From 4ac7b49cd7a31fed8cd3fa0f09fe8fc2bae276c6 Mon Sep 17 00:00:00 2001
From: Mohammad Rafiq <rafiq@rrv.sh>
Date: Sun, 7 Jun 2026 06:30:49 +0800
Subject: [PATCH 1/9] fix(ci): stabilize nix builds

---
 .github/workflows/build.yaml         |  2 ++
 .github/workflows/publish-cache.yaml |  2 ++
 flake.lock                           | 49 ----------------------------
 flake.nix                            |  1 -
 nix/modules/prismlauncher.nix        |  4 +--
 5 files changed, 6 insertions(+), 52 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 85f932ec..dc989741 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -34,6 +34,7 @@ jobs:
         timeout-minutes: 5
         uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
         with:
+          install_url: https://releases.nixos.org/nix/nix-2.34.7/install
           extra_nix_config: |
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
@@ -69,6 +70,7 @@ jobs:
         timeout-minutes: 5
         uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
         with:
+          install_url: https://releases.nixos.org/nix/nix-2.34.7/install
           extra_nix_config: |
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/publish-cache.yaml b/.github/workflows/publish-cache.yaml
index 69ef9483..3680176f 100644
--- a/.github/workflows/publish-cache.yaml
+++ b/.github/workflows/publish-cache.yaml
@@ -35,6 +35,7 @@ jobs:
         timeout-minutes: 5
         uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
         with:
+          install_url: https://releases.nixos.org/nix/nix-2.34.7/install
           extra_nix_config: |
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
@@ -71,6 +72,7 @@ jobs:
         timeout-minutes: 5
         uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
         with:
+          install_url: https://releases.nixos.org/nix/nix-2.34.7/install
           extra_nix_config: |
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
diff --git a/flake.lock b/flake.lock
index 34770058..12a0c2bc 100644
--- a/flake.lock
+++ b/flake.lock
@@ -590,22 +590,6 @@
         "type": "github"
       }
     },
-    "libnbtplusplus": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1772016279,
-        "narHash": "sha256-7itkptyjoRcXfGLwg1/jxajetZ3a4mDc66+w4X6yW8s=",
-        "owner": "PrismLauncher",
-        "repo": "libnbtplusplus",
-        "rev": "687e43031df0dc641984b4256bcca50d5b3f7de3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "PrismLauncher",
-        "repo": "libnbtplusplus",
-        "type": "github"
-      }
-    },
     "mac-app-util": {
       "inputs": {
         "cl-nix-lite": "cl-nix-lite",
@@ -823,19 +807,6 @@
         "type": "github"
       }
     },
-    "nixpkgs_6": {
-      "locked": {
-        "lastModified": 1774709303,
-        "narHash": "sha256-D4ely1FsBcvtj/qSrNhSWpq+CUZKNiKwJIxpxnfy9o4=",
-        "rev": "8110df5ad7abf5d4c0f6fb0f8f978390e77f9685",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre971119.8110df5ad7ab/nixexprs.tar.xz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
-      }
-    },
     "path-from-root-yazi": {
       "flake": false,
       "locked": {
@@ -875,25 +846,6 @@
         "type": "github"
       }
     },
-    "prismlauncher-cracked": {
-      "inputs": {
-        "libnbtplusplus": "libnbtplusplus",
-        "nixpkgs": "nixpkgs_6"
-      },
-      "locked": {
-        "lastModified": 1776795718,
-        "narHash": "sha256-yaY/x2U2K/o2lT1ROkqmUzPlwne5pwJmCY5aoS59nLI=",
-        "owner": "Diegiwg",
-        "repo": "PrismLauncher-Cracked",
-        "rev": "0c20d448a3c89cbff85ef5dc7420bf60dc1e65ff",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Diegiwg",
-        "repo": "PrismLauncher-Cracked",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "flake-parts": "flake-parts",
@@ -910,7 +862,6 @@
         "nixpkgs": "nixpkgs_5",
         "nixpkgs-firefox-darwin": "nixpkgs-firefox-darwin",
         "path-from-root-yazi": "path-from-root-yazi",
-        "prismlauncher-cracked": "prismlauncher-cracked",
         "rust-overlay": "rust-overlay",
         "sops-nix": "sops-nix",
         "waybar-peek": "waybar-peek",
diff --git a/flake.nix b/flake.nix
index ecf015bc..5967d887 100644
--- a/flake.nix
+++ b/flake.nix
@@ -27,7 +27,6 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    prismlauncher-cracked.url = "github:Diegiwg/PrismLauncher-Cracked";
     rust-overlay = {
       url = "github:oxalica/rust-overlay";
       inputs.nixpkgs.follows = "nixpkgs";
diff --git a/nix/modules/prismlauncher.nix b/nix/modules/prismlauncher.nix
index 2702703f..c2b0faee 100644
--- a/nix/modules/prismlauncher.nix
+++ b/nix/modules/prismlauncher.nix
@@ -1,4 +1,4 @@
-{ inputs, config, ... }:
+{ config, ... }:
 let
   cfg = config.flake;
   osModule = {
@@ -13,7 +13,7 @@ in
       { pkgs, ... }:
       {
         home.packages = [
-          (inputs.prismlauncher-cracked.packages.${pkgs.stdenv.hostPlatform.system}.prismlauncher.override {
+          (pkgs.prismlauncher.override {
             jdks = [ pkgs.jdk25 ];
           })
         ];

From 3a8a0256185d6f11e0a2f2569ec80bbcb04950c1 Mon Sep 17 00:00:00 2001
From: Mohammad Rafiq <rafiq@rrv.sh>
Date: Sun, 7 Jun 2026 07:08:06 +0800
Subject: [PATCH 2/9] remove the version pin

---
 .github/workflows/build.yaml         | 2 --
 .github/workflows/publish-cache.yaml | 2 --
 2 files changed, 4 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index dc989741..85f932ec 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -34,7 +34,6 @@ jobs:
         timeout-minutes: 5
         uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
         with:
-          install_url: https://releases.nixos.org/nix/nix-2.34.7/install
           extra_nix_config: |
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
@@ -70,7 +69,6 @@ jobs:
         timeout-minutes: 5
         uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
         with:
-          install_url: https://releases.nixos.org/nix/nix-2.34.7/install
           extra_nix_config: |
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/publish-cache.yaml b/.github/workflows/publish-cache.yaml
index 3680176f..69ef9483 100644
--- a/.github/workflows/publish-cache.yaml
+++ b/.github/workflows/publish-cache.yaml
@@ -35,7 +35,6 @@ jobs:
         timeout-minutes: 5
         uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
         with:
-          install_url: https://releases.nixos.org/nix/nix-2.34.7/install
           extra_nix_config: |
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
@@ -72,7 +71,6 @@ jobs:
         timeout-minutes: 5
         uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
         with:
-          install_url: https://releases.nixos.org/nix/nix-2.34.7/install
           extra_nix_config: |
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 

From 05392843ebc7890adf6d3e4f84703923c0f9497f Mon Sep 17 00:00:00 2001
From: Mohammad Rafiq <rafiq@rrv.sh>
Date: Sun, 7 Jun 2026 07:33:00 +0800
Subject: [PATCH 3/9] feat(ci): cache rosetta builder image

---
 .github/workflows/build.yaml           | 31 +++++++++++++++++++++++++
 .github/workflows/publish-cache.yaml   | 32 ++++++++++++++++++++++++++
 nix/packages/rosetta-builder-image.nix |  5 ++++
 3 files changed, 68 insertions(+)
 create mode 100644 nix/packages/rosetta-builder-image.nix

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 85f932ec..4989a218 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -12,6 +12,34 @@ permissions:
   contents: read
 
 jobs:
+  rosetta-image:
+    name: Rosetta builder image
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - name: Checkout repository
+        timeout-minutes: 5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
+
+      - name: Install Nix
+        timeout-minutes: 5
+        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
+        with:
+          extra_nix_config: |
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+
+      - name: Use Cachix
+        uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+        with:
+          name: rrvsh
+          extraPullNames: nix-community,hyprland,yazi
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+      - name: Build and publish Rosetta builder image
+        timeout-minutes: 120
+        run: nix build --print-build-logs .#packages.aarch64-linux.rosetta-builder-image
+
   linux:
     name: Linux ${{ matrix.target }}
     runs-on: ubuntu-latest
@@ -41,6 +69,7 @@ jobs:
         uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         with:
           name: rrvsh
+          extraPullNames: nix-community,hyprland,yazi
           skipPush: true
 
       - name: Build output
@@ -49,6 +78,7 @@ jobs:
 
   darwin:
     name: Darwin ${{ matrix.target }}
+    needs: rosetta-image
     runs-on: macos-14
     strategy:
       fail-fast: false
@@ -79,6 +109,7 @@ jobs:
         uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         with:
           name: rrvsh
+          extraPullNames: nix-community,hyprland,yazi
           skipPush: true
 
       - name: Build output
diff --git a/.github/workflows/publish-cache.yaml b/.github/workflows/publish-cache.yaml
index 69ef9483..68485e90 100644
--- a/.github/workflows/publish-cache.yaml
+++ b/.github/workflows/publish-cache.yaml
@@ -12,6 +12,35 @@ permissions:
   contents: read
 
 jobs:
+  rosetta-image:
+    name: Rosetta builder image
+    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/prime' }}
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - name: Checkout repository
+        timeout-minutes: 5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
+
+      - name: Install Nix
+        timeout-minutes: 5
+        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
+        with:
+          extra_nix_config: |
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+
+      - name: Use Cachix
+        uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+        with:
+          name: rrvsh
+          extraPullNames: nix-community,hyprland,yazi
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+      - name: Build and publish Rosetta builder image
+        timeout-minutes: 120
+        run: nix build --print-build-logs .#packages.aarch64-linux.rosetta-builder-image
+
   linux:
     name: Linux ${{ matrix.target }}
     if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/prime' }}
@@ -42,6 +71,7 @@ jobs:
         uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         with:
           name: rrvsh
+          extraPullNames: nix-community,hyprland,yazi
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
       - name: Build and publish output
@@ -50,6 +80,7 @@ jobs:
 
   darwin:
     name: Darwin ${{ matrix.target }}
+    needs: rosetta-image
     if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/prime' }}
     runs-on: macos-14
     strategy:
@@ -81,6 +112,7 @@ jobs:
         uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         with:
           name: rrvsh
+          extraPullNames: nix-community,hyprland,yazi
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
       - name: Build and publish output
diff --git a/nix/packages/rosetta-builder-image.nix b/nix/packages/rosetta-builder-image.nix
new file mode 100644
index 00000000..13c9c3d8
--- /dev/null
+++ b/nix/packages/rosetta-builder-image.nix
@@ -0,0 +1,5 @@
+{ inputs, ... }:
+{
+  config.flake.packages.aarch64-linux.rosetta-builder-image =
+    inputs.nix-rosetta-builder.packages.aarch64-linux.image;
+}

From 1201518eb7e02f633ea759664f5e05c7de34635e Mon Sep 17 00:00:00 2001
From: Mohammad Rafiq <rafiq@rrv.sh>
Date: Sun, 7 Jun 2026 07:33:03 +0800
Subject: [PATCH 4/9] feat(nix): add nh flake auto-upgrade

---
 nix/modules/auto-upgrade.nix | 69 ++++++++++++++++++++++++++++++++++++
 nix/profiles/default.nix     |  2 ++
 2 files changed, 71 insertions(+)
 create mode 100644 nix/modules/auto-upgrade.nix

diff --git a/nix/modules/auto-upgrade.nix b/nix/modules/auto-upgrade.nix
new file mode 100644
index 00000000..20ff1a32
--- /dev/null
+++ b/nix/modules/auto-upgrade.nix
@@ -0,0 +1,69 @@
+_:
+let
+  flakeRef = "github:rrvsh/tools/prime";
+  serviceName = "nh-flake-upgrade";
+in
+{
+  config.flake.modules = {
+    darwin.auto-upgrade =
+      { config, pkgs, ... }:
+      {
+        environment = {
+          systemPackages = [ pkgs.nh ];
+          variables.NH_FLAKE = flakeRef;
+        };
+        launchd.daemons.${serviceName} = {
+          script = ''
+            exec ${pkgs.nh}/bin/nh darwin switch ${flakeRef} \
+              --hostname ${config.networking.hostName} \
+              --refresh \
+              --no-nom \
+              --bypass-root-check
+          '';
+          serviceConfig = {
+            RunAtLoad = true;
+            StartInterval = 86400;
+            StandardOutPath = "/var/log/${serviceName}.log";
+            StandardErrorPath = "/var/log/${serviceName}.err.log";
+          };
+        };
+      };
+    nixos.auto-upgrade =
+      { config, pkgs, ... }:
+      {
+        programs.nh = {
+          enable = true;
+          flake = flakeRef;
+        };
+        systemd = {
+          services.${serviceName} = {
+            description = "Upgrade system from flake with nh";
+            after = [ "network-online.target" ];
+            wants = [ "network-online.target" ];
+            path = [
+              config.nix.package
+              config.programs.ssh.package
+              pkgs.gitMinimal
+              pkgs.nh
+            ];
+            script = ''
+              exec nh os switch ${flakeRef} \
+                --hostname ${config.networking.hostName} \
+                --refresh \
+                --no-nom
+            '';
+            serviceConfig.Type = "oneshot";
+          };
+          timers.${serviceName} = {
+            wantedBy = [ "timers.target" ];
+            timerConfig = {
+              OnBootSec = "15min";
+              OnUnitActiveSec = "24h";
+              RandomizedDelaySec = "1h";
+              Persistent = true;
+            };
+          };
+        };
+      };
+  };
+}
diff --git a/nix/profiles/default.nix b/nix/profiles/default.nix
index c037fa57..41739042 100644
--- a/nix/profiles/default.nix
+++ b/nix/profiles/default.nix
@@ -6,6 +6,7 @@ in
   config.flake.modules.darwin.profile-default = {
     imports = with cfg.modules.darwin; [
       allowedUnfreePackages
+      auto-upgrade
       homebrew
       nix-settings
       ssh-config
@@ -18,6 +19,7 @@ in
   config.flake.modules.nixos.profile-default = {
     imports = with cfg.modules.nixos; [
       allowedUnfreePackages
+      auto-upgrade
       nix-settings
       ssh-config
     ];

From aacc8eae601d34b182db33c87686dee8013029df Mon Sep 17 00:00:00 2001
From: Mohammad Rafiq <rafiq@rrv.sh>
Date: Sun, 7 Jun 2026 07:33:07 +0800
Subject: [PATCH 5/9] feat(ci): schedule flake lock updates

---
 .github/workflows/update-flake-lock.yaml | 47 ++++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 .github/workflows/update-flake-lock.yaml

diff --git a/.github/workflows/update-flake-lock.yaml b/.github/workflows/update-flake-lock.yaml
new file mode 100644
index 00000000..85fde2d8
--- /dev/null
+++ b/.github/workflows/update-flake-lock.yaml
@@ -0,0 +1,47 @@
+name: Update Nix flake lock
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 8 * * 0"
+
+concurrency:
+  group: update-flake-lock-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  update-flake-lock:
+    name: Update flake.lock
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        timeout-minutes: 5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          ref: prime
+          persist-credentials: false
+
+      - name: Install Nix
+        timeout-minutes: 5
+        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
+        with:
+          extra_nix_config: |
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+
+      - name: Update flake.lock
+        id: update
+        uses: DeterminateSystems/update-flake-lock@b83e0671a67dfd774680fb1beaa1497ef7e58bfc
+        with:
+          token: ${{ secrets.GH_TOKEN_FOR_UPDATES || github.token }}
+          base: prime
+          branch: update-flake-lock
+          commit-msg: "chore(nix): update flake.lock"
+          pr-title: "chore(nix): update flake.lock"
+          pr-labels: |
+            dependencies
+            nix

From e96685fc3f91de08796523f23575b30035b0be16 Mon Sep 17 00:00:00 2001
From: Mohammad Rafiq <rafiq@rrv.sh>
Date: Sun, 7 Jun 2026 07:44:35 +0800
Subject: [PATCH 6/9] fix(ci): allow rosetta image fallback emulation

---
 .github/workflows/build.yaml         | 1 +
 .github/workflows/publish-cache.yaml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 4989a218..d9e4933c 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -28,6 +28,7 @@ jobs:
         with:
           extra_nix_config: |
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+            system-features = benchmark big-parallel nixos-test uid-range kvm
 
       - name: Use Cachix
         uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
diff --git a/.github/workflows/publish-cache.yaml b/.github/workflows/publish-cache.yaml
index 68485e90..819e6360 100644
--- a/.github/workflows/publish-cache.yaml
+++ b/.github/workflows/publish-cache.yaml
@@ -29,6 +29,7 @@ jobs:
         with:
           extra_nix_config: |
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+            system-features = benchmark big-parallel nixos-test uid-range kvm
 
       - name: Use Cachix
         uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17

From 6a5199c77728cbfd30e393473d2df00c9e34b68d Mon Sep 17 00:00:00 2001
From: Mohammad Rafiq <rafiq@rrv.sh>
Date: Sun, 7 Jun 2026 08:29:30 +0800
Subject: [PATCH 7/9] fix(ci): cache alpha rosetta image derivation

---
 .github/workflows/build.yaml           | 17 +++++++++++++++--
 .github/workflows/publish-cache.yaml   | 17 +++++++++++++++--
 nix/packages/rosetta-builder-image.nix |  5 -----
 3 files changed, 30 insertions(+), 9 deletions(-)
 delete mode 100644 nix/packages/rosetta-builder-image.nix

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index d9e4933c..4636d17b 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -37,9 +37,22 @@ jobs:
           extraPullNames: nix-community,hyprland,yazi
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
-      - name: Build and publish Rosetta builder image
+      - name: Build and publish alpha Rosetta builder image
         timeout-minutes: 120
-        run: nix build --print-build-logs .#packages.aarch64-linux.rosetta-builder-image
+        run: |
+          drv_count="$({
+            nix derivation show --recursive .#darwinConfigurations.alpha.system \
+              | jq -r '
+                .derivations
+                | to_entries[]
+                | select(.value.system == "aarch64-linux")
+                | select(.key | endswith("-nixos-disk-image.drv"))
+                | "/nix/store/" + .key
+              '
+          } | tee /tmp/alpha-rosetta-image-drvs | wc -l)"
+          test "$drv_count" -eq 1
+          drv="$(cat /tmp/alpha-rosetta-image-drvs)"
+          nix build --print-build-logs "$drv"
 
   linux:
     name: Linux ${{ matrix.target }}
diff --git a/.github/workflows/publish-cache.yaml b/.github/workflows/publish-cache.yaml
index 819e6360..ff7ccab3 100644
--- a/.github/workflows/publish-cache.yaml
+++ b/.github/workflows/publish-cache.yaml
@@ -38,9 +38,22 @@ jobs:
           extraPullNames: nix-community,hyprland,yazi
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
-      - name: Build and publish Rosetta builder image
+      - name: Build and publish alpha Rosetta builder image
         timeout-minutes: 120
-        run: nix build --print-build-logs .#packages.aarch64-linux.rosetta-builder-image
+        run: |
+          drv_count="$({
+            nix derivation show --recursive .#darwinConfigurations.alpha.system \
+              | jq -r '
+                .derivations
+                | to_entries[]
+                | select(.value.system == "aarch64-linux")
+                | select(.key | endswith("-nixos-disk-image.drv"))
+                | "/nix/store/" + .key
+              '
+          } | tee /tmp/alpha-rosetta-image-drvs | wc -l)"
+          test "$drv_count" -eq 1
+          drv="$(cat /tmp/alpha-rosetta-image-drvs)"
+          nix build --print-build-logs "$drv"
 
   linux:
     name: Linux ${{ matrix.target }}
diff --git a/nix/packages/rosetta-builder-image.nix b/nix/packages/rosetta-builder-image.nix
deleted file mode 100644
index 13c9c3d8..00000000
--- a/nix/packages/rosetta-builder-image.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-{ inputs, ... }:
-{
-  config.flake.packages.aarch64-linux.rosetta-builder-image =
-    inputs.nix-rosetta-builder.packages.aarch64-linux.image;
-}

From fcadd5711d6c17a8c24860a89e015ad6e7d52c78 Mon Sep 17 00:00:00 2001
From: Mohammad Rafiq <rafiq@rrv.sh>
Date: Sun, 7 Jun 2026 08:44:41 +0800
Subject: [PATCH 8/9] testing stuff and clearing cruft

---
 .github/workflows/build.yaml             | 84 +----------------------
 .github/workflows/publish-cache.yaml     | 86 +-----------------------
 .github/workflows/update-flake-lock.yaml |  9 +--
 nix/modules/auto-upgrade.nix             | 20 +-----
 4 files changed, 7 insertions(+), 192 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 4636d17b..7834b388 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -12,48 +12,6 @@ permissions:
   contents: read
 
 jobs:
-  rosetta-image:
-    name: Rosetta builder image
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - name: Checkout repository
-        timeout-minutes: 5
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-        with:
-          persist-credentials: false
-
-      - name: Install Nix
-        timeout-minutes: 5
-        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
-        with:
-          extra_nix_config: |
-            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
-            system-features = benchmark big-parallel nixos-test uid-range kvm
-
-      - name: Use Cachix
-        uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
-        with:
-          name: rrvsh
-          extraPullNames: nix-community,hyprland,yazi
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-
-      - name: Build and publish alpha Rosetta builder image
-        timeout-minutes: 120
-        run: |
-          drv_count="$({
-            nix derivation show --recursive .#darwinConfigurations.alpha.system \
-              | jq -r '
-                .derivations
-                | to_entries[]
-                | select(.value.system == "aarch64-linux")
-                | select(.key | endswith("-nixos-disk-image.drv"))
-                | "/nix/store/" + .key
-              '
-          } | tee /tmp/alpha-rosetta-image-drvs | wc -l)"
-          test "$drv_count" -eq 1
-          drv="$(cat /tmp/alpha-rosetta-image-drvs)"
-          nix build --print-build-logs "$drv"
-
   linux:
     name: Linux ${{ matrix.target }}
     runs-on: ubuntu-latest
@@ -83,47 +41,7 @@ jobs:
         uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         with:
           name: rrvsh
-          extraPullNames: nix-community,hyprland,yazi
-          skipPush: true
-
-      - name: Build output
-        timeout-minutes: 120
-        run: nix build --print-build-logs "${{ matrix.target }}"
-
-  darwin:
-    name: Darwin ${{ matrix.target }}
-    needs: rosetta-image
-    runs-on: macos-14
-    strategy:
-      fail-fast: false
-      matrix:
-        target:
-          - .#packages.aarch64-darwin.site-bin
-          - .#packages.aarch64-darwin.site-deploy
-          - .#darwinConfigurations.alpha.system
-          - .#darwinConfigurations.auto.system
-    steps:
-      - name: Checkout repository
-        timeout-minutes: 5
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-        with:
-          persist-credentials: false
-
-      - name: Install Nix
-        timeout-minutes: 5
-        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
-        with:
-          extra_nix_config: |
-            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
-
-      - name: Check runner system
-        run: test "$(nix eval --impure --raw --expr builtins.currentSystem)" = aarch64-darwin
-
-      - name: Use Cachix
-        uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
-        with:
-          name: rrvsh
-          extraPullNames: nix-community,hyprland,yazi
+          extraPullNames: nix-community,hyprland,yazi,cuda-maintainers
           skipPush: true
 
       - name: Build output
diff --git a/.github/workflows/publish-cache.yaml b/.github/workflows/publish-cache.yaml
index ff7ccab3..b853d5b0 100644
--- a/.github/workflows/publish-cache.yaml
+++ b/.github/workflows/publish-cache.yaml
@@ -12,49 +12,6 @@ permissions:
   contents: read
 
 jobs:
-  rosetta-image:
-    name: Rosetta builder image
-    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/prime' }}
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - name: Checkout repository
-        timeout-minutes: 5
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-        with:
-          persist-credentials: false
-
-      - name: Install Nix
-        timeout-minutes: 5
-        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
-        with:
-          extra_nix_config: |
-            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
-            system-features = benchmark big-parallel nixos-test uid-range kvm
-
-      - name: Use Cachix
-        uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
-        with:
-          name: rrvsh
-          extraPullNames: nix-community,hyprland,yazi
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-
-      - name: Build and publish alpha Rosetta builder image
-        timeout-minutes: 120
-        run: |
-          drv_count="$({
-            nix derivation show --recursive .#darwinConfigurations.alpha.system \
-              | jq -r '
-                .derivations
-                | to_entries[]
-                | select(.value.system == "aarch64-linux")
-                | select(.key | endswith("-nixos-disk-image.drv"))
-                | "/nix/store/" + .key
-              '
-          } | tee /tmp/alpha-rosetta-image-drvs | wc -l)"
-          test "$drv_count" -eq 1
-          drv="$(cat /tmp/alpha-rosetta-image-drvs)"
-          nix build --print-build-logs "$drv"
-
   linux:
     name: Linux ${{ matrix.target }}
     if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/prime' }}
@@ -85,48 +42,7 @@ jobs:
         uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         with:
           name: rrvsh
-          extraPullNames: nix-community,hyprland,yazi
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-
-      - name: Build and publish output
-        timeout-minutes: 120
-        run: nix build --print-build-logs "${{ matrix.target }}"
-
-  darwin:
-    name: Darwin ${{ matrix.target }}
-    needs: rosetta-image
-    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/prime' }}
-    runs-on: macos-14
-    strategy:
-      fail-fast: false
-      matrix:
-        target:
-          - .#packages.aarch64-darwin.site-bin
-          - .#packages.aarch64-darwin.site-deploy
-          - .#darwinConfigurations.alpha.system
-          - .#darwinConfigurations.auto.system
-    steps:
-      - name: Checkout repository
-        timeout-minutes: 5
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-        with:
-          persist-credentials: false
-
-      - name: Install Nix
-        timeout-minutes: 5
-        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
-        with:
-          extra_nix_config: |
-            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
-
-      - name: Check runner system
-        run: test "$(nix eval --impure --raw --expr builtins.currentSystem)" = aarch64-darwin
-
-      - name: Use Cachix
-        uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
-        with:
-          name: rrvsh
-          extraPullNames: nix-community,hyprland,yazi
+          extraPullNames: nix-community,hyprland,yazi,cuda-maintainers
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
       - name: Build and publish output
diff --git a/.github/workflows/update-flake-lock.yaml b/.github/workflows/update-flake-lock.yaml
index 85fde2d8..e83a0037 100644
--- a/.github/workflows/update-flake-lock.yaml
+++ b/.github/workflows/update-flake-lock.yaml
@@ -39,9 +39,6 @@ jobs:
         with:
           token: ${{ secrets.GH_TOKEN_FOR_UPDATES || github.token }}
           base: prime
-          branch: update-flake-lock
-          commit-msg: "chore(nix): update flake.lock"
-          pr-title: "chore(nix): update flake.lock"
-          pr-labels: |
-            dependencies
-            nix
+          branch: detsys-update-flake-lock
+          commit-msg: "build(flake.lock): update inputs"
+          pr-title: "build(flake.lock): update inputs"
diff --git a/nix/modules/auto-upgrade.nix b/nix/modules/auto-upgrade.nix
index 20ff1a32..740ff75d 100644
--- a/nix/modules/auto-upgrade.nix
+++ b/nix/modules/auto-upgrade.nix
@@ -1,4 +1,3 @@
-_:
 let
   flakeRef = "github:rrvsh/tools/prime";
   serviceName = "nh-flake-upgrade";
@@ -8,16 +7,11 @@ in
     darwin.auto-upgrade =
       { config, pkgs, ... }:
       {
-        environment = {
-          systemPackages = [ pkgs.nh ];
-          variables.NH_FLAKE = flakeRef;
-        };
         launchd.daemons.${serviceName} = {
           script = ''
             exec ${pkgs.nh}/bin/nh darwin switch ${flakeRef} \
               --hostname ${config.networking.hostName} \
               --refresh \
-              --no-nom \
               --bypass-root-check
           '';
           serviceConfig = {
@@ -31,26 +25,16 @@ in
     nixos.auto-upgrade =
       { config, pkgs, ... }:
       {
-        programs.nh = {
-          enable = true;
-          flake = flakeRef;
-        };
         systemd = {
           services.${serviceName} = {
             description = "Upgrade system from flake with nh";
             after = [ "network-online.target" ];
             wants = [ "network-online.target" ];
-            path = [
-              config.nix.package
-              config.programs.ssh.package
-              pkgs.gitMinimal
-              pkgs.nh
-            ];
+            path = [ pkgs.nh ];
             script = ''
               exec nh os switch ${flakeRef} \
                 --hostname ${config.networking.hostName} \
-                --refresh \
-                --no-nom
+                --refresh
             '';
             serviceConfig.Type = "oneshot";
           };

From ccec9f894e7fc529f49fbfb56a8d0e3735c6e5a7 Mon Sep 17 00:00:00 2001
From: Mohammad Rafiq <rafiq@rrv.sh>
Date: Sun, 7 Jun 2026 08:52:14 +0800
Subject: [PATCH 9/9] i give up on auto update for now

---
 nix/modules/auto-upgrade.nix    | 53 ---------------------------------
 nix/modules/nvidia-graphics.nix |  8 +++++
 nix/profiles/default.nix        |  2 --
 3 files changed, 8 insertions(+), 55 deletions(-)
 delete mode 100644 nix/modules/auto-upgrade.nix

diff --git a/nix/modules/auto-upgrade.nix b/nix/modules/auto-upgrade.nix
deleted file mode 100644
index 740ff75d..00000000
--- a/nix/modules/auto-upgrade.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-let
-  flakeRef = "github:rrvsh/tools/prime";
-  serviceName = "nh-flake-upgrade";
-in
-{
-  config.flake.modules = {
-    darwin.auto-upgrade =
-      { config, pkgs, ... }:
-      {
-        launchd.daemons.${serviceName} = {
-          script = ''
-            exec ${pkgs.nh}/bin/nh darwin switch ${flakeRef} \
-              --hostname ${config.networking.hostName} \
-              --refresh \
-              --bypass-root-check
-          '';
-          serviceConfig = {
-            RunAtLoad = true;
-            StartInterval = 86400;
-            StandardOutPath = "/var/log/${serviceName}.log";
-            StandardErrorPath = "/var/log/${serviceName}.err.log";
-          };
-        };
-      };
-    nixos.auto-upgrade =
-      { config, pkgs, ... }:
-      {
-        systemd = {
-          services.${serviceName} = {
-            description = "Upgrade system from flake with nh";
-            after = [ "network-online.target" ];
-            wants = [ "network-online.target" ];
-            path = [ pkgs.nh ];
-            script = ''
-              exec nh os switch ${flakeRef} \
-                --hostname ${config.networking.hostName} \
-                --refresh
-            '';
-            serviceConfig.Type = "oneshot";
-          };
-          timers.${serviceName} = {
-            wantedBy = [ "timers.target" ];
-            timerConfig = {
-              OnBootSec = "15min";
-              OnUnitActiveSec = "24h";
-              RandomizedDelaySec = "1h";
-              Persistent = true;
-            };
-          };
-        };
-      };
-  };
-}
diff --git a/nix/modules/nvidia-graphics.nix b/nix/modules/nvidia-graphics.nix
index 4797cdf6..e1345184 100644
--- a/nix/modules/nvidia-graphics.nix
+++ b/nix/modules/nvidia-graphics.nix
@@ -8,6 +8,14 @@
   config.flake.modules.nixos.nvidia-graphics =
     { config, ... }:
     {
+      nix.settings = {
+        extra-substituters = [
+          "https://cuda-maintainers.cachix.org"
+        ];
+        extra-trusted-public-keys = [
+          "cuda-maintainers.cachix.org-1:0dq3bujKpuEPMCX6U4WylrUDZ9JyUG0VpVZa7CNfq5E="
+        ];
+      };
       services.xserver.videoDrivers = [ "nvidia" ];
       hardware = {
         graphics = {
diff --git a/nix/profiles/default.nix b/nix/profiles/default.nix
index 41739042..c037fa57 100644
--- a/nix/profiles/default.nix
+++ b/nix/profiles/default.nix
@@ -6,7 +6,6 @@ in
   config.flake.modules.darwin.profile-default = {
     imports = with cfg.modules.darwin; [
       allowedUnfreePackages
-      auto-upgrade
       homebrew
       nix-settings
       ssh-config
@@ -19,7 +18,6 @@ in
   config.flake.modules.nixos.profile-default = {
     imports = with cfg.modules.nixos; [
       allowedUnfreePackages
-      auto-upgrade
       nix-settings
       ssh-config
     ];