From a55bf3044de2563542b6850c645dd8159469f591 Mon Sep 17 00:00:00 2001
From: Clan Merge Bot <clan-bot@git.clan.lol>
Date: Mon, 8 Jul 2024 00:00:30 +0000
Subject: [PATCH 01/12] update flake lock - 2024-07-08T00:00+00:00
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Flake lock file updates:

• Updated input 'disko':
    'github:nix-community/disko/e1174d991944a01eaaa04bc59c6281edca4c0e6e' (2024-06-20)
  → 'github:nix-community/disko/64679cd7f318c9b6595902b47d4585b1d51d5f9e' (2024-07-04)
• Updated input 'flake-parts':
    'github:hercules-ci/flake-parts/2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8' (2024-06-01)
  → 'github:hercules-ci/flake-parts/9227223f6d922fee3c7b190b2cc238a99527bbb7' (2024-07-03)
• Updated input 'nixos-generators':
    'github:nix-community/nixos-generators/35c20ba421dfa5059e20e0ef2343c875372bdcf3' (2024-06-10)
  → 'github:nix-community/nixos-generators/168b220231a70e47cc1f0919048fa5914415fb18' (2024-07-04)
• Updated input 'nixos-images':
    'github:nix-community/nixos-images/c1e6a5f7b08f1c9993de1cfc5f15f838bf783b88' (2024-06-20)
  → 'github:nix-community/nixos-images/f8650460d37d9d1820a93ebb7f0db5b6c3621946' (2024-07-04)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/3664857c48feacb35770c00abfdc671e55849be5' (2024-06-27)
  → 'github:NixOS/nixpkgs/60a94e515488e335bd5bce096431d490486915e3' (2024-07-07)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/5e2e9421e9ed2b918be0a441c4535cfa45e04811' (2024-06-23)
  → 'github:Mic92/sops-nix/c184aca4db5d71c3db0c8cbfcaaec337a5d065ea' (2024-07-07)
• Updated input 'treefmt-nix':
    'github:numtide/treefmt-nix/68eb1dc333ce82d0ab0c0357363ea17c31ea1f81' (2024-06-16)
  → 'github:numtide/treefmt-nix/e1d7bd5ec6fc389eb3a90e232c4150338bf6a508' (2024-07-07)
---
 flake.lock | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/flake.lock b/flake.lock
index 0b9fe0ad6..94f3749c4 100644
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1718846788,
-        "narHash": "sha256-9dtXYtEkmXoUJV+PGLqscqF7qTn4AIhAKpFWRFU2NYs=",
+        "lastModified": 1720056646,
+        "narHash": "sha256-BymcV4HWtx2VFuabDCM4/nEJcfivCx0S02wUCz11mAY=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "e1174d991944a01eaaa04bc59c6281edca4c0e6e",
+        "rev": "64679cd7f318c9b6595902b47d4585b1d51d5f9e",
         "type": "github"
       },
       "original": {
@@ -27,11 +27,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1717285511,
-        "narHash": "sha256-iKzJcpdXih14qYVcZ9QC9XuZYnPc6T8YImb6dX166kw=",
+        "lastModified": 1719994518,
+        "narHash": "sha256-pQMhCCHyQGRzdfAkdJ4cIWiw+JNuWsTX7f0ZYSyz0VY=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8",
+        "rev": "9227223f6d922fee3c7b190b2cc238a99527bbb7",
         "type": "github"
       },
       "original": {
@@ -50,11 +50,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1718025593,
-        "narHash": "sha256-WZ1gdKq/9u1Ns/oXuNsDm+W0salonVA0VY1amw8urJ4=",
+        "lastModified": 1720055043,
+        "narHash": "sha256-SKizewU4UeYrkZWPUjur8EoxscGoNb0pGcrNL4YzAIg=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "35c20ba421dfa5059e20e0ef2343c875372bdcf3",
+        "rev": "168b220231a70e47cc1f0919048fa5914415fb18",
         "type": "github"
       },
       "original": {
@@ -71,11 +71,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1718845599,
-        "narHash": "sha256-HbQ0iKohKJC5grC95HNjLxGPdgsc/BJgoENDYNbzkLo=",
+        "lastModified": 1720055024,
+        "narHash": "sha256-c5rsiI1R7tnCDpcgfsa7ouSdn6wpctbme9TUp53CFyU=",
         "owner": "nix-community",
         "repo": "nixos-images",
-        "rev": "c1e6a5f7b08f1c9993de1cfc5f15f838bf783b88",
+        "rev": "f8650460d37d9d1820a93ebb7f0db5b6c3621946",
         "type": "github"
       },
       "original": {
@@ -86,11 +86,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1719451888,
-        "narHash": "sha256-Ky0sgEEJMcBmNEJztY6KcVn+6bq74EKM7pd1CR1wnPQ=",
+        "lastModified": 1720340162,
+        "narHash": "sha256-iVLH0Ygtw/Iw9Q1cFFX7OhNnoPbc7/ZWW6J3c0zbiZw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3664857c48feacb35770c00abfdc671e55849be5",
+        "rev": "60a94e515488e335bd5bce096431d490486915e3",
         "type": "github"
       },
       "original": {
@@ -119,11 +119,11 @@
         "nixpkgs-stable": []
       },
       "locked": {
-        "lastModified": 1719111739,
-        "narHash": "sha256-kr2QzRrplzlCP87ddayCZQS+dhGW98kw2zy7+jUXtF4=",
+        "lastModified": 1720321395,
+        "narHash": "sha256-kcI8q9Nh8/CSj0ygfWq1DLckHl8IHhFarL8ie6g7OEk=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "5e2e9421e9ed2b918be0a441c4535cfa45e04811",
+        "rev": "c184aca4db5d71c3db0c8cbfcaaec337a5d065ea",
         "type": "github"
       },
       "original": {
@@ -139,11 +139,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1718522839,
-        "narHash": "sha256-ULzoKzEaBOiLRtjeY3YoGFJMwWSKRYOic6VNw2UyTls=",
+        "lastModified": 1720436211,
+        "narHash": "sha256-/cKXod0oGLl+vH4bKBZnTV3qxrw4jgOLnyQ8KXey5J8=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "68eb1dc333ce82d0ab0c0357363ea17c31ea1f81",
+        "rev": "6fc8bded78715cdd43a3278a14ded226eb3a239e",
         "type": "github"
       },
       "original": {

From 487b7330aba6f45dc6009a8814e7c972704cbee1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 8 Jul 2024 15:51:36 +0200
Subject: [PATCH 02/12] matrix-synapse: remove obsolete patches

---
 ...w_matrix_user-add-password-file-flag.patch | 100 ------------------
 ...rix-user-add-a-flag-to-ignore-alread.patch |  94 ----------------
 clanModules/matrix-synapse/default.nix        |  28 +----
 3 files changed, 1 insertion(+), 221 deletions(-)
 delete mode 100644 clanModules/matrix-synapse/0001-register_new_matrix_user-add-password-file-flag.patch
 delete mode 100644 clanModules/matrix-synapse/0002-register-new-matrix-user-add-a-flag-to-ignore-alread.patch

diff --git a/clanModules/matrix-synapse/0001-register_new_matrix_user-add-password-file-flag.patch b/clanModules/matrix-synapse/0001-register_new_matrix_user-add-password-file-flag.patch
deleted file mode 100644
index fb9e2eb2a..000000000
--- a/clanModules/matrix-synapse/0001-register_new_matrix_user-add-password-file-flag.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-From bc199a27f23b0fcf175b116f7cf606c0d22b422a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Tue, 11 Jun 2024 11:40:47 +0200
-Subject: [PATCH 1/2] register_new_matrix_user: add password-file flag
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-getpass in python expects stdin to be a tty, hence we cannot just pipe
-into register_new_matrix_user. --password-file instead works better and
-it would also allow the use of stdin if /dev/stdin is passed.
-
-Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>
-Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
----
- changelog.d/17294.feature                    |  2 ++
- debian/register_new_matrix_user.ronn         |  9 +++++++--
- synapse/_scripts/register_new_matrix_user.py | 20 +++++++++++++++-----
- 3 files changed, 24 insertions(+), 7 deletions(-)
- create mode 100644 changelog.d/17294.feature
-
-diff --git a/changelog.d/17294.feature b/changelog.d/17294.feature
-new file mode 100644
-index 000000000..33aac7b0b
---- /dev/null
-+++ b/changelog.d/17294.feature
-@@ -0,0 +1,2 @@
-+`register_new_matrix_user` now supports a --password-file flag, which
-+is useful for scripting.
-diff --git a/debian/register_new_matrix_user.ronn b/debian/register_new_matrix_user.ronn
-index 0410b1f4c..d99e9215a 100644
---- a/debian/register_new_matrix_user.ronn
-+++ b/debian/register_new_matrix_user.ronn
-@@ -31,8 +31,13 @@ A sample YAML file accepted by `register_new_matrix_user` is described below:
-     Local part of the new user. Will prompt if omitted.
- 
-   * `-p`, `--password`:
--    New password for user. Will prompt if omitted. Supplying the password
--    on the command line is not recommended. Use the STDIN instead.
-+    New password for user. Will prompt if this option and `--password-file` are omitted.
-+    Supplying the password on the command line is not recommended.
-+    Use `--password-file` if possible.
-+
-+  * `--password-file`:
-+    File containing the new password for user. If set, overrides `--password`.
-+    This is a more secure alternative to specifying the password on the command line.
- 
-   * `-a`, `--admin`:
-     Register new user as an admin. Will prompt if omitted.
-diff --git a/synapse/_scripts/register_new_matrix_user.py b/synapse/_scripts/register_new_matrix_user.py
-index 77a7129ee..972b35e2d 100644
---- a/synapse/_scripts/register_new_matrix_user.py
-+++ b/synapse/_scripts/register_new_matrix_user.py
-@@ -173,11 +173,18 @@ def main() -> None:
-         default=None,
-         help="Local part of the new user. Will prompt if omitted.",
-     )
--    parser.add_argument(
-+    password_group = parser.add_mutually_exclusive_group()
-+    password_group.add_argument(
-         "-p",
-         "--password",
-         default=None,
--        help="New password for user. Will prompt if omitted.",
-+        help="New password for user. Will prompt for a password if "
-+        "this flag and `--password-file` are both omitted.",
-+    )
-+    password_group.add_argument(
-+        "--password-file",
-+        default=None,
-+        help="File containing the new password for user. If set, will override `--password`.",
-     )
-     parser.add_argument(
-         "-t",
-@@ -247,6 +254,11 @@ def main() -> None:
-             print(_NO_SHARED_SECRET_OPTS_ERROR, file=sys.stderr)
-             sys.exit(1)
- 
-+    if args.password_file:
-+        password = _read_file(args.password_file, "password-file").strip()
-+    else:
-+        password = args.password
-+
-     if args.server_url:
-         server_url = args.server_url
-     elif config is not None:
-@@ -269,9 +281,7 @@ def main() -> None:
-     if args.admin or args.no_admin:
-         admin = args.admin
- 
--    register_new_user(
--        args.user, args.password, server_url, secret, admin, args.user_type
--    )
-+    register_new_user(args.user, password, server_url, secret, admin, args.user_type)
- 
- 
- def _read_file(file_path: Any, config_path: str) -> str:
--- 
-2.44.1
-
diff --git a/clanModules/matrix-synapse/0002-register-new-matrix-user-add-a-flag-to-ignore-alread.patch b/clanModules/matrix-synapse/0002-register-new-matrix-user-add-a-flag-to-ignore-alread.patch
deleted file mode 100644
index df02ad52e..000000000
--- a/clanModules/matrix-synapse/0002-register-new-matrix-user-add-a-flag-to-ignore-alread.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From 1789416df425d22693b0055a6688d8686e0ee4a1 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Thu, 13 Jun 2024 14:38:19 +0200
-Subject: [PATCH 2/2] register-new-matrix-user: add a flag to ignore already
- existing users
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This allows to register users in a more declarative and stateless way.
-
-Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
----
- synapse/_scripts/register_new_matrix_user.py | 22 ++++++++++++++++++--
- 1 file changed, 20 insertions(+), 2 deletions(-)
-
-diff --git a/synapse/_scripts/register_new_matrix_user.py b/synapse/_scripts/register_new_matrix_user.py
-index 972b35e2d..233e7267d 100644
---- a/synapse/_scripts/register_new_matrix_user.py
-+++ b/synapse/_scripts/register_new_matrix_user.py
-@@ -52,6 +52,7 @@ def request_registration(
-     user_type: Optional[str] = None,
-     _print: Callable[[str], None] = print,
-     exit: Callable[[int], None] = sys.exit,
-+    exists_ok: bool = False,
- ) -> None:
-     url = "%s/_synapse/admin/v1/register" % (server_location.rstrip("/"),)
- 
-@@ -97,6 +98,10 @@ def request_registration(
-     r = requests.post(url, json=data)
- 
-     if r.status_code != 200:
-+        response = r.json()
-+        if exists_ok and response["errcode"] == "M_USER_IN_USE":
-+            _print("User already exists. Skipping.")
-+            return
-         _print("ERROR! Received %d %s" % (r.status_code, r.reason))
-         if 400 <= r.status_code < 500:
-             try:
-@@ -115,6 +120,7 @@ def register_new_user(
-     shared_secret: str,
-     admin: Optional[bool],
-     user_type: Optional[str],
-+    exists_ok: bool = False,
- ) -> None:
-     if not user:
-         try:
-@@ -154,7 +160,13 @@ def register_new_user(
-             admin = False
- 
-     request_registration(
--        user, password, server_location, shared_secret, bool(admin), user_type
-+        user,
-+        password,
-+        server_location,
-+        shared_secret,
-+        bool(admin),
-+        user_type,
-+        exists_ok=exists_ok,
-     )
- 
- 
-@@ -173,6 +185,11 @@ def main() -> None:
-         default=None,
-         help="Local part of the new user. Will prompt if omitted.",
-     )
-+    parser.add_argument(
-+        "--exists-ok",
-+        action="store_true",
-+        help="Do not fail if user already exists.",
-+    )
-     password_group = parser.add_mutually_exclusive_group()
-     password_group.add_argument(
-         "-p",
-@@ -192,6 +209,7 @@ def main() -> None:
-         default=None,
-         help="User type as specified in synapse.api.constants.UserTypes",
-     )
-+
-     admin_group = parser.add_mutually_exclusive_group()
-     admin_group.add_argument(
-         "-a",
-@@ -281,7 +299,7 @@ def main() -> None:
-     if args.admin or args.no_admin:
-         admin = args.admin
- 
--    register_new_user(args.user, password, server_url, secret, admin, args.user_type)
-+    register_new_user(args.user, password, server_url, secret, admin, args.user_type, exists_ok=args.exists_ok)
- 
- 
- def _read_file(file_path: Any, config_path: str) -> str:
--- 
-2.44.1
-
diff --git a/clanModules/matrix-synapse/default.nix b/clanModules/matrix-synapse/default.nix
index 29245b1dd..399813e1d 100644
--- a/clanModules/matrix-synapse/default.nix
+++ b/clanModules/matrix-synapse/default.nix
@@ -17,19 +17,8 @@ let
         ln -s $out/config.json $out/config.${nginx-vhost}.json
       '';
 
-  # FIXME: This was taken from upstream. Drop this when our patch is upstream
-  synapseCfg = config.services.matrix-synapse;
-  wantedExtras =
-    synapseCfg.extras
-    ++ lib.optional (synapseCfg.settings ? oidc_providers) "oidc"
-    ++ lib.optional (synapseCfg.settings ? jwt_config) "jwt"
-    ++ lib.optional (synapseCfg.settings ? saml2_config) "saml2"
-    ++ lib.optional (synapseCfg.settings ? redis) "redis"
-    ++ lib.optional (synapseCfg.settings ? sentry) "sentry"
-    ++ lib.optional (synapseCfg.settings ? user_directory) "user-search"
-    ++ lib.optional (synapseCfg.settings.url_preview_enabled) "url-preview"
-    ++ lib.optional (synapseCfg.settings.database.name == "psycopg2") "postgres";
 in
+# FIXME: This was taken from upstream. Drop this when our patch is upstream
 {
   options.services.matrix-synapse.package = lib.mkOption { readOnly = false; };
   options.clan.matrix-synapse = {
@@ -78,21 +67,6 @@ in
   ];
   config = {
     services.matrix-synapse = {
-      package = lib.mkForce (
-        pkgs.matrix-synapse.override {
-          matrix-synapse-unwrapped = pkgs.matrix-synapse.unwrapped.overrideAttrs (_old: {
-            doInstallCheck = false; # too slow, nixpkgs maintainer already run this.
-            patches = [
-              # see: https://github.com/element-hq/synapse/pull/17304
-              ./0001-register_new_matrix_user-add-password-file-flag.patch
-              ./0002-register-new-matrix-user-add-a-flag-to-ignore-alread.patch
-            ];
-          });
-          extras = wantedExtras;
-          plugins = synapseCfg.plugins;
-        }
-      );
-
       enable = true;
       settings = {
         server_name = cfg.domain;

From 50a2b90d66f6e4730f5a8e05d13bfa54819e87e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 8 Jul 2024 15:55:45 +0200
Subject: [PATCH 03/12] gnome.adwaita-icon-theme -> adwaita-icon-theme

---
 pkgs/clan-app/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/clan-app/default.nix b/pkgs/clan-app/default.nix
index ac352d39c..893ccf45e 100644
--- a/pkgs/clan-app/default.nix
+++ b/pkgs/clan-app/default.nix
@@ -6,7 +6,7 @@
   pygobject3,
   wrapGAppsHook,
   gtk4,
-  gnome,
+  adwaita-icon-theme,
   pygobject-stubs,
   gobject-introspection,
   clan-cli,
@@ -39,7 +39,7 @@ let
     gtk4
     libadwaita
     webkitgtk_6_0
-    gnome.adwaita-icon-theme
+    adwaita-icon-theme
   ];
 
   # Deps including python packages from the local project

From bd8515fa59b49abec965f7662635328c113d2e17 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 8 Jul 2024 16:05:15 +0200
Subject: [PATCH 04/12] treefmt: upgrade nixfmt options

---
 docs/nix/flake-module.nix |  2 +-
 formatter.nix             | 38 +++++++-------------------------------
 2 files changed, 8 insertions(+), 32 deletions(-)

diff --git a/docs/nix/flake-module.nix b/docs/nix/flake-module.nix
index 87385cf79..bd44e94b7 100644
--- a/docs/nix/flake-module.nix
+++ b/docs/nix/flake-module.nix
@@ -38,7 +38,7 @@
             patchShebangs --build $out
 
             ruff format --check --diff $out
-            ruff --line-length 88 $out
+            ruff check --line-length 88 $out
             mypy --strict $out
           '';
 
diff --git a/formatter.nix b/formatter.nix
index 60a934f75..1cdc3365b 100644
--- a/formatter.nix
+++ b/formatter.nix
@@ -1,4 +1,4 @@
-{ lib, inputs, ... }:
+{ inputs, ... }:
 {
   imports = [ inputs.treefmt-nix.flakeModule ];
   perSystem =
@@ -8,43 +8,19 @@
       treefmt.programs.shellcheck.enable = true;
 
       treefmt.programs.mypy.enable = true;
+      treefmt.programs.nixfmt.enable = true;
+      treefmt.programs.nixfmt.package = pkgs.nixfmt-rfc-style;
+      treefmt.programs.deadnix.enable = true;
+
       treefmt.programs.mypy.directories = {
         "pkgs/clan-cli".extraPythonPackages = self'.packages.clan-cli.testDependencies;
         "pkgs/clan-app".extraPythonPackages =
           # clan-app currently only exists on linux
           (self'.packages.clan-app.externalTestDeps or [ ]) ++ self'.packages.clan-cli.testDependencies;
       };
+      treefmt.programs.ruff.check = true;
+      treefmt.programs.ruff.format = true;
 
-      treefmt.settings.formatter.nix = {
-        command = "sh";
-        options = [
-          "-eucx"
-          ''
-            # First deadnix
-            ${lib.getExe pkgs.deadnix} --edit "$@"
-            # Then nixpkgs-fmt
-            ${lib.getExe pkgs.nixfmt-rfc-style} "$@"
-          ''
-          "--" # this argument is ignored by bash
-        ];
-        includes = [ "*.nix" ];
-        excludes = [
-          # Was copied from nixpkgs. Keep diff minimal to simplify upstreaming.
-          "pkgs/builders/script-writers.nix"
-        ];
-      };
-      treefmt.settings.formatter.python = {
-        command = "sh";
-        options = [
-          "-eucx"
-          ''
-            ${lib.getExe pkgs.ruff} check --fix "$@"
-            ${lib.getExe pkgs.ruff} format "$@"
-          ''
-          "--" # this argument is ignored by bash
-        ];
-        includes = [ "*.py" ];
-      };
       # FIXME: currently broken in CI
       #treefmt.settings.formatter.vale =
       #  let

From d4917cd4ab80a0b24a3d9a0ddd0fba86a08d2666 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 8 Jul 2024 16:14:32 +0200
Subject: [PATCH 05/12] remove obsolete iso installer

This is now part of nixos-images
---
 pkgs/installer/flake-module.nix | 34 ---------------------------------
 1 file changed, 34 deletions(-)

diff --git a/pkgs/installer/flake-module.nix b/pkgs/installer/flake-module.nix
index f62432895..bfd4dc551 100644
--- a/pkgs/installer/flake-module.nix
+++ b/pkgs/installer/flake-module.nix
@@ -19,29 +19,6 @@ let
         };
       };
     };
-  installerModule =
-    { config, modulesPath, ... }:
-    {
-      imports = [
-        wifiModule
-        self.nixosModules.installer
-        self.inputs.nixos-generators.nixosModules.all-formats
-        (modulesPath + "/installer/cd-dvd/iso-image.nix")
-      ];
-
-      isoImage.squashfsCompression = "zstd";
-
-      system.stateVersion = config.system.nixos.version;
-      nixpkgs.pkgs = self.inputs.nixpkgs.legacyPackages.x86_64-linux;
-    };
-
-  installerSystem = lib.nixosSystem {
-    modules = [
-      self.inputs.disko.nixosModules.default
-      installerModule
-      { disko.memSize = 4096; } # FIXME: otherwise the image builder goes OOM
-    ];
-  };
 
   flashInstallerModule =
     { config, ... }:
@@ -98,14 +75,6 @@ let
 in
 {
   clan = {
-    # To build a generic installer image (without ssh pubkeys),
-    # use the following command:
-    # $ nix build .#iso-installer
-    machines.iso-installer = {
-      imports = [ installerModule ];
-      fileSystems."/".device = lib.mkDefault "/dev/null";
-    };
-
     # To directly flash the installer to a disk, use the following command:
     # $ clan flash flash-installer --disk main /dev/sdX --yes
     # This will include your ssh public keys in the installer.
@@ -114,7 +83,4 @@ in
       boot.loader.grub.enable = lib.mkDefault true;
     };
   };
-  flake.packages.x86_64-linux.iso-installer = installerSystem.config.formats.iso;
-  flake.apps.x86_64-linux.install-vm.program = installerSystem.config.formats.vm.outPath;
-  flake.apps.x86_64-linux.install-vm-nogui.program = installerSystem.config.formats.vm-nogui.outPath;
 }

From b4a0f8484d71e2d1a4e6460ec0d7534d05a8efc6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 8 Jul 2024 16:15:30 +0200
Subject: [PATCH 06/12] remove nixos-generators

---
 flake.lock | 24 ------------------------
 flake.nix  |  3 ---
 2 files changed, 27 deletions(-)

diff --git a/flake.lock b/flake.lock
index 94f3749c4..7151ac9c5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -40,29 +40,6 @@
         "type": "github"
       }
     },
-    "nixos-generators": {
-      "inputs": {
-        "nixlib": [
-          "nixpkgs"
-        ],
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1720055043,
-        "narHash": "sha256-SKizewU4UeYrkZWPUjur8EoxscGoNb0pGcrNL4YzAIg=",
-        "owner": "nix-community",
-        "repo": "nixos-generators",
-        "rev": "168b220231a70e47cc1f0919048fa5914415fb18",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixos-generators",
-        "type": "github"
-      }
-    },
     "nixos-images": {
       "inputs": {
         "nixos-stable": [],
@@ -104,7 +81,6 @@
       "inputs": {
         "disko": "disko",
         "flake-parts": "flake-parts",
-        "nixos-generators": "nixos-generators",
         "nixos-images": "nixos-images",
         "nixpkgs": "nixpkgs",
         "sops-nix": "sops-nix",
diff --git a/flake.nix b/flake.nix
index 1b2fd7452..3b09a906f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -13,9 +13,6 @@
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
     sops-nix.inputs.nixpkgs-stable.follows = "";
-    nixos-generators.url = "github:nix-community/nixos-generators";
-    nixos-generators.inputs.nixpkgs.follows = "nixpkgs";
-    nixos-generators.inputs.nixlib.follows = "nixpkgs";
     nixos-images.url = "github:nix-community/nixos-images";
     nixos-images.inputs.nixos-unstable.follows = "nixpkgs";
     # unused input

From 29616a8b5d68abffefd14fd5a74c02c348203cd5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 8 Jul 2024 16:16:44 +0200
Subject: [PATCH 07/12] fix mkdocs-rss-plugin deps

---
 docs/nix/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/nix/default.nix b/docs/nix/default.nix
index 0e16c705a..01dae322f 100644
--- a/docs/nix/default.nix
+++ b/docs/nix/default.nix
@@ -26,6 +26,7 @@ pkgs.stdenv.mkDerivation {
       mkdocs-material
       mkdocs-rss-plugin
       mkdocs-macros
+      filelock # FIXME: this should be already provided by mkdocs-rss-plugin
     ]);
   configurePhase = ''
     mkdir -p ./site/reference/cli

From 9e6d5124ad633e9c10fed1157ca5dcef99d03be2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 8 Jul 2024 16:19:38 +0200
Subject: [PATCH 08/12] add shellcheck hints to all envrc files

---
 .envrc                 | 1 +
 docs/.envrc            | 1 +
 lib/inventory/.envrc   | 1 +
 pkgs/clan-app/.envrc   | 1 +
 pkgs/clan-cli/.envrc   | 1 +
 pkgs/webview-ui/.envrc | 1 +
 6 files changed, 6 insertions(+)

diff --git a/.envrc b/.envrc
index 18a7568fb..3c82a70c8 100644
--- a/.envrc
+++ b/.envrc
@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 if ! has nix_direnv_version || ! nix_direnv_version 3.0.4; then
   source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/3.0.4/direnvrc" "sha256-DzlYZ33mWF/Gs8DDeyjr8mnVmQGx7ASYqA5WlxwvBG4="
 fi
diff --git a/docs/.envrc b/docs/.envrc
index ffe12138f..484fbdf91 100644
--- a/docs/.envrc
+++ b/docs/.envrc
@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 source_up
 
 watch_file $(find ./nix -name "*.nix" -printf '%p ')
diff --git a/lib/inventory/.envrc b/lib/inventory/.envrc
index 8d1c6842b..22103077a 100644
--- a/lib/inventory/.envrc
+++ b/lib/inventory/.envrc
@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 source_up
 
 watch_file flake-module.nix
diff --git a/pkgs/clan-app/.envrc b/pkgs/clan-app/.envrc
index 77e116591..9e53834ae 100644
--- a/pkgs/clan-app/.envrc
+++ b/pkgs/clan-app/.envrc
@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 source_up
 
 watch_file flake-module.nix shell.nix default.nix
diff --git a/pkgs/clan-cli/.envrc b/pkgs/clan-cli/.envrc
index 24d9f311e..85cfcabdb 100644
--- a/pkgs/clan-cli/.envrc
+++ b/pkgs/clan-cli/.envrc
@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 source_up
 
 watch_file flake-module.nix shell.nix default.nix
diff --git a/pkgs/webview-ui/.envrc b/pkgs/webview-ui/.envrc
index f0f92bedf..8e53fd246 100644
--- a/pkgs/webview-ui/.envrc
+++ b/pkgs/webview-ui/.envrc
@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 source_up
 
 watch_file flake-module.nix default.nix

From f62c30f81ddb6fc593c9955eba4b6be34f59a4b6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 8 Jul 2024 16:24:03 +0200
Subject: [PATCH 09/12] fix shellcheck warnings

---
 docs/.envrc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/.envrc b/docs/.envrc
index 484fbdf91..1eab3d8dc 100644
--- a/docs/.envrc
+++ b/docs/.envrc
@@ -1,7 +1,8 @@
 # shellcheck shell=bash
 source_up
 
-watch_file $(find ./nix -name "*.nix" -printf '%p ')
+mapfile -d '' -t nix_files < <(find ./nix -name "*.nix" -print0)
+watch_file "${nix_files[@]}"
 
 # Because we depend on nixpkgs sources, uploading to builders takes a long time
 use flake .#docs --builders ''

From 4f2f663b3b648af204fb6cf75e09990e60d02cce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 8 Jul 2024 16:24:17 +0200
Subject: [PATCH 10/12] reformat script-writers with nixfmt

---
 pkgs/builders/script-writers.nix | 518 +++++++++++++++++--------------
 1 file changed, 284 insertions(+), 234 deletions(-)

diff --git a/pkgs/builders/script-writers.nix b/pkgs/builders/script-writers.nix
index b8182bdd2..8bbaacdc8 100644
--- a/pkgs/builders/script-writers.nix
+++ b/pkgs/builders/script-writers.nix
@@ -27,107 +27,127 @@ rec {
   # Examples:
   #   writeBash = makeScriptWriter { interpreter = "${pkgs.bash}/bin/bash"; }
   #   makeScriptWriter { interpreter = "${pkgs.dash}/bin/dash"; } "hello" "echo hello world"
-  makeScriptWriter = { interpreter, check ? "", makeWrapperArgs ? [], }: nameOrPath: content:
-    assert lib.or (types.path.check nameOrPath) (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
+  makeScriptWriter =
+    {
+      interpreter,
+      check ? "",
+      makeWrapperArgs ? [ ],
+    }:
+    nameOrPath: content:
+    assert lib.or (types.path.check nameOrPath) (
+      builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null
+    );
     assert lib.or (types.path.check content) (types.str.check content);
     let
       name = last (builtins.split "/" nameOrPath);
     in
 
-    pkgs.runCommandLocal name (
-      {
-        inherit makeWrapperArgs;
-        nativeBuildInputs = [
-          makeWrapper
-        ];
-      }
-      // lib.optionalAttrs (nameOrPath == "/bin/${name}") {
-        meta.mainProgram = name;
-      }
-      // (
-        if (types.str.check content) then {
-          inherit content interpreter;
-          passAsFile = [ "content" ];
-        } else {
-          inherit interpreter;
-          contentPath = content;
+    pkgs.runCommandLocal name
+      (
+        {
+          inherit makeWrapperArgs;
+          nativeBuildInputs = [ makeWrapper ];
         }
+        // lib.optionalAttrs (nameOrPath == "/bin/${name}") { meta.mainProgram = name; }
+        // (
+          if (types.str.check content) then
+            {
+              inherit content interpreter;
+              passAsFile = [ "content" ];
+            }
+          else
+            {
+              inherit interpreter;
+              contentPath = content;
+            }
+        )
       )
-    )
-    ''
-      # On darwin a script cannot be used as an interpreter in a shebang but
-      # there doesn't seem to be a limit to the size of shebang and multiple
-      # arguments to the interpreter are allowed.
-      if [[ -n "${toString pkgs.stdenvNoCC.isDarwin}" ]] && isScript $interpreter
-      then
-        wrapperInterpreterLine=$(head -1 "$interpreter" | tail -c+3)
-        # Get first word from the line (note: xargs echo remove leading spaces)
-        wrapperInterpreter=$(echo "$wrapperInterpreterLine" | xargs echo | cut -d " " -f1)
-
-        if isScript $wrapperInterpreter
+      ''
+        # On darwin a script cannot be used as an interpreter in a shebang but
+        # there doesn't seem to be a limit to the size of shebang and multiple
+        # arguments to the interpreter are allowed.
+        if [[ -n "${toString pkgs.stdenvNoCC.isDarwin}" ]] && isScript $interpreter
         then
-          echo "error: passed interpreter ($interpreter) is a script which has another script ($wrapperInterpreter) as an interpreter, which is not supported."
-          exit 1
+          wrapperInterpreterLine=$(head -1 "$interpreter" | tail -c+3)
+          # Get first word from the line (note: xargs echo remove leading spaces)
+          wrapperInterpreter=$(echo "$wrapperInterpreterLine" | xargs echo | cut -d " " -f1)
+
+          if isScript $wrapperInterpreter
+          then
+            echo "error: passed interpreter ($interpreter) is a script which has another script ($wrapperInterpreter) as an interpreter, which is not supported."
+            exit 1
+          fi
+
+          # This should work as long as wrapperInterpreter is a shell, which is
+          # the case for programs wrapped with makeWrapper, like
+          # python3.withPackages etc.
+          interpreterLine="$wrapperInterpreterLine $interpreter"
+        else
+          interpreterLine=$interpreter
         fi
 
-        # This should work as long as wrapperInterpreter is a shell, which is
-        # the case for programs wrapped with makeWrapper, like
-        # python3.withPackages etc.
-        interpreterLine="$wrapperInterpreterLine $interpreter"
-      else
-        interpreterLine=$interpreter
-      fi
+        echo "#! $interpreterLine" > $out
+        cat "$contentPath" >> $out
+        ${optionalString (check != "") ''
+          ${check} $out
+        ''}
+        chmod +x $out
 
-      echo "#! $interpreterLine" > $out
-      cat "$contentPath" >> $out
-      ${optionalString (check != "") ''
-        ${check} $out
-      ''}
-      chmod +x $out
-
-      # Relocate executable if path was specified instead of name.
-      # Only in this case wrapProgram is applied, as it wouldn't work with a
-      #   single executable file under $out.
-      ${optionalString (types.path.check nameOrPath) ''
-        mv $out tmp
-        mkdir -p $out/$(dirname "${nameOrPath}")
-        mv tmp $out/${nameOrPath}
-        wrapProgram $out/${nameOrPath} ''${makeWrapperArgs[@]}
-      ''}
-    '';
+        # Relocate executable if path was specified instead of name.
+        # Only in this case wrapProgram is applied, as it wouldn't work with a
+        #   single executable file under $out.
+        ${optionalString (types.path.check nameOrPath) ''
+          mv $out tmp
+          mkdir -p $out/$(dirname "${nameOrPath}")
+          mv tmp $out/${nameOrPath}
+          wrapProgram $out/${nameOrPath} ''${makeWrapperArgs[@]}
+        ''}
+      '';
 
   # Base implementation for compiled executables.
   # Takes a compile script, which in turn takes the name as an argument.
   #
   # Examples:
   #   writeSimpleC = makeBinWriter { compileScript = name: "gcc -o $out $contentPath"; }
-  makeBinWriter = { compileScript, strip ? true }: nameOrPath: content:
-    assert lib.or (types.path.check nameOrPath) (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
+  makeBinWriter =
+    {
+      compileScript,
+      strip ? true,
+    }:
+    nameOrPath: content:
+    assert lib.or (types.path.check nameOrPath) (
+      builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null
+    );
     assert lib.or (types.path.check content) (types.str.check content);
     let
       name = last (builtins.split "/" nameOrPath);
     in
-    pkgs.runCommand name ((if (types.str.check content) then {
-      inherit content;
-      passAsFile = [ "content" ];
-    } else {
-      contentPath = content;
-    }) // lib.optionalAttrs (nameOrPath == "/bin/${name}") {
-      meta.mainProgram = name;
-    }) ''
-      ${compileScript}
-      ${lib.optionalString strip
-          "${lib.getBin buildPackages.bintools-unwrapped}/bin/${buildPackages.bintools-unwrapped.targetPrefix}strip -S $out"}
-      # Sometimes binaries produced for darwin (e. g. by GHC) won't be valid
-      # mach-o executables from the get-go, but need to be corrected somehow
-      # which is done by fixupPhase.
-      ${lib.optionalString pkgs.stdenvNoCC.hostPlatform.isDarwin "fixupPhase"}
-      ${optionalString (types.path.check nameOrPath) ''
-        mv $out tmp
-        mkdir -p $out/$(dirname "${nameOrPath}")
-        mv tmp $out/${nameOrPath}
-      ''}
-    '';
+    pkgs.runCommand name
+      (
+        (
+          if (types.str.check content) then
+            {
+              inherit content;
+              passAsFile = [ "content" ];
+            }
+          else
+            { contentPath = content; }
+        )
+        // lib.optionalAttrs (nameOrPath == "/bin/${name}") { meta.mainProgram = name; }
+      )
+      ''
+        ${compileScript}
+        ${lib.optionalString strip "${lib.getBin buildPackages.bintools-unwrapped}/bin/${buildPackages.bintools-unwrapped.targetPrefix}strip -S $out"}
+        # Sometimes binaries produced for darwin (e. g. by GHC) won't be valid
+        # mach-o executables from the get-go, but need to be corrected somehow
+        # which is done by fixupPhase.
+        ${lib.optionalString pkgs.stdenvNoCC.hostPlatform.isDarwin "fixupPhase"}
+        ${optionalString (types.path.check nameOrPath) ''
+          mv $out tmp
+          mkdir -p $out/$(dirname "${nameOrPath}")
+          mv tmp $out/${nameOrPath}
+        ''}
+      '';
 
   # Like writeScript but the first line is a shebang to bash
   #
@@ -135,13 +155,10 @@ rec {
   #   writeBash "example" ''
   #     echo hello world
   #   ''
-  writeBash = makeScriptWriter {
-    interpreter = "${lib.getExe pkgs.bash}";
-  };
+  writeBash = makeScriptWriter { interpreter = "${lib.getExe pkgs.bash}"; };
 
   # Like writeScriptBin but the first line is a shebang to bash
-  writeBashBin = name:
-    writeBash "/bin/${name}";
+  writeBashBin = name: writeBash "/bin/${name}";
 
   # Like writeScript but the first line is a shebang to dash
   #
@@ -149,13 +166,10 @@ rec {
   #   writeDash "example" ''
   #     echo hello world
   #   ''
-  writeDash = makeScriptWriter {
-    interpreter = "${lib.getExe pkgs.dash}";
-  };
+  writeDash = makeScriptWriter { interpreter = "${lib.getExe pkgs.dash}"; };
 
   # Like writeScriptBin but the first line is a shebang to dash
-  writeDashBin = name:
-    writeDash "/bin/${name}";
+  writeDashBin = name: writeDash "/bin/${name}";
 
   # Like writeScript but the first line is a shebang to fish
   #
@@ -165,12 +179,11 @@ rec {
   #   ''
   writeFish = makeScriptWriter {
     interpreter = "${lib.getExe pkgs.fish} --no-config";
-    check = "${lib.getExe pkgs.fish} --no-config --no-execute";  # syntax check only
+    check = "${lib.getExe pkgs.fish} --no-config --no-execute"; # syntax check only
   };
 
   # Like writeScriptBin but the first line is a shebang to fish
-  writeFishBin = name:
-    writeFish "/bin/${name}";
+  writeFishBin = name: writeFish "/bin/${name}";
 
   # writeHaskell takes a name, an attrset with libraries and haskell version (both optional)
   # and some haskell source code and returns an executable.
@@ -181,29 +194,31 @@ rec {
   #
   #     main = launchMissiles
   #   '';
-  writeHaskell = name: {
-    libraries ? [],
-    ghc ? pkgs.ghc,
-    ghcArgs ? [],
-    threadedRuntime ? true,
-    strip ? true
-  }:
+  writeHaskell =
+    name:
+    {
+      libraries ? [ ],
+      ghc ? pkgs.ghc,
+      ghcArgs ? [ ],
+      threadedRuntime ? true,
+      strip ? true,
+    }:
     let
       appendIfNotSet = el: list: if elem el list then list else list ++ [ el ];
       ghcArgs' = if threadedRuntime then appendIfNotSet "-threaded" ghcArgs else ghcArgs;
 
-    in makeBinWriter {
+    in
+    makeBinWriter {
       compileScript = ''
         cp $contentPath tmp.hs
-        ${(ghc.withPackages (_: libraries ))}/bin/ghc ${lib.escapeShellArgs ghcArgs'} tmp.hs
+        ${(ghc.withPackages (_: libraries))}/bin/ghc ${lib.escapeShellArgs ghcArgs'} tmp.hs
         mv tmp $out
       '';
       inherit strip;
     } name;
 
   # writeHaskellBin takes the same arguments as writeHaskell but outputs a directory (like writeScriptBin)
-  writeHaskellBin = name:
-    writeHaskell "/bin/${name}";
+  writeHaskellBin = name: writeHaskell "/bin/${name}";
 
   # Like writeScript but the first line is a shebang to nu
   #
@@ -211,30 +226,30 @@ rec {
   #   writeNu "example" ''
   #     echo hello world
   #   ''
-  writeNu = makeScriptWriter {
-    interpreter = "${lib.getExe pkgs.nushell} --no-config-file";
-  };
+  writeNu = makeScriptWriter { interpreter = "${lib.getExe pkgs.nushell} --no-config-file"; };
 
   # Like writeScriptBin but the first line is a shebang to nu
-  writeNuBin = name:
-    writeNu "/bin/${name}";
+  writeNuBin = name: writeNu "/bin/${name}";
 
   # makeRubyWriter takes ruby and compatible rubyPackages and produces ruby script writer,
   # If any libraries are specified, ruby.withPackages is used as interpreter, otherwise the "bare" ruby is used.
-  makeRubyWriter = ruby: rubyPackages: buildRubyPackages: name: { libraries ? [], ... } @ args:
-  makeScriptWriter (
-    (builtins.removeAttrs args ["libraries"])
-    // {
-      interpreter =
-        if libraries == []
-        then "${ruby}/bin/ruby"
-        else "${(ruby.withPackages (ps: libraries))}/bin/ruby";
-      # Rubocop doesnt seem to like running in this fashion.
-      #check = (writeDash "rubocop.sh" ''
-      #  exec ${lib.getExe buildRubyPackages.rubocop} "$1"
-      #'');
-    }
-  ) name;
+  makeRubyWriter =
+    ruby: _rubyPackages: _buildRubyPackages: name:
+    {
+      libraries ? [ ],
+      ...
+    }@args:
+    makeScriptWriter (
+      (builtins.removeAttrs args [ "libraries" ])
+      // {
+        interpreter =
+          if libraries == [ ] then "${ruby}/bin/ruby" else "${(ruby.withPackages (_ps: libraries))}/bin/ruby";
+        # Rubocop doesnt seem to like running in this fashion.
+        #check = (writeDash "rubocop.sh" ''
+        #  exec ${lib.getExe buildRubyPackages.rubocop} "$1"
+        #'');
+      }
+    ) name;
 
   # Like writeScript but the first line is a shebang to ruby
   #
@@ -244,26 +259,29 @@ rec {
   #   ''
   writeRuby = makeRubyWriter pkgs.ruby pkgs.rubyPackages buildPackages.rubyPackages;
 
-  writeRubyBin = name:
-    writeRuby "/bin/${name}";
+  writeRubyBin = name: writeRuby "/bin/${name}";
 
   # makeLuaWriter takes lua and compatible luaPackages and produces lua script writer,
   # which validates the script with luacheck at build time. If any libraries are specified,
   # lua.withPackages is used as interpreter, otherwise the "bare" lua is used.
-  makeLuaWriter = lua: luaPackages: buildLuaPackages: name: { libraries ? [], ... } @ args:
-  makeScriptWriter (
-    (builtins.removeAttrs args ["libraries"])
-    // {
-      interpreter = lua.interpreter;
+  makeLuaWriter =
+    lua: _luaPackages: buildLuaPackages: name:
+    { ... }@args:
+    makeScriptWriter (
+      (builtins.removeAttrs args [ "libraries" ])
+      // {
+        interpreter = lua.interpreter;
         # if libraries == []
         # then lua.interpreter
         # else (lua.withPackages (ps: libraries)).interpreter
         # This should support packages! I just cant figure out why some dependency collision happens whenever I try to run this.
-      check = (writeDash "luacheck.sh" ''
-        exec ${buildLuaPackages.luacheck}/bin/luacheck "$1"
-      '');
-    }
-   ) name;
+        check = (
+          writeDash "luacheck.sh" ''
+            exec ${buildLuaPackages.luacheck}/bin/luacheck "$1"
+          ''
+        );
+      }
+    ) name;
 
   # writeLua takes a name an attributeset with libraries and some lua source code and
   # returns an executable (should also work with luajit)
@@ -287,27 +305,27 @@ rec {
   # ''
   writeLua = makeLuaWriter pkgs.lua pkgs.luaPackages buildPackages.luaPackages;
 
-  writeLuaBin = name:
-    writeLua "/bin/${name}";
+  writeLuaBin = name: writeLua "/bin/${name}";
 
-  writeRust = name: {
+  writeRust =
+    name:
+    {
       rustc ? pkgs.rustc,
-      rustcArgs ? [],
-      strip ? true
-  }:
-  let
-    darwinArgs = lib.optionals stdenv.isDarwin [ "-L${lib.getLib libiconv}/lib" ];
-  in
+      rustcArgs ? [ ],
+      strip ? true,
+    }:
+    let
+      darwinArgs = lib.optionals stdenv.isDarwin [ "-L${lib.getLib libiconv}/lib" ];
+    in
     makeBinWriter {
       compileScript = ''
         cp "$contentPath" tmp.rs
-        PATH=${lib.makeBinPath [pkgs.gcc]} ${rustc}/bin/rustc ${lib.escapeShellArgs rustcArgs} ${lib.escapeShellArgs darwinArgs} -o "$out" tmp.rs
+        PATH=${lib.makeBinPath [ pkgs.gcc ]} ${rustc}/bin/rustc ${lib.escapeShellArgs rustcArgs} ${lib.escapeShellArgs darwinArgs} -o "$out" tmp.rs
       '';
       inherit strip;
     } name;
 
-  writeRustBin = name:
-    writeRust "/bin/${name}";
+  writeRustBin = name: writeRust "/bin/${name}";
 
   # writeJS takes a name an attributeset with libraries and some JavaScript sourcecode and
   # returns an executable
@@ -319,23 +337,26 @@ rec {
   #     var result = UglifyJS.minify(code);
   #     console.log(result.code);
   #   ''
-  writeJS = name: { libraries ? [] }: content:
-  let
-    node-env = pkgs.buildEnv {
-      name = "node";
-      paths = libraries;
-      pathsToLink = [
-        "/lib/node_modules"
-      ];
-    };
-  in writeDash name ''
-    export NODE_PATH=${node-env}/lib/node_modules
-    exec ${lib.getExe pkgs.nodejs} ${pkgs.writeText "js" content} "$@"
-  '';
+  writeJS =
+    name:
+    {
+      libraries ? [ ],
+    }:
+    content:
+    let
+      node-env = pkgs.buildEnv {
+        name = "node";
+        paths = libraries;
+        pathsToLink = [ "/lib/node_modules" ];
+      };
+    in
+    writeDash name ''
+      export NODE_PATH=${node-env}/lib/node_modules
+      exec ${lib.getExe pkgs.nodejs} ${pkgs.writeText "js" content} "$@"
+    '';
 
   # writeJSBin takes the same arguments as writeJS but outputs a directory (like writeScriptBin)
-  writeJSBin = name:
-    writeJS "/bin/${name}";
+  writeJSBin = name: writeJS "/bin/${name}";
 
   awkFormatNginx = builtins.toFile "awkFormat-nginx.awk" ''
     awk -f
@@ -343,18 +364,22 @@ rec {
     /\{/{ctx++;idx=1}
     /\}/{ctx--}
     {id="";for(i=idx;i<ctx;i++)id=sprintf("%s%s", id, "\t");printf "%s%s\n", id, $0}
-   '';
-
-  writeNginxConfig = name: text: pkgs.runCommandLocal name {
-    inherit text;
-    passAsFile = [ "text" ];
-    nativeBuildInputs = [ gixy ];
-  } /* sh */ ''
-    # nginx-config-formatter has an error - https://github.com/1connect/nginx-config-formatter/issues/16
-    awk -f ${awkFormatNginx} "$textPath" | sed '/^\s*$/d' > $out
-    gixy $out
   '';
 
+  writeNginxConfig =
+    name: text:
+    pkgs.runCommandLocal name
+      {
+        inherit text;
+        passAsFile = [ "text" ];
+        nativeBuildInputs = [ gixy ];
+      } # sh
+      ''
+        # nginx-config-formatter has an error - https://github.com/1connect/nginx-config-formatter/issues/16
+        awk -f ${awkFormatNginx} "$textPath" | sed '/^\s*$/d' > $out
+        gixy $out
+      '';
+
   # writePerl takes a name an attributeset with libraries and some perl sourcecode and
   # returns an executable
   #
@@ -363,42 +388,55 @@ rec {
   #     use boolean;
   #     print "Howdy!\n" if true;
   #   ''
-  writePerl = name: { libraries ? [], ... } @ args:
+  writePerl =
+    name:
+    {
+      libraries ? [ ],
+      ...
+    }@args:
     makeScriptWriter (
-      (builtins.removeAttrs args ["libraries"])
+      (builtins.removeAttrs args [ "libraries" ])
       // {
-        interpreter = "${lib.getExe (pkgs.perl.withPackages (p: libraries))}";
+        interpreter = "${lib.getExe (pkgs.perl.withPackages (_p: libraries))}";
       }
     ) name;
 
   # writePerlBin takes the same arguments as writePerl but outputs a directory (like writeScriptBin)
-  writePerlBin = name:
-    writePerl "/bin/${name}";
+  writePerlBin = name: writePerl "/bin/${name}";
 
   # makePythonWriter takes python and compatible pythonPackages and produces python script writer,
   # which validates the script with flake8 at build time. If any libraries are specified,
   # python.withPackages is used as interpreter, otherwise the "bare" python is used.
-  makePythonWriter = python: pythonPackages: buildPythonPackages: name: { libraries ? [], flakeIgnore ? [], ... } @ args:
-  let
-    ignoreAttribute = optionalString (flakeIgnore != []) "--ignore ${concatMapStringsSep "," escapeShellArg flakeIgnore}";
-  in
-  makeScriptWriter
-    (
-      (builtins.removeAttrs args ["libraries" "flakeIgnore"])
+  makePythonWriter =
+    python: pythonPackages: buildPythonPackages: name:
+    {
+      libraries ? [ ],
+      flakeIgnore ? [ ],
+      ...
+    }@args:
+    let
+      ignoreAttribute =
+        optionalString (flakeIgnore != [ ])
+          "--ignore ${concatMapStringsSep "," escapeShellArg flakeIgnore}";
+    in
+    makeScriptWriter (
+      (builtins.removeAttrs args [
+        "libraries"
+        "flakeIgnore"
+      ])
       // {
         interpreter =
           if pythonPackages != pkgs.pypy2Packages || pythonPackages != pkgs.pypy3Packages then
-            if libraries == []
-            then python.interpreter
-            else (python.withPackages (ps: libraries)).interpreter
-          else python.interpreter
-        ;
-        check = optionalString python.isPy3k (writeDash "pythoncheck.sh" ''
-          exec ${buildPythonPackages.flake8}/bin/flake8 --show-source ${ignoreAttribute} "$1"
-        '');
+            if libraries == [ ] then python.interpreter else (python.withPackages (_ps: libraries)).interpreter
+          else
+            python.interpreter;
+        check = optionalString python.isPy3k (
+          writeDash "pythoncheck.sh" ''
+            exec ${buildPythonPackages.flake8}/bin/flake8 --show-source ${ignoreAttribute} "$1"
+          ''
+        );
       }
-    )
-    name;
+    ) name;
 
   # writePyPy2 takes a name an attributeset with libraries and some pypy2 sourcecode and
   # returns an executable
@@ -415,8 +453,7 @@ rec {
   writePyPy2 = makePythonWriter pkgs.pypy2 pkgs.pypy2Packages buildPackages.pypy2Packages;
 
   # writePyPy2Bin takes the same arguments as writePyPy2 but outputs a directory (like writeScriptBin)
-  writePyPy2Bin = name:
-    writePyPy2 "/bin/${name}";
+  writePyPy2Bin = name: writePyPy2 "/bin/${name}";
 
   # writePython3 takes a name an attributeset with libraries and some python3 sourcecode and
   # returns an executable
@@ -433,8 +470,7 @@ rec {
   writePython3 = makePythonWriter pkgs.python3 pkgs.python3Packages buildPackages.python3Packages;
 
   # writePython3Bin takes the same arguments as writePython3 but outputs a directory (like writeScriptBin)
-  writePython3Bin = name:
-    writePython3 "/bin/${name}";
+  writePython3Bin = name: writePython3 "/bin/${name}";
 
   # writePyPy3 takes a name an attributeset with libraries and some pypy3 sourcecode and
   # returns an executable
@@ -451,47 +487,61 @@ rec {
   writePyPy3 = makePythonWriter pkgs.pypy3 pkgs.pypy3Packages buildPackages.pypy3Packages;
 
   # writePyPy3Bin takes the same arguments as writePyPy3 but outputs a directory (like writeScriptBin)
-  writePyPy3Bin = name:
-    writePyPy3 "/bin/${name}";
+  writePyPy3Bin = name: writePyPy3 "/bin/${name}";
 
+  makeFSharpWriter =
+    {
+      dotnet-sdk ? pkgs.dotnet-sdk,
+      fsi-flags ? "",
+      libraries ? _: [ ],
+      ...
+    }@args:
+    nameOrPath:
+    let
+      fname = last (builtins.split "/" nameOrPath);
+      path = if strings.hasSuffix ".fsx" nameOrPath then nameOrPath else "${nameOrPath}.fsx";
+      _nugetDeps = mkNugetDeps {
+        name = "${fname}-nuget-deps";
+        nugetDeps = libraries;
+      };
 
-  makeFSharpWriter = { dotnet-sdk ? pkgs.dotnet-sdk, fsi-flags ? "", libraries ? _: [], ... } @ args: nameOrPath:
-  let
-    fname = last (builtins.split "/" nameOrPath);
-    path = if strings.hasSuffix ".fsx" nameOrPath then nameOrPath else "${nameOrPath}.fsx";
-    _nugetDeps = mkNugetDeps { name = "${fname}-nuget-deps"; nugetDeps = libraries; };
+      nuget-source = mkNugetSource {
+        name = "${fname}-nuget-source";
+        description = "A Nuget source with the dependencies for ${fname}";
+        deps = [ _nugetDeps ];
+      };
 
-    nuget-source = mkNugetSource {
-      name = "${fname}-nuget-source";
-      description = "A Nuget source with the dependencies for ${fname}";
-      deps = [ _nugetDeps ];
-    };
+      fsi = writeBash "fsi" ''
+        export HOME=$NIX_BUILD_TOP/.home
+        export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
+        export DOTNET_CLI_TELEMETRY_OPTOUT=1
+        export DOTNET_NOLOGO=1
+        script="$1"; shift
+        ${lib.getExe dotnet-sdk} fsi --quiet --nologo --readline- ${fsi-flags} "$@" < "$script"
+      '';
 
-    fsi = writeBash "fsi" ''
-      export HOME=$NIX_BUILD_TOP/.home
-      export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
-      export DOTNET_CLI_TELEMETRY_OPTOUT=1
-      export DOTNET_NOLOGO=1
-      script="$1"; shift
-      ${lib.getExe dotnet-sdk} fsi --quiet --nologo --readline- ${fsi-flags} "$@" < "$script"
-    '';
+    in
+    content:
+    makeScriptWriter
+      (
+        (builtins.removeAttrs args [
+          "dotnet-sdk"
+          "fsi-flags"
+          "libraries"
+        ])
+        // {
+          interpreter = fsi;
+        }
+      )
+      path
+      ''
+        #i "nuget: ${nuget-source}/lib"
+        ${content}
+        exit 0
+      '';
 
-  in content: makeScriptWriter (
-    (builtins.removeAttrs args ["dotnet-sdk" "fsi-flags" "libraries"])
-    // {
-      interpreter = fsi;
-    }
-  ) path
-  ''
-    #i "nuget: ${nuget-source}/lib"
-    ${ content }
-    exit 0
-  '';
+  writeFSharp = makeFSharpWriter { };
 
-  writeFSharp =
-    makeFSharpWriter {};
-
-  writeFSharpBin = name:
-    writeFSharp "/bin/${name}";
+  writeFSharpBin = name: writeFSharp "/bin/${name}";
 
 }

From 83371fca478d4a1d520172f8ce9e4f6d14c8f5cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 8 Jul 2024 16:25:16 +0200
Subject: [PATCH 11/12] quote .envrc

---
 .envrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.envrc b/.envrc
index 3c82a70c8..fda7fa8fb 100644
--- a/.envrc
+++ b/.envrc
@@ -6,7 +6,7 @@ fi
 watch_file .direnv/selected-shell 
 
 if [ -e .direnv/selected-shell ]; then
-  use flake .#$(cat .direnv/selected-shell)
+  use flake ".#$(cat .direnv/selected-shell)"
 else
   use flake
 fi

From e1b7805aef25569310d2a1dc1fde69a53eb99d7d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Mon, 8 Jul 2024 16:30:15 +0200
Subject: [PATCH 12/12] fix new linter issues

---
 pkgs/clan-cli/clan_cli/config/__init__.py |  4 ++--
 pkgs/clan-cli/tests/test_config.py        | 16 ++++++++--------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/clan-cli/clan_cli/config/__init__.py b/pkgs/clan-cli/clan_cli/config/__init__.py
index d1a7ce51b..1085bc314 100644
--- a/pkgs/clan-cli/clan_cli/config/__init__.py
+++ b/pkgs/clan-cli/clan_cli/config/__init__.py
@@ -81,11 +81,11 @@ def cast(value: Any, input_type: Any, opt_description: str) -> Any:
             else:
                 raise ClanError(f"Invalid value {value} for boolean")
         # handle lists
-        elif get_origin(input_type) == list:
+        elif get_origin(input_type) is list:
             subtype = input_type.__args__[0]
             return [cast([x], subtype, opt_description) for x in value]
         # handle dicts
-        elif get_origin(input_type) == dict:
+        elif get_origin(input_type) is dict:
             if not isinstance(value, dict):
                 raise ClanError(
                     f"Cannot set {opt_description} directly. Specify a suboption like {opt_description}.<name>"
diff --git a/pkgs/clan-cli/tests/test_config.py b/pkgs/clan-cli/tests/test_config.py
index 508f361ae..64424d35f 100644
--- a/pkgs/clan-cli/tests/test_config.py
+++ b/pkgs/clan-cli/tests/test_config.py
@@ -108,7 +108,7 @@ def test_type_from_schema_path_simple() -> None:
     schema = dict(
         type="boolean",
     )
-    assert parsing.type_from_schema_path(schema, []) == bool
+    assert parsing.type_from_schema_path(schema, []) is bool
 
 
 def test_type_from_schema_path_nested() -> None:
@@ -125,8 +125,8 @@ def test_type_from_schema_path_nested() -> None:
             age=dict(type="integer"),
         ),
     )
-    assert parsing.type_from_schema_path(schema, ["age"]) == int
-    assert parsing.type_from_schema_path(schema, ["name", "first"]) == str
+    assert parsing.type_from_schema_path(schema, ["age"]) is int
+    assert parsing.type_from_schema_path(schema, ["name", "first"]) is str
 
 
 def test_type_from_schema_path_dynamic_attrs() -> None:
@@ -140,16 +140,16 @@ def test_type_from_schema_path_dynamic_attrs() -> None:
             ),
         ),
     )
-    assert parsing.type_from_schema_path(schema, ["age"]) == int
-    assert parsing.type_from_schema_path(schema, ["users", "foo"]) == str
+    assert parsing.type_from_schema_path(schema, ["age"]) is int
+    assert parsing.type_from_schema_path(schema, ["users", "foo"]) is str
 
 
 def test_map_type() -> None:
     with pytest.raises(ClanError):
         config.map_type("foo")
-    assert config.map_type("string") == str
-    assert config.map_type("integer") == int
-    assert config.map_type("boolean") == bool
+    assert config.map_type("string") is str
+    assert config.map_type("integer") is int
+    assert config.map_type("boolean") is bool
     assert config.map_type("attribute set of string") == dict[str, str]
     assert config.map_type("attribute set of integer") == dict[str, int]
     assert config.map_type("null or string") == str | None