Drop macOS-specific remote-program param from nix copy command

Merge pull request 'Update nixpkgs-dev in devFlake' (#5728 ) from update-devFlake-nixpkgs-dev into main
Update nixpkgs-dev in devFlake
2025-11-04 01:53:58 +08:00 · 2025-11-03 15:07:53 +00:00 · 2025-11-03 15:01:50 +00:00 · 2025-11-03 13:13:53 +00:00 · 2025-11-03 13:06:14 +00:00 · 2025-11-03 10:06:31 +00:00
69 changed files with 1083 additions and 951 deletions
--- a/checks/flash/flake-module.nix
+++ b/checks/flash/flake-module.nix
@@ -58,51 +58,53 @@
        pkgs.buildPackages.xorg.lndir
        pkgs.glibcLocales
        pkgs.kbd.out
-        self.nixosConfigurations."test-flash-machine-${pkgs.hostPlatform.system}".pkgs.perlPackages.ConfigIniFiles
-        self.nixosConfigurations."test-flash-machine-${pkgs.hostPlatform.system}".pkgs.perlPackages.FileSlurp
+        self.nixosConfigurations."test-flash-machine-${pkgs.stdenv.hostPlatform.system}".pkgs.perlPackages.ConfigIniFiles
+        self.nixosConfigurations."test-flash-machine-${pkgs.stdenv.hostPlatform.system}".pkgs.perlPackages.FileSlurp
        pkgs.bubblewrap

-        self.nixosConfigurations."test-flash-machine-${pkgs.hostPlatform.system}".config.system.build.toplevel
-        self.nixosConfigurations."test-flash-machine-${pkgs.hostPlatform.system}".config.system.build.diskoScript
-        self.nixosConfigurations."test-flash-machine-${pkgs.hostPlatform.system}".config.system.build.diskoScript.drvPath
+        self.nixosConfigurations."test-flash-machine-${pkgs.stdenv.hostPlatform.system}".config.system.build.toplevel
+        self.nixosConfigurations."test-flash-machine-${pkgs.stdenv.hostPlatform.system}".config.system.build.diskoScript
+        self.nixosConfigurations."test-flash-machine-${pkgs.stdenv.hostPlatform.system}".config.system.build.diskoScript.drvPath
      ]
      ++ builtins.map (i: i.outPath) (builtins.attrValues self.inputs);
      closureInfo = pkgs.closureInfo { rootPaths = dependencies; };
    in
    {
      # Skip flash test on aarch64-linux for now as it's too slow
-      checks = lib.optionalAttrs (pkgs.stdenv.isLinux && pkgs.hostPlatform.system != "aarch64-linux") {
-        nixos-test-flash = self.clanLib.test.baseTest {
-          name = "flash";
-          nodes.target = {
-            virtualisation.emptyDiskImages = [ 4096 ];
-            virtualisation.memorySize = 4096;
+      checks =
+        lib.optionalAttrs (pkgs.stdenv.isLinux && pkgs.stdenv.hostPlatform.system != "aarch64-linux")
+          {
+            nixos-test-flash = self.clanLib.test.baseTest {
+              name = "flash";
+              nodes.target = {
+                virtualisation.emptyDiskImages = [ 4096 ];
+                virtualisation.memorySize = 4096;

-            virtualisation.useNixStoreImage = true;
-            virtualisation.writableStore = true;
+                virtualisation.useNixStoreImage = true;
+                virtualisation.writableStore = true;

-            environment.systemPackages = [ self.packages.${pkgs.system}.clan-cli ];
-            environment.etc."install-closure".source = "${closureInfo}/store-paths";
+                environment.systemPackages = [ self.packages.${pkgs.system}.clan-cli ];
+                environment.etc."install-closure".source = "${closureInfo}/store-paths";

-            nix.settings = {
-              substituters = lib.mkForce [ ];
-              hashed-mirrors = null;
-              connect-timeout = lib.mkForce 3;
-              flake-registry = "";
-              experimental-features = [
-                "nix-command"
-                "flakes"
-              ];
-            };
+                nix.settings = {
+                  substituters = lib.mkForce [ ];
+                  hashed-mirrors = null;
+                  connect-timeout = lib.mkForce 3;
+                  flake-registry = "";
+                  experimental-features = [
+                    "nix-command"
+                    "flakes"
+                  ];
+                };
+              };
+              testScript = ''
+                start_all()
+                machine.succeed("echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRWUusawhlIorx7VFeQJHmMkhl9X3QpnvOdhnV/bQNG root@target' > ./test_id_ed25519.pub")
+                # Some distros like to automount disks with spaces
+                machine.succeed('mkdir -p "/mnt/with spaces" && mkfs.ext4 /dev/vdc && mount /dev/vdc "/mnt/with spaces"')
+                machine.succeed("clan flash write --ssh-pubkey ./test_id_ed25519.pub --keymap de --language de_DE.UTF-8 --debug --flake ${self.checks.x86_64-linux.clan-core-for-checks} --yes --disk main /dev/vdc test-flash-machine-${pkgs.stdenv.hostPlatform.system}")
+              '';
+            } { inherit pkgs self; };
          };
-          testScript = ''
-            start_all()
-            machine.succeed("echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRWUusawhlIorx7VFeQJHmMkhl9X3QpnvOdhnV/bQNG root@target' > ./test_id_ed25519.pub")
-            # Some distros like to automount disks with spaces
-            machine.succeed('mkdir -p "/mnt/with spaces" && mkfs.ext4 /dev/vdc && mount /dev/vdc "/mnt/with spaces"')
-            machine.succeed("clan flash write --ssh-pubkey ./test_id_ed25519.pub --keymap de --language de_DE.UTF-8 --debug --flake ${self.checks.x86_64-linux.clan-core-for-checks} --yes --disk main /dev/vdc test-flash-machine-${pkgs.hostPlatform.system}")
-          '';
-        } { inherit pkgs self; };
-      };
    };
 }
--- a/checks/installation/flake-module.nix
+++ b/checks/installation/flake-module.nix
@@ -160,9 +160,9 @@
          closureInfo = pkgs.closureInfo {
            rootPaths = [
              privateInputs.clan-core-for-checks
-              self.nixosConfigurations."test-install-machine-${pkgs.hostPlatform.system}".config.system.build.toplevel
-              self.nixosConfigurations."test-install-machine-${pkgs.hostPlatform.system}".config.system.build.initialRamdisk
-              self.nixosConfigurations."test-install-machine-${pkgs.hostPlatform.system}".config.system.build.diskoScript
+              self.nixosConfigurations."test-install-machine-${pkgs.stdenv.hostPlatform.system}".config.system.build.toplevel
+              self.nixosConfigurations."test-install-machine-${pkgs.stdenv.hostPlatform.system}".config.system.build.initialRamdisk
+              self.nixosConfigurations."test-install-machine-${pkgs.stdenv.hostPlatform.system}".config.system.build.diskoScript
              pkgs.stdenv.drvPath
              pkgs.bash.drvPath
              pkgs.buildPackages.xorg.lndir
@@ -215,7 +215,7 @@
                  # Prepare test flake and Nix store
                  flake_dir = prepare_test_flake(
                      temp_dir,
-                      "${self.checks.${pkgs.hostPlatform.system}.clan-core-for-checks}",
+                      "${self.checks.${pkgs.stdenv.hostPlatform.system}.clan-core-for-checks}",
                      "${closureInfo}"
                  )

@@ -296,7 +296,7 @@
                  # Prepare test flake and Nix store
                  flake_dir = prepare_test_flake(
                      temp_dir,
-                      "${self.checks.${pkgs.hostPlatform.system}.clan-core-for-checks}",
+                      "${self.checks.${pkgs.stdenv.hostPlatform.system}.clan-core-for-checks}",
                      "${closureInfo}"
                  )

--- a/checks/llm/default.nix
+++ b/checks/llm/default.nix
@@ -2,7 +2,7 @@

 let

-  cli = self.packages.${pkgs.hostPlatform.system}.clan-cli-full;
+  cli = self.packages.${pkgs.stdenv.hostPlatform.system}.clan-cli-full;

  ollama-model = pkgs.callPackage ./qwen3-4b-instruct.nix { };
 in
@@ -53,7 +53,7 @@ in
              pytest
              pytest-xdist
              (cli.pythonRuntime.pkgs.toPythonModule cli)
-              self.legacyPackages.${pkgs.hostPlatform.system}.nixosTestLib
+              self.legacyPackages.${pkgs.stdenv.hostPlatform.system}.nixosTestLib
            ]
          ))
        ];
--- a/checks/systemd-abstraction/default.nix
+++ b/checks/systemd-abstraction/default.nix
@@ -2,7 +2,7 @@

 let

-  cli = self.packages.${pkgs.hostPlatform.system}.clan-cli-full;
+  cli = self.packages.${pkgs.stdenv.hostPlatform.system}.clan-cli-full;
 in
 {
  name = "systemd-abstraction";
--- a/checks/update/flake-module.nix
+++ b/checks/update/flake-module.nix
@@ -115,9 +115,9 @@
              let
                closureInfo = pkgs.closureInfo {
                  rootPaths = [
-                    self.packages.${pkgs.hostPlatform.system}.clan-cli
-                    self.checks.${pkgs.hostPlatform.system}.clan-core-for-checks
-                    self.clanInternals.machines.${pkgs.hostPlatform.system}.test-update-machine.config.system.build.toplevel
+                    self.packages.${pkgs.stdenv.hostPlatform.system}.clan-cli
+                    self.checks.${pkgs.stdenv.hostPlatform.system}.clan-core-for-checks
+                    self.clanInternals.machines.${pkgs.stdenv.hostPlatform.system}.test-update-machine.config.system.build.toplevel
                    pkgs.stdenv.drvPath
                    pkgs.bash.drvPath
                    pkgs.buildPackages.xorg.lndir
@@ -132,7 +132,7 @@
                  imports = [ self.nixosModules.test-update-machine ];
                };
                extraPythonPackages = _p: [
-                  self.legacyPackages.${pkgs.hostPlatform.system}.nixosTestLib
+                  self.legacyPackages.${pkgs.stdenv.hostPlatform.system}.nixosTestLib
                ];

                testScript = ''
@@ -154,7 +154,7 @@
                      # Prepare test flake and Nix store
                      flake_dir = prepare_test_flake(
                          temp_dir,
-                          "${self.checks.${pkgs.hostPlatform.system}.clan-core-for-checks}",
+                          "${self.checks.${pkgs.stdenv.hostPlatform.system}.clan-core-for-checks}",
                          "${closureInfo}"
                      )
                      (flake_dir / ".clan-flake").write_text("")  # Ensure .clan-flake exists
@@ -226,7 +226,7 @@
                            "--to",
                            "ssh://root@192.168.1.1",
                            "--no-check-sigs",
-                            f"${self.packages.${pkgs.hostPlatform.system}.clan-cli}",
+                            f"${self.packages.${pkgs.stdenv.hostPlatform.system}.clan-cli}",
                            "--extra-experimental-features", "nix-command flakes",
                        ],
                        check=True,
@@ -242,7 +242,7 @@
                          "-o", "UserKnownHostsFile=/dev/null",
                          "-o", "StrictHostKeyChecking=no",
                          f"root@192.168.1.1",
-                          "${self.packages.${pkgs.hostPlatform.system}.clan-cli}/bin/clan",
+                          "${self.packages.${pkgs.stdenv.hostPlatform.system}.clan-cli}/bin/clan",
                          "machines",
                          "update",
                          "--debug",
@@ -270,7 +270,7 @@

                      # Run clan update command
                      subprocess.run([
-                          "${self.packages.${pkgs.hostPlatform.system}.clan-cli-full}/bin/clan",
+                          "${self.packages.${pkgs.stdenv.hostPlatform.system}.clan-cli-full}/bin/clan",
                          "machines",
                          "update",
                          "--debug",
@@ -297,7 +297,7 @@

                      # Run clan update command with --build-host
                      subprocess.run([
-                          "${self.packages.${pkgs.hostPlatform.system}.clan-cli-full}/bin/clan",
+                          "${self.packages.${pkgs.stdenv.hostPlatform.system}.clan-cli-full}/bin/clan",
                          "machines",
                          "update",
                          "--debug",
--- a/clanServices/certificates/README.md
+++ b/clanServices/certificates/README.md
@@ -1,3 +1,6 @@
+!!! Danger "Experimental"
+    This service is experimental and will change in the future.
+
 This service sets up a certificate authority (CA) that can issue certificates to
 other machines in your clan. For this the `ca` role is used.
 It additionally provides a `default` role, that can be applied to all machines
--- a/clanServices/coredns/README.md
+++ b/clanServices/coredns/README.md
@@ -1,3 +1,6 @@
+!!! Danger "Experimental"
+    This service is experimental and will change in the future.
+
 This module enables hosting clan-internal services easily, which can be resolved
 inside your VPN. This allows defining a custom top-level domain (e.g. `.clan`)
 and exposing endpoints from a machine to others, which will be
--- a/clanServices/hello-world/README.md
+++ b/clanServices/hello-world/README.md
@@ -1 +1,83 @@
-This a test README just to appease the eval warnings if we don't have one
+!!! Danger "Experimental"
+    This service is for demonstration purpose only and may change in the future.
+
+The Hello-World Clan Service is a minimal example showing how to build and register your own service.
+
+It serves as a reference implementation and is used in clan-core CI tests to ensure compatibility.
+
+## What it demonstrates
+
+- How to define a basic Clan-compatible service.
+- How to structure your service for discovery and configuration.
+- How Clan services interact with nixos.
+
+## Testing
+
+This service demonstrates two levels of testing to ensure quality and stability across releases:
+
+1. **Unit & Integration Testing** — via [`nix-unit`](https://github.com/nix-community/nix-unit)
+2. **End-to-End Testing** — via **NixOS VM tests**, which we extended to support **container virtualization** for better performance.
+
+We highly advocate following the [Practical Testing Pyramid](https://martinfowler.com/articles/practical-test-pyramid.html):
+
+* Write **unit tests** for core logic and invariants.
+* Add **one or two end-to-end (E2E)** tests to confirm your service starts and behaves correctly in a real NixOS environment.
+
+NixOS is **untyped** and frequently changes; tests are the safest way to ensure long-term stability of services.
+
+```
+               / \
+              /   \
+             / E2E \
+            /-------\
+           /         \
+          /Integration\
+         /-------------\
+        /               \
+       /    Unit Tests   \
+       -------------------
+```
+
+### nix-unit
+
+We highly advocate the usage of
+
+[nix-unit](https://github.com/nix-community/nix-unit)
+
+Example in: tests/eval-tests.nix
+
+If you use flake-parts you can use the [native integration](https://flake.parts/options/nix-unit.html)
+
+If nix-unit succeeds you'r nixos evaluation should be mostly correct.
+
+!!! Tip
+    - Ensure most used 'settings' and variants are tested.
+    - Think about some important edge-cases your system should handle.
+
+### NixOS VM / Container Test
+
+!!! Warning "Early Vars & clanTest"
+    The testing system around vars is experimental
+
+    `clanTest` is still experimental and enables container virtualization by default.
+    This is still early and might have some limitations.
+
+Some minimal boilerplate is needed to use `clanTest`
+
+```nix
+nixosLib = import (inputs.nixpkgs + "/nixos/lib") { }
+nixosLib.runTest (
+    { ... }:
+    {
+        imports = [
+            self.modules.nixosTest.clanTest
+            # Example in tests/vm/default.nix
+            testModule
+        ];
+        hostPkgs = pkgs;
+
+        # Uncomment if you don't want or cannot use containers
+        # test.useContainers = false;
+    }
+)
+```
--- a/clanServices/hello-world/default.nix
+++ b/clanServices/hello-world/default.nix
@@ -8,7 +8,7 @@
 {
  _class = "clan.service";
  manifest.name = "clan-core/hello-word";
-  manifest.description = "This is a test";
+  manifest.description = "Minimal example clan service that greets the world";
  manifest.readme = builtins.readFile ./README.md;

  # This service provides two roles: "morning" and "evening". Roles can be
--- a/clanServices/hello-world/flake-module.nix
+++ b/clanServices/hello-world/flake-module.nix
@@ -26,7 +26,7 @@ in
            # The hello-world service being tested
            ../../clanServices/hello-world
            # Required modules
-            ../../nixosModules/clanCore
+            ../../nixosModules
          ];
          testName = "hello-world";
          tests = ./tests/eval-tests.nix;
--- a/clanServices/hello-world/tests/eval-tests.nix
+++ b/clanServices/hello-world/tests/eval-tests.nix
@@ -4,7 +4,7 @@
  ...
 }:
 let
-  testFlake = clanLib.clan {
+  testClan = clanLib.clan {
    self = { };
    # Point to the folder of the module
    # TODO: make this optional
@@ -33,10 +33,20 @@ let
  };
 in
 {
-  test_simple = {
-    config = testFlake.config;
+  /**
+    We highly advocate the usage of:
+    https://github.com/nix-community/nix-unit

-    expr = { };
-    expected = { };
+    If you use flake-parts you can use the native integration: https://flake.parts/options/nix-unit.html
+  */
+  test_simple = {
+    # Allows inspection via the nix-repl
+    # Ignored by nix-unit; it only looks at 'expr' and 'expected'
+    inherit testClan;
+
+    # Assert that jon has the
+    # configured greeting in 'environment.etc.hello.text'
+    expr = testClan.config.nixosConfigurations.jon.config.environment.etc."hello".text;
+    expected = "Good evening World!";
  };
 }
--- a/clanServices/internet/README.md
+++ b/clanServices/internet/README.md
@@ -1,8 +1,5 @@
-🚧🚧🚧 Experimental 🚧🚧🚧
-
-Use at your own risk.
-
-We are still refining its interfaces, instability and breakages are expected.
+!!! Danger "Experimental"
+    This service is experimental and will change in the future.

 ---

--- a/clanServices/monitoring/README.md
+++ b/clanServices/monitoring/README.md
@@ -1,3 +1,6 @@
+!!! Danger "Experimental"
+    This service is experimental and will change in the future.
+
 ## Usage

 ```
--- a/clanServices/syncthing/flake-module.nix
+++ b/clanServices/syncthing/flake-module.nix
@@ -22,6 +22,7 @@ in
            ../../clanServices/syncthing
            # Required modules
            ../../nixosModules/clanCore
+            ../../nixosModules/machineModules
            # Dependencies like clan-cli
            ../../pkgs/clan-cli
          ];
--- a/clanServices/tor/README.md
+++ b/clanServices/tor/README.md
@@ -1,8 +1,5 @@
-🚧🚧🚧 Experimental 🚧🚧🚧
-
-Use at your own risk.
-
-We are still refining its interfaces, instability and breakages are expected.
+!!! Danger "Experimental"
+    This service is experimental and will change in the future.

 ---

--- a/clanServices/wifi/tests/eval-tests.nix
+++ b/clanServices/wifi/tests/eval-tests.nix
@@ -41,14 +41,14 @@ let
  # In this case it is 'self-zerotier-redux'
  # This is usually only used internally, but we can use it to test the evaluation of service module in isolation
  # evaluatedService =
-  #   testFlake.clanInternals.inventoryClass.distributedServices.importedModulesEvaluated.self-zerotier-redux.config;
+  #   testFlake.clanInternals.inventoryClass.distributedServices.servicesEval.config.mappedServices.self-zerotier-redux.config;
 in
 {
  test_simple = {
    inherit testFlake;

    expr =
-      testFlake.config.clan.clanInternals.inventoryClass.distributedServices.importedModulesEvaluated.self-wifi.config;
+      testFlake.config.clan.clanInternals.inventoryClass.distributedServices.servicesEval.config.mappedServices.self-wifi.config;
    expected = 1;

    # expr = {
--- a/clanServices/yggdrasil/README.md
+++ b/clanServices/yggdrasil/README.md
@@ -1,8 +1,5 @@
-🚧🚧🚧 Experimental 🚧🚧🚧
-
-Use at your own risk.
-
-We are still refining its interfaces, instability and breakages are expected.
+!!! Danger "Experimental"
+    This service is experimental and will change in the future.

 ---

--- a/clanServices/zerotier/flake-module.nix
+++ b/clanServices/zerotier/flake-module.nix
@@ -21,6 +21,7 @@ in
            ../../clanServices/zerotier
            # Required modules
            ../../nixosModules/clanCore
+            ../../nixosModules/machineModules
            # Dependencies like clan-cli
            ../../pkgs/clan-cli
          ];
--- a/devFlake/flake.lock
+++ b/devFlake/flake.lock
@@ -105,11 +105,11 @@
    },
    "nixpkgs-dev": {
      "locked": {
-        "lastModified": 1761458099,
-        "narHash": "sha256-XeAdn1NidGKXSwlepyjH+n58hsCDqbpx1M8sdDM2Ggc=",
+        "lastModified": 1762168314,
+        "narHash": "sha256-+DX6mIF47gRGoK0mqkTg1Jmcjcup0CAXJFHVkdUx8YA=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "d8cc1036c65d3c9468a91443a75b51276279ac61",
+        "rev": "94fc102d2c15d9c1a861e59de550807c65358e1b",
        "type": "github"
      },
      "original": {
@@ -128,11 +128,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1760652422,
-        "narHash": "sha256-C88Pgz38QIl9JxQceexqL2G7sw9vodHWx1Uaq+NRJrw=",
+        "lastModified": 1761730856,
+        "narHash": "sha256-t1i5p/vSWwueZSC0Z2BImxx3BjoUDNKyC2mk24krcMY=",
        "owner": "NuschtOS",
        "repo": "search",
-        "rev": "3ebeebe8b6a49dfb11f771f761e0310f7c48d726",
+        "rev": "e29de6db0cb3182e9aee75a3b1fd1919d995d85b",
        "type": "github"
      },
      "original": {
--- a/docs/site/getting-started/creating-your-first-clan.md
+++ b/docs/site/getting-started/creating-your-first-clan.md
@@ -51,7 +51,7 @@ Make sure you have the following:
    **Note:** This creates a new directory in your current location

    ```shellSession
-    nix run https://git.clan.lol/clan/clan-core/archive/main.tar.gz#clan-cli --refresh -- flakes create
+    nix run "https://git.clan.lol/clan/clan-core/archive/main.tar.gz#clan-cli" --refresh -- flakes create
    ```

 3. Enter a **name** in the prompt:
--- a/docs/site/guides/contributing/testing.md
+++ b/docs/site/guides/contributing/testing.md
@@ -150,10 +150,61 @@ Those are very similar to NixOS VM tests, as in they run virtualized nixos machi
 As of now the container test driver is a downstream development in clan-core.
 Basically everything stated under the NixOS VM tests sections applies here, except some limitations.

-Limitations:
+### Using Container Tests vs VM Tests

- Cannot run in interactive mode, however while the container test runs, it logs a nsenter command that can be used to log into each of the container.
- setuid binaries don't work
+Container tests are **enabled by default** for all tests using the clan testing framework.
+They offer significant performance advantages over VM tests:
+
+- **Faster startup**
+- **Lower resource usage**: No full kernel boot or hardware emulation overhead
+
+To control whether a test uses containers or VMs, use the `clan.test.useContainers` option:
+
+```nix
+{
+  clan = {
+    directory = ./.;
+    test.useContainers = true;  # Use containers (default)
+    # test.useContainers = false;  # Use VMs instead
+  };
+}
+```
+
+**When to use VM tests instead of container tests:**
+
+- Testing kernel features, modules, or boot processes
+- Testing hardware-specific features
+- When you need full system isolation
+
+### System Requirements for Container Tests
+
+Container tests require the **`uid-range`** system feature** in the Nix sandbox.
+This feature allows Nix to allocate a range of UIDs for containers to use, enabling `systemd-nspawn` containers to run properly inside the Nix build sandbox.
+
+**Configuration:**
+
+The `uid-range` feature requires the `auto-allocate-uids` setting to be enabled in your Nix configuration.
+
+To verify or enable it, add to your `/etc/nix/nix.conf` or NixOS configuration:
+
+```nix
+settings.experimental-features = [
+    "auto-allocate-uids"
+];
+
+nix.settings.auto-allocate-uids = true;
+nix.settings.system-features = [ "uid-range" ];
+```
+
+**Technical details:**
+
+- Container tests set `requiredSystemFeatures = [ "uid-range" ];` in their derivation (see `lib/test/container-test-driver/driver-module.nix:98`)
+- Without this feature, containers cannot properly manage user namespaces and will fail to start
+
+### Limitations
+
+- Cannot run in interactive mode, however while the container test runs, it logs a nsenter command that can be used to log into each of the containers.
+- Early implementation and limited by features.

 ### Where to find examples for NixOS container tests

--- a/flake.lock
+++ b/flake.lock
@@ -31,11 +31,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1760701190,
-        "narHash": "sha256-y7UhnWlER8r776JsySqsbTUh2Txf7K30smfHlqdaIQw=",
+        "lastModified": 1761899396,
+        "narHash": "sha256-XOpKBp6HLzzMCbzW50TEuXN35zN5WGQREC7n34DcNMM=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "3a9450b26e69dcb6f8de6e2b07b3fc1c288d85f5",
+        "rev": "6f4cf5abbe318e4cd1e879506f6eeafd83f7b998",
        "type": "github"
      },
      "original": {
@@ -51,11 +51,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1760948891,
-        "narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=",
+        "lastModified": 1762040540,
+        "narHash": "sha256-z5PlZ47j50VNF3R+IMS9LmzI5fYRGY/Z5O5tol1c9I4=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04",
+        "rev": "0010412d62a25d959151790968765a70c436598b",
        "type": "github"
      },
      "original": {
@@ -71,11 +71,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1760721282,
-        "narHash": "sha256-aAHphQbU9t/b2RRy2Eb8oMv+I08isXv2KUGFAFn7nCo=",
+        "lastModified": 1762039661,
+        "narHash": "sha256-oM5BwAGE78IBLZn+AqxwH/saqwq3e926rNq5HmOulkc=",
        "owner": "nix-darwin",
        "repo": "nix-darwin",
-        "rev": "c3211fcd0c56c11ff110d346d4487b18f7365168",
+        "rev": "c3c8c9f2a5ed43175ac4dc030308756620e6e4e4",
        "type": "github"
      },
      "original": {
@@ -115,10 +115,10 @@
    "nixpkgs": {
      "locked": {
        "lastModified": 315532800,
-        "narHash": "sha256-yDxtm0PESdgNetiJN5+MFxgubBcLDTiuSjjrJiyvsvM=",
-        "rev": "d7f52a7a640bc54c7bb414cca603835bf8dd4b10",
+        "narHash": "sha256-LDT9wuUZtjPfmviCcVWif5+7j4kBI2mWaZwjNNeg4eg=",
+        "rev": "a7fc11be66bdfb5cdde611ee5ce381c183da8386",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-25.11pre871443.d7f52a7a640b/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-25.11pre887438.a7fc11be66bd/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
--- a/flakeModules/clan.nix
+++ b/flakeModules/clan.nix
@@ -39,32 +39,10 @@ in
          };
          modules = [
            clan-core.modules.clan.default
-            {
-              checks.minNixpkgsVersion = {
-                assertion = lib.versionAtLeast nixpkgs.lib.version "25.11";
-                message = ''
-                  Nixpkgs version: ${nixpkgs.lib.version} is incompatible with clan-core. (>= 25.11 is recommended)
-                  ---
-                  Your version of 'nixpkgs' seems too old for clan-core.
-                  Please read: https://docs.clan.lol/guides/nixpkgs-flake-input
-
-                  You can ignore this check by setting:
-                  clan.checks.minNixpkgsVersion.ignore = true;
-                  ---
-                '';
-              };
-            }
          ];
        };
-        apply =
-          config:
-          lib.deepSeq (lib.mapAttrs (
-            id: check:
-            if check.ignore || check.assertion then
-              null
-            else
-              throw "clan.checks.${id} failed with message\n${check.message}"
-          ) config.checks) config;
+        # Important: !This logic needs to be kept in sync with lib.clan function!
+        apply = config: clan-core.lib.checkConfig config.checks config;
      };

    # Mapped flake toplevel outputs
--- a/lib/clan/checkConfig.nix
+++ b/lib/clan/checkConfig.nix
@@ -0,0 +1,19 @@
+{ lib, ... }:
+/**
+  Function to assert clan configuration checks.
+
+  Arguments:
+
+  - 'checks' attribute of clan configuration
+  - Any: the returned configuration (can be anything, is just passed through)
+*/
+checks:
+lib.deepSeq (
+  lib.mapAttrs (
+    id: check:
+    if check.ignore || check.assertion then
+      null
+    else
+      throw "clan.checks.${id} failed with message\n${check.message}"
+  ) checks
+)
--- a/lib/clan/default.nix
+++ b/lib/clan/default.nix
@@ -33,20 +33,23 @@
 let
  nixpkgs = self.inputs.nixpkgs or clan-core.inputs.nixpkgs;
  nix-darwin = self.inputs.nix-darwin or clan-core.inputs.nix-darwin;
+  configuration = (
+    lib.evalModules {
+      class = "clan";
+      specialArgs = {
+        inherit
+          self
+          ;
+        inherit
+          nixpkgs
+          nix-darwin
+          ;
+      };
+      modules = [
+        clan-core.modules.clan.default
+        m
+      ];
+    }
+  );
 in
-lib.evalModules {
-  class = "clan";
-  specialArgs = {
-    inherit
-      self
-      ;
-    inherit
-      nixpkgs
-      nix-darwin
-      ;
-  };
-  modules = [
-    clan-core.modules.clan.default
-    m
-  ];
-}
+clan-core.clanLib.checkConfig configuration.config.checks configuration
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -16,6 +16,8 @@ lib.fix (
      */
      callLib = file: args: import file ({ inherit lib clanLib; } // args);

+      checkConfig = clanLib.callLib ./clan/checkConfig.nix { };
+
      evalService = clanLib.callLib ./evalService.nix { };
      # ------------------------------------
      # ClanLib functions
--- a/lib/dir_test.nix
+++ b/lib/dir_test.nix
@@ -53,7 +53,12 @@ in
            };
          };
        }).clan
-          { config.directory = rootPath; };
+          {
+            directory = rootPath;
+            self = {
+              inputs.nixpkgs.lib.version = "25.11";
+            };
+          };
    in
    {
      inherit vclan;
@@ -94,7 +99,12 @@ in
            };
          };
        }).clan
-          { config.directory = rootPath; };
+          {
+            directory = rootPath;
+            self = {
+              inputs.nixpkgs.lib.version = "25.11";
+            };
+          };
    in
    {
      inherit vclan;
--- a/lib/inventory/default.nix
+++ b/lib/inventory/default.nix
@@ -2,11 +2,7 @@
  lib,
  clanLib,
 }:
-let
-  services = clanLib.callLib ./distributed-service/inventory-adapter.nix { };
-in
 {
-  inherit (services) mapInstances;
  inventoryModule = {
    _file = "clanLib.inventory.module";
    imports = [
--- a/lib/inventory/distributed-service/all-services-wrapper.nix
+++ b/lib/inventory/distributed-service/all-services-wrapper.nix
@@ -28,19 +28,15 @@ in
        elemType = submoduleWith {
          class = "clan.service";
          specialArgs = {
-            exports = config.exports;
            directory = directory;
            clanLib = specialArgs.clanLib;
+            exports = config.exports;
          };
          modules = [
            (
              { name, ... }:
              {
                _module.args._ctx = [ name ];
-                _module.args.clanLib = specialArgs.clanLib;
-                _module.args.exports = config.exports;
-                _module.args.directory = directory;
-
              }
            )
            ./service-module.nix
--- a/lib/inventory/distributed-service/flake-module.nix
+++ b/lib/inventory/distributed-service/flake-module.nix
@@ -21,6 +21,7 @@ in
          ../../../flakeModules
          ../../../lib
          ../../../nixosModules/clanCore
+          ../../../nixosModules/machineModules
          ../../../machines
          ../../../inventory.json
          ../../../modules
--- a/lib/inventory/distributed-service/inventory-adapter.nix
+++ b/lib/inventory/distributed-service/inventory-adapter.nix
@@ -1,171 +0,0 @@
-# Adapter function between the inventory.instances and the clan.service module
-#
-# Data flow:
-# - inventory.instances -> Adapter -> clan.service module -> Service Resources (i.e. NixosModules per Machine, Vars per Service, etc.)
-#
-# What this file does:
-#
-# - Resolves the [Module] to an actual module-path and imports it.
-# - Groups together all the same modules into a single import and creates all instances for it.
-# - Resolves the inventory tags into machines. Tags don't exist at the service level.
-#   Also combines the settings for 'machines' and 'tags'.
-{
-  lib,
-  clanLib,
-  ...
-}:
-{
-  mapInstances =
-    {
-      # This is used to resolve the module imports from 'flake.inputs'
-      flakeInputs,
-      # The clan inventory
-      inventory,
-      directory,
-      clanCoreModules,
-      prefix ? [ ],
-      exportsModule,
-    }:
-    let
-      # machineHasTag = machineName: tagName: lib.elem tagName inventory.machines.${machineName}.tags;
-
-      # map the instances into the module
-      importedModuleWithInstances = lib.mapAttrs (
-        instanceName: instance:
-        let
-          resolvedModule = clanLib.resolveModule {
-            moduleSpec = instance.module;
-            inherit flakeInputs clanCoreModules;
-          };
-
-          # Every instance includes machines via roles
-          # :: { client :: ... }
-          instanceRoles = lib.mapAttrs (
-            roleName: role:
-            let
-              resolvedMachines = clanLib.inventory.resolveTags {
-                members = {
-                  # Explicit members
-                  machines = lib.attrNames role.machines;
-                  # Resolved Members
-                  tags = lib.attrNames role.tags;
-                };
-                inherit (inventory) machines;
-                inherit instanceName roleName;
-              };
-            in
-            # instances.<instanceName>.roles.<roleName> =
-            # Remove "tags", they are resolved into "machines"
-            (removeAttrs role [ "tags" ])
-            // {
-              machines = lib.genAttrs resolvedMachines.machines (
-                machineName:
-                let
-                  machineSettings = instance.roles.${roleName}.machines.${machineName}.settings or { };
-                in
-                # TODO: tag settings
-                # Wait for this feature until option introspection for 'settings' is done.
-                # This might get too complex to handle otherwise.
-                # settingsViaTags = lib.filterAttrs (
-                #   tagName: _: machineHasTag machineName tagName
-                # ) instance.roles.${roleName}.tags;
-                {
-                  # TODO: Do we want to wrap settings with
-                  # setDefaultModuleLocation "inventory.instances.${instanceName}.roles.${roleName}.tags.${tagName}";
-                  settings = {
-                    imports = [
-                      machineSettings
-                    ]; # ++ lib.attrValues (lib.mapAttrs (_tagName: v: v.settings) settingsViaTags);
-                  };
-                }
-              );
-            }
-          ) instance.roles;
-        in
-        {
-          inherit (instance) module;
-          inherit resolvedModule instanceRoles;
-        }
-      ) inventory.instances or { };
-
-      # Group the instances by the module they resolve to
-      # This is necessary to evaluate the module in a single pass
-      # :: { <module.input>_<module.name> :: [ { name, value } ] }
-      # Since 'perMachine' needs access to all the instances we should include them as a whole
-      grouped = lib.foldlAttrs (
-        acc: instanceName: instance:
-        let
-          inputName = if instance.module.input == null then "<clan-core>" else instance.module.input;
-          id = inputName + "-" + instance.module.name;
-        in
-        acc
-        // {
-          ${id} = acc.${id} or [ ] ++ [
-            {
-              inherit instanceName instance;
-            }
-          ];
-        }
-      ) { } importedModuleWithInstances;
-
-      # servicesEval.config.mappedServices.self-A.result.final.jon.nixosModule
-      allMachines = lib.mapAttrs (machineName: _: {
-        # This is the list of nixosModules for each machine
-        machineImports = lib.foldlAttrs (
-          acc: _module_ident: serviceModule:
-          acc ++ [ serviceModule.result.final.${machineName}.nixosModule or { } ]
-        ) [ ] servicesEval.config.mappedServices;
-      }) inventory.machines or { };
-
-      evalServices =
-        { modules, prefix }:
-        lib.evalModules {
-          class = "clan";
-          specialArgs = {
-            inherit clanLib;
-            _ctx = prefix;
-          };
-          modules = [
-            (import ./all-services-wrapper.nix { inherit directory; })
-          ]
-          ++ modules;
-        };
-
-      servicesEval = evalServices {
-        inherit prefix;
-        modules = [
-          {
-            inherit exportsModule;
-            mappedServices = lib.mapAttrs (_module_ident: instances: {
-              imports = [
-                # Import the resolved module.
-                # i.e. clan.modules.admin
-                {
-                  options.module = lib.mkOption {
-                    type = lib.types.raw;
-                    default = (builtins.head instances).instance.module;
-                  };
-                }
-                (builtins.head instances).instance.resolvedModule
-              ] # Include all the instances that correlate to the resolved module
-              ++ (builtins.map (v: {
-                instances.${v.instanceName}.roles = v.instance.instanceRoles;
-              }) instances);
-            }) grouped;
-          }
-        ];
-      };
-      importedModulesEvaluated = servicesEval.config.mappedServices;
-
-    in
-    {
-      inherit
-        servicesEval
-        importedModuleWithInstances
-        # Exposed for testing
-        grouped
-        allMachines
-        importedModulesEvaluated
-        ;
-    };
-}
--- a/lib/inventory/distributed-service/service-module.nix
+++ b/lib/inventory/distributed-service/service-module.nix
@@ -81,6 +81,7 @@ let
  applySettings =
    instanceName: instance:
    lib.mapAttrs (roleName: role: {
+      settings = config.instances.${instanceName}.roles.${roleName}.finalSettings.config;
      machines = lib.mapAttrs (machineName: _v: {
        settings =
          config.instances.${instanceName}.roles.${roleName}.machines.${machineName}.finalSettings.config;
@@ -158,6 +159,29 @@ in
                        (
                          { name, ... }@role:
                          {
+                            options.finalSettings = mkOption {
+                              default = evalMachineSettings instance.name role.name null role.config.settings { };
+                              type = types.raw;
+                              description = ''
+                                Final evaluated settings of the curent-machine
+
+                                This contains the merged and evaluated settings of the role interface,
+                                the role settings and the machine settings.
+
+                                Type: 'configuration' as returned by 'lib.evalModules'
+                              '';
+                              apply = lib.warn ''
+                                === WANRING ===
+                                'roles.<roleName>.settings' do not contain machine specific settings.
+
+                                Prefer `machines.<machineName>.settings` instead. (i.e `perInstance: roles.<roleName>.machines.<machineName>.settings`)
+
+                                If you have a use-case that requires access to the original role settings without machine overrides.
+                                Contact us via matrix (https://matrix.to/#/#clan:clan.lol) or file an issue: https://git.clan.lol
+
+                                This feature will be removed in the next release
+                              '';
+                            };
                            # instances.{instanceName}.roles.{roleName}.machines
                            options.machines = mkOption {
                              description = ''
@@ -859,7 +883,11 @@ in
                  instanceRes.nixosModule
                ]
                ++ (map (
-                  s: if builtins.typeOf s == "string" then "${directory}/${s}" else s
+                  s:
+                  if builtins.typeOf s == "string" then
+                    lib.warn "String types for 'extraModules' will be deprecated - ${s}" "${directory}/${s}"
+                  else
+                    lib.setDefaultModuleLocation "via inventory.instances.${instanceName}.roles.${roleName}" s
                ) instanceCfg.roles.${roleName}.extraModules);
              };
            }
--- a/lib/inventory/distributed-service/tests/default.nix
+++ b/lib/inventory/distributed-service/tests/default.nix
@@ -4,63 +4,53 @@
  ...
 }:
 let
-  inherit (lib)
-    evalModules
-    ;

-  evalInventory =
-    m:
-    (evalModules {
-      # Static modules
-      modules = [
-        clanLib.inventory.inventoryModule
-        {
-          _file = "test file";
-          tags.all = [ ];
-          tags.nixos = [ ];
-          tags.darwin = [ ];
-        }
-        {
-          modules.test = { };
-        }
-        m
-      ];
-    }).config;
-
-  callInventoryAdapter =
-    inventoryModule:
-    let
-      inventory = evalInventory inventoryModule;
-      flakeInputsFixture = {
-        self.clan.modules = inventoryModule.modules or { };
-        # Example upstream module
-        upstream.clan.modules = {
-          uzzi = {
-            _class = "clan.service";
-            manifest = {
-              name = "uzzi-from-upstream";
-            };
-          };
+  flakeInputsFixture = {
+    upstream.clan.modules = {
+      uzzi = {
+        _class = "clan.service";
+        manifest = {
+          name = "uzzi-from-upstream";
        };
      };
-    in
-    clanLib.inventory.mapInstances {
-      directory = ./.;
-      clanCoreModules = { };
-      flakeInputs = flakeInputsFixture;
-      inherit inventory;
-      exportsModule = { };
    };
+  };
+
+  createTestClan =
+    testClan:
+    let
+      res = clanLib.clan ({
+        # Static / mocked
+        specialArgs = {
+          clan-core = {
+            clan.modules = { };
+          };
+        };
+        self.inputs = flakeInputsFixture // {
+          self.clan = res.config;
+        };
+        directory = ./.;
+        exportsModule = { };
+
+        imports = [
+          testClan
+        ];
+      });
+    in
+    res;
+
 in
 {
  extraModules = import ./extraModules.nix { inherit clanLib; };
  exports = import ./exports.nix { inherit lib clanLib; };
-  settings = import ./settings.nix { inherit lib callInventoryAdapter; };
-  specialArgs = import ./specialArgs.nix { inherit lib callInventoryAdapter; };
-  resolve_module_spec = import ./import_module_spec.nix { inherit lib callInventoryAdapter; };
+  settings = import ./settings.nix { inherit lib createTestClan; };
+  specialArgs = import ./specialArgs.nix { inherit lib createTestClan; };
+  resolve_module_spec = import ./import_module_spec.nix {
+    inherit lib createTestClan;
+  };
  test_simple =
    let
-      res = callInventoryAdapter {
+      res = createTestClan {
        # Authored module
        # A minimal module looks like this
        # It isn't exactly doing anything but it's a valid module that produces an output
@@ -71,7 +61,7 @@ in
          };
        };
        # User config
-        instances."instance_foo" = {
+        inventory.instances."instance_foo" = {
          module = {
            name = "simple-module";
          };
@@ -81,7 +71,7 @@ in
    {
      # Test that the module is mapped into the output
      # We might change the attribute name in the future
-      expr = res.importedModulesEvaluated ? "<clan-core>-simple-module";
+      expr = res.config._services.mappedServices ? "<clan-core>-simple-module";
      expected = true;
      inherit res;
    };
@@ -92,7 +82,7 @@ in
  # All instances should be included within one evaluation to make all of them available
  test_module_grouping =
    let
-      res = callInventoryAdapter {
+      res = createTestClan {
        # Authored module
        # A minimal module looks like this
        # It isn't exactly doing anything but it's a valid module that produces an output
@@ -112,18 +102,19 @@ in

          perMachine = { }: { };
        };
+
        # User config
-        instances."instance_foo" = {
+        inventory.instances."instance_foo" = {
          module = {
            name = "A";
          };
        };
-        instances."instance_bar" = {
+        inventory.instances."instance_bar" = {
          module = {
            name = "B";
          };
        };
-        instances."instance_baz" = {
+        inventory.instances."instance_baz" = {
          module = {
            name = "A";
          };
@@ -133,16 +124,16 @@ in
    {
      # Test that the module is mapped into the output
      # We might change the attribute name in the future
-      expr = lib.mapAttrs (_n: v: builtins.length v) res.grouped;
-      expected = {
-        "<clan-core>-A" = 2;
-        "<clan-core>-B" = 1;
-      };
+      expr = lib.attrNames res.config._services.mappedServices;
+      expected = [
+        "<clan-core>-A"
+        "<clan-core>-B"
+      ];
    };

  test_creates_all_instances =
    let
-      res = callInventoryAdapter {
+      res = createTestClan {
        # Authored module
        # A minimal module looks like this
        # It isn't exactly doing anything but it's a valid module that produces an output
@@ -154,22 +145,24 @@ in

          perMachine = { }: { };
        };
-        instances."instance_foo" = {
-          module = {
-            name = "A";
-            input = "self";
+        inventory = {
+          instances."instance_foo" = {
+            module = {
+              name = "A";
+              input = "self";
+            };
          };
-        };
-        instances."instance_bar" = {
-          module = {
-            name = "A";
-            input = "self";
+          instances."instance_bar" = {
+            module = {
+              name = "A";
+              input = "self";
+            };
          };
-        };
-        instances."instance_zaza" = {
-          module = {
-            name = "B";
-            input = null;
+          instances."instance_zaza" = {
+            module = {
+              name = "B";
+              input = null;
+            };
          };
        };
      };
@@ -177,7 +170,7 @@ in
    {
      # Test that the module is mapped into the output
      # We might change the attribute name in the future
-      expr = lib.attrNames res.importedModulesEvaluated.self-A.instances;
+      expr = lib.attrNames res.config._services.mappedServices.self-A.instances;
      expected = [
        "instance_bar"
        "instance_foo"
@@ -187,7 +180,7 @@ in
  # Membership via roles
  test_add_machines_directly =
    let
-      res = callInventoryAdapter {
+      res = createTestClan {
        # Authored module
        # A minimal module looks like this
        # It isn't exactly doing anything but it's a valid module that produces an output
@@ -202,38 +195,40 @@ in

          # perMachine = {}: {};
        };
-        machines = {
-          jon = { };
-          sara = { };
-          hxi = { };
-        };
-        instances."instance_foo" = {
-          module = {
-            name = "A";
-            input = "self";
+        inventory = {
+          machines = {
+            jon = { };
+            sara = { };
+            hxi = { };
          };
-          roles.peer.machines.jon = { };
-        };
-        instances."instance_bar" = {
-          module = {
-            name = "A";
-            input = "self";
+          instances."instance_foo" = {
+            module = {
+              name = "A";
+              input = "self";
+            };
+            roles.peer.machines.jon = { };
          };
-          roles.peer.machines.sara = { };
-        };
-        instances."instance_zaza" = {
-          module = {
-            name = "B";
-            input = null;
+          instances."instance_bar" = {
+            module = {
+              name = "A";
+              input = "self";
+            };
+            roles.peer.machines.sara = { };
+          };
+          instances."instance_zaza" = {
+            module = {
+              name = "B";
+              input = null;
+            };
+            roles.peer.tags.all = { };
          };
-          roles.peer.tags.all = { };
        };
      };
    in
    {
      # Test that the module is mapped into the output
      # We might change the attribute name in the future
-      expr = lib.attrNames res.importedModulesEvaluated.self-A.result.allMachines;
+      expr = lib.attrNames res.config._services.mappedServices.self-A.result.allMachines;
      expected = [
        "jon"
        "sara"
@@ -243,7 +238,7 @@ in
  # Membership via tags
  test_add_machines_via_tags =
    let
-      res = callInventoryAdapter {
+      res = createTestClan {
        # Authored module
        # A minimal module looks like this
        # It isn't exactly doing anything but it's a valid module that produces an output
@@ -257,35 +252,37 @@ in

          # perMachine = {}: {};
        };
-        machines = {
-          jon = {
-            tags = [ "foo" ];
+        inventory = {
+          machines = {
+            jon = {
+              tags = [ "foo" ];
+            };
+            sara = {
+              tags = [ "foo" ];
+            };
+            hxi = { };
          };
-          sara = {
-            tags = [ "foo" ];
+          instances."instance_foo" = {
+            module = {
+              name = "A";
+              input = "self";
+            };
+            roles.peer.tags.foo = { };
          };
-          hxi = { };
-        };
-        instances."instance_foo" = {
-          module = {
-            name = "A";
-            input = "self";
+          instances."instance_zaza" = {
+            module = {
+              name = "B";
+              input = null;
+            };
+            roles.peer.tags.all = { };
          };
-          roles.peer.tags.foo = { };
-        };
-        instances."instance_zaza" = {
-          module = {
-            name = "B";
-            input = null;
-          };
-          roles.peer.tags.all = { };
        };
      };
    in
    {
      # Test that the module is mapped into the output
      # We might change the attribute name in the future
-      expr = lib.attrNames res.importedModulesEvaluated.self-A.result.allMachines;
+      expr = lib.attrNames res.config._services.mappedServices.self-A.result.allMachines;
      expected = [
        "jon"
        "sara"
@@ -293,6 +290,9 @@ in
    };

  machine_imports = import ./machine_imports.nix { inherit lib clanLib; };
-  per_machine_args = import ./per_machine_args.nix { inherit lib callInventoryAdapter; };
-  per_instance_args = import ./per_instance_args.nix { inherit lib callInventoryAdapter; };
+  per_machine_args = import ./per_machine_args.nix { inherit lib createTestClan; };
+  per_instance_args = import ./per_instance_args.nix {
+    inherit lib;
+    callInventoryAdapter = createTestClan;
+  };
 }
--- a/lib/inventory/distributed-service/tests/import_module_spec.nix
+++ b/lib/inventory/distributed-service/tests/import_module_spec.nix
@@ -1,4 +1,4 @@
-{ callInventoryAdapter, ... }:
+{ createTestClan, ... }:
 let
  # Authored module
  # A minimal module looks like this
@@ -23,10 +23,13 @@ let

  resolve =
    spec:
-    callInventoryAdapter {
-      inherit modules machines;
-      instances."instance_foo" = {
-        module = spec;
+    createTestClan {
+      inherit modules;
+      inventory = {
+        inherit machines;
+        instances."instance_foo" = {
+          module = spec;
+        };
      };
    };
 in
@@ -36,25 +39,16 @@ in
      (resolve {
        name = "A";
        input = "self";
-      }).importedModuleWithInstances.instance_foo.resolvedModule;
-    expected = {
-      _class = "clan.service";
-      manifest = {
-        name = "network";
-      };
-    };
+      }).config._services.mappedServices.self-A.manifest.name;
+    expected = "network";
  };
  test_import_remote_module_by_name = {
    expr =
      (resolve {
        name = "uzzi";
        input = "upstream";
-      }).importedModuleWithInstances.instance_foo.resolvedModule;
-    expected = {
-      _class = "clan.service";
-      manifest = {
-        name = "uzzi-from-upstream";
-      };
-    };
+      }).config._services.mappedServices.upstream-uzzi.manifest.name;
+    expected = "uzzi-from-upstream";
+
  };
 }
--- a/lib/inventory/distributed-service/tests/per_instance_args.nix
+++ b/lib/inventory/distributed-service/tests/per_instance_args.nix
@@ -58,39 +58,43 @@ let
    sara = { };
  };
  res = callInventoryAdapter {
-    inherit modules machines;
-    instances."instance_foo" = {
-      module = {
-        name = "A";
-        input = "self";
+    inherit modules;
+
+    inventory = {
+      inherit machines;
+      instances."instance_foo" = {
+        module = {
+          name = "A";
+          input = "self";
+        };
+        roles.peer.machines.jon = {
+          settings.timeout = lib.mkForce "foo-peer-jon";
+        };
+        roles.peer = {
+          settings.timeout = "foo-peer";
+        };
+        roles.controller.machines.jon = { };
      };
-      roles.peer.machines.jon = {
-        settings.timeout = lib.mkForce "foo-peer-jon";
+      instances."instance_bar" = {
+        module = {
+          name = "A";
+          input = "self";
+        };
+        roles.peer.machines.jon = {
+          settings.timeout = "bar-peer-jon";
+        };
      };
-      roles.peer = {
-        settings.timeout = "foo-peer";
+      # TODO: move this into a seperate test.
+      # Seperate out the check that this module is never imported
+      # import the module "B" (undefined)
+      # All machines have this instance
+      instances."instance_zaza" = {
+        module = {
+          name = "B";
+          input = null;
+        };
+        roles.peer.tags.all = { };
      };
-      roles.controller.machines.jon = { };
-    };
-    instances."instance_bar" = {
-      module = {
-        name = "A";
-        input = "self";
-      };
-      roles.peer.machines.jon = {
-        settings.timeout = "bar-peer-jon";
-      };
-    };
-    # TODO: move this into a seperate test.
-    # Seperate out the check that this module is never imported
-    # import the module "B" (undefined)
-    # All machines have this instance
-    instances."instance_zaza" = {
-      module = {
-        name = "B";
-        input = null;
-      };
-      roles.peer.tags.all = { };
    };
  };

@@ -105,9 +109,10 @@ in
 {
  # settings should evaluate
  test_per_instance_arguments = {
+    inherit res;
    expr = {
      instanceName =
-        res.importedModulesEvaluated.self-A.result.allRoles.peer.allInstances."instance_foo".allMachines.jon.passthru.instanceName;
+        res.config._services.mappedServices.self-A.result.allRoles.peer.allInstances."instance_foo".allMachines.jon.passthru.instanceName;

      # settings are specific.
      # Below we access:
@@ -115,11 +120,11 @@ in
      # roles = peer
      # machines = jon
      settings =
-        res.importedModulesEvaluated.self-A.result.allRoles.peer.allInstances.instance_foo.allMachines.jon.passthru.settings;
+        res.config._services.mappedServices.self-A.result.allRoles.peer.allInstances.instance_foo.allMachines.jon.passthru.settings;
      machine =
-        res.importedModulesEvaluated.self-A.result.allRoles.peer.allInstances.instance_foo.allMachines.jon.passthru.machine;
+        res.config._services.mappedServices.self-A.result.allRoles.peer.allInstances.instance_foo.allMachines.jon.passthru.machine;
      roles =
-        res.importedModulesEvaluated.self-A.result.allRoles.peer.allInstances.instance_foo.allMachines.jon.passthru.roles;
+        res.config._services.mappedServices.self-A.result.allRoles.peer.allInstances.instance_foo.allMachines.jon.passthru.roles;
    };
    expected = {
      instanceName = "instance_foo";
@@ -137,6 +142,7 @@ in
              settings = { };
            };
          };
+          settings = { };
        };
        peer = {
          machines = {
@@ -146,6 +152,9 @@ in
              };
            };
          };
+          settings = {
+            timeout = "foo-peer";
+          };
        };
      };
      settings = {
@@ -156,9 +165,9 @@ in

  # TODO: Cannot be tested like this anymore
  test_per_instance_settings_vendoring = {
-    x = res.importedModulesEvaluated.self-A;
+    x = res.config._services.mappedServices.self-A;
    expr =
-      res.importedModulesEvaluated.self-A.result.allRoles.peer.allInstances.instance_foo.allMachines.jon.passthru.vendoredSettings;
+      res.config._services.mappedServices.self-A.result.allRoles.peer.allInstances.instance_foo.allMachines.jon.passthru.vendoredSettings;
    expected = {
      timeout = "config.thing";
    };
--- a/lib/inventory/distributed-service/tests/per_machine_args.nix
+++ b/lib/inventory/distributed-service/tests/per_machine_args.nix
@@ -1,4 +1,4 @@
-{ lib, callInventoryAdapter }:
+{ lib, createTestClan }:
 let
  # Authored module
  # A minimal module looks like this
@@ -39,36 +39,40 @@ let
    jon = { };
    sara = { };
  };
-  res = callInventoryAdapter {
-    inherit modules machines;
-    instances."instance_foo" = {
-      module = {
-        name = "A";
-        input = "self";
+  res = createTestClan {
+    inherit modules;
+    inventory = {
+
+      inherit machines;
+      instances."instance_foo" = {
+        module = {
+          name = "A";
+          input = "self";
+        };
+        roles.peer.machines.jon = {
+          settings.timeout = lib.mkForce "foo-peer-jon";
+        };
+        roles.peer = {
+          settings.timeout = "foo-peer";
+        };
      };
-      roles.peer.machines.jon = {
-        settings.timeout = lib.mkForce "foo-peer-jon";
+      instances."instance_bar" = {
+        module = {
+          name = "A";
+          input = "self";
+        };
+        roles.peer.machines.jon = {
+          settings.timeout = "bar-peer-jon";
+        };
      };
-      roles.peer = {
-        settings.timeout = "foo-peer";
+      instances."instance_zaza" = {
+        module = {
+          name = "B";
+          input = null;
+        };
+        roles.peer.tags.all = { };
      };
    };
-    instances."instance_bar" = {
-      module = {
-        name = "A";
-        input = "self";
-      };
-      roles.peer.machines.jon = {
-        settings.timeout = "bar-peer-jon";
-      };
-    };
-    instances."instance_zaza" = {
-      module = {
-        name = "B";
-        input = null;
-      };
-      roles.peer.tags.all = { };
-    };
  };
 in

@@ -79,7 +83,7 @@ in
    inherit res;
    expr = {
      hasMachineSettings =
-        res.importedModulesEvaluated.self-A.result.allMachines.jon.passthru.instances.instance_foo.roles.peer.machines.jon
+        res.config._services.mappedServices.self-A.result.allMachines.jon.passthru.instances.instance_foo.roles.peer.machines.jon
        ? settings;

      # settings are specific.
@@ -88,10 +92,10 @@ in
      # roles = peer
      # machines = jon
      specificMachineSettings =
-        res.importedModulesEvaluated.self-A.result.allMachines.jon.passthru.instances.instance_foo.roles.peer.machines.jon.settings;
+        res.config._services.mappedServices.self-A.result.allMachines.jon.passthru.instances.instance_foo.roles.peer.machines.jon.settings;

      hasRoleSettings =
-        res.importedModulesEvaluated.self-A.result.allMachines.jon.passthru.instances.instance_foo.roles.peer
+        res.config._services.mappedServices.self-A.result.allMachines.jon.passthru.instances.instance_foo.roles.peer
        ? settings;

      # settings are specific.
@@ -100,20 +104,25 @@ in
      # roles = peer
      # machines = *
      specificRoleSettings =
-        res.importedModulesEvaluated.self-A.result.allMachines.jon.passthru.instances.instance_foo.roles.peer;
+        res.config._services.mappedServices.self-A.result.allMachines.jon.passthru.instances.instance_foo.roles.peer;
    };
-    expected = rec {
+    expected = {
      hasMachineSettings = true;
-      hasRoleSettings = false;
+      hasRoleSettings = true;
      specificMachineSettings = {
        timeout = "foo-peer-jon";
      };
      specificRoleSettings = {
        machines = {
          jon = {
-            settings = specificMachineSettings;
+            settings = {
+              timeout = "foo-peer-jon";
+            };
          };
        };
+        settings = {
+          timeout = "foo-peer";
+        };
      };
    };
  };
--- a/lib/inventory/distributed-service/tests/settings.nix
+++ b/lib/inventory/distributed-service/tests/settings.nix
@@ -1,6 +1,6 @@
-{ callInventoryAdapter, lib, ... }:
+{ createTestClan, lib, ... }:
 let
-  res = callInventoryAdapter {
+  res = createTestClan {
    modules."A" = {
      _class = "clan.service";
      manifest = {
@@ -21,28 +21,31 @@ let
          };
        };
    };
-    machines = {
-      jon = { };
-      sara = { };
-    };
-    instances."instance_foo" = {
-      module = {
-        name = "A";
-        input = "self";
+    inventory = {
+
+      machines = {
+        jon = { };
+        sara = { };
      };
-      # Settings for both jon and sara
-      roles.peer.settings = {
-        timeout = 40;
+      instances."instance_foo" = {
+        module = {
+          name = "A";
+          input = "self";
+        };
+        # Settings for both jon and sara
+        roles.peer.settings = {
+          timeout = 40;
+        };
+        # Jon overrides timeout
+        roles.peer.machines.jon = {
+          settings.timeout = lib.mkForce 42;
+        };
+        roles.peer.machines.sara = { };
      };
-      # Jon overrides timeout
-      roles.peer.machines.jon = {
-        settings.timeout = lib.mkForce 42;
-      };
-      roles.peer.machines.sara = { };
    };
  };

-  config = res.servicesEval.config.mappedServices.self-A;
+  config = res.config._services.mappedServices.self-A;

  #
  applySettings =
--- a/lib/inventory/distributed-service/tests/specialArgs.nix
+++ b/lib/inventory/distributed-service/tests/specialArgs.nix
@@ -1,6 +1,6 @@
-{ callInventoryAdapter, lib, ... }:
+{ createTestClan, lib, ... }:
 let
-  res = callInventoryAdapter {
+  res = createTestClan {
    modules."A" = m: {
      _class = "clan.service";
      config = {
@@ -14,19 +14,21 @@ let
        default = m;
      };
    };
-    machines = {
-      jon = { };
-    };
-    instances."instance_foo" = {
-      module = {
-        name = "A";
-        input = "self";
+    inventory = {
+      machines = {
+        jon = { };
+      };
+      instances."instance_foo" = {
+        module = {
+          name = "A";
+          input = "self";
+        };
+        roles.peer.machines.jon = { };
      };
-      roles.peer.machines.jon = { };
    };
  };

-  specialArgs = lib.attrNames res.servicesEval.config.mappedServices.self-A.test.specialArgs;
+  specialArgs = lib.attrNames res.config._services.mappedServices.self-A.test.specialArgs;
 in
 {
  test_simple = {
--- a/lib/tests.nix
+++ b/lib/tests.nix
@@ -212,6 +212,36 @@ in
      };
    };

+  test_clan_check_simple_fail =
+    let
+      eval = clan {
+        checks.constFail = {
+          assertion = false;
+          message = "This is a constant failure";
+        };
+      };
+    in
+    {
+      result = eval;
+      expr = eval.config;
+      expectedError.type = "ThrownError";
+      expectedError.msg = "This is a constant failure";
+    };
+  test_clan_check_simple_pass =
+    let
+      eval = clan {
+        checks.constFail = {
+          assertion = true;
+          message = "This is a constant success";
+        };
+      };
+    in
+    {
+      result = eval;
+      expr = lib.seq eval.config 42;
+      expected = 42;
+    };
+
  test_get_var_machine =
    let
      varsLib = import ./vars.nix { };
--- a/modules/clan/checks.nix
+++ b/modules/clan/checks.nix
@@ -0,0 +1,16 @@
+{ lib, nixpkgs, ... }:
+{
+  checks.minNixpkgsVersion = {
+    assertion = lib.versionAtLeast nixpkgs.lib.version "25.11";
+    message = ''
+      Nixpkgs version: ${nixpkgs.lib.version} is incompatible with clan-core. (>= 25.11 is recommended)
+      ---
+      Your version of 'nixpkgs' seems too old for clan-core.
+      Please read: https://docs.clan.lol/guides/nixpkgs-flake-input
+
+      You can ignore this check by setting:
+      clan.checks.minNixpkgsVersion.ignore = true;
+      ---
+    '';
+  };
+}
--- a/modules/clan/default.nix
+++ b/modules/clan/default.nix
@@ -1,3 +1,14 @@
+/**
+  Root 'clan' Module
+
+  Defines lib.clan and flake-parts.clan options
+  and all common logic for the 'clan' module.
+
+  - has Class _class = "clan"
+
+  - _module.args.clan-core: reference to clan-core flake
+  - _module.args.clanLib: reference to lib.clan function
+*/
 { clan-core }:
 {
  _class = "clan";
@@ -6,7 +17,9 @@
    inherit (clan-core) clanLib;
  };
  imports = [
+    ./top-level-interface.nix
    ./module.nix
-    ./interface.nix
+    ./distributed-services.nix
+    ./checks.nix
  ];
 }
--- a/modules/clan/distributed-services.nix
+++ b/modules/clan/distributed-services.nix
@@ -0,0 +1,163 @@
+{
+  lib,
+  clanLib,
+  config,
+  clan-core,
+  ...
+}:
+let
+  inherit (lib) mkOption types;
+  # Keep a reference to top-level
+  clanConfig = config;
+
+  inventory = clanConfig.inventory;
+  flakeInputs = clanConfig.self.inputs;
+  clanCoreModules = clan-core.clan.modules;
+
+  grouped = lib.foldlAttrs (
+    acc: instanceName: instance:
+    let
+      inputName = if instance.module.input == null then "<clan-core>" else instance.module.input;
+      id = inputName + "-" + instance.module.name;
+    in
+    acc
+    // {
+      ${id} = acc.${id} or [ ] ++ [
+        {
+          inherit instanceName instance;
+        }
+      ];
+    }
+  ) { } importedModuleWithInstances;
+
+  importedModuleWithInstances = lib.mapAttrs (
+    instanceName: instance:
+    let
+      resolvedModule = clanLib.resolveModule {
+        moduleSpec = instance.module;
+        inherit flakeInputs clanCoreModules;
+      };
+
+      # Every instance includes machines via roles
+      # :: { client :: ... }
+      instanceRoles = lib.mapAttrs (
+        roleName: role:
+        let
+          resolvedMachines = clanLib.inventory.resolveTags {
+            members = {
+              # Explicit members
+              machines = lib.attrNames role.machines;
+              # Resolved Members
+              tags = lib.attrNames role.tags;
+            };
+            inherit (inventory) machines;
+            inherit instanceName roleName;
+          };
+        in
+        # instances.<instanceName>.roles.<roleName> =
+        # Remove "tags", they are resolved into "machines"
+        (removeAttrs role [ "tags" ])
+        // {
+          machines = lib.genAttrs resolvedMachines.machines (
+            machineName:
+            let
+              machineSettings = instance.roles.${roleName}.machines.${machineName}.settings or { };
+            in
+            # TODO: tag settings
+            # Wait for this feature until option introspection for 'settings' is done.
+            # This might get too complex to handle otherwise.
+            # settingsViaTags = lib.filterAttrs (
+            #   tagName: _: machineHasTag machineName tagName
+            # ) instance.roles.${roleName}.tags;
+            {
+              # TODO: Do we want to wrap settings with
+              # setDefaultModuleLocation "inventory.instances.${instanceName}.roles.${roleName}.tags.${tagName}";
+              settings = {
+                imports = [
+                  machineSettings
+                ]; # ++ lib.attrValues (lib.mapAttrs (_tagName: v: v.settings) settingsViaTags);
+              };
+            }
+          );
+        }
+      ) instance.roles;
+    in
+    {
+      inherit (instance) module;
+      inherit resolvedModule instanceRoles;
+    }
+  ) inventory.instances or { };
+in
+{
+  _class = "clan";
+  options._services = mkOption {
+    visible = false;
+    description = ''
+      All service instances
+
+      !!! Danger "Internal API"
+        Do not rely on this API yet.
+
+        - Will be renamed to just 'services' in the future.
+        Once the name can be claimed again.
+        - Structure will change.
+
+        API will be declared as public after beeing simplified.
+    '';
+    type = types.submoduleWith {
+      # TODO: Remove specialArgs
+      specialArgs = {
+        inherit clanLib;
+      };
+      modules = [
+        (import ../../lib/inventory/distributed-service/all-services-wrapper.nix {
+          inherit (clanConfig) directory;
+        })
+        # Dependencies
+        {
+          exportsModule = clanConfig.exportsModule;
+        }
+        {
+          # TODO: Rename to "allServices"
+          # All services
+          mappedServices = lib.mapAttrs (_module_ident: instances: {
+            imports = [
+              # Import the resolved module.
+              # i.e. clan.modules.admin
+              {
+                options.module = lib.mkOption {
+                  type = lib.types.raw;
+                  default = (builtins.head instances).instance.module;
+                };
+              }
+              (builtins.head instances).instance.resolvedModule
+            ] # Include all the instances that correlate to the resolved module
+            ++ (builtins.map (v: {
+              instances.${v.instanceName}.roles = v.instance.instanceRoles;
+            }) instances);
+          }) grouped;
+        }
+      ];
+    };
+    default = { };
+  };
+  options._allMachines = mkOption {
+    internal = true;
+    type = types.raw;
+    default = lib.mapAttrs (machineName: _: {
+      # This is the list of nixosModules for each machine
+      machineImports = lib.foldlAttrs (
+        acc: _module_ident: serviceModule:
+        acc ++ [ serviceModule.result.final.${machineName}.nixosModule or { } ]
+      ) [ ] config._services.mappedServices;
+    }) inventory.machines or { };
+  };
+
+  config = {
+    clanInternals.inventoryClass.machines = config._allMachines;
+    # clanInternals.inventoryClass.distributedServices = config._services;
+
+    # Exports from distributed services
+    exports = config._services.exports;
+  };
+}
--- a/modules/clan/eval-docs.nix
+++ b/modules/clan/eval-docs.nix
@@ -3,12 +3,16 @@
  lib,
  clanModule,
  clanLib,
+  clan-core,
 }:
 let
  eval = lib.evalModules {
    modules = [
      clanModule
    ];
+    specialArgs = {
+      self = clan-core;
+    };
  };

  evalDocs = pkgs.nixosOptionsDoc {
--- a/modules/clan/flake-module.nix
+++ b/modules/clan/flake-module.nix
@@ -12,6 +12,7 @@ in
    }:
    let
      jsonDocs = import ./eval-docs.nix {
+        clan-core = self;
        inherit
          pkgs
          lib
--- a/modules/clan/module.nix
+++ b/modules/clan/module.nix
@@ -100,7 +100,7 @@ let
          _: machine:
          machine.extendModules {
            modules = [
-              (lib.modules.importApply ../machineModules/overridePkgs.nix {
+              (lib.modules.importApply ../../nixosModules/machineModules/overridePkgs.nix {
                pkgs = pkgsFor.${system};
              })
            ];
@@ -167,6 +167,9 @@ in
          { ... }@args:
          let
            _class =
+              # _class was added in https://github.com/NixOS/nixpkgs/pull/395141
+              # Clan relies on it to determine which modules to load
+              # people need to use at least that version of nixpkgs
              args._class or (throw ''
                Your version of nixpkgs is incompatible with the latest clan.
                Please update nixpkgs input to the latest nixos-unstable or nixpkgs-unstable.
@@ -176,7 +179,7 @@ in
          in
          {
            imports = [
-              (lib.modules.importApply ../machineModules/forName.nix {
+              (lib.modules.importApply ../../nixosModules/machineModules/forName.nix {
                inherit (config.inventory) meta;
                inherit
                  name
@@ -216,12 +219,22 @@ in
    inherit nixosConfigurations;
    inherit darwinConfigurations;

-    exports = config.clanInternals.inventoryClass.distributedServices.servicesEval.config.exports;
-
    clanInternals = {
      inventoryClass =
        let
          flakeInputs = config.self.inputs;
+          # Compute the relative directory path
+          selfStr = toString config.self;
+          dirStr = toString directory;
+          relativeDirectory =
+            if selfStr == dirStr then
+              ""
+            else if lib.hasPrefix selfStr dirStr then
+              lib.removePrefix (selfStr + "/") dirStr
+            else
+              # This shouldn't happen in normal usage, but can occur when
+              # the flake is copied (e.g., in tests). Fall back to empty string.
+              "";
        in
        {
          _module.args = {
@@ -230,25 +243,18 @@ in
          imports = [
            ../inventoryClass/default.nix
            {
-              inherit inventory directory flakeInputs;
+              inherit
+                inventory
+                directory
+                flakeInputs
+                relativeDirectory
+                ;
              exportsModule = config.exportsModule;
            }
            (
-              { config, ... }:
+              { ... }:
              {
                staticModules = clan-core.clan.modules;
-
-                distributedServices = clanLib.inventory.mapInstances {
-                  inherit (config)
-                    inventory
-                    directory
-                    flakeInputs
-                    exportsModule
-                    ;
-                  clanCoreModules = clan-core.clan.modules;
-                  prefix = [ "distributedServices" ];
-                };
-                machines = config.distributedServices.allMachines;
              }
            )
          ];
--- a/modules/clan/templates.nix
+++ b/modules/clan/templates.nix
@@ -1,3 +1,28 @@
+/**
+  The templates submodule
+
+  'clan.templates'
+
+  Different kinds supported:
+
+  - clan templates: 'clan.templates.clan'
+  - disko templates: 'clan.templates.disko'
+  - machine templates: 'clan.templates.machine'
+
+  A template has the form:
+
+  ```nix
+  {
+    description: string; # short summary what the template contains
+    path: path; # path to the template
+  }
+  ```
+
+  The clan API copies the template from the given 'path'
+  into a target folder. For example,
+
+  `./machines/<machine-name>` for 'machine' templates.
+*/
 {
  lib,
  ...
--- a/modules/clan/top-level-interface.nix
+++ b/modules/clan/top-level-interface.nix
--- a/modules/inventoryClass/default.nix
+++ b/modules/inventoryClass/default.nix
@@ -67,9 +67,6 @@ in
      type = types.raw;
    };

-    distributedServices = mkOption {
-      type = types.raw;
-    };
    inventory = mkOption {
      type = types.raw;
    };
@@ -81,6 +78,14 @@ in
    directory = mkOption {
      type = types.path;
    };
+    relativeDirectory = mkOption {
+      type = types.str;
+      internal = true;
+      description = ''
+        The relative directory path from the flake root to the clan directory.
+        Empty string if directory equals the flake root.
+      '';
+    };
    machines = mkOption {
      type = types.attrsOf (submodule ({
        options = {
--- a/modules/inventoryClass/role.nix
+++ b/modules/inventoryClass/role.nix
@@ -44,12 +44,6 @@ in
      description = ''
        List of additionally imported `.nix` expressions.

-        Supported types:
-
-        - **Strings**: Interpreted relative to the 'directory' passed to `lib.clan`.
-        - **Paths**: should be relative to the current file.
-        - **Any**: Nix expression must be serializable to JSON.
-
        !!! Note
            **The import only happens if the machine is part of the service or role.**

@@ -74,7 +68,7 @@ in
            ```
      '';
      default = [ ];
-      type = types.listOf types.deferredModule;
+      type = types.listOf types.raw;
    };
  };
 }
--- a/nixosModules/flake-module.nix
+++ b/nixosModules/flake-module.nix
@@ -18,7 +18,7 @@ let
        inputs.data-mesher.nixosModules.data-mesher
      ];
      config = {
-        clan.core.clanPkgs = lib.mkDefault self.packages.${pkgs.hostPlatform.system};
+        clan.core.clanPkgs = lib.mkDefault self.packages.${pkgs.stdenv.hostPlatform.system};
      };
    };
 in
--- a/nixosModules/installer/zfs-latest.nix
+++ b/nixosModules/installer/zfs-latest.nix
@@ -30,5 +30,5 @@ let
 in
 {
  # Note this might jump back and worth as kernel get added or removed.
-  boot.kernelPackages = lib.mkIf (lib.meta.availableOn pkgs.hostPlatform pkgs.zfs) latestKernelPackage;
+  boot.kernelPackages = lib.mkIf (lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.zfs) latestKernelPackage;
 }
--- a/nixosModules/machineModules/forName.nix
+++ b/nixosModules/machineModules/forName.nix
@@ -3,6 +3,7 @@
  directory,
  meta,
 }:
+# The following is a nixos/darwin module
 {
  _class,
  lib,
--- a/nixosModules/machineModules/overridePkgs.nix
+++ b/nixosModules/machineModules/overridePkgs.nix
--- a/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py
+++ b/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py
@@ -245,7 +245,7 @@ class SecretStore(StoreBase):
                            output_dir / "activation" / generator.name / file.name
                        )
                        out_file.parent.mkdir(parents=True, exist_ok=True)
-                        out_file.write_bytes(self.get(generator, file.name))
+                        out_file.write_bytes(file.value)
        if "partitioning" in phases:
            for generator in vars_generators:
                for file in generator.files:
@@ -254,7 +254,7 @@ class SecretStore(StoreBase):
                            output_dir / "partitioning" / generator.name / file.name
                        )
                        out_file.parent.mkdir(parents=True, exist_ok=True)
-                        out_file.write_bytes(self.get(generator, file.name))
+                        out_file.write_bytes(file.value)

        hash_data = self.generate_hash(machine)
        if hash_data:
--- a/pkgs/clan-cli/clan_cli/vars/secret_modules/sops.py
+++ b/pkgs/clan-cli/clan_cli/vars/secret_modules/sops.py
@@ -246,7 +246,7 @@ class SecretStore(StoreBase):
                        )
                        # chmod after in case it doesn't have u+w
                        target_path.touch(mode=0o600)
-                        target_path.write_bytes(self.get(generator, file.name))
+                        target_path.write_bytes(file.value)
                        target_path.chmod(file.mode)

        if "partitioning" in phases:
@@ -260,7 +260,7 @@ class SecretStore(StoreBase):
                        )
                        # chmod after in case it doesn't have u+w
                        target_path.touch(mode=0o600)
-                        target_path.write_bytes(self.get(generator, file.name))
+                        target_path.write_bytes(file.value)
                        target_path.chmod(file.mode)

    @override
--- a/pkgs/clan-cli/clan_lib/api/init.py
+++ b/pkgs/clan-cli/clan_lib/api/init.py
@@ -243,7 +243,11 @@ API.register(get_system_file)
            if "oneOf" not in return_type:
                msg = (
                    f"Return type of function '{name}' is not a union type. Expected a union of Success and Error types."
-                    # @DavHau: no idea wy exactly this leads to the "oneOf" ot being present, but this should help
+                    # If the SuccessData type is unsupported it was dropped by Union narrowing.
+                    # This is probably an antifeature
+                    # Introduced because run_generator wanted to use:
+                    # Callable[[Generator], dict[str, str]]
+                    # In its function signature.
                    "Hint: When using dataclasses as return types, ensure they don't contain public fields with non-serializable types"
                )
                raise JSchemaTypeError(msg)
--- a/pkgs/clan-cli/clan_lib/dirs/init.py
+++ b/pkgs/clan-cli/clan_lib/dirs/init.py
@@ -156,14 +156,28 @@ def vm_state_dir(flake_url: str, vm_name: str) -> Path:


 def machines_dir(flake: "Flake") -> Path:
+    # Determine the base path
    if flake.is_local:
-        return flake.path / "machines"
+        base_path = flake.path
+    else:
+        store_path = flake.store_path
+        if store_path is None:
+            msg = "Invalid flake object. Doesn't have a store path"
+            raise ClanError(msg)
+        base_path = Path(store_path)

-    store_path = flake.store_path
-    if store_path is None:
-        msg = "Invalid flake object. Doesn't have a store path"
-        raise ClanError(msg)
-    return Path(store_path) / "machines"
+    # Get the clan directory configuration from Nix
+    # This is computed in Nix where store paths are consistent
+    # Returns "" if no custom directory is set
+    # Fall back to "" if the option doesn't exist (backwards compatibility)
+    try:
+        clan_dir = flake.select("clanInternals.inventoryClass.relativeDirectory")
+    except ClanError:
+        # Option doesn't exist in older clan-core versions
+        # Assume no custom directory
+        clan_dir = ""
+
+    return base_path / clan_dir / "machines"


 def specific_machine_dir(machine: "MachineSpecProtocol") -> Path:
--- a/pkgs/clan-cli/clan_lib/flake/flake.py
+++ b/pkgs/clan-cli/clan_lib/flake/flake.py
@@ -211,7 +211,7 @@ class ClanSelectError(ClanError):

    def __str__(self) -> str:
        if self.description:
-            return f"{self.msg}  Reason: {self.description}"
+            return f"{self.msg}  Reason: {self.description}. Use flag '--debug' to see full nix trace."
        return self.msg

    def __repr__(self) -> str:
--- a/pkgs/clan-cli/clan_lib/llm/container_test.py
+++ b/pkgs/clan-cli/clan_lib/llm/container_test.py
@@ -5,15 +5,18 @@ from pathlib import Path
 from typing import TYPE_CHECKING
 from unittest.mock import MagicMock, patch

+import clan_lib.llm.llm_types
 import pytest
 from clan_lib.flake.flake import Flake
+from clan_lib.llm.llm_types import ModelConfig
 from clan_lib.llm.orchestrator import get_llm_turn
 from clan_lib.llm.service import create_llm_model, run_llm_service
 from clan_lib.service_runner import create_service_manager

 if TYPE_CHECKING:
    from clan_lib.llm.llm_types import ChatResult
-    from clan_lib.llm.schemas import ChatMessage, SessionState
+    from clan_lib.llm.schemas import SessionState
+import platform


 def get_current_mode(session_state: "SessionState") -> str:
@@ -168,28 +171,80 @@ def llm_service() -> Iterator[None]:
            service_manager.stop_service("ollama")


-def execute_multi_turn_workflow(
-    user_request: str,
-    flake: Flake | MagicMock,
-    conversation_history: list["ChatMessage"] | None = None,
-    provider: str = "ollama",
-    session_state: "SessionState | None" = None,
-) -> "ChatResult":
-    """Execute the multi-turn workflow, auto-executing all pending operations.
+@pytest.mark.service_runner
+@pytest.mark.usefixtures("mock_nix_shell", "llm_service")
+def test_full_conversation_flow(mock_flake: MagicMock) -> None:
+    """Test the complete conversation flow by manually calling get_llm_turn at each step.

-    This simulates the behavior of the CLI auto-execute loop in workflow.py.
+    This test verifies:
+    - State transitions through discovery -> readme_fetch -> service_selection -> final_decision
+    - Each step returns the correct next_action
+    - Conversation history is preserved across turns
+    - Session state is correctly maintained
    """
+    flake = mock_flake
+    trace_file = Path("~/.ollama/container_test_llm_trace.json").expanduser()
+    trace_file.unlink(missing_ok=True)  # Start fresh
+    provider = "ollama"
+
+    # Override DEFAULT_MODELS with 4-minute timeouts for container tests
+    clan_lib.llm.llm_types.DEFAULT_MODELS = {
+        "ollama": ModelConfig(
+            name="qwen3:4b-instruct",
+            provider="ollama",
+            timeout=300,  # set inference timeout to 5 minutes as CI may be slow
+            temperature=0,  # set randomness to 0 for consistent test results
+        ),
+    }
+
+    # ========== STEP 1: Initial request (should return next_action for discovery) ==========
+    print_separator("STEP 1: Initial Request", char="=", width=80)
    result = get_llm_turn(
-        user_request=user_request,
+        user_request="What VPN options do I have?",
        flake=flake,
-        conversation_history=conversation_history,
        provider=provider,  # type: ignore[arg-type]
-        session_state=session_state,
        execute_next_action=False,
+        trace_file=trace_file,
    )

-    # Auto-execute any pending operations
-    while result.next_action:
+    # Should have next_action for discovery phase
+    assert result.next_action is not None, "Should have next_action for discovery"
+    assert result.next_action["type"] == "discovery"
+    assert result.requires_user_response is False
+    assert len(result.proposed_instances) == 0
+    assert "pending_discovery" in result.session_state
+    print(f"  Next Action: {result.next_action['type']}")
+    print(f"  Description: {result.next_action['description']}")
+    print_meta_info(result, turn=1, phase="Initial Request")
+
+    # ========== STEP 2: Execute discovery (should return next_action for readme_fetch) ==========
+    print_separator("STEP 2: Execute Discovery", char="=", width=80)
+    result = get_llm_turn(
+        user_request="",
+        flake=flake,
+        conversation_history=list(result.conversation_history),
+        provider=provider,  # type: ignore[arg-type]
+        session_state=result.session_state,
+        execute_next_action=True,
+        trace_file=trace_file,
+    )
+
+    # Should have next_action for readme fetch OR a clarifying question
+    if result.next_action:
+        assert result.next_action["type"] == "fetch_readmes"
+        assert "pending_readme_fetch" in result.session_state
+        print(f"  Next Action: {result.next_action['type']}")
+        print(f"  Description: {result.next_action['description']}")
+    else:
+        # LLM asked a clarifying question
+        assert result.requires_user_response is True
+        assert len(result.assistant_message) > 0
+        print(f"  Assistant Message: {result.assistant_message[:100]}...")
+    print_meta_info(result, turn=2, phase="Discovery Executed")
+
+    # ========== STEP 3: Execute readme fetch (if applicable) ==========
+    if result.next_action and result.next_action["type"] == "fetch_readmes":
+        print_separator("STEP 3: Execute Readme Fetch", char="=", width=80)
        result = get_llm_turn(
            user_request="",
            flake=flake,
@@ -197,187 +252,74 @@ def execute_multi_turn_workflow(
            provider=provider,  # type: ignore[arg-type]
            session_state=result.session_state,
            execute_next_action=True,
+            trace_file=trace_file,
        )

-    return result
+        # Should have next_action for service selection
+        assert result.next_action is not None
+        assert result.next_action["type"] == "service_selection"
+        assert "pending_service_selection" in result.session_state
+        print(f"  Next Action: {result.next_action['type']}")
+        print(f"  Description: {result.next_action['description']}")
+        print_meta_info(result, turn=3, phase="Readme Fetch Executed")

+        if platform.machine() == "aarch64":
+            pytest.skip(
+                "aarch64 detected: skipping readme/service-selection and final step for performance reasons"
+            )

-@pytest.mark.service_runner
-@pytest.mark.usefixtures("mock_nix_shell", "llm_service")
-def test_full_conversation_flow(mock_flake: MagicMock) -> None:
-    """Comprehensive test that exercises the complete conversation flow with the actual LLM service.
-
-    This test simulates a realistic multi-turn conversation that covers:
-    - Discovery phase: Initial request and LLM gathering information
-    - Service selection phase: User choosing from available options
-    - Final decision phase: Configuring the selected service with specific parameters
-    - State transitions: pending_service_selection -> pending_final_decision -> completion
-    - Conversation history preservation across all turns
-    - Error handling and edge cases
-    """
-    flake = mock_flake
-    # ========== TURN 1: Discovery Phase - Initial vague request ==========
-    print_separator("TURN 1: Discovery Phase", char="=", width=80)
-    result = execute_multi_turn_workflow(
-        user_request="What VPN options do I have?",
-        flake=flake,
-        provider="ollama",
-    )
-
-    # Verify discovery phase behavior
-    assert result.requires_user_response is True, (
-        "Should require user response in discovery"
-    )
-    assert len(result.conversation_history) >= 2, (
-        "Should have user + assistant messages"
-    )
-    assert result.conversation_history[0]["role"] == "user"
-    assert result.conversation_history[0]["content"] == "What VPN options do I have?"
-    assert result.conversation_history[-1]["role"] == "assistant"
-    assert len(result.assistant_message) > 0, "Assistant should provide a response"
-
-    # After multi-turn execution, we may have either:
-    # - pending_service_selection (if LLM provided options and is waiting for choice)
-    # - pending_final_decision (if LLM directly selected a service)
-    # - no pending state (if LLM asked a clarifying question)
-
-    # No instances yet
-    assert len(result.proposed_instances) == 0
-    assert result.error is None
-
-    print_chat_exchange(
-        "What VPN options do I have?", result.assistant_message, result.session_state
-    )
-    print_meta_info(result, turn=1, phase="Discovery")
-
-    # ========== TURN 2: Service Selection Phase - User makes a choice ==========
-    print_separator("TURN 2: Service Selection", char="=", width=80)
-    user_msg_2 = "I'll use ZeroTier please"
-    result = execute_multi_turn_workflow(
-        user_request=user_msg_2,
-        flake=flake,
-        conversation_history=list(result.conversation_history),
-        provider="ollama",
-        session_state=result.session_state,
-    )
-
-    # Verify conversation history growth and preservation
-    assert len(result.conversation_history) > 2, "History should grow"
-    assert result.conversation_history[0]["content"] == "What VPN options do I have?"
-    assert result.conversation_history[2]["content"] == "I'll use ZeroTier please"
-
-    # Should either ask for configuration details or provide direct config
-    # Most likely will ask for more details (pending_final_decision)
-    if result.requires_user_response:
-        # LLM is asking for configuration details
-        assert len(result.assistant_message) > 0
-        # Should transition to final decision phase
-        if "pending_final_decision" not in result.session_state:
-            # Might still be in service selection asking clarifications
-            assert "pending_service_selection" in result.session_state
-    else:
-        # LLM provided configuration immediately (less likely)
-        assert len(result.proposed_instances) > 0
-        assert result.proposed_instances[0]["module"]["name"] == "zerotier"
-
-    print_chat_exchange(user_msg_2, result.assistant_message, result.session_state)
-    print_meta_info(result, turn=2, phase="Service Selection")
-
-    # ========== Continue conversation until we reach final decision or completion ==========
-    max_turns = 10
-    turn_count = 2
-
-    while result.requires_user_response and turn_count < max_turns:
-        turn_count += 1
-
-        # Determine appropriate response based on current state
-        if "pending_service_selection" in result.session_state:
-            # Still selecting service
-            user_request = "Yes, ZeroTier"
-            phase = "Service Selection (continued)"
-        elif "pending_final_decision" in result.session_state:
-            # Configuring the service
-            user_request = "Set up gchq-local as controller, qube-email as moon, and wintux as peer"
-            phase = "Final Configuration"
-        else:
-            # Generic continuation
-            user_request = "Yes, that sounds good. Use gchq-local as controller."
-            phase = "Continuing Conversation"
-
-        print_separator(f"TURN {turn_count}: {phase}", char="=", width=80)
-
-        result = execute_multi_turn_workflow(
-            user_request=user_request,
+        # ========== STEP 4: Execute service selection ==========
+        print_separator("STEP 4: Execute Service Selection", char="=", width=80)
+        result = get_llm_turn(
+            user_request="I want ZeroTier.",
            flake=flake,
            conversation_history=list(result.conversation_history),
-            provider="ollama",
+            provider=provider,  # type: ignore[arg-type]
            session_state=result.session_state,
+            execute_next_action=True,
+            trace_file=trace_file,
        )

-        # Verify conversation history continues to grow
-        assert len(result.conversation_history) == (turn_count * 2), (
-            f"History should have {turn_count * 2} messages (turn {turn_count})"
-        )
+        # Should either have next_action for final_decision OR a clarifying question
+        if result.next_action:
+            assert result.next_action["type"] == "final_decision"
+            assert "pending_final_decision" in result.session_state
+            print(f"  Next Action: {result.next_action['type']}")
+            print(f"  Description: {result.next_action['description']}")
+        else:
+            # LLM asked a clarifying question during service selection
+            assert result.requires_user_response is True
+            assert len(result.assistant_message) > 0
+            print(f"  Assistant Message: {result.assistant_message[:100]}...")
+        print_meta_info(result, turn=4, phase="Service Selection Executed")

-        # Verify history preservation
-        assert (
-            result.conversation_history[0]["content"] == "What VPN options do I have?"
-        )
+        # ========== STEP 5: Execute final decision (if applicable) ==========
+        if result.next_action and result.next_action["type"] == "final_decision":
+            print_separator("STEP 5: Execute Final Decision", char="=", width=80)
+            result = get_llm_turn(
+                user_request="",
+                flake=flake,
+                conversation_history=list(result.conversation_history),
+                provider=provider,  # type: ignore[arg-type]
+                session_state=result.session_state,
+                execute_next_action=True,
+                trace_file=trace_file,
+            )

-        print_chat_exchange(
-            user_request, result.assistant_message, result.session_state
-        )
-        print_meta_info(result, turn=turn_count, phase=phase)
+            # Should either have proposed_instances OR ask a clarifying question
+            if result.proposed_instances:
+                assert len(result.proposed_instances) > 0
+                assert result.next_action is None
+                print(f"  Proposed Instances: {len(result.proposed_instances)}")
+                for inst in result.proposed_instances:
+                    print(f"    - {inst['module']['name']}")
+            else:
+                # LLM asked a clarifying question
+                assert result.requires_user_response is True
+                assert len(result.assistant_message) > 0
+                print(f"  Assistant Message: {result.assistant_message[:100]}...")
+            print_meta_info(result, turn=5, phase="Final Decision Executed")

-        # Check for completion
-        if not result.requires_user_response:
-            print_separator("CONVERSATION COMPLETED", char="=", width=80)
-            break
-
-    # ========== Final Verification ==========
-    print_separator("FINAL VERIFICATION", char="=", width=80)
-    assert turn_count < max_turns, f"Conversation took too many turns ({turn_count})"
-
-    # If conversation completed, verify we have valid configuration
-    if not result.requires_user_response:
-        assert len(result.proposed_instances) > 0, (
-            "Should have at least one proposed instance"
-        )
-        instance = result.proposed_instances[0]
-
-        # Verify instance structure
-        assert "module" in instance
-        assert "name" in instance["module"]
-        assert instance["module"]["name"] in [
-            "zerotier",
-            "wireguard",
-            "yggdrasil",
-            "mycelium",
-        ]
-
-        # Should not be in pending state anymore
-        assert "pending_service_selection" not in result.session_state
-        assert "pending_final_decision" not in result.session_state
-
-        assert result.error is None, f"Should not have error: {result.error}"
-
-        print_separator("FINAL SUMMARY", char="-", width=80, double=False)
-        print("  Status:                SUCCESS")
-        print(f"  Module Name:           {instance['module']['name']}")
-        print(f"  Total Turns:           {turn_count}")
-        print(f"  Final History Length:  {len(result.conversation_history)} messages")
-        if "roles" in instance:
-            roles_list = ", ".join(instance["roles"].keys())
-            print(f"  Configuration Roles:   {roles_list}")
-        print("  Errors:                None")
-        print("-" * 80)
-    else:
-        # Conversation didn't complete but should have made progress
-        assert len(result.conversation_history) > 2
-        assert result.error is None
-        print_separator("FINAL SUMMARY", char="-", width=80, double=False)
-        print("  Status:                IN PROGRESS")
-        print(f"  Total Turns:           {turn_count}")
-        print(f"  Current State:         {list(result.session_state.keys())}")
-        print(f"  History Length:        {len(result.conversation_history)} messages")
-        print("-" * 80)
+    # Verify conversation history has grown
+    assert len(result.conversation_history) > 0
+    assert result.conversation_history[0]["content"] == "What VPN options do I have?"
--- a/pkgs/clan-cli/clan_lib/llm/endpoints.py
+++ b/pkgs/clan-cli/clan_lib/llm/endpoints.py
@@ -149,6 +149,7 @@ def call_openai_api(
    trace_file: Path | None = None,
    stage: str = "unknown",
    trace_metadata: dict[str, Any] | None = None,
+    temperature: float | None = None,
 ) -> OpenAIChatCompletionResponse:
    """Call the OpenAI API for chat completion.

@@ -160,6 +161,7 @@ def call_openai_api(
        trace_file: Optional path to write trace entries for debugging
        stage: Stage name for trace entries (default: "unknown")
        trace_metadata: Optional metadata to include in trace entries
+        temperature: Sampling temperature (default: None = use API default)

    Returns:
        The parsed JSON response from the API
@@ -178,6 +180,8 @@ def call_openai_api(
        "messages": messages,
        "tools": list(tools),
    }
+    if temperature is not None:
+        payload["temperature"] = temperature
    _debug_log_request("openai", messages, tools)
    url = "https://api.openai.com/v1/chat/completions"
    headers = {
@@ -256,6 +260,7 @@ def call_claude_api(
    trace_file: Path | None = None,
    stage: str = "unknown",
    trace_metadata: dict[str, Any] | None = None,
+    temperature: float | None = None,
 ) -> OpenAIChatCompletionResponse:
    """Call the Claude API (via OpenAI-compatible endpoint) for chat completion.

@@ -268,6 +273,7 @@ def call_claude_api(
        trace_file: Optional path to write trace entries for debugging
        stage: Stage name for trace entries (default: "unknown")
        trace_metadata: Optional metadata to include in trace entries
+        temperature: Sampling temperature (default: None = use API default)

    Returns:
        The parsed JSON response from the API
@@ -293,6 +299,8 @@ def call_claude_api(
        "messages": messages,
        "tools": list(tools),
    }
+    if temperature is not None:
+        payload["temperature"] = temperature
    _debug_log_request("claude", messages, tools)

    url = f"{base_url}chat/completions"
@@ -372,6 +380,7 @@ def call_ollama_api(
    stage: str = "unknown",
    max_tokens: int | None = None,
    trace_metadata: dict[str, Any] | None = None,
+    temperature: float | None = None,
 ) -> OllamaChatResponse:
    """Call the Ollama API for chat completion.

@@ -384,6 +393,7 @@ def call_ollama_api(
        stage: Stage name for trace entries (default: "unknown")
        max_tokens: Maximum number of tokens to generate (default: None = unlimited)
        trace_metadata: Optional metadata to include in trace entries
+        temperature: Sampling temperature (default: None = use API default)

    Returns:
        The parsed JSON response from the API
@@ -399,9 +409,14 @@ def call_ollama_api(
        "tools": list(tools),
    }

-    # Add max_tokens limit if specified
+    # Add options for max_tokens and temperature if specified
+    options: dict[str, int | float] = {}
    if max_tokens is not None:
-        payload["options"] = {"num_predict": max_tokens}  # type: ignore[typeddict-item]
+        options["num_predict"] = max_tokens
+    if temperature is not None:
+        options["temperature"] = temperature
+    if options:
+        payload["options"] = options  # type: ignore[typeddict-item]
    _debug_log_request("ollama", messages, tools)
    url = "http://localhost:11434/api/chat"

--- a/pkgs/clan-cli/clan_lib/llm/llm_types.py
+++ b/pkgs/clan-cli/clan_lib/llm/llm_types.py
@@ -73,19 +73,21 @@ class ModelConfig:
        name: The model identifier/name
        provider: The LLM provider
        timeout: Request timeout in seconds (default: 120)
+        temperature: Sampling temperature for the model (default: None = use API default)

    """

    name: str
    provider: Literal["openai", "ollama", "claude"]
    timeout: int = 120
+    temperature: float | None = None


 # Default model configurations for each provider
 DEFAULT_MODELS: dict[Literal["openai", "ollama", "claude"], ModelConfig] = {
    "openai": ModelConfig(name="gpt-4o", provider="openai", timeout=60),
    "claude": ModelConfig(name="claude-sonnet-4-5", provider="claude", timeout=60),
-    "ollama": ModelConfig(name="qwen3:4b-instruct", provider="ollama", timeout=120),
+    "ollama": ModelConfig(name="qwen3:4b-instruct", provider="ollama", timeout=180),
 }


--- a/pkgs/clan-cli/clan_lib/llm/phases.py
+++ b/pkgs/clan-cli/clan_lib/llm/phases.py
@@ -100,6 +100,7 @@ def get_llm_discovery_phase(
            trace_file=trace_file,
            stage="discovery",
            trace_metadata=trace_metadata,
+            temperature=model_config.temperature,
        )
        function_calls, message_content = parse_openai_response(
            openai_response, provider="openai"
@@ -113,6 +114,7 @@ def get_llm_discovery_phase(
            trace_file=trace_file,
            stage="discovery",
            trace_metadata=trace_metadata,
+            temperature=model_config.temperature,
        )
        function_calls, message_content = parse_openai_response(
            claude_response, provider="claude"
@@ -127,6 +129,7 @@ def get_llm_discovery_phase(
            stage="discovery",
            max_tokens=300,  # Limit output for discovery phase (get_readme calls or short question)
            trace_metadata=trace_metadata,
+            temperature=model_config.temperature,
        )
        function_calls, message_content = parse_ollama_response(
            ollama_response, provider="ollama"
@@ -249,6 +252,7 @@ def get_llm_service_selection(
            trace_file=trace_file,
            stage="select_service",
            trace_metadata=trace_metadata,
+            temperature=model_config.temperature,
        )
        function_calls, message_content = parse_openai_response(
            openai_response, provider="openai"
@@ -262,6 +266,7 @@ def get_llm_service_selection(
            trace_file=trace_file,
            stage="select_service",
            trace_metadata=trace_metadata,
+            temperature=model_config.temperature,
        )
        function_calls, message_content = parse_openai_response(
            claude_response, provider="claude"
@@ -276,6 +281,7 @@ def get_llm_service_selection(
            stage="select_service",
            max_tokens=600,  # Allow space for summary
            trace_metadata=trace_metadata,
+            temperature=model_config.temperature,
        )
        function_calls, message_content = parse_ollama_response(
            ollama_response, provider="ollama"
@@ -447,6 +453,7 @@ def get_llm_final_decision(
            trace_file=trace_file,
            stage="final_decision",
            trace_metadata=trace_metadata,
+            temperature=model_config.temperature,
        )
        function_calls, message_content = parse_openai_response(
            openai_response, provider="openai"
@@ -462,6 +469,7 @@ def get_llm_final_decision(
            trace_file=trace_file,
            stage="final_decision",
            trace_metadata=trace_metadata,
+            temperature=model_config.temperature,
        )
        function_calls, message_content = parse_openai_response(
            claude_response, provider="claude"
@@ -477,6 +485,7 @@ def get_llm_final_decision(
        stage="final_decision",
        max_tokens=500,  # Limit output to prevent excessive verbosity
        trace_metadata=trace_metadata,
+        temperature=model_config.temperature,
    )
    function_calls, message_content = parse_ollama_response(
        ollama_response, provider="ollama"
--- a/pkgs/clan-cli/clan_lib/llm/schemas.py
+++ b/pkgs/clan-cli/clan_lib/llm/schemas.py
@@ -231,6 +231,7 @@ class ChatCompletionRequestPayload(TypedDict, total=False):
    messages: list[ChatMessage]
    tools: list[ToolDefinition]
    stream: NotRequired[bool]
+    temperature: NotRequired[float]


@dataclass(frozen=True)
--- a/pkgs/clan-cli/clan_lib/machines/update.py
+++ b/pkgs/clan-cli/clan_lib/machines/update.py
@@ -59,9 +59,7 @@ def upload_sources(machine: Machine, ssh: Host, upload_inputs: bool) -> str:
    if not has_path_inputs and not upload_inputs:
        # Just copy the flake to the remote machine, we can substitute other inputs there.
        path = flake_data["path"]
-        if machine._class_ == "darwin":
-            remote_program_params = "?remote-program=bash -lc 'exec nix-daemon --stdio'"
-        remote_url = f"ssh-ng://{remote_url_base}{remote_program_params}"
+        remote_url = f"ssh-ng://{remote_url_base}"
        cmd = nix_command(
            [
                "copy",
--- a/pkgs/clan-cli/clan_lib/nix_models/clan.py
+++ b/pkgs/clan-cli/clan_lib/nix_models/clan.py
@@ -28,13 +28,11 @@ class InventoryInstanceRoleMachine(TypedDict):



-InventoryInstanceRoleExtramodulesType = list[Unknown]
 InventoryInstanceRoleMachinesType = dict[str, InventoryInstanceRoleMachine]
 InventoryInstanceRoleSettingsType = Unknown
 InventoryInstanceRoleTagsType = dict[str, Any] | list[str]

 class InventoryInstanceRole(TypedDict):
-    extraModules: NotRequired[InventoryInstanceRoleExtramodulesType]
    machines: NotRequired[InventoryInstanceRoleMachinesType]
    settings: NotRequired[InventoryInstanceRoleSettingsType]
    tags: NotRequired[InventoryInstanceRoleTagsType]
--- a/pkgs/clan-cli/clan_lib/service_runner/systemd_user.py
+++ b/pkgs/clan-cli/clan_lib/service_runner/systemd_user.py
@@ -5,7 +5,7 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import TYPE_CHECKING, Literal, TypedDict

-from clan_lib.cmd import RunOpts, run
+from clan_lib.cmd import Log, RunOpts, run
 from clan_lib.errors import ClanError

 if TYPE_CHECKING:
@@ -70,7 +70,7 @@ class SystemdUserService:
        """Run systemctl command with --user flag."""
        return run(
            ["systemctl", "--user", action, f"{service_name}.service"],
-            RunOpts(check=False),
+            RunOpts(check=False, log=Log.NONE),
        )

    def _get_property(self, service_name: str, prop: str) -> str:
@@ -240,11 +240,15 @@ class SystemdUserService:
        service_name = self._service_name(name)

        result = self._systemctl("stop", service_name)
-        if result.returncode != 0 and "not loaded" not in result.stderr.lower():
+        if (
+            result.returncode != 0
+            and "not loaded" not in result.stderr.lower()
+            and "does not exist" not in result.stderr.lower()
+        ):
            msg = f"Failed to stop service: {result.stderr}"
            raise ClanError(msg)

-        self._systemctl("disable", service_name)  # Ignore errors for transient units
+        result = self._systemctl("disable", service_name)

        unit_file = self._unit_file_path(name)
        if unit_file.exists():
--- a/pkgs/classgen/main.py
+++ b/pkgs/classgen/main.py
@@ -241,6 +241,11 @@ def generate_dataclass(
        # If we are at the top level, and the attribute name is not explicitly included we only do shallow
        field_name = prop.replace("-", "_")

+        # Skip "extraModules"
+        # TODO: Introduce seperate model that is tied to the serialization format
+        if "extraModules" in field_name:
+            continue
+
        # if len(attr_path) == 0 and prop in shallow_attrs:
        #     field_def = field_name, "dict[str, Any]"
        #     fields_with_default.append(field_def)
--- a/pkgs/docs-from-code/flake-module.nix
+++ b/pkgs/docs-from-code/flake-module.nix
@@ -64,6 +64,9 @@
          '';
    in
    {
+      legacyPackages = {
+        inherit jsonDocs clanModulesViaService;
+      };
      packages = {
        inherit module-docs;
      };
--- a/pkgs/option-search/flake-module.nix
+++ b/pkgs/option-search/flake-module.nix
@@ -11,151 +11,10 @@
      ...
    }:
    let
-      inherit (lib)
-        mapAttrsToList
-        mapAttrs
-        mkOption
-        types
-        splitString
-        stringLength
-        substring
-        ;
-      inherit (self) clanLib;
-
-      serviceModules = self.clan.modules;

      baseHref = "/option-search/";

-      getRoles =
-        module:
-        (clanLib.evalService {
-          modules = [ module ];
-          prefix = [ ];
-        }).config.roles;
-
-      getManifest =
-        module:
-        (clanLib.evalService {
-          modules = [ module ];
-          prefix = [ ];
-        }).config.manifest;
-
-      settingsModules = module: mapAttrs (_roleName: roleConfig: roleConfig.interface) (getRoles module);
-
      # Map each letter to its capitalized version
-      capitalizeChar =
-        char:
-        {
-          a = "A";
-          b = "B";
-          c = "C";
-          d = "D";
-          e = "E";
-          f = "F";
-          g = "G";
-          h = "H";
-          i = "I";
-          j = "J";
-          k = "K";
-          l = "L";
-          m = "M";
-          n = "N";
-          o = "O";
-          p = "P";
-          q = "Q";
-          r = "R";
-          s = "S";
-          t = "T";
-          u = "U";
-          v = "V";
-          w = "W";
-          x = "X";
-          y = "Y";
-          z = "Z";
-        }
-        .${char};
-
-      title =
-        name:
-        let
-          # split by -
-          parts = splitString "-" name;
-          # capitalize first letter of each part
-          capitalize = part: (capitalizeChar (substring 0 1 part)) + substring 1 (stringLength part) part;
-          capitalizedParts = map capitalize parts;
-        in
-        builtins.concatStringsSep " " capitalizedParts;
-
-      fakeInstanceOptions =
-        name: module:
-        let
-          manifest = getManifest module;
-          description = ''
-            # ${title name} (Clan Service)
-
-            **${manifest.description}**
-
-            ${lib.optionalString (manifest ? readme) manifest.readme}
-
-            ${
-              if manifest.categories != [ ] then
-                "Categories: " + builtins.concatStringsSep ", " manifest.categories
-              else
-                "No categories defined"
-            }
-
-          '';
-        in
-        {
-          options = {
-            instances.${name} = lib.mkOption {
-              inherit description;
-              type = types.submodule {
-                options.roles = mapAttrs (
-                  roleName: roleSettingsModule:
-                  mkOption {
-                    type = types.submodule {
-                      _file = "docs flake-module";
-                      imports = [
-                        { _module.args = { inherit clanLib; }; }
-                        (import ../../modules/inventoryClass/role.nix {
-                          nestedSettingsOption = mkOption {
-                            type = types.raw;
-                            description = ''
-                              See [instances.${name}.roles.${roleName}.settings](${baseHref}?option_scope=0&option=inventory.instances.${name}.roles.${roleName}.settings)
-                            '';
-                          };
-                          settingsOption = mkOption {
-                            type = types.submoduleWith {
-                              modules = [ roleSettingsModule ];
-                            };
-                          };
-                        })
-                      ];
-                    };
-                  }
-                ) (settingsModules module);
-              };
-            };
-          };
-        };
-
-      docModules = [
-        {
-          inherit self;
-        }
-        self.modules.clan.default
-        {
-          options.inventory = lib.mkOption {
-            type = types.submoduleWith {
-              modules = [
-                { noInstanceOptions = true; }
-              ]
-              ++ mapAttrsToList fakeInstanceOptions serviceModules;
-            };
-          };
-        }
-      ];

      baseModule =
        # Module
@@ -208,12 +67,6 @@
              title = "Clan Options";
              # scopes = mapAttrsToList mkScope serviceModules;
              scopes = [
-                {
-                  inherit baseHref;
-                  name = "Flake Options (clan.nix file)";
-                  modules = docModules;
-                  urlPrefix = "https://git.clan.lol/clan/clan-core/src/branch/main/";
-                }
                {
                  name = "Machine Options (clan.core NixOS options)";
                  optionsJSON = "${coreOptions}/share/doc/nixos/options.json";
Author	SHA1	Message	Date
Yadunand Prem	9a05d2a072	Drop macOS-specific remote-program param from nix copy command	2025-11-04 01:53:58 +08:00
clan-bot	62b64c3b3e	Merge pull request 'Update nixpkgs-dev in devFlake' (#5728 ) from update-devFlake-nixpkgs-dev into main	2025-11-03 15:07:53 +00:00
clan-bot	19a1ad6081	Update nixpkgs-dev in devFlake	2025-11-03 15:01:50 +00:00
Kenji Berthold	a2df5db3d6	Merge pull request 'docs/testing: Document requirements for our container testing system' (#5693 ) from ke-docs-testing-container into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5693	2025-11-03 13:13:53 +00:00
Kenji Berthold	ac46f890ea	Merge branch 'main' into ke-docs-testing-container	2025-11-03 13:06:14 +00:00
clan-bot	19abf8d288	Merge pull request 'Update nixpkgs-dev in devFlake' (#5726 ) from update-devFlake-nixpkgs-dev into main	2025-11-03 10:06:31 +00:00
clan-bot	e5105e31c4	Update nixpkgs-dev in devFlake	2025-11-03 10:01:47 +00:00
clan-bot	0f847b4799	Merge pull request 'Update nixpkgs-dev in devFlake' (#5724 ) from update-devFlake-nixpkgs-dev into main	2025-11-02 20:06:24 +00:00
clan-bot	40a8a823b8	Update nixpkgs-dev in devFlake	2025-11-02 20:01:50 +00:00
Mic92	e3adb3fc71	Merge pull request 'Fix vars upload for public vars with neededFor activation/partitioning' (#5723 ) from vars into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5723	2025-11-02 16:00:13 +00:00
Jörg Thalheim	a569a1d147	Fix vars upload for public vars with neededFor activation/partitioning When vars are marked with neededFor="activation" or "partitioning", they need to be available early in the boot process. However, the populate_dir methods in both sops and password_store secret backends were only calling self.get() which only retrieves secret vars from the .../secret path. This caused public vars (stored at .../value) to fail with "Secret does not exist" errors when trying to upload them. The fix uses file.value property instead, which properly delegates to the correct store (SecretStore or FactStore) based on whether the file is marked as secret or public. Fixes affected all neededFor phases in both backends: - sops: activation and partitioning phases - password_store: activation and partitioning phases	2025-11-02 16:49:49 +01:00
Mic92	64718b77ca	Merge pull request 'readme fix' (#5722 ) from i18n/clan-core:main into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5722	2025-11-02 15:49:16 +00:00
i18n	7b34c39736	Merge pull request '更新 docs/site/getting-started/creating-your-first-clan.md' (#1 ) from i18n-patch-1 into main Reviewed-on: https://git.clan.lol/i18n/clan-core/pulls/1	2025-11-02 13:24:05 +00:00
i18n	4d6ab60793	更新 docs/site/getting-started/creating-your-first-clan.md	2025-11-02 13:23:04 +00:00
clan-bot	35bffee544	Merge pull request 'Update nixpkgs-dev in devFlake' (#5721 ) from update-devFlake-nixpkgs-dev into main	2025-11-02 10:05:51 +00:00
clan-bot	16917fd79b	Update nixpkgs-dev in devFlake	2025-11-02 10:01:50 +00:00
clan-bot	895c116c01	Merge pull request 'Update nix-darwin' (#5720 ) from update-nix-darwin into main	2025-11-02 05:06:00 +00:00
clan-bot	e67151f7b9	Merge pull request 'Update flake-parts' (#5719 ) from update-flake-parts into main	2025-11-02 05:05:06 +00:00
clan-bot	8d26ec1760	Update nix-darwin	2025-11-02 05:01:04 +00:00
clan-bot	7a9062b629	Update flake-parts	2025-11-02 05:01:01 +00:00
clan-bot	de07454a0a	Merge pull request 'Update nix-darwin' (#5718 ) from update-nix-darwin into main	2025-11-01 20:06:16 +00:00
clan-bot	6fe60f61cf	Update nix-darwin	2025-11-01 20:00:58 +00:00
clan-bot	3fa74847e4	Merge pull request 'Update nixpkgs-dev in devFlake' (#5716 ) from update-devFlake-nixpkgs-dev into main	2025-11-01 15:06:01 +00:00
clan-bot	fc37140b52	Update nixpkgs-dev in devFlake	2025-11-01 15:01:52 +00:00
hsjobeki	83406c61f3	Merge pull request 'services: update hello-world readme and tests' (#5714 ) from update-docs into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5714	2025-11-01 11:37:39 +00:00
hsjobeki	6d736e7e80	Merge pull request 'docs: update experimental notes as planned in release-notes' (#5715 ) from ex-docs into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5715	2025-11-01 11:35:29 +00:00
Johannes Kirschbauer	7b6cec4100	services: update hello-world readme and tests	2025-11-01 12:33:15 +01:00
Johannes Kirschbauer	e21a6516b5	docs: update experimental notes as planned in release-notes	2025-11-01 12:30:01 +01:00
Mic92	6ffe8ea5f6	Merge pull request 'treewide: replace pkgs.hostPlatform with pkgs.stdenv.hostPlatform' (#5713 ) from fix-eval into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5713	2025-10-31 17:57:38 +00:00
Jörg Thalheim	0a2fefd141	treewide: replace pkgs.hostPlatform with pkgs.stdenv.hostPlatform nixpkgs now throws an error for this, the other variant in stdenv also exists in the previous release	2025-10-31 18:52:31 +01:00
Luis Hebendanz	0c885d05b6	Merge pull request 'clan_lib/flake: Improve select error message' (#5711 ) from Qubasa/clan-core:improve_clan_select_error_message into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5711	2025-10-31 15:11:29 +00:00
Qubasa	58d85b117a	clan_lib/flake: Improve select error message	2025-10-31 16:05:54 +01:00
clan-bot	ad58d7b6e9	Merge pull request 'Update nixpkgs-dev in devFlake' (#5710 ) from update-devFlake-nixpkgs-dev into main	2025-10-31 15:05:13 +00:00
clan-bot	7a63cb9642	Update nixpkgs-dev in devFlake	2025-10-31 15:01:50 +00:00
clan-bot	196b98da36	Merge pull request 'Update disko' (#5707 ) from update-disko into main	2025-10-31 10:10:34 +00:00
clan-bot	42acbe95b8	Update disko	2025-10-31 10:00:58 +00:00
clan-bot	b6b065e365	Merge pull request 'Update nixpkgs-dev in devFlake' (#5706 ) from update-devFlake-nixpkgs-dev into main	2025-10-31 00:08:41 +00:00
clan-bot	4b1955b189	Update nixpkgs-dev in devFlake	2025-10-31 00:02:00 +00:00
clan-bot	ef7ef8b843	Merge pull request 'Update nixpkgs-dev in devFlake' (#5704 ) from update-devFlake-nixpkgs-dev into main	2025-10-30 20:05:49 +00:00
clan-bot	38c1367322	Update nixpkgs-dev in devFlake	2025-10-30 20:01:49 +00:00
clan-bot	8e72c086fd	Merge pull request 'Update nixpkgs-dev in devFlake' (#5702 ) from update-devFlake-nixpkgs-dev into main	2025-10-30 15:06:22 +00:00
clan-bot	c454b1339d	Update nixpkgs-dev in devFlake	2025-10-30 15:01:51 +00:00
hsjobeki	d1b2d43e5b	Merge pull request 'services: move into clan submodule' (#5701 ) from unify-clan into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5701	2025-10-30 13:00:14 +00:00
Johannes Kirschbauer	da98ca0f1c	clanLib: remove unused mapInstances	2025-10-30 13:54:05 +01:00
Johannes Kirschbauer	1953540d08	tests: update inventory tests to use whole clan modules	2025-10-30 13:54:05 +01:00
Johannes Kirschbauer	be31b9ce21	docs: remove service options from nuschtSearch These hacks are blocking the flake level vars and exports Maybe we bring this back later So far nobody seemed using nuschtSearch	2025-10-30 13:54:05 +01:00
Johannes Kirschbauer	169b4016e6	docs: set self to clan-core for docs	2025-10-30 13:53:49 +01:00
Johannes Kirschbauer	2e55028a1b	services: move into clan submodule	2025-10-30 13:53:49 +01:00
hsjobeki	1d228231f2	Merge pull request 'clan/services: Reduce surface of services wrapper function' (#5700 ) from unify-clan into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5700	2025-10-30 09:49:56 +00:00
Johannes Kirschbauer	affb926450	services: remove duplicate module args	2025-10-30 10:10:55 +01:00
Johannes Kirschbauer	c7f65e929f	inventoryAdapter: replace importedModulesEvaluated by equivalent config	2025-10-30 10:10:31 +01:00
hsjobeki	ba4ff493e8	Merge pull request 'revert: uniqueStrings' (#5699 ) from hsjobeki-patch-1 into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5699	2025-10-30 08:34:59 +00:00
hsjobeki	eb08803e2a	revert `bfb30251e6` revert lib: replace uniqueStrings after upstreamed TODO: Reapply after 25.11 release	2025-10-30 08:29:43 +00:00
clan-bot	bbc9486f0e	Merge pull request 'Update nixpkgs-dev in devFlake' (#5697 ) from update-devFlake-nixpkgs-dev into main	2025-10-29 20:06:16 +00:00
clan-bot	999d709350	Update nixpkgs-dev in devFlake	2025-10-29 20:01:48 +00:00
clan-bot	0b1a330cc2	Merge pull request 'Update nixpkgs-dev in devFlake' (#5696 ) from update-devFlake-nixpkgs-dev into main	2025-10-29 15:06:14 +00:00
clan-bot	995b7cf50d	Update nixpkgs-dev in devFlake	2025-10-29 15:01:49 +00:00
a-kenji	bc290fe59f	docs/testing: Document requirements for our container testing system Document the requirements for our container testing system: - uid-range - auto-allocate-uids Further document that the container tests are used by default and how to switch to the more traditional and more supported / featureful VM testing framework.	2025-10-29 13:47:26 +01:00
clan-bot	5477b13233	Merge pull request 'Update nuschtos in devFlake' (#5690 ) from update-devFlake-nuschtos into main	2025-10-29 10:08:23 +00:00
clan-bot	d6170e5efb	Update nuschtos in devFlake	2025-10-29 10:01:53 +00:00
clan-bot	18fe117363	Merge pull request 'Update nixpkgs-dev in devFlake' (#5689 ) from update-devFlake-nixpkgs-dev into main	2025-10-29 00:07:47 +00:00
clan-bot	33a868acc2	Update nixpkgs-dev in devFlake	2025-10-29 00:03:27 +00:00
hsjobeki	11372d35e1	Merge pull request 'clan/checks: fix clanLib not checking' (#5685 ) from check into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5685	2025-10-28 10:51:17 +00:00
Johannes Kirschbauer	b7508b2b43	clan/checks: fix clanLib not checking	2025-10-28 11:46:49 +01:00
clan-bot	183817b769	Merge pull request 'Update nixpkgs-dev in devFlake' (#5684 ) from update-devFlake-nixpkgs-dev into main	2025-10-28 10:08:10 +00:00
clan-bot	591e53e9be	Update nixpkgs-dev in devFlake	2025-10-28 10:01:54 +00:00
hsjobeki	a6a6415e31	Merge pull request 'clan/checks: move into lib function; add tests' (#5683 ) from role-settings into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5683	2025-10-28 08:46:41 +00:00
Johannes Kirschbauer	0060ead876	clan/checks: move into lib function; add tests	2025-10-28 09:40:31 +01:00
hsjobeki	224e41d3ad	Merge pull request 'modules: clean up clan module' (#5679 ) from role-settings into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5679	2025-10-28 08:22:46 +00:00
Johannes Kirschbauer	b3323007b2	test: update test filesets	2025-10-28 09:04:50 +01:00
Johannes Kirschbauer	3e950bc66f	docs: add doc-comment for template submodule	2025-10-28 09:04:50 +01:00
Johannes Kirschbauer	9503b46b21	modules: rename arbitrary interface.nix to 'top-level-interface'	2025-10-28 09:04:50 +01:00
Johannes Kirschbauer	a2cec323a2	modules: move nixos modules into nixosModules folder	2025-10-28 09:04:50 +01:00
Johannes Kirschbauer	4239f4d27f	clan/module: explain throw	2025-10-28 09:04:50 +01:00
clan-bot	8ac8264997	Merge pull request 'Update nixpkgs-dev in devFlake' (#5681 ) from update-devFlake-nixpkgs-dev into main	2025-10-27 20:06:57 +00:00
clan-bot	544a53ae9c	Update nixpkgs-dev in devFlake	2025-10-27 20:01:46 +00:00
Luis Hebendanz	89e18482ed	Merge pull request 'checks: Fix flakey llm test, improve performance' (#5678 ) from Qubasa/clan-core:fix_slow_llm into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5678	2025-10-27 16:34:21 +00:00
Qubasa	a8217b5a32	llm checks: Skip parts of the test on aarch64 for performance	2025-10-27 17:25:06 +01:00
Qubasa	bdd5de5628	checks: Fix flakey llm test, improve performance	2025-10-27 17:12:12 +01:00
Mic92	61d8bfd0d1	Merge pull request 'fix: respect directory parameter in machines_dir' (#5677 ) from fix-custom-directory into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5677 Reviewed-by: hsjobeki <hsjobeki@gmail.com>	2025-10-27 15:42:44 +00:00
Jörg Thalheim	b8d79c7fc2	fix: respect directory parameter in machines_dir The machines_dir() function was hardcoding "machines" without considering the directory parameter from buildClan/clan configuration. This caused update-hardware-config and other commands to write files to the wrong location when a custom directory was specified (e.g., directory = ./clan). Solution: 1. Added relativeDirectory to inventoryClass in Nix, computed where both self and directory have consistent store paths during evaluation 2. Updated machines_dir() to use this pre-computed relative path from Nix via flake.select("clanInternals.inventoryClass.relativeDirectory") Fixes: https://git.clan.lol/clan/clan-core/issues/2906	2025-10-27 16:37:07 +01:00
hsjobeki	fb25ab028b	Merge pull request 'services: add role settings with explicit warning' (#5676 ) from role-settings into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5676	2025-10-27 15:33:39 +00:00
clan-bot	5b136ecaf0	Merge pull request 'Update nixpkgs-dev in devFlake' (#5675 ) from update-devFlake-nixpkgs-dev into main	2025-10-27 15:08:23 +00:00
clan-bot	d4733dbb0a	Update nixpkgs-dev in devFlake	2025-10-27 15:01:55 +00:00
Johannes Kirschbauer	bfb30251e6	lib: replace uniqueStrings after upstreamed	2025-10-27 14:00:46 +01:00
Johannes Kirschbauer	33115f76b7	services: add role settings with explicit warning	2025-10-27 13:31:44 +01:00
pinpox	9e9208e699	Merge pull request 'yggdrasil: read peers from exports' (#5657 ) from yggdrasil-export-peers into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5657	2025-10-27 12:13:59 +00:00
hsjobeki	6b3fd57174	Merge pull request 'extraModules: soft deprecation for string extraModules' (#5656 ) from inline into main Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/5656	2025-10-27 12:12:17 +00:00
clan-bot	3be5237cf6	Merge pull request 'Update nixpkgs-dev in devFlake' (#5674 ) from update-devFlake-nixpkgs-dev into main	2025-10-26 20:06:09 +00:00
clan-bot	368f80eaae	Merge pull request 'Update nix-darwin' (#5665 ) from update-nix-darwin into main	2025-10-26 20:04:12 +00:00
clan-bot	4d7079534c	Update nixpkgs-dev in devFlake	2025-10-26 20:01:51 +00:00
clan-bot	7d4cf1c551	Update nix-darwin	2025-10-26 20:00:59 +00:00
Johannes Kirschbauer	1aba0577dc	schemas: filter 'extraModules' from python classes and derived schemas	2025-10-24 16:57:26 +02:00
Johannes Kirschbauer	6ee4657da3	extraModules: soft deprecation for string extraModules	2025-10-24 12:54:17 +02:00