nixos/whale2: Refresh Valheim server and world

Pin the community image and start simpland3 while retaining simpland2. Correct the server-files volume name and reuse the admin ID in both access lists.
docs: Update generated references
2026-09-20 21:23:01 +01:00 · 2026-08-25 19:59:15 +00:00 · 2026-08-25 20:57:26 +01:00 · 2026-08-25 08:58:57 +01:00 · 2026-08-25 08:46:45 +01:00 · 2026-08-25 00:12:01 +01:00
28 changed files with 221 additions and 433 deletions
@@ -22,6 +22,12 @@ Key reminders (see the doc for the full steps):
  and the `flake.nix` stable pins must agree on one release.
 - **Re-verify the patch stack against freshly fetched upstream**, not stale refs — enumerate it with
  `git log`; don't assume a remembered list.
+- After pushing the rebased fork branches, **wait for the GitHub mirror to catch up** before
+  refreshing flake pins. The `nixpkgs-mine*` inputs fetch from GitHub, not the fork's primary
+  remote; verify both GitHub branch tips match the pushed local tips first.
 - After refreshing the pins, update `lib/constants.nix` to the current explicit LTS and latest
  kernel package attributes, and update the `lib/default.nix` version overlay's `YY.MM` prefix to
  the current month. Change its codename only when the stable channel advances.
+- After the cheap evaluations pass, build the actual devshell and one representative NixOS system
+  (prefer the local box). `nix flake check --no-build` does not expose dependency build failures;
+  this is especially important when updating build-tool inputs such as Determinate Nix.
@@ -37,6 +37,10 @@ jobs:
        env:
          HARMONIA_SSH_KEY: ${{ secrets.HARMONIA_SSH_KEY }}
        run: |
+          echo "::group::Collect cache garbage"
+          ci/push-to-cache.sh --gc
+          echo "::endgroup::"
+
          nix eval --json --apply "builtins.attrNames" .#ci.x86_64-linux | jq -cr '.[]' | while read job; do
            echo "::group::Build $job"
            nix build --no-link .#ci.x86_64-linux."$job"
@@ -39,10 +39,10 @@ jobs:
      - name: Commit and push if changed
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-          REPO_URL: ${{ gitea.repositoryUrl }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
+          REPO_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}"
          git remote set-url origin "${REPO_URL/https:\/\//https:\/\/oauth2:${GITEA_TOKEN}@}"
          git add docs/
          if ! git diff --cached --quiet; then
@@ -10,6 +10,14 @@ remote_cmd() {
  ssh -i "$SSH_KEY" "$SSH_HOST" env HOME=/run/harmonia NIX_REMOTE="$REMOTE_STORE" "$@"
 }

+collect_garbage() {
+  echo "Collecting garbage..."
+  remote_cmd nix-env \
+    -p "$REMOTE_STORE"/nix/var/nix/profiles/nixfiles \
+    --delete-generations 60d
+  remote_cmd nix-collect-garbage
+}
+
 umask_old=$(umask)
 umask 0066
 echo "$HARMONIA_SSH_KEY" | base64 -d > "$SSH_KEY"
@@ -17,6 +25,12 @@ umask $umask_old

 mkdir -p ~/.ssh
 cp ci/known_hosts ~/.ssh/
+
+if [ "${1-}" = "--gc" ]; then
+  collect_garbage
+  exit
+fi
+
 path="$1"

 echo "Pushing $path to cache..."
@@ -25,7 +39,4 @@ nix copy --no-check-sigs --to "$STORE_URI" "$path"
 if [ -n "$UPDATE_PROFILE" ]; then
  echo "Updating profile..."
  remote_cmd nix-env -p "$REMOTE_STORE"/nix/var/nix/profiles/nixfiles --set "$path"
-
-  echo "Collecting garbage..."
-  remote_cmd nix-collect-garbage --delete-older-than 60d
 fi
@@ -47,7 +47,7 @@ colony (physical VM host, ams1)
 │                                     ├── colony-psql  (shared PostgreSQL)
 │                                     ├── chatterbox   (Matrix Synapse + bridges)
 │                                     ├── jackflix     (media stack)
-│                                     ├── object       (MinIO, Harmonia Nix cache, Sharry, HedgeDoc, wastebin)
+│                                     ├── object       (MinIO, Harmonia Nix cache, HedgeDoc, wastebin)
 │                                     ├── toot         (Bluesky PDS; Mastodon disabled)
 │                                     ├── waffletail   (Tailscale subnet router / exit node)
 │                                     ├── qclk         (WireGuard management appliance)
@@ -175,7 +175,7 @@ descriptions) see [`reference/nixos-options.md`](reference/nixos-options.md).

 | Module | Provides |
 |---|---|
-| `common` | Baseline for all boxes: imports the impermanence, ragenix (age), sharry, copyparty and harmonia NixOS modules; pins `system.stateVersion`; `doas` instead of `sudo`; immutable users; nix settings (flakes, `ca-derivations`, the `nix-cache.nul.ie` substituter); declares the `my` option root. |
+| `common` | Baseline for all boxes: imports the impermanence, ragenix (age), copyparty and harmonia NixOS modules; pins `system.stateVersion`; `doas` instead of `sudo`; immutable users; nix settings (flakes, `ca-derivations`, the `nix-cache.nul.ie` substituter); declares the `my` option root. |
 | `user` | `my.user` — the primary user: `users.users` + matching `home-manager.users` entry, wheel/doas, SSH authorized key from `.keys/me.pub`, shell taken from the home config, home persistence under tmproot. |
 | `build` | `my.build` — alternate build targets via `extendModules`: `my.buildAs.devVM` (QEMU dev VM), `iso`, `container`, `kexecTree`, `netbootTree`/`netbootArchive`; `my.build.isDevVM` marker; `allHardware` profile toggle. |
 | `dynamic-motd` | `my.dynamic-motd` — runs a script via `pam_exec` to generate the MOTD on login/ssh. |
@@ -222,13 +222,14 @@ On pushes to `master`, this installs Determinate Nix on the runner (via
 Harmonia substituter as the boxes), runs `nix flake check --no-build`, then builds every attribute
 of `.#ci.x86_64-linux`: systems as `system-<name>`, homes as `home-<name>` (with `@` changed to
 `-at-`), packages as `package-<name>`, and the development `shell`. Each result is pushed to the
-Harmonia cache with [`ci/push-to-cache.sh`](../ci/push-to-cache.sh).
+Harmonia cache with [`ci/push-to-cache.sh`](../ci/push-to-cache.sh). Before the first push, the
+workflow deletes cache-profile generations older than its retention period, then collects
+unreachable paths so a full cache cannot prevent collection from being reached.

 It then builds `.#ciDrv.x86_64-linux`, a `linkFarm` of all CI attributes, and pushes it with
-`UPDATE_PROFILE=1`. That updates the `nixfiles` profile on the cache box and collects old paths
-according to the workflow's retention setting. The SSH store uses `/var/lib/harmonia`,
-`HARMONIA_SSH_KEY`, and pinned `ci/known_hosts`; clients use `https://nix-cache.nul.ie` through
-`lib.my.c.nix.cache`.
+`UPDATE_PROFILE=1`. That updates the `nixfiles` profile on the cache box. The SSH store uses
+`/var/lib/harmonia`, `HARMONIA_SSH_KEY`, and pinned `ci/known_hosts`; clients use
+`https://nix-cache.nul.ie` through `lib.my.c.nix.cache`.

 ### `installer.yaml`

@@ -159,6 +159,7 @@ edit prose there, never the other generated cells.
 | [`cellar`](sites/home/cellar.md) | `192.168.68.80/22 gw 192.168.71.254` | `2a0e:97c0:4d0:1::4:1/64` | h.nul.ie |  |
 | [`hass`](sites/home/sfh/containers/hass.md) | `192.168.68.103/22 gw 192.168.71.254` | `2a0e:97c0:4d0:1::5:3/64` | h.nul.ie |  |
 | [`palace`](sites/home/palace.md) | `192.168.68.22/22 gw 192.168.71.254` | `2a0e:97c0:4d0:1::2:1/64` | h.nul.ie |  |
+| [`portcullis`](sites/colony/portcullis.md) | `192.168.68.41/22 gw 192.168.71.254` | `2a0e:97c0:4d0:1::6:1/64` | h.nul.ie |  |
 | [`river`](sites/home/river.md) | `192.168.68.1/22` | `2a0e:97c0:4d0:1::1/64` | h.nul.ie |  |
 | `router-hi` | `192.168.71.254/22 gw 192.168.68.1` | `2a0e:97c0:4d0:1::ffff/64` | h.nul.ie | Floating VIP shared by [`river`](sites/home/river.md) and [`stream`](sites/home/stream.md) |
 | [`sfh`](sites/home/sfh/README.md) | `192.168.68.81/22 gw 192.168.71.254` | `2a0e:97c0:4d0:1::4:2/64` | h.nul.ie |  |
@@ -72,6 +72,12 @@ For **both** branches — `devplayer0` onto `upstream/nixos-unstable`, and `devp
   conflicted.
 6. ⏸ **Push:** only after confirmation. `git push --force-with-lease origin devplayer0
   devplayer0-stable` (force needed — rebase rewrites history).
+7. Wait for the GitHub mirror used by the flake inputs to catch up with the primary fork remote.
+   Compare the local branch tips with
+   `git ls-remote https://github.com/devplayer0/nixpkgs.git refs/heads/devplayer0
+   refs/heads/devplayer0-stable` and do not continue until both match. Updating sooner can leave
+   `nixpkgs-mine` and `nixpkgs-mine-stable` pinned to the pre-rebase commits even though the push
+   succeeded.

 ## Phase 3 — Update the pinned inputs

@@ -126,7 +132,7 @@ Don't blanket-update. Walk the other inputs deliberately:

 1. List inputs and locked revisions from `flake.lock` (or `nix flake metadata`).
 2. For each meaningful input (`libnetRepo`, `devshell`, `determinate-nix`, `ragenix`, `deploy-rs`,
-   `impermanence`, and the packaged apps like `boardie`, `harmonia`, `copyparty`, `sharry`, …),
+   `impermanence`, and the packaged apps like `boardie`, `harmonia`, and `copyparty`),
   compare the locked revision to upstream and summarize notable changes (breaking changes,
   relevant fixes). Many inputs `follows` `nixpkgs-unstable` and already moved in Phase 3.
 3. Propose a per-input update list with reasons; update the approved ones with targeted
@@ -137,7 +143,14 @@ Don't blanket-update. Walk the other inputs deliberately:
 1. `nix flake check --no-build` (broad eval; reproduces CI's cheap checks).
 2. `check-system <host>` on a representative box, and one exercising the stable channel if the
   boxes mix channels. This must exercise the refreshed kernel constants on both channels.
-3. Report eval/build results honestly. On failure, surface the error and stop rather than papering
+3. Build the actual devshell with
+   `nix build --no-link --print-out-paths .#devShells.x86_64-linux.default`. Evaluation does not
+   build its dependencies, so it cannot catch packaging conflicts introduced by inputs such as
+   Determinate Nix.
+4. After the evaluations pass, run `build-system <host>` for one representative NixOS box. Prefer
+   the local box when it is managed by this flake: its full closure is likely to exercise the most
+   relevant packages, home-manager configuration and upgraded kernel. Build only; do not switch.
+5. Report eval/build results honestly. On failure, surface the error and stop rather than papering
   over it.

 ## Wrap-up
@@ -24,7 +24,7 @@
 | `my.borgthin.jobs.<name>.repo` | string | `null` | borg repository URL |
 | `my.borgthin.jobs.<name>.timer.at` | string or list of string | `"5:00"` | systemd calendar time(s) to run backup at |
 | `my.borgthin.jobs.<name>.timer.persistent` | boolean | `false` | Persistent systemd timer |
-| `my.borgthin.lvmPackage` | package | `<derivation lvm2-2.03.39>` | Packge containing LVM tools |
+| `my.borgthin.lvmPackage` | package | `<derivation lvm2-2.03.41>` | Packge containing LVM tools |
 | `my.borgthin.package` | package | `inputs.borgthin.packages.${system}.borgthin` | borgthin package |
 | `my.borgthin.thinToolsPackage` | package | `<derivation thin-provisioning-tools-1.3.2>` | Package containing thin-provisioning-tools |

@@ -167,7 +167,7 @@
 | `my.nginx-sso.includes.instances.<name>.auth.redirect` | string | `"$scheme://$http_host$request_uri"` | URL to redirect to upon successful login. |
 | `my.nginx-sso.includes.instances.<name>.logout.path` | string | `"/sso-logout"` | HTTP path for SSO logout. |
 | `my.nginx-sso.includes.instances.<name>.logout.redirect` | string | `"$scheme://$http_host/"` | URL to redirect to upon successful logout. |
-| `my.nginx-sso.package` | package | `<derivation nginx-sso-0.27.7>` | nginx-sso package to use. |
+| `my.nginx-sso.package` | package | `<derivation nginx-sso-0.27.8>` | nginx-sso package to use. |

 ## `nvme` — [`nixos/modules/nvme`](../../nixos/modules/nvme)

@@ -276,11 +276,11 @@
 | `my.vms.instances.<name>.networks.<name>.model` | string | `"virtio-net"` | Device type for network interface. |
 | `my.vms.instances.<name>.networks.<name>.tapFD` | null or (unsigned integer, meaning >=0) | `null` | FD to use to pass existing TAP device. |
 | `my.vms.instances.<name>.networks.<name>.waitOnline` | boolean or string | `true` | Whether to wait for networkd to consider the bridge / existing TAP device online. Pass a string to set the OPERSTATE will wait for. |
-| `my.vms.instances.<name>.qemuBin` | absolute path | `"/nix/store/w4yhckm5wyvml3pqw8ai5fl174j14nrb-qemu-host-cpu-only-11.0.0/bin/qemu-kvm"` | Path to QEMU executable. |
+| `my.vms.instances.<name>.qemuBin` | absolute path | `"/nix/store/2lkr0v29a67jybn8ckjawpg08y0yizfp-qemu-host-cpu-only-11.1.0/bin/qemu-kvm"` | Path to QEMU executable. |
 | `my.vms.instances.<name>.qemuFlags` | list of string | `[ ]` | Additional flags to pass to QEMU. |
 | `my.vms.instances.<name>.smp.cpus` | unsigned integer, meaning >=0 | `1` | Number of CPU cores. |
 | `my.vms.instances.<name>.smp.threads` | unsigned integer, meaning >=0 | `1` | Number of threads per core. |
 | `my.vms.instances.<name>.spice.enable` | boolean | `true` | Whether to enable SPICE. |
 | `my.vms.instances.<name>.uuid` | string | `null` | QEMU machine UUID. |
 | `my.vms.instances.<name>.vga` | string | `"virtio"` | VGA card type. |
-| `my.vms.ovmfPackage` | package | `<derivation OVMF-202602>` | OVMF package. |
+| `my.vms.ovmfPackage` | package | `<derivation OVMF-202605>` | OVMF package. |
@@ -53,7 +53,7 @@ their current addresses. Each container has its own page:
 | [`colony-psql`](containers/colony-psql.md) | Shared PostgreSQL (14) |
 | [`chatterbox`](containers/chatterbox.md) | Matrix Synapse + bridges |
 | [`jackflix`](containers/jackflix.md) | Media stack |
-| [`object`](containers/object.md) | MinIO, Harmonia Nix cache, Sharry, HedgeDoc, wastebin |
+| [`object`](containers/object.md) | MinIO, Harmonia Nix cache, HedgeDoc, wastebin |
 | [`toot`](containers/toot.md) | Bluesky PDS (Mastodon disabled) |
 | [`waffletail`](containers/waffletail.md) | Tailscale subnet router / exit node |
 | [`qclk`](containers/qclk.md) | WireGuard management appliance |
@@ -15,7 +15,7 @@ database, the containers (and the `git` VM) connect here over the `ctrs` network
  the ident map.
 - **netdata** with the Python PostgreSQL collector.
 - Consumers wait for the database to accept connections with the `lib.my.systemdAwaitPostgres`
-  helper (e.g. `sharry`, `atticd`, `mastodon-init-db`, and `middleman`'s nginx as a DNS
+  helper (e.g. `atticd`, `mastodon-init-db`, and `middleman`'s nginx as a DNS
  bootstrap hack).

 ## Network assignments
@@ -27,7 +27,7 @@ use as the database hostname.

 ## Consumers

- [object](object.md) — `sharry` and `hedgedoc` (and `atticd` when enabled) over
+- [object](object.md) — `hedgedoc` (and `atticd` when enabled) over
  `colony-psql:5432`
 - [toot](toot.md) — Mastodon's database (Mastodon currently disabled)
 - [chatterbox](chatterbox.md) — the mautrix bridges (WhatsApp, Messenger, Instagram) via
@@ -71,7 +71,6 @@ all vhosts are `onlySSL`, kTLS and HTTP/2. "SSO" = gated behind nginx-sso (`gene
 | `jackflix.nul.ie` | `jackflix-ctr:8096` | Jellyfin; `/socket` websockets; `/` redirects to `/web/` |
 | `toot.nul.ie` | `toot-ctr:80` | Mastodon — **upstream currently disabled**, see [toot](toot.md) |
 | `pds.nul.ie` | `toot-ctr:3000` | Bluesky PDS ([toot](toot.md)); websockets |
-| `share.nul.ie` | `object-ctr:9090` | Sharry ([object](object.md)); websockets |
 | `stuff.nul.ie` | `jackflix-ctr:3923` | copyparty |
 | `public.nul.ie` (+ alias `p.nul.ie`) | static `/mnt/media/public` | fancyindex file listing; `addSSL` so plain HTTP also works |
 | `mc-map.nul.ie` | `simpcraft-oci:8100` | Minecraft map (OCI container on [`whale2`](../../whale2.md#game-servers)) |
@@ -1,7 +1,6 @@
 # object

-Object storage and the Nix binary cache, plus a few small self-hosted web apps (Sharry,
-HedgeDoc, wastebin).
+Object storage and the Nix binary cache, plus HedgeDoc and wastebin.

 - **Source:** [`shill/containers/object.nix`](../../../../../nixos/boxes/colony/vms/shill/containers/object.nix)
 - **Host:** NixOS container on [`shill`](../README.md) (bind-mounts `/mnt/minio` and
@@ -14,7 +13,6 @@ HedgeDoc, wastebin).
 | --- | --- | --- |
 | MinIO | `9000` (S3) / `9001` (console) | S3-compatible object storage, `s3.nul.ie` + `*.s3.nul.ie` (virtual-host style via `MINIO_DOMAIN`), console at `minio.nul.ie`; region `eu-central-1`; data on the `/mnt/minio` XFS volume |
 | Harmonia | `5000` | Nix binary cache at `nix-cache.nul.ie` — `harmonia-dev` cache serves `shill`'s `/nix/store` out of a dedicated store view rooted at `/var/lib/harmonia` (bind-mounted from `/mnt/nix-cache`), signed with the `nix-cache.key` secret; a `harmonia` user with authorized keys exists for cache pushes |
-| Sharry | `9090` | file sharing at `share.nul.ie`; Postgres on [colony-psql](colony-psql.md), files stored in the `share` MinIO bucket; fixed `dev` account + invite signup; mail via `mail.nul.ie`; configured share-size limit |
 | HedgeDoc | `3000` | collaborative markdown notes at `md.nul.ie`; Postgres on [colony-psql](colony-psql.md); anonymous edits but no anonymous notes, email login, no open email registration |
 | wastebin | `8088` | pastebin at `pb.nul.ie` |
 | atticd | `8069` | **currently disabled** (`services.atticd.enable = false`) — an alternative Nix cache that would store locally and sit behind `nix-cache.nul.ie`; config (including the `object/atticd.env` secret) is kept around |
@@ -29,10 +27,10 @@ See the consolidated [network assignments](../../../../networking.md#box-assignm

 ## Backing services

- [colony-psql](colony-psql.md) — Sharry and HedgeDoc databases (atticd too, when enabled).
+- [colony-psql](colony-psql.md) — HedgeDoc's database (atticd too, when enabled).
 - MinIO buckets back other boxes' services: Gitea LFS/packages (with the `middleman` MIME hack
  for Docker manifests), Mastodon's `mastodon` bucket and the Bluesky PDS `pds` bucket on
-  [toot](toot.md), and Sharry's `share` bucket.
+  [toot](toot.md).

 ## Notable config files

@@ -48,7 +48,8 @@ forwarded by `estuary`.
 | `graeme` | `25569` tcp+udp | running |

 - **valheim** ([`valheim.nix`](../../../nixos/boxes/colony/vms/whale2/valheim.nix)) —
-  `lloesche/valheim-server`, public server "amogus sus", world `simpland2`,
+  `community-valheim-tools/valheim-server`, public server "amogus sus", world `simpland3`
+  (previous world `simpland2` retained in the `valheim_data` volume),
  allow-listed Steam IDs, password from agenix.
 - **simpcraft** ([`minecraft/`](../../../nixos/boxes/colony/vms/whale2/minecraft)) —
  `itzg/minecraft-server` (self-built `git.nul.ie/dev/craftblock` image),
@@ -75,11 +75,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781351267,
-        "narHash": "sha256-86HFs1K+LRlx8t4AjaMdU5qlg4O7kLz1VlnNapKZIuY=",
+        "lastModified": 1787524125,
+        "narHash": "sha256-P48TOQdIbB0PKMn4FTk6X0utbf0LemNlJ+bFcSbveGA=",
        "owner": "9001",
        "repo": "copyparty",
-        "rev": "90639de9840d7dcc2d9000026fe547f666c1d550",
+        "rev": "9de090265f8d063056320f41d984830839017a2f",
        "type": "github"
      },
      "original": {
@@ -90,11 +90,11 @@
    },
    "crane": {
      "locked": {
-        "lastModified": 1780532242,
-        "narHash": "sha256-D+BsdpxmtUwtqGoY0IXPhHgTlmqgcZKCEo1oMyn7ep0=",
+        "lastModified": 1787326676,
+        "narHash": "sha256-lWhBbBvC05/xwivKBBiM2YNizpmgqCgyOIzomvRuwxs=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "59a82a1222dd3b2080b5cc52a1a2e8d5f1b77f37",
+        "rev": "692f7e9ef2ece8125b466f66f2af532b3edaed0d",
        "type": "github"
      },
      "original": {
@@ -150,11 +150,11 @@
        "utils": "utils"
      },
      "locked": {
-        "lastModified": 1781023725,
-        "narHash": "sha256-Gt+qFANcrDRjl3xzidLYrAUQCd3808iuAsLwZbYYAEU=",
+        "lastModified": 1786361680,
+        "narHash": "sha256-IxaZkb9rCGEZ+yGndxKXONeIEcKMzoFUsvLTB5G/caw=",
        "owner": "serokell",
        "repo": "deploy-rs",
-        "rev": "2ce9051767ee4d1a3c43b52ba327431783bfd463",
+        "rev": "16901271e5b30b591e56f7a84f25f186fb20f3e1",
        "type": "github"
      },
      "original": {
@@ -167,19 +167,17 @@
      "inputs": {
        "flake-parts": "flake-parts",
        "git-hooks-nix": "git-hooks-nix",
-        "nixpkgs": [
-          "nixpkgs-unstable"
-        ],
+        "nixpkgs": "nixpkgs_4",
        "nixpkgs-23-11": "nixpkgs-23-11",
        "nixpkgs-regression": "nixpkgs-regression"
      },
      "locked": {
-        "lastModified": 1785428605,
-        "narHash": "sha256-wfaiSRLM1wDb4MV+NEzbyheK9Y03/oe56NR2I84UF7E=",
-        "rev": "0ff46631f69584c9f76792cae595ea253bd482c3",
-        "revCount": 26288,
+        "lastModified": 1787334067,
+        "narHash": "sha256-wmwgSBcAGJe/e+FrLwJxlghYV12F7UkIodm0j6cosYg=",
+        "rev": "c407745c8b9b616bebf7288697699c45794e31ac",
+        "revCount": 27248,
        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.21.9/019fb409-4d6e-7243-8a88-23ceee2520e9/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.22.2/01a02595-e77f-7e43-a616-5bbc77a2dc07/source.tar.gz"
      },
      "original": {
        "type": "tarball",
@@ -205,25 +203,6 @@
        "type": "github"
      }
    },
-    "devshell-tools": {
-      "inputs": {
-        "flake-utils": "flake-utils_10",
-        "nixpkgs": "nixpkgs_5"
-      },
-      "locked": {
-        "lastModified": 1710099997,
-        "narHash": "sha256-WmBKTLdth6I/D+0//9enbIXohGsBjepbjIAm9pCYj0U=",
-        "owner": "eikek",
-        "repo": "devshell-tools",
-        "rev": "e82faf976d318b3829f6f7f6785db6f3c7b65267",
-        "type": "github"
-      },
-      "original": {
-        "owner": "eikek",
-        "repo": "devshell-tools",
-        "type": "github"
-      }
-    },
    "devshell_2": {
      "inputs": {
        "flake-utils": "flake-utils_3",
@@ -282,15 +261,15 @@
    "flake-compat_2": {
      "flake": false,
      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "owner": "edolstra",
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
        "type": "github"
      },
      "original": {
-        "owner": "edolstra",
+        "owner": "NixOS",
        "repo": "flake-compat",
        "type": "github"
      }
@@ -303,12 +282,12 @@
        ]
      },
      "locked": {
-        "lastModified": 1748821116,
-        "narHash": "sha256-F82+gS044J1APL0n4hH50GYdPRv/5JWm34oCJYmVKdE=",
-        "rev": "49f0870db23e8c1ca0b5259734a02cd9e1e371a1",
-        "revCount": 377,
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "revCount": 480,
        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/hercules-ci/flake-parts/0.1.377%2Brev-49f0870db23e8c1ca0b5259734a02cd9e1e371a1/01972f28-554a-73f8-91f4-d488cc502f08/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/hercules-ci/flake-parts/0.1.480%2Brev-17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e/019f2195-dee5-7233-9747-eca0c27f7406/source.tar.gz"
      },
      "original": {
        "type": "tarball",
@@ -354,57 +333,6 @@
        "type": "github"
      }
    },
-    "flake-utils_10": {
-      "inputs": {
-        "systems": "systems_10"
-      },
-      "locked": {
-        "lastModified": 1709126324,
-        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_11": {
-      "inputs": {
-        "systems": "systems_11"
-      },
-      "locked": {
-        "lastModified": 1705309234,
-        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_12": {
-      "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
    "flake-utils_2": {
      "inputs": {
        "systems": "systems_2"
@@ -543,21 +471,18 @@
    "git-hooks-nix": {
      "inputs": {
        "flake-compat": "flake-compat_2",
-        "gitignore": [
-          "determinate-nix"
-        ],
        "nixpkgs": [
          "determinate-nix",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1747372754,
-        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
-        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
-        "revCount": 1026,
+        "lastModified": 1784288435,
+        "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=",
+        "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9",
+        "revCount": 1231,
        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/cachix/git-hooks.nix/0.1.1026%2Brev-80479b6ec16fefd9c1db3ea13aeb038c60530f46/0196d79a-1b35-7b8e-a021-c894fb62163d/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/cachix/git-hooks.nix/0.1.1231%2Brev-43b3c1ab9d40fb1dbb008f451988a91e375825e9/019f7135-8fdf-76f0-b1a1-d2c67e91af8d/source.tar.gz"
      },
      "original": {
        "type": "tarball",
@@ -574,11 +499,11 @@
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1781128165,
-        "narHash": "sha256-97WpKZkaNAL5g7MtASLwqnrJrvrLpQRr6cXWiRNLiXQ=",
+        "lastModified": 1787502072,
+        "narHash": "sha256-K5sKCAV3kPbUW0evsqpWrlQRsa2t0jfkduSZ+lRWAA8=",
        "owner": "nix-community",
        "repo": "harmonia",
-        "rev": "f0dd1094cdc8d72e038cf9347cacfa9272a8f72d",
+        "rev": "7c1ef262e324bbf61201fe92a73849eb3d6fd9e2",
        "type": "github"
      },
      "original": {
@@ -595,11 +520,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781402797,
-        "narHash": "sha256-pBdDca7xv1nuP0kj+gC5g5AcR/DV+9Zy3CS6uDOMdJ4=",
+        "lastModified": 1781447016,
+        "narHash": "sha256-bxZ8XTdUFQRWsh6rZn7fCui/SV4ox7dUAiSg4zYJuDg=",
        "owner": "devplayer0",
        "repo": "hass-west-wood",
-        "rev": "3e6ef7a9084e4053c82dea20127a775e7bcf77a5",
+        "rev": "fd43bede6e1175d9118c42507b737041b8923787",
        "type": "github"
      },
      "original": {
@@ -637,11 +562,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781319724,
-        "narHash": "sha256-ZGuxexEMo4Xv28KJ0dX/m/PHN4oZIOnxHZpNTyrvx4M=",
+        "lastModified": 1787377438,
+        "narHash": "sha256-Sxu1NLTD/Ern6hFGLlZmtKCSct3YQXZI/lls8RE1XeM=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "8355f0a16b2dbb06a97959a918af5b239bbe05ae",
+        "rev": "65258d5c65a250189fde2e35f490d15e064c4c62",
        "type": "github"
      },
      "original": {
@@ -657,11 +582,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781305496,
-        "narHash": "sha256-g8Vv4Qfc7n+lgov97REu3X6BeJtvYY0hlSUZR1GrGQQ=",
+        "lastModified": 1787487906,
+        "narHash": "sha256-zIdM+8teujHm5hc5MIPDnV7k2UeOOT/pFyFtWjOCwsY=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "c87a39aa979acc4848016d2220c6238390d84779",
+        "rev": "cfba7ad5886b342b8dd63ba74354b3853ea4cfc9",
        "type": "github"
      },
      "original": {
@@ -674,7 +599,7 @@
        "home-manager": [
          "home-manager-unstable"
        ],
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_5"
      },
      "locked": {
        "lastModified": 1769548169,
@@ -693,11 +618,11 @@
    "libnetRepo": {
      "flake": false,
      "locked": {
-        "lastModified": 1776595118,
-        "narHash": "sha256-6bIEi8q5hXCHU9nApTbQXvpljMWldg3QipCD+jkOGK8=",
+        "lastModified": 1781446676,
+        "narHash": "sha256-b3rJDKxzsf7p4wI698iBi2PInDPRH3KwjdqOk/SahKk=",
        "owner": "oddlama",
        "repo": "nixos-extra-modules",
-        "rev": "84207afebb794be7b53cfc9768730f37c64f4a13",
+        "rev": "f097b474fcb5db7dfd52263c055c9e6caeb13d62",
        "type": "github"
      },
      "original": {
@@ -709,11 +634,11 @@
    "nix": {
      "flake": false,
      "locked": {
-        "lastModified": 1780652321,
-        "narHash": "sha256-o/6YXRB6AbeL4SYtSHlJ9oEROl6Wmf7yheJNa3fAv2I=",
+        "lastModified": 1787394889,
+        "narHash": "sha256-qtDusLx9yn0aME9D9Oe5QhFnmDUaARwMJo/vt4+DtIU=",
        "owner": "nixos",
        "repo": "nix",
-        "rev": "d1f04a798cf4276da59567c07a3bf4a628669288",
+        "rev": "88b09c64fbea076a0376830d98e5331f70ed31a3",
        "type": "github"
      },
      "original": {
@@ -777,11 +702,11 @@
    },
    "nixpkgs-mine": {
      "locked": {
-        "lastModified": 1781356656,
-        "narHash": "sha256-Ygkl3ZBJ434/WhwdK1FyvPMeHvNPAopg3KE/1HtcJuk=",
+        "lastModified": 1787612836,
+        "narHash": "sha256-25KxhEJHYVZXAwsHQbXpyaG9/WpWGo9EmGe7kzMc25Y=",
        "owner": "devplayer0",
        "repo": "nixpkgs",
-        "rev": "a15e20705db295f621cb5bb63613f03a9373323f",
+        "rev": "c92598bc3fd46ff4d23407045091eea206120979",
        "type": "github"
      },
      "original": {
@@ -793,11 +718,11 @@
    },
    "nixpkgs-mine-stable": {
      "locked": {
-        "lastModified": 1781356876,
-        "narHash": "sha256-s8ed+zuk5wrbyhtDQpkxycAcLmhQH9umGRuVRBNKUbU=",
+        "lastModified": 1787523195,
+        "narHash": "sha256-NI87OKi5hXSZlIgh5Gwjjca52MAJnwRaU/+Su99fMqg=",
        "owner": "devplayer0",
        "repo": "nixpkgs",
-        "rev": "2eb8bacf9f641d4510fc43ba7fc0eea7dfdf5b24",
+        "rev": "2a058ae98b603146eae51e6a268854ce0ad035a1",
        "type": "github"
      },
      "original": {
@@ -825,11 +750,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1780902259,
-        "narHash": "sha256-q8yYEC5f1mFlQO9RGna4LTc9QrcvWunX6FYp83munkQ=",
+        "lastModified": 1787414105,
+        "narHash": "sha256-WncT27+3BOkgTaJZLnCsf3LcYf9RXMuR9ONSN4rzQ7s=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "bd0ff2d3eac24699c3664d5966b9ef36f388e2ca",
+        "rev": "a9e6d84f9c2f9012f5fe7d964a7851352300e61a",
        "type": "github"
      },
      "original": {
@@ -840,11 +765,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1781074563,
-        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
+        "lastModified": 1787360063,
+        "narHash": "sha256-dt4WdcvsA8/RCe+VZZwqU0X+XMM3wBbGCWA0/sFWzGo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
+        "rev": "2c423e03bbafcff28bfadc6781a4a8257f205cb5",
        "type": "github"
      },
      "original": {
@@ -884,6 +809,22 @@
      }
    },
    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1784160687,
+        "narHash": "sha256-iYL/bixrb6FlHFu/gIuBYzq6c6lM5AAXsXNSWXtIgQc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "4382ed2b7a6839d4280a9b386db49cbc5907414d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "4382ed2b7a6839d4280a9b386db49cbc5907414d",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
      "locked": {
        "lastModified": 1768564909,
        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
@@ -899,38 +840,6 @@
        "type": "github"
      }
    },
-    "nixpkgs_5": {
-      "locked": {
-        "lastModified": 1709309926,
-        "narHash": "sha256-VZFBtXGVD9LWTecGi6eXrE0hJ/mVB3zGUlHImUs2Qak=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "79baff8812a0d68e24a836df0a364c678089e2c7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-23.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_6": {
-      "locked": {
-        "lastModified": 1674990008,
-        "narHash": "sha256-4zOyp+hFW2Y7imxIpZqZGT8CEqKmDjwgfD6BzRUE0mQ=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "d2bbcbe6c626d339b25a4995711f07625b508214",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
    "openwrt-feeds": {
      "inputs": {
        "nixpkgs": [
@@ -963,11 +872,11 @@
        "systems": "systems_7"
      },
      "locked": {
-        "lastModified": 1787302424,
-        "narHash": "sha256-fg9pKzO6OeQhe/bY2CpHb6QnHq57P/icwQz35GF/R/8=",
+        "lastModified": 1787474509,
+        "narHash": "sha256-jL5RS/TbKk7HxjsGyFWeceHveyRgM8btvfY9Z77P9jM=",
        "owner": "astro",
        "repo": "nix-openwrt-imagebuilder",
-        "rev": "276c1dd6346f50231392e97b3a9987c9dd57da28",
+        "rev": "4371439b1e4e582266fc38345d1a01db1f8db6d6",
        "type": "github"
      },
      "original": {
@@ -1044,8 +953,7 @@
        "nixpkgs-unstable": "nixpkgs-unstable",
        "openwrt-feeds": "openwrt-feeds",
        "openwrt-imagebuilder": "openwrt-imagebuilder",
-        "ragenix": "ragenix",
-        "sharry": "sharry"
+        "ragenix": "ragenix"
      }
    },
    "rust-overlay": {
@@ -1056,11 +964,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1761791894,
-        "narHash": "sha256-myRIDh+PxaREz+z9LzbqBJF+SnTFJwkthKDX9zMyddY=",
+        "lastModified": 1787454509,
+        "narHash": "sha256-r4LDUF+zmJnkftvCVkCrUhSJazsf6EVJF+V2l4/MYbI=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "59c45eb69d9222a4362673141e00ff77842cd219",
+        "rev": "f60c1b57ff805a46b5175c76fc981fb4f81efbcc",
        "type": "github"
      },
      "original": {
@@ -1069,48 +977,6 @@
        "type": "github"
      }
    },
-    "sbt": {
-      "inputs": {
-        "flake-utils": "flake-utils_12",
-        "nixpkgs": "nixpkgs_6"
-      },
-      "locked": {
-        "lastModified": 1698464090,
-        "narHash": "sha256-Pnej7WZIPomYWg8f/CZ65sfW85IfIUjYhphMMg7/LT0=",
-        "owner": "zaninime",
-        "repo": "sbt-derivation",
-        "rev": "6762cf2c31de50efd9ff905cbcc87239995a4ef9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "zaninime",
-        "repo": "sbt-derivation",
-        "type": "github"
-      }
-    },
-    "sharry": {
-      "inputs": {
-        "devshell-tools": "devshell-tools",
-        "flake-utils": "flake-utils_11",
-        "nixpkgs": [
-          "nixpkgs-unstable"
-        ],
-        "sbt": "sbt"
-      },
-      "locked": {
-        "lastModified": 1741328331,
-        "narHash": "sha256-OtsHm9ykxfAOMRcgFDsqFBBy5Wu0ag7eq1qmTIluVcw=",
-        "owner": "eikek",
-        "repo": "sharry",
-        "rev": "6203b90f9a76357d75c108a27ad00f323d45c1d0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "eikek",
-        "repo": "sharry",
-        "type": "github"
-      }
-    },
    "systems": {
      "locked": {
        "lastModified": 1681028828,
@@ -1126,36 +992,6 @@
        "type": "github"
      }
    },
-    "systems_10": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_11": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
    "systems_2": {
      "locked": {
        "lastModified": 1681028828,
@@ -1284,11 +1120,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780220602,
-        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "lastModified": 1786901030,
+        "narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+        "rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa",
        "type": "github"
      },
      "original": {
@@ -35,10 +35,11 @@
    home-manager-stable.inputs.nixpkgs.follows = "nixpkgs-stable";

    # Determinate Nix, used as the common Nix implementation across systems, homes, the devshell and
-    # CI (see lib.my.c.nix). We build it ourselves against our pinned nixpkgs (FlakeHub's cache needs
-    # auth), so it flows through our own Harmonia cache like everything else.
+    # CI (see lib.my.c.nix). We build it ourselves (FlakeHub's cache needs auth), so it flows through
+    # our own Harmonia cache like everything else. Keep its tested nixpkgs pin: its packaging carries
+    # compatibility patches that can conflict with newer nixpkgs patches.
    determinate-nix.url = "https://flakehub.com/f/DeterminateSystems/nix-src/*";
-    determinate-nix.inputs.nixpkgs.follows = "nixpkgs-unstable";
+    determinate-nix.inputs.nixpkgs.url = "github:NixOS/nixpkgs/4382ed2b7a6839d4280a9b386db49cbc5907414d";

    # Stuff used by the flake for build / deployment
    # ragenix.url = "github:yaxitech/ragenix";
@@ -68,8 +69,6 @@
    openwrt-feeds.inputs.openwrt-imagebuilder.follows = "openwrt-imagebuilder";

    # Packages not in nixpkgs
-    sharry.url = "github:eikek/sharry";
-    sharry.inputs.nixpkgs.follows = "nixpkgs-unstable";
    borgthin.url = "github:devplayer0/borg";
    # TODO: Update borgthin so this works
    # borgthin.inputs.nixpkgs.follows = "nixpkgs-mine";
@@ -423,12 +423,12 @@ in
        gtk = {
          enable = true;
          theme = {
-            name = "Numix";
-            package = pkgs.numix-gtk-theme;
+            name = "Adwaita";
+            package = pkgs.gnome-themes-extra;
          };
          gtk4.theme = {
-            name = "Numix";
-            package = pkgs.numix-gtk-theme;
+            name = "Adwaita";
+            package = pkgs.gnome-themes-extra;
          };
          iconTheme = {
            name = "Numix";
@@ -30,7 +30,7 @@ rec {

  kernel = {
    lts = pkgs: pkgs.linuxKernel.packages.linux_6_18;
-    latest = pkgs: pkgs.linuxKernel.packages.linux_7_0;
+    latest = pkgs: pkgs.linuxKernel.packages.linux_7_2;
  };

  nginx = rec {
@@ -253,7 +253,7 @@ rec {
  in
  {
    trivial = prev.trivial // {
-      release = "26.06:u-${prev.trivial.release}";
+      release = "26.08:u-${prev.trivial.release}";
      codeName = "Irritating";
      revisionWithDefault = default: self.rev or default;
      versionSuffix = ".${date}.${revCode self}:u-${revCode pkgsFlake}";
@@ -336,15 +336,6 @@ in
        useACMEHost = pubDomain;
      };

-      "share.${pubDomain}" = {
-        locations."/" = {
-          proxyPass = "http://object-ctr.${domain}:9090";
-          proxyWebsockets = true;
-          extraConfig = proxyHeaders;
-        };
-        useACMEHost = pubDomain;
-      };
-
      "stuff.${pubDomain}" = {
        locations."/" = {
          proxyPass = "http://jackflix-ctr.${domain}:3923";
@@ -47,10 +47,6 @@ in
              key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdHbZErWLmTPO/aEWB1Fup/aGMf31Un5Wk66FJwTz/8";
              files = {
                "object/minio.env" = {};
-                "object/sharry.conf" = {
-                  owner = "sharry";
-                  group = "sharry";
-                };
                "object/minio-client-config.json" = {
                  owner = config.my.user.config.name;
                  group = config.my.user.config.group;
@@ -65,7 +61,6 @@ in
            firewall = {
              tcp.allowed = [
                9000 9001
-                config.services.sharry.config.bind.port
                8069
                5000
                config.services.hedgedoc.settings.port
@@ -122,8 +117,6 @@ in
                };
              };

-              sharry = awaitPostgres;
-
              atticd = mkMerge [
                awaitPostgres
                {
@@ -175,66 +168,6 @@ in
              dataDir = [ "/mnt/minio" ];
            };

-            sharry = {
-              enable = true;
-              configOverridesFile = config.age.secrets."object/sharry.conf".path;
-
-              config = {
-                base-url = "https://share.${lib.my.c.pubDomain}";
-                bind.address = "::";
-                alias-member-enabled = true;
-                webapp = {
-                  chunk-size = "64M";
-                };
-                backend = {
-                  auth = {
-                    fixed = {
-                      enabled = true;
-                      user = "dev";
-                    };
-                    internal = {
-                      enabled = true;
-                      order = 50;
-                    };
-                  };
-                  jdbc = {
-                    url = "jdbc:postgresql://colony-psql:5432/sharry";
-                    user = "sharry";
-                  };
-                  files = {
-                    default-store = "minio";
-                    stores = {
-                      database.enabled = false;
-                      minio = {
-                        enabled = true;
-                        type = "s3";
-                        endpoint = "https://s3.nul.ie";
-                        access-key = "share";
-                        bucket = "share";
-                      };
-                    };
-                  };
-                  compute-checksum.parallel = 4;
-                  signup.mode = "invite";
-                  share = {
-                    max-size = "128G";
-                    max-validity = "3650 days";
-                  };
-                  mail = {
-                    enabled = true;
-                    smtp = {
-                      host = "mail.nul.ie";
-                      port = 587;
-                      user = "sharry@nul.ie";
-                      ssl-type = "starttls";
-                      default-from = "Sharry <sharry@nul.ie>";
-                      timeout = "30 seconds";
-                    };
-                  };
-                };
-              };
-            };
-
            atticd = {
              enable = false;
              environmentFile = config.age.secrets."object/atticd.env".path;
@@ -308,7 +241,6 @@ in
            forwardPorts = [
              { from = "host"; host.port = 9000; guest.port = 9000; }
              { from = "host"; host.port = 9001; guest.port = 9001; }
-              { from = "host"; guest.port = config.services.sharry.config.bind.port; }
            ];
          };
        })
@@ -2,21 +2,24 @@
 let
  inherit (lib) concatStringsSep;
  inherit (lib.my) dockerNetAssignment;
+
+  admin = "76561198049818986"; # /dev/player0
 in
 {
  config = {
    virtualisation.oci-containers.containers = {
      valheim = {
-        image = "ghcr.io/lloesche/valheim-server@sha256:d977ccbeff02d2509646fb0157b5e353ebadb3105a3ed351b9c309a09a61701b";
+        image = "ghcr.io/community-valheim-tools/valheim-server@sha256:f3ccde9a4e292663cf5096d502ff33cc9617015f6d70b6a9ca0968543f165ef2";

        environment = {
          BACKUPS_IF_IDLE = "false";
          SERVER_NAME = "amogus sus";
          SERVER_PUBLIC = "true";
-          WORLD_NAME = "simpland2";
-          ADMINLIST_IDS = "76561198049818986";
+          # Previous world: simpland2
+          WORLD_NAME = "simpland3";
+          ADMINLIST_IDS = admin;
          PERMITTEDLIST_IDS = concatStringsSep " " [
-            "76561198049818986" # /dev/player0
+            admin
            "76561198044432445" # Nuda
            "76561198121606266" # El Pugador
            "76561198059894566" # hynge
@@ -27,7 +30,7 @@ in

        volumes = [
          "valheim_data:/config"
-          "valhem_server:/opt/valheim"
+          "valheim_server:/opt/valheim"
        ];

        extraOptions = [
@@ -47,8 +47,9 @@ in
      inherit (lib) mkMerge mkIf mkForce;
      inherit (lib.my) networkdAssignment;

+      hassPort = 8123;
      hassCli = pkgs.writeShellScriptBin "hass-cli" ''
-        export HASS_SERVER="http://localhost:${toString config.services.home-assistant.config.http.server_port}"
+        export HASS_SERVER="http://localhost:${toString hassPort}"
        export HASS_TOKEN="$(< ${config.age.secrets."hass/cli-token.txt".path})"
        exec ${pkgs.home-assistant-cli}/bin/hass-cli "$@"
      '';
@@ -69,7 +70,7 @@ in
          };

          firewall = {
-            tcp.allowed = [ "http" 1883 ];
+            tcp.allowed = [ "http" hassPort 1883 ];
          };
        };

@@ -164,29 +165,7 @@ in
            };
          };

-          home-assistant =
-          let
-            cfg = config.services.home-assistant;
-
-            pyirishrail = ps: ps.buildPythonPackage rec {
-              pname = "pyirishrail";
-              version = "0.0.2";
-              src = pkgs.fetchFromGitHub {
-                owner = "ttroy50";
-                repo = "pyirishrail";
-                tag = version;
-                hash = "sha256-NgARqhcXP0lgGpgBRiNtQaSn9JcRNtCcZPljcL7t3Xc=";
-              };
-
-              dependencies = with ps; [
-                requests
-              ];
-
-              pyproject = true;
-              build-system = [ ps.setuptools ];
-            };
-          in
-          {
+          home-assistant = {
            enable = true;

            extraComponents = [
@@ -208,7 +187,6 @@ in
              isal

              gtts
-              (pyirishrail python3Packages)
            ];
            customComponents = with pkgs.home-assistant-custom-components; [
              alarmo
@@ -217,7 +195,6 @@ in
            ];

            configWritable = false;
-            openFirewall = true;
            config = {
              default_config = {};
              homeassistant = {
@@ -227,9 +204,10 @@ in
                country = "IE";
                time_zone = "Europe/Dublin";
                external_url = "https://hass.${pubDomain}";
-                internal_url = "http://hass-ctr.${domain}:${toString cfg.config.http.server_port}";
+                internal_url = "http://hass-ctr.${domain}:${toString hassPort}";
              };
              http = {
+                server_port = hassPort;
                use_x_forwarded_for = true;
                trusted_proxies = with allAssignments.middleman.internal; [
                  ipv4.address
@@ -191,7 +191,7 @@ let
      # Routes the custom modules into `baseModules` so the NixOS manual documents them. The old
      # infinite-recursion is gone, but enabling this makes every system build regenerate the
      # manual, and it documents everything the modules transitively import — including third-party
-      # modules that aren't doc-clean (e.g. `services.sharry`). Prefer the generated
+      # modules that aren't doc-clean. Prefer the generated
      # `nixos.optionsDoc` reference (`docs/reference/nixos-options.md`) instead.
      docCustom = mkBoolOpt' false "Whether to document nixfiles' custom NixOS modules.";

@@ -11,7 +11,6 @@ in
  imports = [
    inputs.impermanence.nixosModules.default
    inputs.ragenix.nixosModules.age
-    inputs.sharry.nixosModules.default
    inputs.copyparty.nixosModules.default
    inputs.harmonia.nixosModules.harmonia
  ];
@@ -77,7 +76,6 @@ in
      nixpkgs = {
        overlays = [
          inputs.deploy-rs.overlays.default
-          inputs.sharry.overlays.default
          # TODO: Re-enable when borgthin is updated
          # inputs.borgthin.overlays.default
          inputs.boardie.overlays.default
@@ -169,7 +167,7 @@ in

      services = {
        # TODO: Remove if-else when 26.11 releases
-        kmscon = if (config.system.nixos.release == "26.06:u-26.11") then {
+        kmscon = if (config.system.nixos.release == "26.08:u-26.11") then {
          enable = mkDefault false;
          config = {
            hwaccel = config.hardware.graphics.enable;
@@ -36,9 +36,9 @@
  // procfs files report a size of zero, so IOUtils reads /proc/meminfo as empty.
  // nsIScriptableInputStream also rejects reads larger than that reported size;
  // nsIConverterInputStream reads until EOF without relying on it.
-  function availableMemory() {
+  function readProcFile(path) {
    const file = Cc["@mozilla.org/file/local;1"].createInstance(Ci.nsIFile);
-    file.initWithPath("/proc/meminfo");
+    file.initWithPath(path);
    const fileStream = Cc["@mozilla.org/network/file-input-stream;1"].createInstance(
      Ci.nsIFileInputStream
    );
@@ -48,17 +48,38 @@
    );
    input.init(fileStream, "UTF-8", 0, 0);
    const chunk = {};
-    let meminfo = "";
+    let contents = "";
    while (input.readString(4096, chunk)) {
-      meminfo += chunk.value;
+      contents += chunk.value;
    }
    input.close();
+    return contents;
+  }

-    const match = /^MemAvailable:\s+(\d+)\s+kB$/m.exec(meminfo);
+  function memoryInfo() {
+    const meminfo = readProcFile("/proc/meminfo");
+
+    const readKiB = name => {
+      const match = new RegExp(`^${name}:\\s+(\\d+)\\s+kB$`, "m").exec(meminfo);
+      if (!match) {
+        throw new Error(`${name} is absent from /proc/meminfo`);
+      }
+      return Number(match[1]) * 1024;
+    };
+
+    return {
+      available: readKiB("MemAvailable"),
+    };
+  }
+
+  const availableMemory = () => memoryInfo().available;
+
+  function swapOutPages() {
+    const match = /^pswpout\s+(\d+)$/m.exec(readProcFile("/proc/vmstat"));
    if (!match) {
-      throw new Error("MemAvailable is absent from /proc/meminfo");
+      throw new Error("pswpout is absent from /proc/vmstat");
    }
-    return Number(match[1]) * 1024;
+    return Number(match[1]);
  }

  async function unloadOne(minInactiveMs) {
@@ -184,6 +205,7 @@
    underPressure: false,
    timer: null,
    paths: null,
+    previousSwapOutPages: null,

    async tick() {
      if (this.busy) {
@@ -203,19 +225,32 @@
          return;
        }

-        const available = await availableMemory();
+        const { available } = memoryInfo();
+        const currentSwapOutPages = swapOutPages();
+        // Swap usage persists after pressure passes, so react to new swap-outs instead.
+        const swappedOutPages =
+          this.previousSwapOutPages === null
+            ? 0
+            : Math.max(0, currentSwapOutPages - this.previousSwapOutPages);
+        this.previousSwapOutPages = currentSwapOutPages;
        const low = prefInt("lowAvailableMiB") * MiB;
        const high = prefInt("highAvailableMiB") * MiB;
        if (high <= low) {
          throw new Error("highAvailableMiB must be greater than lowAvailableMiB");
        }

-        if (!this.underPressure && available <= low) {
+        if (!this.underPressure && (available <= low || swappedOutPages > 0)) {
          this.underPressure = true;
-          log(`memory pressure entered at ${Math.round(available / MiB)} MiB available`);
-        } else if (this.underPressure && available >= high) {
+          log(
+            `memory pressure entered at ${Math.round(available / MiB)} MiB available, ` +
+              `${swappedOutPages} pages swapped out since the previous poll`
+          );
+        } else if (this.underPressure && available >= high && swappedOutPages === 0) {
          this.underPressure = false;
-          log(`memory pressure cleared at ${Math.round(available / MiB)} MiB available`);
+          log(
+            `memory pressure cleared at ${Math.round(available / MiB)} MiB available, ` +
+              "no pages swapped out since the previous poll"
+          );
        }

        if (this.underPressure) {
@@ -1,18 +0,0 @@
-----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGhrYnR2ZyBCeHA4
-Y0hkSGZSNkMxNTY0SUVEQ3FXK0V5QUdVK2hXUFloVW1hVERHK2xFCm4xd1JJWXpH
-a1J2QTVvUyt4OXdzWWtMMEo4NFZ3ZkY0YXdydXpOVCtya1UKLT4gWDI1NTE5IHhI
-TW5FTHdpYjNwclVsajBUS3ZRSXpER0pKaEFiWFU3Q3cyT0RZT1VnQXcKZFNOODJu
-d3RiS0p0b3JmRlZ5M0JCRDB0MzNoUkRWamdkNXZQUzB1RHZoQQotPiAvR15OXkZR
-eS1ncmVhc2UKVjhxR0dVVHNWWHdxVFkyd1lPMnN5NXp6Ky9MOHlpNnpIeEExVUhO
-dEtXNG9DRFY2OWNlWnFIb1c3MjNLS2V6ZAppTEo3RmZHbzRPQVA3b2xkdmZZCi0t
-LSA4RmE0OVlPbUhqWDdwVHNvS0JRcm9XQXl6SFVEYXRnWS81SzNxV1NBWjY4CoYX
-xS977tMXj6AbcEZvzRgJfLFoFVRGajoa+QwQyLfkZ6wkI/BQQbgSDOR2s6JEB5Fy
-RIoJAB7iZoApj+Ctc4W23qif8gdMedp576VRaDSIo8CC+R6FQlf9s+1MHay8Z+ge
-TjWV3xO/70eVYjPc2u/NvejZruBQc52X/yWxnZOrOl2QRDe3dzn9PHiawXdun1bl
-qZlhaMaR449BPl3eadTrm4l6IybRSRqIgTWgkEOCUqdrVuBtb1HbqTf2FB9/rD41
-BblBV0q/UGx9kUxetgPiu8Wa1hjepSeSglJ9SeKAlH0PC3q+F9tYirphrxFrLGiK
-e7aV4Ukpqi0T5vpCkkwm7wF3uTZnmPDz7cWvYbIw1T12N3pV/pxrjigTpqB91svC
-jlMQCCtdyEojfUb+tlLlNjvkAbvwZHrc8nBCyuvTuzc2vaUnf6VTaJxGG97tUIyY
-brkp5b+mDaU=
-----END AGE ENCRYPTED FILE-----
Author	SHA1	Message	Date
jackos1998	73e538ad1f	nixos/whale2: Refresh Valheim server and world CI / Check, build and cache nixfiles (push) Successful in 55m5s Details Update docs / update (push) Successful in 1m10s Details Pin the community image and start simpland3 while retaining simpland2. Correct the server-files volume name and reuse the admin ID in both access lists.	2026-09-20 21:23:01 +01:00
github-actions[bot]	9e9027a250	docs: Update generated references	2026-08-25 19:59:15 +00:00
jackos1998	b904922356	ci/docs: Fix repository URL for push CI / Check, build and cache nixfiles (push) Has been cancelled Details Update docs / update (push) Successful in 1m4s Details	2026-08-25 20:57:26 +01:00
jackos1998	02c965dd96	ci/cache: Keep collection in preflight CI / Check, build and cache nixfiles (push) Successful in 47m34s Details Update docs / update (push) Failing after 1m4s Details Group cache collection separately in the Actions log and avoid repeating it after updating the CI profile.	2026-08-25 08:58:57 +01:00
jackos1998	adea4bd9e5	ci/cache: Prune profile generations Update docs / update (push) Failing after 1m5s Details CI / Check, build and cache nixfiles (push) Failing after 3h5m51s Details Explicitly remove expired generations from the nonstandard Harmonia profile before collecting garbage. This keeps old CI closures from remaining rooted until the cache exhausts its inodes.	2026-08-25 08:46:45 +01:00
jackos1998	e875971237	nixos/hass: Use packaged pyirishrail CI / Check, build and cache nixfiles (push) Failing after 29m48s Details Update docs / update (push) Failing after 1m9s Details Fix pyirishrail metadata in the nixpkgs fork, update the mine pin, and remove the local package now supplied by the Home Assistant component.	2026-08-25 00:12:01 +01:00
jackos1998	1a9c601c2b	ci/cache: Collect garbage before pushes Update docs / update (push) Failing after 1m3s Details CI / Check, build and cache nixfiles (push) Failing after 26m9s Details Run retention cleanup before uploading build results so inode exhaustion cannot prevent CI from reaching its only garbage-collection step.	2026-08-24 22:57:10 +01:00
jackos1998	92855606a4	pkgs/firefox-memory-control: React to swap-outs CI / Check, build and cache nixfiles (push) Failing after 20m49s Details Update docs / update (push) Failing after 1m9s Details Firefox can exhaust swap while `MemAvailable` remains above the unload threshold. Track new `pswpout` pages so active swapping triggers tab unloading without treating stale swap occupancy as permanent pressure.	2026-08-24 15:19:23 +01:00
jackos1998	5171a10079	nixpkgs: Refresh channels and inputs CI / Check, build and cache nixfiles (push) Failing after 59m32s Details Update docs / update (push) Failing after 1m12s Details Rebase the fork branches and refresh nixpkgs, home-manager, and the approved ancillary inputs. Update kernel and release metadata, adapt removed package and Home Assistant options, and keep Determinate Nix on its tested nixpkgs revision to avoid duplicate Boost patches. Retire Sharry and its public endpoint because copyparty replaces it. Document the GitHub mirror gate and require real devshell and system builds in the upgrade validation workflow.	2026-08-24 00:10:18 +01:00