flake.nix

@@ -39,7 +39,7 @@
         inherit (mods) homeManagerModules nixosModules;
         # TODO: use ./hosts/
         nixosConfigurations = {
-          artemis = mkLinuxSystem [./hosts/artemis] [];
+          artemis = mkLinuxSystem [./hosts/artemis inputs.lanzaboote.nixosModules.lanzaboote] [];
           hermes = mkLinuxSystem [./hosts/hermes inputs.nocodb.nixosModules.nocodb inputs.copyparty.nixosModules.default] [inputs.copyparty.overlays.default];
         };
         diskoConfigurations = {}; # maybe?
@@ -88,7 +88,7 @@
     };
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
     unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
 
     scenics.url = "github:callumio/scenics";
@@ -117,12 +117,12 @@
     };
 
     home-manager = {
-      url = "github:nix-community/home-manager/release-25.11";
+      url = "github:nix-community/home-manager/release-25.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
     stylix = {
-      url = "github:danth/stylix/release-25.11";
+      url = "github:danth/stylix/release-25.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
@@ -161,6 +161,11 @@
     treefmt-nix.url = "github:numtide/treefmt-nix";
     treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";
 
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/v0.4.2";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     nish = {
       url = "github:callumio/nish";
       inputs = {

home/c/default.nix

@@ -24,7 +24,7 @@
     adwaita-icon-theme
     networkmanagerapplet
     libsecret
-    bitwarden-desktop
+    bitwarden
     #betterbird
     wl-clipboard
     discord

home/c/programs/direnv/default.nix

@@ -1,4 +1,4 @@
-{...}: {
+{config, ...}: {
   programs.direnv = {
     enable = true;
     nix-direnv.enable = true;

home/c/programs/fish/default.nix

@@ -13,7 +13,6 @@ in {
     enable = true;
 
     interactiveShellInit = ''
-      set sponge_purge_only_on_exit true
       set fish_greeting
       trap __trap_exit_tmux EXIT
     '';
@@ -32,6 +31,7 @@ in {
     };
 
     plugins = with pkgs.fishPlugins; [
+      (mkFishPlug z)
       (mkFishPlug hydro)
       (mkFishPlug sponge)
       (mkFishPlug grc)

home/c/programs/git/default.nix

@@ -1,6 +1,5 @@
 {...}: {
-  programs = {
-    git = {
+  programs.git = {
     enable = true;
 
     userName = "Callum Leslie";
@@ -34,8 +33,7 @@
       push = {autoSetupRemote = true;};
       ghq = {root = "~/repos";};
     };
-    };
+
     delta.enable = true;
-    delta.enableGitIntegration = true;
   };
 }

home/c/programs/hypr/default.nix

@@ -11,7 +11,7 @@
   chat = getProgFor "discord";
   media = getProgFor "spotify";
   terminal = getProgFor "alacritty";
-  runner = getProgFor "rofi";
+  runner = getProgFor' "rofi-wayland" "rofi";
   rofi-rbw = getProgFor' "rofi-rbw-wayland" "rofi-rbw";
   tmux = getProgFor "tmux";
   slurp = getProgFor "slurp";

home/c/programs/jj/default.nix

@@ -1,4 +1,4 @@
-{...}: {
+{lib, ...}: {
   programs.jujutsu = {
     enable = true;
     settings = {

home/c/programs/rofi/default.nix

@@ -1,7 +1,7 @@
 {pkgs, ...}: {
   programs.rofi = {
     enable = true;
-    package = pkgs.rofi;
+    package = pkgs.rofi-wayland;
     #theme = "Arc-Dark";
   };
 }

hosts/artemis/configuration.nix

@@ -32,7 +32,7 @@
     adwaita-icon-theme
     apple-cursor
     wget
-    pinentry-gnome3
+    pinentry
     fzf
     nil
     killall

hosts/artemis/hardware-configuration.nix

@@ -18,8 +18,11 @@
     ];
     #kernelPackages = pkgs.linuxPackages_latest;
 
-    # loader.systemd-boot.enable = lib.mkForce false;
-    loader.systemd-boot.enable = true;
+    loader.systemd-boot.enable = lib.mkForce false;
+    lanzaboote = {
+      enable = true;
+      pkiBundle = "/etc/secureboot";
+    };
   };
   hardware = {
     bluetooth = {
@@ -36,7 +39,7 @@
         #intel-vaapi-driver # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
         intel-ocl
         libvdpau-va-gl
-        libva-vdpau-driver
+        vaapiVdpau
         intel-compute-runtime
         vpl-gpu-rt
       ];

hosts/hermes/copyparty.nix

@@ -20,7 +20,7 @@ in {
           };
         };
         "/paperless" = {
-          path = "/var/lib/paperless";
+          path = "/var/lib/media/library";
           access = {
             rw = ["c"];
           };

hosts/hermes/headscale.nix

@@ -8,10 +8,7 @@ in {
       port = 8080;
       settings = {
         server_url = "https://${domain}";
-        dns = {
-          base_domain = "net.cleslie.uk";
-          override_local_dns = false;
-        };
+        dns = {base_domain = "net.cleslie.uk";};
 
         ip_prefixes = "100.64.0.0/10";
       };

hosts/hermes/media.nix

@@ -1,4 +1,8 @@
-{pkgs, ...}: let
+{
+  pkgs,
+  config,
+  ...
+}: let
   mediaDir = "/var/lib/media";
 in {
   users = {
@@ -36,7 +40,7 @@ in {
     extraPackages = with pkgs; [
       intel-media-driver
       intel-vaapi-driver # previously vaapiIntel
-      libva-vdpau-driver
+      vaapiVdpau
       libvdpau-va-gl
       intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
       unstable.vpl-gpu-rt # QSV on 11th gen or newer

hosts/hermes/n8n.nix

@@ -5,9 +5,9 @@ in {
     cloudflare-dyndns.domains = [domain];
     n8n = {
       enable = true;
-      environment = {
-        PORT = "5678";
-        WEBHOOK_URL = "https://" + domain + "/";
+      webhookUrl = "https://" + domain + "/";
+      settings = {
+        port = 5678;
       };
     };
     caddy.virtualHosts.${domain}.extraConfig = ''

modules/tailscale.nix

@@ -1,5 +1,6 @@
 {
   config,
+  options,
   lib,
   ...
 }:

packages/default.nix

@@ -7,7 +7,7 @@
   om = inputs'.omnix.packages.default;
   nvf = inputs'.nvf.packages.default;
   agenix = inputs'.agenix.packages.default;
-  vaapiIntel = pkgs.intel-vaapi-driver.override {enableHybridCodec = true;};
+  vaapiIntel = pkgs.vaapiIntel.override {enableHybridCodec = true;};
   devour-flake = pkgs.callPackage inputs.devour-flake {};
   nish = inputs'.nish.packages.default;
   nsbm = inputs'.nsbm.packages.default;