/nyQnBGqD3X3yfvkt+aQnoLxcjoanpJVM9VeigyPu1mRg0OOxXg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-01-11T17:28:43Z"
-    mac: ENC[AES256_GCM,data:l43vquKg33LndSXOm0hsPcalQRXjqbb30QvptXuBsmQrcEVVh20Aqp92l+rwgv60P03ZtK4SKxm/udVVoqViFTwCLYtCC5GEn4OqbD94LQKzl+XLe7yLWwv2WF8ueu170YpZ97uFxUrhOoaOaKUgnAV+4CocixG5hfadpqA3yYE=,iv:a6RRILzz4gDUuiSZPVoqjlIMu4NZG+D5Q+brusfh9PU=,tag:Y8nKbnctjka44eH15x8oCA==,type:str]
+    lastmodified: "2026-01-25T14:03:57Z"
+    mac: ENC[AES256_GCM,data:RBf3LjVNSclsPN7I4QPaDUjWbKlaccjk3rzsRNdRe3+OvJSd7MsS9RfpUFCqUtO7ZkkocXHmkHA8z8LNxs6vejT9czMsLLQD14qHZS6fFdTnToOx3Kt5UuviPO/2UryVI+6HWORkH1aqFJhzkSMop2TO5mzuOTfbCEBLYUUuS6s=,iv:NQs8O1hIbjzGBTZo+gCuisj3edraFGk/Y146HmfPmQY=,tag:4g9IXw2UFC5V9EIHuWJqdA==,type:str]
     pgp:
         - created_at: "2026-01-11T17:12:49Z"
           enc: |-

users/adriangl.nix

@@ -9,14 +9,6 @@
       "nix-builder-users"
     ];
 
-    packages = with pkgs; [
-      neovim
-      htop
-      ripgrep
-      vim
-      foot.terminfo
-    ];
-
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFa5y7KyLn2tjxed1czMbyM5scnEpo9v/GfnhL/28ckM legolas"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICf7SlyHR6KgP7+IeFr/Iuiu2lL5vaSlzqPonaO8XU0J gunalx@aragon"

users/albertba.nix

@@ -5,11 +5,7 @@
     extraGroups = [ "wheel" "drift" "nix-builder-users" ];
 
     packages = with pkgs; [
-      htop
-      neovim
-      ripgrep
       fd
-      tmux
     ];
 
     shell = pkgs.zsh;

users/felixalb.nix

@@ -9,8 +9,9 @@
     ];
     shell = pkgs.zsh;
     openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDKzPICGew7uN0cmvRmbwkwTCodTBUgEhkoftQnZuO4Q felixalbrigtsen@gmail.com"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBTXSL0w7OUcz1LzEt1T3I3K5RgyNV+MYz0x/1RbpDHQ felixalb@worf"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDKzPICGew7uN0cmvRmbwkwTCodTBUgEhkoftQnZuO4Q felixalb@pvv.ntnu.no"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJky33ynjqyWP+hh24gFCMFIEqe3CjIIowGM9jiPbT79 felixalb@sisko.home.feal.no"
     ];
   };
 }

users/oysteikt.nix

@@ -12,9 +12,6 @@
     packages = with pkgs; [
       bottom
       eza
-      neovim
-      ripgrep
-      tmux
     ];
 
     openssh.authorizedKeys.keys = [

users/pederbs.nix

@@ -14,14 +14,9 @@
       bat
       edir
       fd
-      htop
-      jq
       micro
       ncdu
-      ripgrep
       sd
-      tmux
-      wget
       xe
       yq
     ];

users/vegardbm.nix

@@ -11,9 +11,6 @@
     packages = with pkgs; [
       btop
       eza
-      neovim
-      ripgrep
-      tmux
     ];
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDVA3HqEx3je6L1AC+bP8sTxu3ZTKvTCR0npCyOVAYK5 vbm@arch-xeon"