Refactor flake patching/recursion

Signed-off-by: Nikolaos Karaolidis <nick@karaolidis.com>
2025-07-19 12:51:28 +01:00
parent a3d44b8b26
commit 1587967488
55 changed files with 303 additions and 426 deletions
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,8 +0,0 @@
-[submodule "submodules/nixpkgs"]
-	path = submodules/nixpkgs
-	url = git@github.com:karaolidis/nixpkgs.git
-	branch = integration
-[submodule "submodules/home-manager"]
-	path = submodules/home-manager
-	url = git@github.com:karaolidis/home-manager.git
-	branch = integration
--- a/README.md
+++ b/README.md
@@ -27,9 +27,7 @@ NixOS dotfiles and configuration for various hosts and users.
    - [`add-host.sh`](./lib/scripts/add-host.sh): Instantiate the keys for a new host configuration.
    - [`remove-host.sh`](./lib/scripts/remove-host.sh): Remove references to a host.
    - [`update-keys.sh`](./lib/scripts/update-keys.sh): Update the encryption keys in all relevant files using `sops.yaml` configurations.
-    - [`update.sh`](./lib/scripts/update.sh): Update flake and all git submodules.
-
- [`submodules/`](./submodules): Flake forks used in the repository, such as [`nixpkgs`](https://github.com/NixOS/nixpkgs) and [`home-manager`](https://github.com/nix-community/home-manager).
+    - [`update.sh`](./lib/scripts/update.sh): Update flake and all packages.

 Any `options.nix` files create custom option definitions when present.

--- a/flake.lock
+++ b/flake.lock
@@ -11,16 +11,15 @@
        ]
      },
      "locked": {
-        "lastModified": 1751930350,
-        "narHash": "sha256-hBIrzyrwG3XjeNyzVNWKDX+yYVlpwAqf9ovgF7qecug=",
+        "lastModified": 1752328525,
+        "narHash": "sha256-0aaVFLQxY1dKIS5jzwhbO847yIdr3U0o2heUzC5iat4=",
        "owner": "aylur",
        "repo": "ags",
-        "rev": "22f37ccb0db58d9d8a11ad0054ab20ecfad005ad",
+        "rev": "2eb3ea54311b0f7ba9d333d661d12cda1ed5507e",
        "type": "github"
      },
      "original": {
        "owner": "aylur",
-        "ref": "main",
        "repo": "ags",
        "type": "github"
      }
@@ -32,16 +31,15 @@
        ]
      },
      "locked": {
-        "lastModified": 1752227802,
-        "narHash": "sha256-5Nr80lTZJ8ewuxIzRHc6E8L4LW4rdGZukiZyL7nOVSE=",
+        "lastModified": 1752404970,
+        "narHash": "sha256-XULTToDUkIshNXEO+YP2mAHdQv8bxWDvKjbamBfOC8E=",
        "owner": "aylur",
        "repo": "astal",
-        "rev": "81eb3770965190024803ed6dd0fe35318da64831",
+        "rev": "2c5eb54f39e1710c6e2c80915a240978beb3269a",
        "type": "github"
      },
      "original": {
        "owner": "aylur",
-        "ref": "main",
        "repo": "astal",
        "type": "github"
      }
@@ -53,20 +51,43 @@
        ]
      },
      "locked": {
-        "lastModified": 1752113600,
-        "narHash": "sha256-7LYDxKxZgBQ8LZUuolAQ8UkIB+jb4A2UmiR+kzY9CLI=",
+        "lastModified": 1746728054,
+        "narHash": "sha256-eDoSOhxGEm2PykZFa/x9QG5eTH0MJdiJ9aR00VAofXE=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "79264292b7e3482e5702932949de9cbb69fedf6d",
+        "rev": "ff442f5d1425feb86344c028298548024f21256d",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "master",
+        "ref": "latest",
        "repo": "disko",
        "type": "github"
      }
    },
+    "flake-input-patcher": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": [
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1751871600,
+        "narHash": "sha256-I4/2ekJrbRMhOpKfzgnlrN45nQj9YQmZnoSeAaRa1SU=",
+        "owner": "jfly",
+        "repo": "flake-input-patcher",
+        "rev": "4ff068126d49829b106280738944bde91951d59d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "jfly",
+        "repo": "flake-input-patcher",
+        "type": "github"
+      }
+    },
    "flake-parts": {
      "inputs": {
        "nixpkgs-lib": [
@@ -104,7 +125,6 @@
      },
      "original": {
        "owner": "numtide",
-        "ref": "main",
        "repo": "flake-utils",
        "type": "github"
      }
@@ -132,32 +152,31 @@
        ]
      },
      "locked": {
-        "lastModified": 1752220369,
-        "narHash": "sha256-Fk4KFIfdq4iATbwojGQvHFly93mZJnGuD6k+P4YV/lE=",
-        "owner": "karaolidis",
+        "lastModified": 1752814804,
+        "narHash": "sha256-irfg7lnfEpJY+3Cffkluzp2MTVw1Uq9QGxFp6qadcXI=",
+        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "444d7a18b87260772c5293a10f998d3da67e5f44",
+        "rev": "d0300c8808e41da81d6edfc202f3d3833c157daf",
        "type": "github"
      },
      "original": {
-        "owner": "karaolidis",
-        "ref": "integration",
+        "owner": "nix-community",
        "repo": "home-manager",
        "type": "github"
      }
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1752234186,
-        "narHash": "sha256-v9iaBVKTk6vGVle8q6s22reTtl+BxJFA+i6Gs5YmMXo=",
-        "owner": "karaolidis",
+        "lastModified": 1752687322,
+        "narHash": "sha256-RKwfXA4OZROjBTQAl9WOZQFm7L8Bo93FQwSJpAiSRvo=",
+        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "5b6fdd0939385dff89d6cfc5d2e125a392f7a107",
+        "rev": "6e987485eb2c77e5dcc5af4e3c70843711ef9251",
        "type": "github"
      },
      "original": {
-        "owner": "karaolidis",
-        "ref": "integration",
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
@@ -170,16 +189,15 @@
        ]
      },
      "locked": {
-        "lastModified": 1752229622,
-        "narHash": "sha256-jGJH7ssNiuex4+FVOS97PRhmkMAeJreKfmEkWhka/Bc=",
+        "lastModified": 1752908641,
+        "narHash": "sha256-7fSP4+p5QjWXFbnD4NeVQjtdCSsTMX2yAP1eNDooq4E=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "b814b0f9755b2d58ecd69303cb438d0776ee49a5",
+        "rev": "ea63ce63073a11274ef327c5eb7f2ebb67606ebe",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "main",
        "repo": "NUR",
        "type": "github"
      }
@@ -189,35 +207,35 @@
        "nixpkgs": [
          "nixpkgs"
        ],
-        "utils": "utils"
+        "utils": [
+          "flake-utils"
+        ]
      },
      "locked": {
-        "lastModified": 1752193435,
-        "narHash": "sha256-kEmmqqBoiB46HcFNYojiTAqZiCraaHMAbB5wxWg2/cU=",
+        "lastModified": 1752555591,
+        "narHash": "sha256-3u29/v6VCHnaXjkMmjgwIGzR4Oul9EVHqxgJB6xTN0w=",
        "owner": "icewind1991",
        "repo": "nvidia-patch-nixos",
-        "rev": "ab69bce4e85c45c356acbc9ab818fbbd646e44c3",
+        "rev": "1140fd66d2f7e0be1a72ac9fdc32fffe4bb371e5",
        "type": "github"
      },
      "original": {
        "owner": "icewind1991",
-        "ref": "main",
        "repo": "nvidia-patch-nixos",
        "type": "github"
      }
    },
    "quadlet-nix": {
      "locked": {
-        "lastModified": 1751931728,
-        "narHash": "sha256-i4OALPUnFhe9j9NauZaszZZTgIYSaLHmCO2gp9MZYKQ=",
+        "lastModified": 1752618481,
+        "narHash": "sha256-8132xTqalZxJZbznHDNoia1UqjNdL/hIQD4IXnI9F58=",
        "owner": "SEIAROTg",
        "repo": "quadlet-nix",
-        "rev": "5cb4f185dc3722d589bdf238e6802c4c9f87994e",
+        "rev": "0c1d64f360c1a3c3534f6b592ca3ed5d46cf8429",
        "type": "github"
      },
      "original": {
        "owner": "SEIAROTg",
-        "ref": "main",
        "repo": "quadlet-nix",
        "type": "github"
      }
@@ -227,6 +245,7 @@
        "ags": "ags",
        "astal": "astal",
        "disko": "disko",
+        "flake-input-patcher": "flake-input-patcher",
        "flake-utils": "flake-utils",
        "home-manager": "home-manager",
        "nixpkgs": "nixpkgs",
@@ -235,7 +254,7 @@
        "quadlet-nix": "quadlet-nix",
        "sops-nix": "sops-nix",
        "spicetify-nix": "spicetify-nix",
-        "systems": "systems_2",
+        "systems": "systems",
        "treefmt-nix": "treefmt-nix"
      }
    },
@@ -246,16 +265,15 @@
        ]
      },
      "locked": {
-        "lastModified": 1751606940,
-        "narHash": "sha256-KrDPXobG7DFKTOteqdSVeL1bMVitDcy7otpVZWDE6MA=",
+        "lastModified": 1752544651,
+        "narHash": "sha256-GllP7cmQu7zLZTs9z0J2gIL42IZHa9CBEXwBY9szT0U=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "3633fc4acf03f43b260244d94c71e9e14a2f6e0d",
+        "rev": "2c8def626f54708a9c38a5861866660395bb3461",
        "type": "github"
      },
      "original": {
        "owner": "Mic92",
-        "ref": "master",
        "repo": "sops-nix",
        "type": "github"
      }
@@ -270,16 +288,15 @@
        ]
      },
      "locked": {
-        "lastModified": 1751776600,
-        "narHash": "sha256-75wd/aSvSoXUVd/buwI+Gsqx6LdmBVMbdXw+tCV1u58=",
+        "lastModified": 1752381641,
+        "narHash": "sha256-R2iDZb94RosuCeuIukacZVVXxzWYr4jn/QI/ax15nW8=",
        "owner": "Gerg-L",
        "repo": "spicetify-nix",
-        "rev": "54fad36eeae085f4a6ce4522bc351705b9c0c58a",
+        "rev": "8f9fd947c52aa6adb6bafe72516eccf186708954",
        "type": "github"
      },
      "original": {
        "owner": "Gerg-L",
-        "ref": "master",
        "repo": "spicetify-nix",
        "type": "github"
      }
@@ -299,22 +316,6 @@
        "type": "github"
      }
    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "ref": "main",
-        "repo": "default",
-        "type": "github"
-      }
-    },
    "treefmt-nix": {
      "inputs": {
        "nixpkgs": [
@@ -322,37 +323,18 @@
        ]
      },
      "locked": {
-        "lastModified": 1752055615,
-        "narHash": "sha256-19m7P4O/Aw/6+CzncWMAJu89JaKeMh3aMle1CNQSIwM=",
+        "lastModified": 1752909129,
+        "narHash": "sha256-Eh8FkMvGRaY71BU/oyZTTzt9RsBIq2E6j0r3eLZ/2kY=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "c9d477b5d5bd7f26adddd3f96cfd6a904768d4f9",
+        "rev": "0043b95d80b5bf6d61e84d237e2007727f4dd38d",
        "type": "github"
      },
      "original": {
        "owner": "numtide",
-        "ref": "main",
        "repo": "treefmt-nix",
        "type": "github"
      }
-    },
-    "utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@@ -1,110 +1,64 @@
 {
  inputs = {
-    nixpkgs = {
-      # --- Official
-      # type = "github";
-      # owner = "NixOS";
-      # repo = "nixpkgs";
-      # ref = "master";
-      # --- Fork
-      type = "github";
-      owner = "karaolidis";
-      repo = "nixpkgs";
-      ref = "integration";
-      # --- Local
-      # url = "git+file:./submodules/nixpkgs";
-    };
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

    home-manager = {
-      # --- Official
-      # type = "github";
-      # owner = "nix-community"
-      # repo = "home-manager";
-      # --- Fork
-      type = "github";
-      owner = "karaolidis";
-      repo = "home-manager";
-      ref = "integration";
-      # --- Local
-      # url = "git+file:./submodules/home-manager";
-
+      url = "github:nix-community/home-manager";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    disko = {
-      type = "github";
-      owner = "nix-community";
-      repo = "disko";
-      ref = "master";
-
+      url = "github:nix-community/disko/latest";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    sops-nix = {
-      type = "github";
-      owner = "Mic92";
-      repo = "sops-nix";
-      ref = "master";
-
+      url = "github:Mic92/sops-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    systems = {
-      type = "github";
-      owner = "nix-systems";
-      repo = "default";
-      ref = "main";
-    };
+    systems.url = "github:nix-systems/default";

    nur = {
-      type = "github";
-      owner = "nix-community";
-      repo = "NUR";
-      ref = "main";
-
+      url = "github:nix-community/NUR";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    flake-utils = {
-      type = "github";
-      owner = "numtide";
-      repo = "flake-utils";
-      ref = "main";
-
+      url = "github:numtide/flake-utils";
      inputs.systems.follows = "systems";
    };

    treefmt-nix = {
-      type = "github";
-      owner = "numtide";
-      repo = "treefmt-nix";
-      ref = "main";
-
+      url = "github:numtide/treefmt-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    quadlet-nix = {
-      type = "github";
-      owner = "SEIAROTg";
-      repo = "quadlet-nix";
-      ref = "main";
+    flake-input-patcher = {
+      url = "github:jfly/flake-input-patcher";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        systems.follows = "systems";
+      };
+    };
+
+    quadlet-nix.url = "github:SEIAROTg/quadlet-nix";
+
+    nvidia-patch = {
+      url = "github:icewind1991/nvidia-patch-nixos";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        utils.follows = "flake-utils";
+      };
    };

    astal = {
-      type = "github";
-      owner = "aylur";
-      repo = "astal";
-      ref = "main";
-
+      url = "github:aylur/astal";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    ags = {
-      type = "github";
-      owner = "aylur";
-      repo = "ags";
-      ref = "main";
-
+      url = "github:aylur/ags";
      inputs = {
        nixpkgs.follows = "nixpkgs";
        astal.follows = "astal";
@@ -112,66 +66,37 @@
    };

    spicetify-nix = {
-      type = "github";
-      owner = "Gerg-L";
-      repo = "spicetify-nix";
-      ref = "master";
-
+      url = "github:Gerg-L/spicetify-nix";
      inputs = {
        nixpkgs.follows = "nixpkgs";
        systems.follows = "systems";
      };
    };
-
-    nvidia-patch = {
-      type = "github";
-      owner = "icewind1991";
-      repo = "nvidia-patch-nixos";
-      ref = "main";
-
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
  };

  outputs =
-    { self, nixpkgs, ... }@inputs:
-    {
-      nixosConfigurations = {
-        installer = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          modules = [ ./hosts/installer ];
-          specialArgs = { inherit inputs system; };
-        };
+    inputs:
+    let
+      mkInputs =
+        system:
+        let
+          patcher = inputs.flake-input-patcher.lib.${system};
+        in
+        patcher.patch inputs (import ./patches.nix { inherit patcher; });

-        himalia = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          modules = [ ./hosts/himalia ];
+      mkNixosConfiguration =
+        inputs: system: modules:
+        inputs.nixpkgs.lib.nixosSystem {
+          inherit system modules;
          specialArgs = { inherit inputs system; };
        };
-
-        elara = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          modules = [ ./hosts/elara ];
-          specialArgs = { inherit inputs system; };
-        };
-
-        jupiter = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          modules = [ ./hosts/jupiter ];
-          specialArgs = { inherit inputs system; };
-        };
-
-        jupiter-vps = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          modules = [ ./hosts/jupiter-vps ];
-          specialArgs = { inherit inputs system; };
-        };
-      };
-    }
-    // inputs.flake-utils.lib.eachSystem [ "x86_64-linux" ] (
-      system:
+    in
+    (
      let
-        pkgs = import nixpkgs {
+        system = "x86_64-linux";
+        inputs = mkInputs system;
+
+        pkgs = import inputs.nixpkgs {
          inherit system;
          config.allowUnfree = true;
        };
@@ -179,12 +104,20 @@
        treefmt = inputs.treefmt-nix.lib.evalModule pkgs ./treefmt.nix;
      in
      {
-        devShells = import ./hosts/common/shells { inherit pkgs; };
-        lib = import ./lib { inherit pkgs; };
-        packages = import ./packages { inherit pkgs inputs system; };
+        nixosConfigurations = {
+          installer = mkNixosConfiguration inputs system [ ./hosts/installer ];
+          himalia = mkNixosConfiguration inputs system [ ./hosts/himalia ];
+          elara = mkNixosConfiguration inputs system [ ./hosts/elara ];
+          jupiter = mkNixosConfiguration inputs system [ ./hosts/jupiter ];
+          jupiter-vps = mkNixosConfiguration inputs system [ ./hosts/jupiter-vps ];
+        };

-        formatter = treefmt.config.build.wrapper;
-        checks.formatting = treefmt.config.build.check self;
+        devShells.${system} = import ./hosts/common/shells { inherit pkgs; };
+        lib.${system} = import ./lib { inherit pkgs; };
+        packages.${system} = import ./packages { inherit pkgs inputs system; };
+
+        formatter.${system} = treefmt.config.build.wrapper;
+        checks.formatting.${system} = treefmt.config.build.check inputs.self;
      }
    );
 }
--- a/hosts/himalia/hardware/gu605c-spi-cs-gpio/default.nix
+++ b/hosts/himalia/hardware/gu605c-spi-cs-gpio/default.nix
@@ -1,5 +1,5 @@
 { pkgs, ... }:
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
  pname = "asus-gu605c-acpi";
  version = "0.0.1";

@@ -17,12 +17,12 @@ pkgs.stdenv.mkDerivation rec {

  buildPhase = ''
    mkdir -p kernel/firmware/acpi
-    iasl -we -p kernel/firmware/acpi/${pname} ${src}
-    find kernel | cpio -H newc -o > ${pname}.cpio
+    iasl -we -p kernel/firmware/acpi/${finalAttrs.pname} ${finalAttrs.src}
+    find kernel | cpio -H newc -o > ${finalAttrs.pname}.cpio
  '';

  installPhase = ''
    mkdir -p $out
-    cp ${pname}.cpio $out/
+    cp ${finalAttrs.pname}.cpio $out/
  '';
-}
+})
--- a/hosts/jupiter/configs/wireguard/default.nix
+++ b/hosts/jupiter/configs/wireguard/default.nix
@@ -24,8 +24,9 @@ in
    wireguard.interfaces.wg0 =
      let
        ip = "${pkgs.iproute2}/bin/ip";
+        table = "wireguard";
      in
-      rec {
+      {
        ips = [
          "10.0.0.2/24"
          "${jupiterPublicIPv4}/32"
@@ -33,7 +34,7 @@ in

        privateKeyFile = config.sops.secrets."wireguard/client/vps".path;

-        table = "wireguard";
+        inherit table;
        postSetup = [ "${ip} rule add from ${jupiterPublicIPv4} table ${table}" ];
        postShutdown = [ "${ip} rule del from ${jupiterPublicIPv4} table ${table}" ];

--- a/lib/scripts/add-host.sh
+++ b/lib/scripts/add-host.sh
@@ -192,11 +192,7 @@ cat <<EOF > "./hosts/$host/README.md"
 EOF

 sed -i "/nixosConfigurations = {/a\\
-        $host = nixpkgs.lib.nixosSystem rec {\\
-          system = \"x86_64-linux\";\\
-          modules = [ ./hosts/$host ];\\
-          specialArgs = { inherit inputs system; };\\
-        };\n\n" flake.nix
+          $host = mkNixosConfiguration inputs system [ ./hosts/$host ];\n" flake.nix

 sed -i "/knownHosts = {/a\\    $host.publicKeyFile = ../../../../$host/secrets/ssh_host_ed25519_key.pub;" ./hosts/common/configs/system/ssh/default.nix

--- a/lib/scripts/remove-host.sh
+++ b/lib/scripts/remove-host.sh
@@ -18,9 +18,8 @@ find . -type f -name "sops.yaml" | while IFS= read -r sops_file; do
  sed -i "/          - \*$host/d" "$sops_file"
 done

-sed -i "/$host/d" ./hosts/common/configs/system/ssh/default.nix
-sed -i "/$host = nixpkgs.lib.nixosSystem rec {/,/^[[:space:]]*};/d" flake.nix
-sed -i "/$host/d" ./README.md
+sed -i "/$host = mkNixosConfiguration/d" flake.nix
+sed -i "/`$host`/d" ./README.md

 rm -rf "./hosts/$host"

--- a/lib/scripts/update.sh
+++ b/lib/scripts/update.sh
@@ -4,43 +4,6 @@ set -o errexit
 set -o nounset
 set -o pipefail

-echo "Updating submodules..."
-
-paths=$(git config --file .gitmodules --name-only --get-regexp path | while read -r line; do
-  path=$(git config --file .gitmodules --get "$line")
-  url=$(git config --file .gitmodules --get "${line%.*}.url")
-  if [[ $url == *"karaolidis"* ]]; then
-    echo "$path"
-  fi
-done)
-
-for path in $paths; do
-  echo "Processing submodule: $path"
-
-  cd "$path" || exit
-
-  default_branch=$(git remote show origin | awk '/HEAD branch/ {print $NF}')
-  git checkout "$default_branch"
-  git fetch upstream
-  git merge "upstream/$default_branch"
-
-  branches=$(git for-each-ref --format='%(refname:short)' refs/heads/ | grep -v "^${default_branch}$")
-  for branch in $branches; do
-    git checkout "$branch"
-    git rebase "$default_branch"
-  done
-
-  git checkout integration
-  git push origin --all --force-with-lease
-  git push origin --tags --force-with-lease
-
-  cd - > /dev/null || exit
-done
-
-echo "All submodules updated successfully."
-
-echo "Updating packages..."
-
 find packages -type f -name "*.nix" | while read -r file; do
  update_command=$(grep -oP '^#\s*AUTO-UPDATE:\s*\K.+' "$file" || true)
  if [[ -n "$update_command" ]]; then
@@ -49,6 +12,4 @@ find packages -type f -name "*.nix" | while read -r file; do
  fi
 done

-echo "All packages updated successfully."
-
 nix flake update
--- a/packages/darktable/ghost-cms-publish/default.nix
+++ b/packages/darktable/ghost-cms-publish/default.nix
@@ -1,19 +1,19 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake --version=branch=main darktable-ghost-cms-publish --subpackage npmSrc
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
  pname = "darktable-ghost-cms-publish";
  version = "0-unstable-2025-02-23";

  src = pkgs.fetchFromGitLab {
    domain = "git.karaolidis.com";
    owner = "karaolidis";
-    repo = pname;
+    repo = finalAttrs.pname;
    rev = "26780273b2a093c6e6a3140d0220d252f0bc709e";
    hash = "sha256-5aoGkqxMyvyK8EDsSE6kZa+dpExxVH2GRx2n87VusKE=";
  };

  npmSrc = pkgs.buildNpmPackage {
-    inherit src pname version;
+    inherit (finalAttrs) src pname version;

    npmDepsHash = "sha256-K/x9ZEMNO8D+SkvVPfqVJtZaDXY5gDApRRocg/POY68=";
    dontNpmBuild = true;
@@ -25,16 +25,16 @@ pkgs.stdenv.mkDerivation rec {

  # FIXME: https://github.com/NixOS/nixpkgs/issues/255890
  wrapper = pkgs.writeShellApplication {
-    name = pname;
+    name = finalAttrs.pname;
    runtimeInputs = with pkgs; [ bun ];
    text = ''
-      exec bun ${npmSrc}/src/index.ts "$@"
+      exec bun ${finalAttrs.npmSrc}/src/index.ts "$@"
    '';
  };

  installPhase = ''
-    mkdir -p $out/bin $out/lib/${pname}
-    cp publish.lua $out/lib/${pname}/
-    cp ${wrapper}/bin/${pname} $out/bin/
+    mkdir -p $out/bin $out/lib/${finalAttrs.pname}
+    cp publish.lua $out/lib/${finalAttrs.pname}/
+    cp ${finalAttrs.wrapper}/bin/${finalAttrs.pname} $out/bin/
  '';
-}
+})
--- a/packages/darktable/hald-clut/default.nix
+++ b/packages/darktable/hald-clut/default.nix
@@ -1,12 +1,12 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake --version=branch=master darktable-hald-clut
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
  pname = "hald-clut";
  version = "0-unstable-2019-03-21";

  src = pkgs.fetchFromGitHub {
    owner = "cedeber";
-    repo = pname;
+    repo = "hald-clut";
    rev = "3b3180f82d4dcea1e6e8c5648473539a910d7f49";
    hash = "sha256-R8vyYmcsfk49QsSV3v0QblXcO6U0oIfDyxbHPLwSMdo=";
  };
--- a/packages/darktable/lua-scripts/default.nix
+++ b/packages/darktable/lua-scripts/default.nix
@@ -1,12 +1,12 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake --version=branch=master darktable-lua-scripts
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
  pname = "lua-scripts";
  version = "release-2.0.0-unstable-2025-07-05";

  src = pkgs.fetchFromGitHub {
    owner = "darktable-org";
-    repo = pname;
+    repo = "lua-scripts";
    rev = "aed3275943f218e559c58b98579ceafb02e220da";
    hash = "sha256-vRE0kxqbjdjwU+S0Eu44ctYulYPgD0XsrTsz1ESq6t0=";
  };
--- a/packages/docker/jellyseerr/default.nix
+++ b/packages/docker/jellyseerr/default.nix
@@ -8,20 +8,25 @@ let
  };

  # FIXME: https://github.com/fallenbagel/jellyseerr/pull/1505
-  jellyseerr = pkgs.jellyseerr.overrideAttrs (oldAttrs: rec {
-    src = pkgs.fetchFromGitHub {
-      owner = "Fallenbagel";
-      repo = "jellyseerr";
-      tag = "preview-OIDC";
-      hash = "sha256-iBnO0WjNqvXfuJMoS6z/NmYgtW5FQ9Ptp9uV5rODIf8=";
-    };
-
-    pnpmDeps = (pkgs.pnpm_9.override { nodejs = pkgs.nodejs_22; }).fetchDeps {
+  jellyseerr = pkgs.jellyseerr.overrideAttrs (
+    oldAttrs:
+    let
+      src = pkgs.fetchFromGitHub {
+        owner = "Fallenbagel";
+        repo = "jellyseerr";
+        tag = "preview-OIDC";
+        hash = "sha256-iBnO0WjNqvXfuJMoS6z/NmYgtW5FQ9Ptp9uV5rODIf8=";
+      };
+    in
+    {
      inherit src;
-      inherit (oldAttrs) pname version;
-      hash = "sha256-lq/b2PqQHsZmnw91Ad4h1uxZXsPATSLqIdb/t2EsmMI=";
-    };
-  });
+      pnpmDeps = (pkgs.pnpm_9.override { nodejs = pkgs.nodejs_22; }).fetchDeps {
+        inherit src;
+        inherit (oldAttrs) pname version;
+        hash = "sha256-lq/b2PqQHsZmnw91Ad4h1uxZXsPATSLqIdb/t2EsmMI=";
+      };
+    }
+  );
 in
 pkgs.dockerTools.buildImage {
  name = "jellyseerr";
--- a/packages/docker/traefik/default.nix
+++ b/packages/docker/traefik/default.nix
@@ -11,6 +11,10 @@ pkgs.dockerTools.buildImage {

  config = {
    Entrypoint = [ "traefik" ];
+    Volumes = {
+      "/var/lib/traefik" = { };
+    };
+    WorkingDir = "/var/lib/traefik";
    ExposedPorts = {
      "80/tcp" = { };
    };
--- a/packages/jellyfin/plugins/bookshelf/default.nix
+++ b/packages/jellyfin/plugins/bookshelf/default.nix
@@ -1,11 +1,11 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-bookshelf
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
  pname = "bookshelf";
  version = "12";

  src = pkgs.fetchzip {
-    url = "https://github.com/jellyfin/jellyfin-plugin-bookshelf/releases/download/v${version}/bookshelf_${version}.0.0.0.zip";
+    url = "https://github.com/jellyfin/jellyfin-plugin-bookshelf/releases/download/v${finalAttrs.version}/bookshelf_${finalAttrs.version}.0.0.0.zip";
    sha256 = "sha256-P85SLXaJuFIv9AmAE6mPbxZDMBhqEt+88dZiPUKu2iQ=";
    stripRoot = false;
  };
@@ -13,4 +13,4 @@ pkgs.stdenv.mkDerivation rec {
  installPhase = ''
    cp -r $src $out
  '';
-}
+})
--- a/packages/jellyfin/plugins/intro-skipper/default.nix
+++ b/packages/jellyfin/plugins/intro-skipper/default.nix
@@ -1,16 +1,16 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-intro-skipper
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
  pname = "intro-skipper";
  version = "10.10/v1.10.10.20";

  src =
    let
-      parts = pkgs.lib.strings.splitString "/" version;
+      parts = pkgs.lib.strings.splitString "/" finalAttrs.version;
      full = builtins.elemAt parts 1;
    in
    pkgs.fetchzip {
-      url = "https://github.com/intro-skipper/intro-skipper/releases/download/${version}/intro-skipper-${full}.zip";
+      url = "https://github.com/intro-skipper/intro-skipper/releases/download/${finalAttrs.version}/intro-skipper-${full}.zip";
      sha256 = "sha256-RlrZkE8108Uj5V90+jw2o5fXb+K+9/hoDcEaSkKLDGg=";
      stripRoot = false;
    };
@@ -18,4 +18,4 @@ pkgs.stdenv.mkDerivation rec {
  installPhase = ''
    cp -r $src $out
  '';
-}
+})
--- a/packages/jellyfin/plugins/opensubtitles/default.nix
+++ b/packages/jellyfin/plugins/opensubtitles/default.nix
@@ -1,11 +1,11 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-opensubtitles
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
  pname = "opensubtitles";
  version = "20";

  src = pkgs.fetchzip {
-    url = "https://github.com/jellyfin/jellyfin-plugin-opensubtitles/releases/download/v${version}/open-subtitles_${version}.0.0.0.zip";
+    url = "https://github.com/jellyfin/jellyfin-plugin-opensubtitles/releases/download/v${finalAttrs.version}/open-subtitles_${finalAttrs.version}.0.0.0.zip";
    sha256 = "sha256-U17wQn32GB4nh05ExYJhzRw4nDvYOCB4EJtDoaaUnjI=";
    stripRoot = false;
  };
@@ -13,4 +13,4 @@ pkgs.stdenv.mkDerivation rec {
  installPhase = ''
    cp -r $src $out
  '';
-}
+})
--- a/packages/jellyfin/plugins/playbackreporting/default.nix
+++ b/packages/jellyfin/plugins/playbackreporting/default.nix
@@ -1,11 +1,11 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-playbackreporting
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
  pname = "playbackreporting";
  version = "16";

  src = pkgs.fetchzip {
-    url = "https://github.com/jellyfin/jellyfin-plugin-playbackreporting/releases/download/v${version}/playback-reporting_${version}.0.0.0.zip";
+    url = "https://github.com/jellyfin/jellyfin-plugin-playbackreporting/releases/download/v${finalAttrs.version}/playback-reporting_${finalAttrs.version}.0.0.0.zip";
    sha256 = "sha256-UrWxS0CpeeW4nYNyRNxnK0jqiAqXwfLv3YfFokfVH0A=";
    stripRoot = false;
  };
@@ -13,4 +13,4 @@ pkgs.stdenv.mkDerivation rec {
  installPhase = ''
    cp -r $src $out
  '';
-}
+})
--- a/packages/jellyfin/plugins/reports/default.nix
+++ b/packages/jellyfin/plugins/reports/default.nix
@@ -1,11 +1,11 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-reports
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
  pname = "reports";
  version = "17";

  src = pkgs.fetchzip {
-    url = "https://github.com/jellyfin/jellyfin-plugin-reports/releases/download/v${version}/reports_${version}.0.0.0.zip";
+    url = "https://github.com/jellyfin/jellyfin-plugin-reports/releases/download/v${finalAttrs.version}/reports_${finalAttrs.version}.0.0.0.zip";
    sha256 = "sha256-kN1UDhx5/1sw3PO5co2YkfbZNiDj56F2YAT8S/0EdZM=";
    stripRoot = false;
  };
@@ -13,4 +13,4 @@ pkgs.stdenv.mkDerivation rec {
  installPhase = ''
    cp -r $src $out
  '';
-}
+})
--- a/packages/jellyfin/plugins/sso/default.nix
+++ b/packages/jellyfin/plugins/sso/default.nix
@@ -1,11 +1,11 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-sso
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
  pname = "sso";
  version = "3.5.2.4";

  src = pkgs.fetchzip {
-    url = "https://github.com/9p4/jellyfin-plugin-sso/releases/download/v${version}/sso-authentication_${version}.zip";
+    url = "https://github.com/9p4/jellyfin-plugin-sso/releases/download/v${finalAttrs.version}/sso-authentication_${finalAttrs.version}.zip";
    sha256 = "sha256-e+w5m6/7vRAynStDj34eBexfCIEgDJ09huHzi5gQEbo=";
    stripRoot = false;
  };
@@ -13,4 +13,4 @@ pkgs.stdenv.mkDerivation rec {
  installPhase = ''
    cp -r $src $out
  '';
-}
+})
--- a/packages/jellyfin/plugins/subtitleextract/default.nix
+++ b/packages/jellyfin/plugins/subtitleextract/default.nix
@@ -1,11 +1,11 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-subtitleextract
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
  pname = "subtitleextract";
  version = "4";

  src = pkgs.fetchzip {
-    url = "https://github.com/jellyfin/jellyfin-plugin-subtitleextract/releases/download/v${version}/subtitle-extract_${version}.0.0.0.zip";
+    url = "https://github.com/jellyfin/jellyfin-plugin-subtitleextract/releases/download/v${finalAttrs.version}/subtitle-extract_${finalAttrs.version}.0.0.0.zip";
    sha256 = "sha256-FstPWUYsZg416DNshIV4yOvbg6U21cRxKse8hITUyBY=";
    stripRoot = false;
  };
@@ -13,4 +13,4 @@ pkgs.stdenv.mkDerivation rec {
  installPhase = ''
    cp -r $src $out
  '';
-}
+})
--- a/packages/jellyfin/plugins/tmdbboxsets/default.nix
+++ b/packages/jellyfin/plugins/tmdbboxsets/default.nix
@@ -1,11 +1,11 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-tmdbboxsets
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
  pname = "tmdbboxsets";
  version = "11";

  src = pkgs.fetchzip {
-    url = "https://github.com/jellyfin/jellyfin-plugin-tmdbboxsets/releases/download/v${version}/tmdb-box-sets_${version}.0.0.0.zip";
+    url = "https://github.com/jellyfin/jellyfin-plugin-tmdbboxsets/releases/download/v${finalAttrs.version}/tmdb-box-sets_${finalAttrs.version}.0.0.0.zip";
    sha256 = "sha256-cO3hpjFacS62kdXn8ebS7oMtFT9LJAt8Q4b36aSxwCQ=";
    stripRoot = false;
  };
@@ -13,4 +13,4 @@ pkgs.stdenv.mkDerivation rec {
  installPhase = ''
    cp -r $src $out
  '';
-}
+})
--- a/packages/jellyfin/plugins/tvdb/default.nix
+++ b/packages/jellyfin/plugins/tvdb/default.nix
@@ -1,11 +1,11 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-tvdb
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
  pname = "tvdb";
  version = "19";

  src = pkgs.fetchzip {
-    url = "https://github.com/jellyfin/jellyfin-plugin-tvdb/releases/download/v${version}/thetvdb_${version}.0.0.0.zip";
+    url = "https://github.com/jellyfin/jellyfin-plugin-tvdb/releases/download/v${finalAttrs.version}/thetvdb_${finalAttrs.version}.0.0.0.zip";
    sha256 = "sha256-011wpVwQy562XDAwAQ44GJTbu/ESHcyo5F/wrtNBAcs=";
    stripRoot = false;
  };
@@ -13,4 +13,4 @@ pkgs.stdenv.mkDerivation rec {
  installPhase = ''
    cp -r $src $out
  '';
-}
+})
--- a/packages/linux-firmware-latest/default.nix
+++ b/packages/linux-firmware-latest/default.nix
@@ -1,12 +1,12 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake --version=branch=main linux-firmware-latest
-pkgs.stdenvNoCC.mkDerivation rec {
+pkgs.stdenvNoCC.mkDerivation {
  pname = "linux-firmware";
  version = "20250708-unstable-2025-07-08";

  src = pkgs.fetchFromGitLab {
    owner = "kernel-firmware";
-    repo = pname;
+    repo = "linux-firmware";
    rev = "99d64b4f788c16e81b6550ef94f43c6b91cfad2d";
    hash = "sha256-TJ97A9I0ipsqgg7ex3pAQgdhDJcLbkNCvuLppt9a07o=";
  };
--- a/packages/littlelink-server/default.nix
+++ b/packages/littlelink-server/default.nix
@@ -1,6 +1,6 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake --version=branch=main littlelink-server --subpackage yarnSrc
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
  pname = "littlelink-server";
  version = "0-unstable-2025-07-16";

@@ -12,10 +12,10 @@ pkgs.stdenv.mkDerivation rec {
  };

  yarnSrc = pkgs.stdenv.mkDerivation {
-    inherit src pname version;
+    inherit (finalAttrs) src pname version;

    offlineCache = pkgs.fetchYarnDeps {
-      yarnLock = src + "/yarn.lock";
+      yarnLock = finalAttrs.src + "/yarn.lock";
      hash = "sha256-nv1NgMm56wWlAYqqdH9UKTnWNhjxWBs1lmG+UCCQAzk=";
    };

@@ -29,24 +29,24 @@ pkgs.stdenv.mkDerivation rec {
    yarnBuildFlags = [ "--noninteractive" ];

    installPhase = ''
-      mkdir -p $out/lib/${pname}
-      cp -r build node_modules $out/lib/${pname}
+      mkdir -p $out/lib/${finalAttrs.pname}
+      cp -r build node_modules $out/lib/${finalAttrs.pname}
    '';
  };

  wrapper = pkgs.writeShellApplication {
-    name = pname;
+    name = finalAttrs.pname;
    runtimeInputs = with pkgs; [ nodejs_20 ];
    text = ''
-      cd ${yarnSrc}/lib/${pname}
+      cd ${finalAttrs.yarnSrc}/lib/${finalAttrs.pname}
      exec node build/server.js "$@"
    '';
  };

  installPhase = ''
    mkdir -p $out/bin
-    cp ${wrapper}/bin/${pname} $out/bin/
+    cp ${finalAttrs.wrapper}/bin/${finalAttrs.pname} $out/bin/
  '';

-  meta.mainProgram = pname;
-}
+  meta.mainProgram = finalAttrs.pname;
+})
--- a/packages/obsidian/plugins/better-word-count/default.nix
+++ b/packages/obsidian/plugins/better-word-count/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-better-word-count
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
  pname = "better-word-count";
  version = "0.10.1";

  src = pkgs.fetchFromGitHub {
    owner = "lukeleppan";
-    repo = pname;
-    rev = version;
+    repo = "better-word-count";
+    rev = finalAttrs.version;
    hash = "sha256-+z31nYnCrHjuV4ICVO+cKBM5q/zYA7Ju+J+6eU7t9Bo=";
  };

@@ -23,4 +23,4 @@ pkgs.buildNpmPackage rec {
    cp ./dist/main.js $out/main.js
    cp ./src/styles.css $out/styles.css
  '';
-}
+})
--- a/packages/obsidian/plugins/dataview/default.nix
+++ b/packages/obsidian/plugins/dataview/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-dataview
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
  pname = "dataview";
  version = "0.5.70";

  src = pkgs.fetchFromGitHub {
    owner = "blacksmithgu";
    repo = "obsidian-dataview";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-qz2Un5r4bZyX0mZ7J7Yvd/gSWKn/GxUUrC7OF2jTL3c=";
  };

@@ -23,4 +23,4 @@ pkgs.buildNpmPackage rec {
    cp ./build/main.js $out/main.js
    cp ./styles.css $out/styles.css
  '';
-}
+})
--- a/packages/obsidian/plugins/excalidraw/default.nix
+++ b/packages/obsidian/plugins/excalidraw/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-excalidraw --subpackage mathjaxToSVG
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
  pname = "obsidian.plugins.excalidraw";
  version = "2.13.0";

  pkg = pkgs.fetchFromGitHub {
    owner = "zsviczian";
    repo = "obsidian-excalidraw-plugin";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-zZDKgVQDwa2Mb5DQtu5/QUQnMbBudQxhrVSNr8Xi44o=";
  };

@@ -15,7 +15,7 @@ pkgs.buildNpmPackage rec {
    pname = "obsidian.plugins.excalidraw.mathjaxToSVG";
    version = "1.0.0";

-    src = "${pkg}/MathjaxToSVG";
+    src = "${finalAttrs.pkg}/MathjaxToSVG";
    npmDepsHash = "sha256-AosKWlX08dpXNQ2YlrfR6jEInmU02Ztf26nmV19Jxok=";

    configurePhase = ''
@@ -28,7 +28,7 @@ pkgs.buildNpmPackage rec {
    '';
  };

-  src = pkg;
+  src = finalAttrs.pkg;

  npmDepsHash = "sha256-Cb8PTYW2fxYLlvCrDJhtV5KnOMkSTlBO8QJR4p6wyr8=";
  npmPackFlags = [ "--ignore-scripts" ];
@@ -36,7 +36,7 @@ pkgs.buildNpmPackage rec {
  configurePhase = ''
    mkdir dist
    mkdir -p ./MathjaxToSVG/dist
-    cp ${mathjaxToSVG}/index.js ./MathjaxToSVG/dist/index.js
+    cp ${finalAttrs.mathjaxToSVG}/index.js ./MathjaxToSVG/dist/index.js
  '';

  installPhase = ''
@@ -45,4 +45,4 @@ pkgs.buildNpmPackage rec {
    cp ./dist/main.js $out/main.js
    cp ./dist/styles.css $out/styles.css
  '';
-}
+})
--- a/packages/obsidian/plugins/kanban/default.nix
+++ b/packages/obsidian/plugins/kanban/default.nix
@@ -1,18 +1,18 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-kanban
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
  pname = "kanban";
  version = "2.0.51";

  src = pkgs.fetchFromGitHub {
    owner = "mgmeyers";
    repo = "obsidian-kanban";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-NahypggwPrub2KxRBAn54ZpEInP1V+6l/xmUKUt6myA=";
  };

  offlineCache = pkgs.fetchYarnDeps {
-    yarnLock = src + "/yarn.lock";
+    yarnLock = finalAttrs.src + "/yarn.lock";
    hash = "sha256-eof2W9Ja4RlmjQ0SnaF/jadHX3GRkCRrMwZU2z0M/Jk=";
  };

@@ -29,4 +29,4 @@ pkgs.stdenv.mkDerivation rec {
    cp ./main.js $out/main.js
    cp ./styles.css $out/styles.css
  '';
-}
+})
--- a/packages/obsidian/plugins/languagetool/default.nix
+++ b/packages/obsidian/plugins/languagetool/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-languagetool
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
  pname = "languagetool";
  version = "0.3.7";

  src = pkgs.fetchFromGitHub {
    owner = "Clemens-E";
    repo = "obsidian-languagetool-plugin";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-OsdOOrXNoraKuFPqvgn6pj6ZagEbiFCJyQ529eyZXUU=";
  };

@@ -17,7 +17,7 @@ pkgs.stdenv.mkDerivation rec {
  ];

  offlineCache = pkgs.fetchYarnDeps {
-    yarnLock = src + "/yarn.lock";
+    yarnLock = finalAttrs.src + "/yarn.lock";
    hash = "sha256-749RGQmg9Mte7TR6k3qP6xcb8+rj/C60LYLbF8j8gNc=";
  };

@@ -34,4 +34,4 @@ pkgs.stdenv.mkDerivation rec {
    cp ./main.js $out/main.js
    cp ./styles.css $out/styles.css
  '';
-}
+})
--- a/packages/obsidian/plugins/linter/default.nix
+++ b/packages/obsidian/plugins/linter/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-linter
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
  pname = "linter";
  version = "1.29.2";

  src = pkgs.fetchFromGitHub {
    owner = "platers";
    repo = "obsidian-linter";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-I60nP99bdQfvq+GYtUvHPpYqp/nqpn3BqrgZzgPzRpI=";
  };

@@ -20,4 +20,4 @@ pkgs.buildNpmPackage rec {
    cp ./main.js $out/main.js
    cp ./src/styles.css $out/styles.css
  '';
-}
+})
--- a/packages/obsidian/plugins/map-view/default.nix
+++ b/packages/obsidian/plugins/map-view/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-map-view
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
  pname = "map-view";
  version = "5.5.0";

  src = pkgs.fetchFromGitHub {
    owner = "esm7";
    repo = "obsidian-map-view";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-HiH6KPLnCNyidp6TI7HJK4aj5SL0B0xO6HOWUgjVdd4=";
  };

@@ -25,4 +25,4 @@ pkgs.buildNpmPackage rec {
    cp ./dist/main.js $out/main.js
    cp ./dist/styles.css $out/styles.css
  '';
-}
+})
--- a/packages/obsidian/plugins/minimal-settings/default.nix
+++ b/packages/obsidian/plugins/minimal-settings/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-minimal-settings
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
  pname = "minimal-settings";
  version = "8.1.1";

  src = pkgs.fetchFromGitHub {
    owner = "kepano";
    repo = "obsidian-minimal-settings";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-JcWqSVgSRJAm0QiLnGuPpv0S9SVZw7UdtuKnvUAKiwQ=";
  };

@@ -22,4 +22,4 @@ pkgs.buildNpmPackage rec {
    cp ./main.js $out/main.js
    cp ./styles.css $out/styles.css
  '';
-}
+})
--- a/packages/obsidian/plugins/outliner/default.nix
+++ b/packages/obsidian/plugins/outliner/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-outliner
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
  pname = "outliner";
  version = "4.9.0";

  src = pkgs.fetchFromGitHub {
    owner = "vslinko";
    repo = "obsidian-outliner";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-W8cEAuFwGZUJvJgZo9Yz5aJV7xfm5kFZ9bpvwSPWhmE=";
  };

@@ -20,4 +20,4 @@ pkgs.buildNpmPackage rec {
    cp ./main.js $out/main.js
    cp ./styles.css $out/styles.css
  '';
-}
+})
--- a/packages/obsidian/plugins/style-settings/default.nix
+++ b/packages/obsidian/plugins/style-settings/default.nix
@@ -1,24 +1,24 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-style-settings --src-attr unpatchedSrc
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
  pname = "style-settings";
  version = "1.0.9";

  unpatchedSrc = pkgs.fetchFromGitHub {
    owner = "mgmeyers";
    repo = "obsidian-style-settings";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-eNbZQ/u3mufwVX+NRJpMSk5uGVkWfW0koXKq7wg9d+I=";
  };

  # Wrap in applyPatches so that offlineCache below is built correctly
  src = pkgs.applyPatches {
-    src = unpatchedSrc;
+    src = finalAttrs.unpatchedSrc;
    patches = [ ./package-lock.patch ];
  };

  offlineCache = pkgs.fetchYarnDeps {
-    yarnLock = "${src}/yarn.lock";
+    yarnLock = "${finalAttrs.src}/yarn.lock";
    hash = "sha256-tqX09XWI3ZL9bXVdjgsAEuvfCAjnyWj5uSWGFbNApds=";
  };

@@ -35,4 +35,4 @@ pkgs.stdenv.mkDerivation rec {
    cp ./main.js $out/main.js
    cp ./styles.css $out/styles.css
  '';
-}
+})
--- a/packages/obsidian/plugins/tasks/default.nix
+++ b/packages/obsidian/plugins/tasks/default.nix
@@ -1,18 +1,18 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-tasks
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
  pname = "tasks";
  version = "7.20.0";

  src = pkgs.fetchFromGitHub {
    owner = "obsidian-tasks-group";
    repo = "obsidian-tasks";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-K9/H2BgruB1O9KwW+xoiCsuXFfu6o4xZDCI40OEmh+o=";
  };

  offlineCache = pkgs.fetchYarnDeps {
-    yarnLock = src + "/yarn.lock";
+    yarnLock = finalAttrs.src + "/yarn.lock";
    hash = "sha256-ecPZvpMQkL2o0X4qx6h1jwQVZrtTC3+Aj7n/SBLRQbo=";
  };

@@ -29,4 +29,4 @@ pkgs.stdenv.mkDerivation rec {
    cp ./main.js $out/main.js
    cp ./styles.css $out/styles.css
  '';
-}
+})
--- a/packages/obsidian/plugins/url-into-selection/default.nix
+++ b/packages/obsidian/plugins/url-into-selection/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-url-into-selection
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
  pname = "url-into-selection";
  version = "1.7.0";

  src = pkgs.fetchFromGitHub {
    owner = "denolehov";
    repo = "obsidian-url-into-selection";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-xmKJOuXirg/LFVK/0925fazW+cm+XUlLpAUgpAS6bZI=";
  };

@@ -21,4 +21,4 @@ pkgs.buildNpmPackage rec {
    cp ./manifest.json $out/manifest.json
    cp ./main.js $out/main.js
  '';
-}
+})
--- a/packages/obsidian/themes/minimal/default.nix
+++ b/packages/obsidian/themes/minimal/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-theme-minimal
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
  pname = "minimal";
  version = "8.0.1";

  src = pkgs.fetchFromGitHub {
    owner = "kepano";
    repo = "obsidian-minimal";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-9FHkJ47R+cy2Pq62OuUUZQLSxd929xUIsQcpFGb4rso=";
  };

@@ -25,4 +25,4 @@ pkgs.buildNpmPackage rec {
    cp ./manifest.json $out/manifest.json
    cp ./theme.css $out/theme.css
  '';
-}
+})
--- a/packages/oidcwarden/default.nix
+++ b/packages/oidcwarden/default.nix
@@ -1,21 +1,21 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake oidcwarden
 # FIXME: https://github.com/dani-garcia/vaultwarden/pull/3899
-pkgs.rustPlatform.buildRustPackage rec {
+pkgs.rustPlatform.buildRustPackage (finalAttrs: {
  pname = "oidcwarden";
  version = "2025.6.1-2";

  src = pkgs.fetchFromGitHub {
    owner = "Timshel";
    repo = "OIDCWarden";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    hash = "sha256-wpb+7/a8TEaLvOiMt/POLvl+rb6hHG99audNghSJvII=";
  };

  useFetchCargoVendor = true;
  cargoHash = "sha256-fMePvMnefdcN90Y3BPqcKNXyg7tUd64IOUnOQis/qTU=";

-  env.VW_VERSION = version;
+  env.VW_VERSION = finalAttrs.version;

  nativeBuildInputs = with pkgs; [ pkg-config ];
  buildInputs = with pkgs; [
@@ -31,4 +31,4 @@ pkgs.rustPlatform.buildRustPackage rec {
  };

  meta.mainProgram = "oidcwarden";
-}
+})
--- a/packages/prometheus-fail2ban-exporter/default.nix
+++ b/packages/prometheus-fail2ban-exporter/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake prometheus-fail2ban-exporter
-pkgs.buildGoModule rec {
+pkgs.buildGoModule (finalAttrs: {
  pname = "prometheus-fail2ban-exporter";
  version = "0.10.3";

  src = pkgs.fetchFromGitLab {
    owner = "hctrdev";
    repo = "fail2ban-prometheus-exporter";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    hash = "sha256-CyYGY6SovnvgExB22G+LEKRDRzbDZWhWUjctJMkprYs=";
  };

@@ -18,8 +18,8 @@ pkgs.buildGoModule rec {
  ldflags = [
    "-s"
    "-w"
-    "-X main.version=${version}"
-    "-X main.commit=${version}"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.version}"
    "-X main.date=1970-01-01T00:00:00Z"
    "-X main.builtBy=NixOS"
  ];
@@ -28,4 +28,4 @@ pkgs.buildGoModule rec {
    mkdir -p $out/bin
    cp -r "$GOPATH/bin/fail2ban-prometheus-exporter" $out/bin/prometheus-fail2ban-exporter
  '';
-}
+})
--- a/packages/prometheus-podman-exporter/default.nix
+++ b/packages/prometheus-podman-exporter/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake prometheus-podman-exporter
-pkgs.buildGoModule rec {
+pkgs.buildGoModule (finalAttrs: {
  pname = "prometheus-podman-exporter";
  version = "1.17.2";

  src = pkgs.fetchFromGitHub {
    owner = "containers";
    repo = "prometheus-podman-exporter";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    hash = "sha256-TlQQbeYcCTZKF6DUKM+UE8iU9KC5tLpCtee62sNbW8s=";
  };

@@ -31,8 +31,8 @@ pkgs.buildGoModule rec {
  ldflags = [
    "-s"
    "-w"
-    "-X github.com/containers/prometheus-podman-exporter/cmd.buildVersion=${version}"
-    "-X github.com/containers/prometheus-podman-exporter/cmd.buildRevision=${builtins.head (pkgs.lib.strings.splitString "." version)}"
+    "-X github.com/containers/prometheus-podman-exporter/cmd.buildVersion=${finalAttrs.version}"
+    "-X github.com/containers/prometheus-podman-exporter/cmd.buildRevision=${builtins.head (pkgs.lib.strings.splitString "." finalAttrs.version)}"
    "-X github.com/containers/prometheus-podman-exporter/cmd.buildBranch=HEAD"
  ];

@@ -48,4 +48,4 @@ pkgs.buildGoModule rec {
    fi
      '
  '';
-}
+})
--- a/packages/sas/cacert/default.nix
+++ b/packages/sas/cacert/default.nix
@@ -1,5 +1,5 @@
 { pkgs, ... }:
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
  pname = "sas-cacert";
  version = "0-unstable-2025-05-13";

--- a/packages/sas/viya4-orders-cli/default.nix
+++ b/packages/sas/viya4-orders-cli/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake viya4-orders-cli
-pkgs.buildGoModule rec {
+pkgs.buildGoModule (finalAttrs: {
  pname = "viya4-orders-cli";
  version = "1.7.0";

  src = pkgs.fetchFromGitHub {
    owner = "sassoftware";
    repo = "viya4-orders-cli";
-    rev = version;
+    rev = finalAttrs.version;
    hash = "sha256-0AZBKxQC3NDgwtdnso0zEd4h9PBexFzqig4tWoHJTFM=";
  };

@@ -18,11 +18,11 @@ pkgs.buildGoModule rec {
  ldflags = [
    "-s"
    "-w"
-    "-X github.com/sassoftware/viya4-orders-cli/cmd.version=${version}"
+    "-X github.com/sassoftware/viya4-orders-cli/cmd.version=${finalAttrs.version}"
  ];

  installPhase = ''
    mkdir -p $out/bin
    cp "$GOPATH/bin/viya4-orders-cli" $out/bin/viya4-orders-cli
  '';
-}
+})
--- a/packages/shlink-web-client/default.nix
+++ b/packages/shlink-web-client/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake shlink-web-client
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
  pname = "shlink-web-client";
  version = "4.4.1";

  src = pkgs.fetchFromGitHub {
    owner = "shlinkio";
-    repo = pname;
-    rev = "v${version}";
+    repo = finalAttrs.pname;
+    rev = "v${finalAttrs.version}";
    hash = "sha256-qq683pLqbQ6kMAzc9QOrUdGh67joCy401h3OOr270qQ=";
  };

@@ -19,11 +19,11 @@ pkgs.buildNpmPackage rec {

  postPatch = ''
    tmpfile=$(mktemp)
-    ${pkgs.lib.meta.getExe pkgs.jq} '.homepage = "${homepage}"' package.json > "$tmpfile"
+    ${pkgs.lib.meta.getExe pkgs.jq} '.homepage = "${finalAttrs.homepage}"' package.json > "$tmpfile"
    mv "$tmpfile" package.json
  '';

  installPhase = ''
    cp -r build $out
  '';
-}
+})
--- a/packages/shlink/default.nix
+++ b/packages/shlink/default.nix
@@ -1,15 +1,15 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake shlink
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
  pname = "shlink";
  version = "4.4.6";

  src = pkgs.fetchzip {
-    url = "https://github.com/shlinkio/shlink/releases/download/v${version}/shlink${version}_php8.4_dist.zip";
+    url = "https://github.com/shlinkio/shlink/releases/download/v${finalAttrs.version}/shlink${finalAttrs.version}_php8.4_dist.zip";
    sha256 = "sha256-fjGUQoIKAiB45jeCnbOjMnDOFIadWXdsdn/d8tRuJP8=";
  };

  installPhase = ''
    cp -r $src $out
  '';
-}
+})
--- a/packages/ssh/known-hosts/github/default.nix
+++ b/packages/ssh/known-hosts/github/default.nix
@@ -4,7 +4,7 @@
  system,
  ...
 }:
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
  pname = "ssh-known-hosts-github";
  version = "0-unstable-2025-02-25";

--- a/packages/ssh/known-hosts/sas/artifact/default.nix
+++ b/packages/ssh/known-hosts/sas/artifact/default.nix
@@ -4,7 +4,7 @@
  system,
  ...
 }:
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
  pname = "ssh-known-hosts-sas-artifact";
  version = "0-unstable-2025-03-14";

--- a/packages/ssh/known-hosts/sas/cldlgn/default.nix
+++ b/packages/ssh/known-hosts/sas/cldlgn/default.nix
@@ -4,7 +4,7 @@
  system,
  ...
 }:
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
  pname = "ssh-known-hosts-sas-cldlgn";
  version = "0-unstable-2025-02-25";

--- a/packages/ssh/known-hosts/sas/gerrit/default.nix
+++ b/packages/ssh/known-hosts/sas/gerrit/default.nix
@@ -4,7 +4,7 @@
  system,
  ...
 }:
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
  pname = "ssh-known-hosts-sas-gerrit";
  version = "0-unstable-2025-02-25";

--- a/packages/ssh/known-hosts/sas/gitlab/default.nix
+++ b/packages/ssh/known-hosts/sas/gitlab/default.nix
@@ -4,7 +4,7 @@
  system,
  ...
 }:
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
  pname = "ssh-known-hosts-sas-gitlab";
  version = "0-unstable-2025-02-25";

--- a/packages/yazi/plugins/custom-shell/default.nix
+++ b/packages/yazi/plugins/custom-shell/default.nix
@@ -1,6 +1,6 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake --version=branch=main yazi-plugin-custom-shell
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
  pname = "custom-shell";
  version = "0-unstable-2025-06-07";

--- a/patches.nix
+++ b/patches.nix
@@ -0,0 +1,10 @@
+{ patcher, ... }:
+{
+  home-manager.patches = [
+    (patcher.fetchpatch {
+      name = "ssh: make userKnownHostsFiles consistent with nixpkgs";
+      url = "https://github.com/nix-community/home-manager/compare/master...karaolidis:home-manager:consistent-ssh-known-hosts-files.diff";
+      hash = "sha256-5EHdNqezDVF1xOO8g+qQj40GuS8XR1Vgm4D5zlDQo4I=";
+    })
+  ];
+}
--- a/submodules/home-manager
+++ b/submodules/home-manager
--- a/submodules/nixpkgs
+++ b/submodules/nixpkgs
--- a/treefmt.nix
+++ b/treefmt.nix
@@ -16,8 +16,6 @@
  settings = {
    global = {
      excludes = [
-        # Third-party
-        "submodules/*"
        # Binary Files
        "*.jpg"
        "*.png"