lots of updates from the past few months

flake.nix

@@ -39,7 +39,7 @@
         inherit (mods) homeManagerModules nixosModules;
         # TODO: use ./hosts/
         nixosConfigurations = {
-          artemis = mkLinuxSystem [./hosts/artemis inputs.lanzaboote.nixosModules.lanzaboote] [];
+          artemis = mkLinuxSystem [./hosts/artemis] [];
           hermes = mkLinuxSystem [./hosts/hermes inputs.nocodb.nixosModules.nocodb inputs.copyparty.nixosModules.default] [inputs.copyparty.overlays.default];
         };
         diskoConfigurations = {}; # maybe?
@@ -88,7 +88,7 @@
     };
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
     unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
 
     scenics.url = "github:callumio/scenics";
@@ -117,12 +117,12 @@
     };
 
     home-manager = {
-      url = "github:nix-community/home-manager/release-25.05";
+      url = "github:nix-community/home-manager/release-25.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
     stylix = {
-      url = "github:danth/stylix/release-25.05";
+      url = "github:danth/stylix/release-25.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
@@ -161,11 +161,6 @@
     treefmt-nix.url = "github:numtide/treefmt-nix";
     treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";
 
-    lanzaboote = {
-      url = "github:nix-community/lanzaboote/v0.4.2";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     nish = {
       url = "github:callumio/nish";
       inputs = {

home/c/default.nix

@@ -24,7 +24,7 @@
     adwaita-icon-theme
     networkmanagerapplet
     libsecret
-    bitwarden
+    bitwarden-desktop
     #betterbird
     wl-clipboard
     discord

home/c/programs/git/default.nix

@@ -1,5 +1,6 @@
 {...}: {
-  programs.git = {
+  programs = {
+    git = {
       enable = true;
 
       userName = "Callum Leslie";
@@ -33,7 +34,8 @@
         push = {autoSetupRemote = true;};
         ghq = {root = "~/repos";};
       };
-
+    };
     delta.enable = true;
+    delta.enableGitIntegration = true;
   };
 }

home/c/programs/hypr/default.nix

@@ -11,7 +11,7 @@
   chat = getProgFor "discord";
   media = getProgFor "spotify";
   terminal = getProgFor "alacritty";
-  runner = getProgFor' "rofi-wayland" "rofi";
+  runner = getProgFor "rofi";
   rofi-rbw = getProgFor' "rofi-rbw-wayland" "rofi-rbw";
   tmux = getProgFor "tmux";
   slurp = getProgFor "slurp";

home/c/programs/rofi/default.nix

@@ -1,7 +1,7 @@
 {pkgs, ...}: {
   programs.rofi = {
     enable = true;
-    package = pkgs.rofi-wayland;
+    package = pkgs.rofi;
     #theme = "Arc-Dark";
   };
 }

hosts/artemis/configuration.nix

@@ -32,7 +32,7 @@
     adwaita-icon-theme
     apple-cursor
     wget
-    pinentry
+    pinentry-gnome3
     fzf
     nil
     killall

hosts/artemis/hardware-configuration.nix

@@ -18,11 +18,8 @@
     ];
     #kernelPackages = pkgs.linuxPackages_latest;
 
-    loader.systemd-boot.enable = lib.mkForce false;
+    # loader.systemd-boot.enable = lib.mkForce false;
-    lanzaboote = {
+    loader.systemd-boot.enable = true;
-      enable = true;
-      pkiBundle = "/etc/secureboot";
-    };
   };
   hardware = {
     bluetooth = {
@@ -39,7 +36,7 @@
         #intel-vaapi-driver # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
         intel-ocl
         libvdpau-va-gl
-        vaapiVdpau
+        libva-vdpau-driver
         intel-compute-runtime
         vpl-gpu-rt
       ];

hosts/hermes/headscale.nix

@@ -8,7 +8,10 @@ in {
       port = 8080;
       settings = {
         server_url = "https://${domain}";
-        dns = {base_domain = "net.cleslie.uk";};
+        dns = {
+          base_domain = "net.cleslie.uk";
+          override_local_dns = false;
+        };
 
         ip_prefixes = "100.64.0.0/10";
       };

hosts/hermes/media.nix

@@ -40,7 +40,7 @@ in {
     extraPackages = with pkgs; [
       intel-media-driver
       intel-vaapi-driver # previously vaapiIntel
-      vaapiVdpau
+      libva-vdpau-driver
       libvdpau-va-gl
       intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
       unstable.vpl-gpu-rt # QSV on 11th gen or newer

hosts/hermes/n8n.nix

@@ -5,9 +5,9 @@ in {
     cloudflare-dyndns.domains = [domain];
     n8n = {
       enable = true;
-      webhookUrl = "https://" + domain + "/";
+      environment = {
-      settings = {
+        PORT = "5678";
-        port = 5678;
+        WEBHOOK_URL = "https://" + domain + "/";
       };
     };
     caddy.virtualHosts.${domain}.extraConfig = ''