flake.nix

{
  description = "System config";

  nixConfig = {
    extra-substituters = [
      "https://vicinae.cachix.org"
      "https://cuda-maintainers.cachix.org"
      "https://cache.numtide.com"
    ];
    extra-trusted-public-keys = [
      "vicinae.cachix.org-1:1kDrfienkGHPYbkpNj1mWTr7Fm1+zcenzgTizIcI3oc="
      "cuda-maintainers.cachix.org-1:0dq3bujKpuEPMCX6U4WylrUDZ9JyUG0VpVZa7CNfq5E="
      "niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
    ];
  };

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
    home-manager = {
      url = "github:nix-community/home-manager";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    sops-nix.url = "github:Mic92/sops-nix";
    claude-code.url = "github:numtide/llm-agents.nix";
    vicinae.url = "github:vicinaehq/vicinae";
    grabit.url = "git+file:///home/fobos/dev/grabit?ref=edit-existing-file";
    hyprland-preview-share-picker.url = "git+https://github.com/WhySoBad/hyprland-preview-share-picker?submodules=1";
    mt7927-dkms = {
      url = "github:jetm/mediatek-mt7927-dkms";
      flake = false;
    };
    nix-index-database = {
      url = "github:nix-community/nix-index-database";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    net-tui = {
      url = "github:yofsh/net-tui";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    glide = {
      url = "github:glide-browser/glide.nix";
      inputs.nixpkgs.follows = "nixpkgs";
      inputs.home-manager.follows = "home-manager";
    };
  };

  outputs = { self, nixpkgs, home-manager, sops-nix, ... }@inputs:

    let
      system = "x86_64-linux";

      # file 5.48's landlock sandbox can't spawn decompressors, breaking archive
      # MIME detection and patool's tests (→ bottles → system build).
      # Backport of nixpkgs#540742; drop once it reaches nixos-unstable.
      patoolLandlockFix = _: prev: {
        pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
          (_: pyprev: {
            patool = pyprev.patool.override {
              file = prev.file.overrideAttrs (old: {
                postPatch = (old.postPatch or "") + ''
                  substituteInPlace src/landlock.c --replace-fail \
                    "LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR" \
                    "LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR | LANDLOCK_ACCESS_FS_EXECUTE"
                '';
              });
            };
          })
        ];
      };

      pkgs = import nixpkgs {
        inherit system;
        overlays = [
          # drop once nixpkgs#539806 (click-threading: rm docs before check) reaches nixos-unstable
          (_: prev: {
            pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
              (_: pyprev: {
                click-threading = pyprev.click-threading.overridePythonAttrs (old: {
                  preCheck = (old.preCheck or "") + ''
                    rm -rf docs
                  '';
                });
              })
            ];
          })
        ];
      };

    in {

      nixosConfigurations.iso = nixpkgs.lib.nixosSystem {
        inherit system;
        specialArgs = { inherit inputs; };
        modules = [
          ./hosts/iso/configuration.nix
          { nixpkgs.overlays = [ patoolLandlockFix ]; }

          home-manager.nixosModules.home-manager
          {
            home-manager.useGlobalPkgs = true;
            home-manager.useUserPackages = true;
            home-manager.extraSpecialArgs = { inherit inputs; hostname = "iso"; };
            home-manager.sharedModules = [
              inputs.vicinae.homeManagerModules.default
              inputs.nix-index-database.homeModules.nix-index
            ];
            home-manager.users.fobos = import ./home/default.nix;
          }
        ];
      };

      nixosConfigurations.ares = nixpkgs.lib.nixosSystem {
        inherit system;
        specialArgs = { inherit inputs; };
        modules = [
          sops-nix.nixosModules.sops
          ./hosts/ares/configuration.nix
          {
            nixpkgs.overlays = [
              (_: prev: { monique = prev.callPackage ./pkgs/monique.nix { }; })
              patoolLandlockFix
            ];
          }
        ];
      };

      nixosConfigurations.athena = nixpkgs.lib.nixosSystem {
        inherit system;
        specialArgs = { inherit inputs; };
        modules = [
          ./hosts/athena/configuration.nix
          sops-nix.nixosModules.sops
          { nixpkgs.overlays = [ patoolLandlockFix ]; }
        ];
      };

      nixosConfigurations.hermes = nixpkgs.lib.nixosSystem {
        inherit system;
        modules = [ ./hosts/hermes/configuration.nix ];
      };

      nixosConfigurations.demeter = nixpkgs.lib.nixosSystem {
        inherit system;
        modules = [ ./hosts/demeter/configuration.nix ];
      };

      homeConfigurations = let
        mkHome = hostname: home-manager.lib.homeManagerConfiguration {
          extraSpecialArgs = { inherit inputs hostname; };
          inherit pkgs;
          modules = [
            ./home/default.nix
            inputs.vicinae.homeManagerModules.default
            inputs.nix-index-database.homeModules.nix-index
          ];
        };
      in {
        "fobos@ares" = mkHome "ares";
        "fobos@athena" = mkHome "athena";
      };
    };
}