nixbld-etc-nixos/afws-module.nix

@@ -10,34 +10,16 @@ in
       default = false;
       description = "Enable AFWS server";
     };
-    logFile = mkOption {
-      type = types.str;
-      default = "/var/lib/afws/logs/afws.log";
-      description = "Path to the log file";
-    };
-    logBackupCount = mkOption {
-      type = types.int;
-      default = 30;
-      description = "Number of daily log files to keep";
-    };
   };
 
   config = mkIf config.services.afws.enable {
     systemd.services.afws = {
       description = "AFWS server";
       wantedBy = [ "multi-user.target" ];
-      preStart = ''
-        mkdir -p "$(dirname ${config.services.afws.logFile})"
-        chown afws:afws "$(dirname ${config.services.afws.logFile})"
-      '';
       serviceConfig = {
         User = "afws";
         Group = "afws";
-        ExecStart = ''
-          ${afws}/bin/afws_server \
-            --log-file ${config.services.afws.logFile} \
-            --log-backup-count ${toString config.services.afws.logBackupCount}
-        '';
+        ExecStart = "${afws}/bin/afws_server";
         ExecReload = "${pkgs.coreutils}/bin/kill -USR1 $MAINPID";
       };
       path = [ pkgs.nix pkgs.git ];

nixbld-etc-nixos/configuration.nix

@@ -358,6 +358,14 @@ in
     };
   };
 
+  # Break cycle dependency making netdev service stop when network-setup is stopped
+  systemd.services."${netifAlt}-netdev" = {
+      partOf = pkgs.lib.mkOverride 1 [ ];
+  };
+  systemd.services."${netifUSA}-netdev" = {
+      partOf = pkgs.lib.mkOverride 1 [ ];
+  };
+
   # https://kb.isc.org/docs/dnssec-key-and-signing-policy
   # chown named.named /etc/nixos/named
   services.bind = {

nixbld-etc-nixos/nix-networked-derivations.patch

@@ -1,8 +1,8 @@
 diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
-index 763045a80..d7c5cc82e 100644
+index 64b55ca6a..9b4e52b8e 100644
 --- a/src/libstore/build/local-derivation-goal.cc
 +++ b/src/libstore/build/local-derivation-goal.cc
-@@ -190,6 +190,8 @@ void LocalDerivationGoal::tryLocalBuild()
+@@ -180,6 +180,8 @@ void LocalDerivationGoal::tryLocalBuild()
  
      assert(derivationType);
  
@@ -11,7 +11,7 @@ index 763045a80..d7c5cc82e 100644
      /* Are we doing a chroot build? */
      {
          auto noChroot = parsedDrv->getBoolAttr("__noChroot");
-@@ -207,7 +209,7 @@ void LocalDerivationGoal::tryLocalBuild()
+@@ -197,7 +199,7 @@ void LocalDerivationGoal::tryLocalBuild()
          else if (settings.sandboxMode == smDisabled)
              useChroot = false;
          else if (settings.sandboxMode == smRelaxed)
@@ -20,7 +20,7 @@ index 763045a80..d7c5cc82e 100644
      }
  
      auto & localStore = getLocalStore();
-@@ -717,7 +719,7 @@ void LocalDerivationGoal::startBuilder()
+@@ -691,7 +693,7 @@ void LocalDerivationGoal::startBuilder()
                  "nogroup:x:65534:\n", sandboxGid()));
  
          /* Create /etc/hosts with localhost entry. */
@@ -29,7 +29,7 @@ index 763045a80..d7c5cc82e 100644
              writeFile(chrootRootDir + "/etc/hosts", "127.0.0.1 localhost\n::1 localhost\n");
  
          /* Make the closure of the inputs available in the chroot,
-@@ -921,7 +923,7 @@ void LocalDerivationGoal::startBuilder()
+@@ -895,7 +897,7 @@ void LocalDerivationGoal::startBuilder()
             us.
          */
  
@@ -38,7 +38,7 @@ index 763045a80..d7c5cc82e 100644
              privateNetwork = true;
  
          userNamespaceSync.create();
-@@ -1160,7 +1162,7 @@ void LocalDerivationGoal::initEnv()
+@@ -1134,7 +1136,7 @@ void LocalDerivationGoal::initEnv()
         to the builder is generally impure, but the output of
         fixed-output derivations is by definition pure (since we
         already know the cryptographic hash of the output). */
@@ -47,7 +47,7 @@ index 763045a80..d7c5cc82e 100644
          for (auto & i : parsedDrv->getStringsAttr("impureEnvVars").value_or(Strings()))
              env[i] = getEnv(i).value_or("");
      }
-@@ -1829,7 +1831,7 @@ void LocalDerivationGoal::runChild()
+@@ -1799,7 +1801,7 @@ void LocalDerivationGoal::runChild()
              /* Fixed-output derivations typically need to access the
                 network, so give them access to /etc/resolv.conf and so
                 on. */
@@ -56,21 +56,21 @@ index 763045a80..d7c5cc82e 100644
                  // Only use nss functions to resolve hosts and
                  // services. Don’t use it for anything else that may
                  // be configured for this system. This limits the
-@@ -2071,7 +2073,7 @@ void LocalDerivationGoal::runChild()
-                 #include "sandbox-defaults.sb"
-                 ;
- 
--            if (!derivationType->isSandboxed())
-+            if (networked || !derivationType->isSandboxed())
-                 sandboxProfile +=
-                     #include "sandbox-network.sb"
+@@ -2050,7 +2052,7 @@ void LocalDerivationGoal::runChild()
+                     #include "sandbox-defaults.sb"
                      ;
+ 
+-                if (!derivationType->isSandboxed())
++                if (networked || !derivationType->isSandboxed())
+                     sandboxProfile +=
+                         #include "sandbox-network.sb"
+                         ;
 diff --git a/src/libstore/build/local-derivation-goal.hh b/src/libstore/build/local-derivation-goal.hh
-index 86b86c01e..95b03aae8 100644
+index 0a05081c7..4c251718c 100644
 --- a/src/libstore/build/local-derivation-goal.hh
 +++ b/src/libstore/build/local-derivation-goal.hh
-@@ -82,6 +82,8 @@ struct LocalDerivationGoal : public DerivationGoal
-      */
+@@ -66,6 +66,8 @@ struct LocalDerivationGoal : public DerivationGoal
+ 
      Path chrootRootDir;
  
 +    bool networked;

nixops/common-users.nix

@@ -57,7 +57,7 @@
   };
   esavkin = {
     isNormalUser = true;
-    extraGroups = ["plugdev" "dialout" "libvirtd" "wireshark"];
+    extraGroups = ["plugdev" "dialout" "libvirtd"];
     openssh.authorizedKeys.keys = [
       "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBLDJI4GFLBmScbeR8Jh4Gi8A/2nuGlYtFTJVT+Es/bzdiPRk8DLG62T0hyRR+8LfHjbrCsDuYFNztT8hHGXd7h3xp3y2X7ArkJo8xUK5QxGd5D2Zn4ANfZTTVkoGlEHbFA=="
     ];

nixops/desktop.nix

@@ -64,8 +64,8 @@ in
     xournal
     xsane
     gtkwave unzip zip gnupg
-    gnome-tweaks
-    ghex
+    gnome3.gnome-tweaks
+    gnome3.ghex
     jq sublime3 rink qemu_kvm
     tmux screen gdb minicom picocom
     artiq.packages.x86_64-linux.openocd-bscanspi
@@ -129,9 +129,17 @@ in
     nssmdns4 = true;
   };
 
-  hardware.graphics.enable32Bit = true;
+  # Enable sound.
+  sound.enable = true;
+  hardware.pulseaudio = {
+    enable = true;
+    package = pkgs.pulseaudioFull;
+  };
 
-  fonts.packages = [ pkgs.noto-fonts pkgs.noto-fonts-cjk-sans pkgs.noto-fonts-emoji pkgs.noto-fonts-extra pkgs.emacs-all-the-icons-fonts ];
+  hardware.opengl.driSupport32Bit = true;
+  hardware.pulseaudio.support32Bit = true;
+
+  fonts.packages = [ pkgs.noto-fonts pkgs.noto-fonts-cjk pkgs.noto-fonts-emoji pkgs.noto-fonts-extra pkgs.emacs-all-the-icons-fonts ];
 
   # Enable the X11 windowing system.
   services.xserver.enable = true;